[Policy] Anonymity-preserving 'smart' channel for reporting antitrust violations to the FTC

As part of the Aspen Tech Policy program and in collaboration with the Federal Trade Commission, I led a research project with the over-arching objective to improve public/employee participation in reporting corporate crimes. We focused on anticompetitive behavior within and enabled by large tech firms. I presented the policy recommendation, accompanied by a fully working prototype, to the FTC's Chief Technology Officer's office. The proposal was also picked up by D.C. news outlets. The project is hosted on the Aspen Policy Academy website here, and an abridged memo follows below. Finally, here's a tongue-in-cheek X thread about the project and whistleblowing in big tech firms.

Executive Summary 

The Federal Trade Commission (FTC) should develop a smart user experience – including a secure communication channel – to improve the processing of antitrust violation reports. A structured submission workflow would assist prospective whistleblowers in figuring out the violation, and would also increase the usability of the report. With the ability to sort and label reports, FTC case teams would be able to more effectively filter, query, process, and authenticate submissions. The underlying architecture of the entire smart user system, including that which facilitates communication between FTC staff and whistleblowers, should be transparent and open source. This would mean that informants would not be forced to simply trust that the security measures and privacy design of the system are sufficient; instead, independent organizations could provide oversight and catch vulnerabilities or design flaws.

Background

Currently, the FTC uses a single email address to process all whistleblower reports, irrespective of the antitrust violation being claimed (e.g., price fixing, refusal to deal, etc.). This approach’s flaws include:

1. Inefficiency. Because the FTC provides an email address and not a set of form fields, submissions are entirely unstructured and vary from email to email. Case teams cannot perform basic queries to organize inbound reports, and emails may be missing critical information. 
2. Insufficient support for the whistleblower and their attorneys. On the FTC website, whistleblowers are given a few links to existing antitrust responses, and then they are asked to email their reports by answering a few simple questions. This “user journey” lacks important guidance. Although educational resources on antitrust violation categories do exist on the FTC’s website, they are difficult to parse, far removed from the submission website, and not interactive, meaning many informants might miss them entirely.
3. Privacy risks. The FTC’s current use of unencrypted emails adds risk of whistleblowers’ identities being exposed, accidentally or otherwise. The onus is on the whistleblower to protect their anonymity when submitting via this method, but they are provided with little help. 
4. Inhibited usage. This lack of clarity on process, as well as the lack of support for whistleblowers on the current FTC website, may explain low submission volume. Perhaps not coincidentally, the Director of the FTC’s Bureau of Competition in 2018 mentioned having difficulty "finding antitrust cases".
   

This approach is inadequate for several reasons. First, it falls behind global standards for whistleblower reporting, including those of other federal agencies.  Second, if pending legislation passes, an email address may no longer be sufficient regardless. The FTC Whistleblower Act (FTCWA HR 6093) would reward and protect disclosures relating to suspected corporate violations of FTC regulations. If this legislation becomes law, we believe the FTC will need to better protect whistleblower identities using technology, as greater financial incentives are likely to increase the risks undertaken by whistleblower. These incentives are also likely to increase overall volume of reports, which makes improvements to informant support and violation categorization even more essential. Finally, our proposal is not dependent on future laws – even if today the FTC cannot explicitly solicit reports from whistleblowers, it also cannot prevent whistleblowers from volunteering information about possible antitrust violations. Improving security, privacy, and informant support in the reporting process is overdue. 

Recommendations

Smart Workflow UX

To improve the whistleblower reporting system, the FTC should design and develop a new UX feature: a “smart workflow", where the prospective whistleblower follows an adaptive wizard designed to identify the type of violation. A video walkthrough is viewable here.  A full smart workflow for FTC antitrust violations is available for download and closer review here. There are 12 possible violation endpoints, indicated by yellow squares. By requesting specific inputs from the whistleblower and provisionally categorizing the violation, this smart workflow would: 

1. Educate whistleblowers on what constitutes an antitrust violation, while simultaneously narrowing down the category of each violation;
2. Help whistleblowers gather the strongest evidence to support investigation; 
3. Maximize the usability of the report(s);
4. Help whistleblowers make a well informed decision before engaging with the agency;
5. Save FTC case teams significant spent on time filtering, segmenting, and evaluating reports;
6. Reduce the number of irrelevant and inadmissible reports;
7. Enable automated routing of reports to reviewers with specific domain expertise; and
8. Enable direct querying submissions without any data preparation, manual review, or machine learning.

Provably Secure System

The FTC should build and deploy a new smart whistleblower channel using transparent and open source software. This would enable civil society members, including specialist NGOs, privacy advocacy groups, and other technical contributors, to audit the system and uncover any vulnerabilities, backdoors, or other flaws. This system would provide superior assurances to prospective whistleblowers that their identity – as well as the sensitive information they supply – will remain secure and will be shared only with explicitly designated recipients (e.g., FTC case teams). Whistleblowers would not be forced to simply trust the software vendor that runs the system on behalf of the agency. Moreover, such a system would also insure the FTC against (a) cyberattacks that seek to deanonymize whistleblowers and (b) accidental leaks of sensitive information. 

Evidence suggests that these security protocols would help improve the quality of FTC submissions. A 2021 study conducted by EQS Group and the University of Applied Sciences of the Grisons found that organizations with specialized reporting channels, such as a secure digital channel,were more likely to receive relevant whistleblowing reports than organizations with more basic ways of filing, such as via an email address. Similarly, the Securities and Exchange Commission (SEC), which has invested greatly in improving its informant/whistleblower programs in the past decade, also endorses (a) improving reporting systems by providing whistleblowers with educational resources, (b) greater system transparency, and (c) better processing efficiency on the agency side.

Operationalization

Proposed user journey (versus status quo). Our proposal interface would add steps to the report submission process that are critical to guide and narrow inbound reports.

Proposed framework. The channel should be built with the GlobaLeaks framework, or another free and open source software with equivalent or superior UX flexibility and security auditibility.

Pros
- The security and architecture of GlobaLeaks are publicly auditable, and it is already utilized by various public institutions, particularly in Europe.
- GlobaLeaks leverages prior work by offering relevant built-in features, such as anonymity-preserving communication between whistleblowers and case teams.
- The technical requirements for launching an instance of GlobaLeaks are minimal. 
- GlobaLeaks offers many customizable templates for user flows, which are sophisticated enough to accommodate the smart workflow included in this proposal. 

Cons
- Adopting open source technology may meet cultural resistance.
- Such technology may require a security evaluation by an established auditor of government agency technology. 
- While GlobaLeaks provides a high level of out-of-the-box customization, there may be UX requirements that necessitate front-end development work. 
- The system will require some development and maintenance to be compatible with the FTC’s backend systems.

‍