Today, the Project on Government Oversight (POGO), the respected DC-based government watchdog organization, launched its own version of SecureDrop, our open-source whistleblower submission system.

This installation takes on a special and urgent significance, as POGO has recently been subpoenaed for information on whistleblowers that have contacted them about the Department of Veteran’s Affairs (VA) scandal that has seen scores of veterans suffer through months or years of waiting time to see a doctor for medical issues related to combat. The head of the VA, General Shinseki, was recently forced to resign as a result of the scandal.

Disgracefully, the Inspector General (IG) of the VA subpoenaed POGO earlier this week for all of the information it has received through its tips system that, for the past month, has been located at VAoversight.org. (Do not use this website anymore. The new SecureDrop page is located here.). POGO has said “Since the website went live, about 700 people have submitted tips or aired grievances. About 25 percent of those tips have come from current or former VA staffers.” 

It is understandable why the IG would want information regarding the content of the complaints so it could do its job and hold people accountable inside the agency for their failure to provide adequate care. It is unfathomable why they are demanding the identifying information of the whistleblowers that have contacted POGO to report waste, fraud, and abuse. The subpoena makes it seem like the IG is more interested in investigating who leaked rather than who is responsible for the misconduct the leaks have exposed. 

POGO wrote earlier this week about whistleblowers’ legitimate fears of being exposed, even to the Inspector General:

Some VA employees who contacted POGO and requested confidentiality said they feared retaliation if their names were divulged. Any of them could have reported their concerns to the VA inspector general. In fact, some of the employees told POGO that they had filed reports with the IG. Some people expressed a lack of confidence in the Office of the Inspector General.

We helped POGO install SecureDrop and train their investigators in how to use it earlier this week. This is a significant upgrade to their technical security and will hopefully provide further protection to sources wishing to stay anonymous. SecureDrop provides many benefits when used properly: whistleblowers’ identifying information is protected by the Tor network, the files they send are encrypted, and the system logs as little information as possible—much less than email or web forms.

However, it’s important to keep in mind limitations of SecureDrop, or any communications system. It cannot provide magic powers that can make an organization impervious to receiving subpoenas. What it does do is attempt to prevent dragnet surveillance from exposing sources, strictly limit the identifying information available, and puts all the power back into the hands of the organization that is running it. That means there is no third-party for the government to subpoena in secret like we have seen in so many recent leak cases. It allows the organization to always be able to contest the subpoena to the fullest extent of the law and refuse to hand over such information if they so choose.

This is exactly what POGO has pledged to do in this case. "We are certainly prepared to go to court," POGO’s head of communications Joe Newman told Ars Technica earlier this week in response to the subpoena. "We are certainly prepared to go to jail to prevent any of that information from being released."

Ultimately, whistleblowers use SecureDrop, or any submission system, at their own risk. But we hope SecureDrop can provide POGO and its whistleblowers with significant technical security benefits to facilitate more transparency and accountability. And we stand fully behind POGO’s promise to defend their sources from subpoena at all costs.