Two years ago, I did something I almost never do: I put on a dress. Then I dropped my phone and other electronics off at the home of friends who had agreed to tell anyone who asked that I was at their place the entire time, and headed to the Oakland offices of the Guardian for my first meeting with a reporter. Leaving my electronics was a safeguard against possible tracking by my then employer, Facebook. The dress was an additional layer of alibi: I theorized that if anyone from work saw me and could contradict my first alibi, they might conclude that my unusual behavior was evidence of nothing more than an affair. That first, anxious meeting was the beginning of a lengthy process that would culminate in my decision – 18 months later and after I had been fired by Facebook – to step forward and blow the whistle on Facebook’s failure to combat deception and abuse by powerful politicians around the world. This month, another Facebook whistleblower, Frances Haugen, has come forward. After providing the Wall Street Journal and US government with thousands of internal documents showing Facebook’s internal research into its own harms, Haugen testified to Congress. Her testimony and revelations have captured the imaginations of the public, the press and Capitol Hill and raised hopes that regulators might finally act to rein in Facebook’s immense power. During her testimony, Haugen encouraged “more tech employees to come forward through legitimate channels … to make sure that the public has the information they need”. But whistleblowing is never straightforward. When I was deciding whether to speak out, I struggled to find guidance on the best way to go about it. If you’re in that position now, here’s my best advice on how to navigate the complicated path to becoming a whistleblower. Decide what you’re willing to risk Whistleblowing is not for everyone; I knew Facebook employees on H1-B visas who considered speaking, but could not risk being fired and deported. Speaking out internally or anonymously to the press will risk your current job. Speaking out publicly will risk your future career. Providing documentation will risk lawsuits and legal action. These risks can be minimized, but not eliminated. Decide whether you’re going to go public The first question you have to ask yourself is whether your aim is to change the minds of employees and leadership, or to pressure them via public opinion? Employees will be more sympathetic to the company than the general public; an internal post denouncing the chief executive as intentionally undermining democracy might alienate your co-workers, but can move the window of discussion. Before I went public, I used Facebook’s internal message board, Workplace, to try to effect change. It was only when this failed that I decided to go to the press. If you do make an internal post, remember that leaks are inevitable, and consider how your words can be misunderstood. When I wrote my departure memo, I naively thought it would not leak, and wrote for an audience of insiders. One of the consequences of this was that a stray comment about “actors” (referring to people who take certain actions) resulted in incorrect reports in the Indian press that Bollywood stars were interfering with elections. Exhaust your internal options Don’t let the company claim that they were ignorant of the situation and issues you’re speaking out about, or allege that you had failed to speak to the right people. Even if you expect complaints to be ignored, consider making them nevertheless – in writing – so you can point to them later. Decide what you’re going to say Speaking out about an area of personal expertise gives you credibility and insight, but narrows your scope to areas that may not arouse as much public interest. Speaking out about topics beyond your normal work will require you to conduct research and seek out internal documents you wouldn’t normally look at – creating a digital trail that could expose you – but could make your story more compelling. Be careful that what you say is correct and you aren’t making assumptions based on any personal bias or opinions; would-be “whistleblowers” have come forward with unconvincing revelations based on preconceptions. Expect to face company criticism regardless of what you speak on – Facebook dismissed Haugen for speaking about issues beyond her scope, and attempted the same for myself even though I spoke only about topics I personally worked on. Whatever you speak about, consider what your end goal is and whether your revelations will accomplish that. Risking your career to help a tech reporter live-tweet a company meeting may not be the risk/reward ratio you had in mind. No screenshots, no work devices Never contact outside parties (such as reporters or lawyers) via work devices; only do so via end-to-end encrypted systems like Signal on your personal devices. To securely copy work documents, use a personal device to take photos of the screen; do not take screenshots. If you’re accessing many documents, ensure that you have a plausible alibi. If leaking while employed, ensure that you’re only sharing documents that many employees have recently accessed. And if you intend to go public, insulate yourself beforehand by removing personal information online with a service like DeleteMe. Save up for a year without pay If you intend to go public with documentation, ensure that you’re able to survive off savings for at least a year. Most would-be-whistleblowers I’ve spoken to are concerned that they won’t be able to find another job. I worried about this too, but I’ve actually received many recruiting attempts – an experience also reported by others. Nevertheless, talking to the press, civil society and government officials is time consuming and will probably prevent you from working for some time. You will likely also incur additional expenses on lawyers and PR advice. Some whistleblowers choose to solicit donations, but this might undermine your credibility. Lawyer up If you intend to go public with documentation and details, speak with a lawyer first. Organizations such as Whistleblower Aid and the Signals Network can help connect you with someone. By speaking out, you face the risk of lawsuits for breach of contract, or even prosecution in the United States for theft of trade secrets. These risks are unlikely, but the possibility exists nevertheless. Make contact with an outsider Most tech reporters have a Signal address in their Twitter profile. I’ve heard many employees concerned that reporters will not protect anonymity – I personally have few concerns in that regard, although I would advise working with an established news outlet. When you do speak with a reporter, you should be clear up front about whether you’re speaking on the record (you can be quoted by name), unattributed (you can be quoted but not by name), or off the record (none of this can be published). If you intend to speak with the government, your lawyer should be able to help. It’s your decision – trust yourself In the end, whistleblowing is an intensely personal decision that very few will ever consider. It’s easy to criticize from the outside, but many feel differently when they face those risks themselves. Every time I advise others, I remind them that I can provide advice but the ultimate decision is their own. I am glad that I chose to come forward, and that Frances did as well, but no one is obligated to torch their career in pursuit of justice.