Earlier quoted context omitted.
> Who should he have leaked it to? The appropriate regulatory agency rather than the media. > Where should he have published it? Publishing internal documents is the last resort after everything else has failed.
Whistleblower protection laws generally do not require that the "appropriate regulatory agency" be the only person to whom disclosure is made... Publishing internal documents is the last resort after everything else has failed. No, that's usually the first and best option once the company has been made aware of the problem and chooses not to correct it...as is what is alleged happened here. Why make vague statements…
Whistleblower protection laws in some cases don't even exist and even where they do you're typically not going to have a fun time if you have to use them. When it comes down to it you do what you've got to do, but going there first rather than last is not a really great idea.
> No, that's usually the first and best option once the company has been made aware of the problem and chooses not to correct it...as is what is alleged happened here. Why make vague statements that Company X ignored Problem Y when you can just provide documents proving your claims?
For one thing, documents rarely prove anything on their own (how do you even know they're not forgeries?) without the investigatory powers needed to verify the information in them. Which the government has and Twitter doesn't.