Why does a whistleblower need to be identified? Why can't it be an anonymous tip to the regulator, who then uses the tip during audits to dig deeper and get to the truth? If they can't get to the truth even after being provided a tip, then their audit process is too broken? This whole business of non-anonymous whistleblower has too much power-imbalance and always seems to end badly for the individual.
Sometimes anonymous is sufficient. But if the regulator is building a legal case in the US against a company and the only evidence they have is what the whistleblower provides, right to face one's accuser (a right we do not give up lightly) demands that the whistleblower be named.
I will buy this ‘corporate rights are human rights’ argument when a corporation is put on death row for murder.