• PC World
• » Security

The Enron scandal last year inspired a federal law to promote corporate accountability, including encouraging employees to act on their consciences--and now a software firm is offering a technological tool for the task.

Among other things, the federal Sarbanes Oxley Act requires publicly traded corporations to have a system for employees to anonymously report corporate wrongdoings without threat of retaliation. Anonymizer.com (probably best known for its Internet privacy tools and services), has introduced the SECtips.com service, providing an anonymous communications conduit available as a subscription service.

Accommodating Anonymity

The Sarbanes Oxley Act is "equivalent to a lunar landing in terms of strengthening corporate responsibility to shareholders and employees alike," says Tom Devine, legal director of the Government Accountability Project, a nonprofit organization set up to protect whistleblowers. The new law provides criminal penalties for anyone who destroys records, commits fraud, or fails to report fraudulent acts.

Under the new law, companies must offer employees safe and anonymous ways to report both violations of the law and suspect or unethical accounting practices. According to Anonymizer, SECtips.com offers such a pathway to legality in a package deal that can be set up in about ten minutes. Anonymizer representatives say they are unaware of any competing similar service.

When a company signs up for SECtips.com, it gets a whistleblower Web site with its own URL (something like www.SECtips.com/CompanyName). It also gets a single, company-wide password that any employee can use to make an accusation from any Internet-connected computer in the world.

Anonymizer keeps a record that a message was sent on such and such a date and time--possible useful information in future lawsuits--but not of the message's contents (the company can keep an encrypted secure backup). More importantly, no record is kept of who sent the message. There's no way someone could hack into Anonymizer's server and discover who sent a message, because that information isn't there to begin with.

Anonymizer provides the service for an annual fee based on company size, starting at $1000.

Risk Remains

But even Anonymizer is aware that a probing employer and careless informant might result in identification.

If a tip includes enough information to start an investigation, chances are it also includes enough information to lead to the whistleblower. Once a whistleblower is identified, there's danger of retaliation.

Anonymizer is aware of this danger, and posts a warning on the whistleblower form against giving away too much information.

"We can technically prevent the identity from getting back, but if [whistleblowers] provide information that can trace them back," there's nothing Anonymizer can do for them, says Lance Cottrell, chief executive officer and founder.

Services like SECtips.com are "at best the first step in a prolonged process for whistleblowers to make a difference without exposing themselves to harassment," says Devine of the Government Accountability Act.

The next step is an ongoing, confidential dialog between the accuser and whoever reads the anonymous messages on the other side of the SECtips.com process, he says. In a small company, this could be the CEO; in a large one, it could be a member of an internal auditing committee. In the course of the give and take, protection is assured while the accuser gives more information.

SECtips.com allows for "two-way anonymous and confidential communications" between the parties involved, but a technological solution can only go so far, Devine notes.

"Any company that takes advantage of [SECtips.com] needs structure for legally binding confidentiality during the follow-up phase," says Devine.

• See more like this:
• anonymizer,
• anonymous,
• anonymizer.com,
• sectips.com,
• sectips,
• whistleblower,
• whistle-blower,
• government accountability act,
• Sarbanes oxley act