Sign in Subscribe
REDACTED

NSA's Own Watchdog Found Its Secrecy Agreements Skip the One Clause the Law Requires

NSA's Own Watchdog Found Its Secrecy Agreements Skip the One Clause the Law Requires

The National Security Agency's own inspector general concluded this week that the agency has spent years asking employees to sign secrecy agreements that omit the one clause federal law requires: the part telling them they're allowed to report wrongdoing. Not redacted. Not buried in fine print. Simply absent — from most of the paperwork NSA staff sign before they're allowed near classified work at all.

What the watchdog actually found

The report, released this week by the NSA Office of Inspector General, examined every nondisclosure agreement the agency uses. It found five NSA-developed NDAs in circulation. Four make no mention of whistleblower protections whatsoever. The fifth — NSA's Security Agreement, the one most employees actually sign — references whistleblower protections in passing but omits the specific statutory language the law requires.

Then the IG went looking for documents that function as NDAs without being labeled as one, and found five more. These aren't called nondisclosure agreements. They don't appear in a "sign here to keep quiet" folder. But they impose nondisclosure obligations on employees all the same, and none of them include the required whistleblower language either.

The pattern extends into how NSA grants access to "compartmented" information — the agency's most sensitive tier, the stuff that requires its own separate sign-off beyond a standard clearance. Individual offices build their own access forms from a shared template. Investigators asked subject matter experts to pull up their own brief sheets during interviews. Two did. Neither had the required language. The IG checked the template itself and found the same gap baked in at the source.

NSA already sits outside the full reach of the Whistleblower Protection Enhancement Act — Congress carved it out, on the reasoning that the Office of Special Counsel has no jurisdiction over counterintelligence and foreign intelligence matters anyway. But lawmakers didn't leave the agency uncovered. Since 1988, annual appropriations law has required NSA to apply nearly all of the Act's other provisions to its own workforce, year after year, by name.

So this isn't a case of an agency slipping through a jurisdictional gap nobody noticed. Congress built a specific, repeated, three-decade-old requirement for NSA to tell its people they can report fraud, waste, and legal violations without being punished for it. The agency's own paperwork simply didn't carry that message forward. Employees signing away their silence were, in the IG's word, "not aware" that a limit on that silence even existed.

Why this lands now

The timing is not incidental. The Trump administration is currently weighing a standardized nondisclosure agreement to be applied across the entire federal government — a policy the Office of Personnel Management first proposed in May. It has already drawn bipartisan pushback from lawmakers, federal unions, and civil society groups, who warn a governmentwide NDA could chill the exact kind of internal reporting whistleblower law exists to protect.

The NSA review didn't happen in a vacuum, either. Sen. Chuck Grassley, R-Iowa — long Congress's most consistent whistleblower advocate — specifically requested it. Grassley has spent decades pushing agencies to honor these protections in practice, not just on paper, and this report reads like exactly the kind of evidence he was looking for: an agency that already uses NDAs at scale, tested against the law, coming up short in a way that's easy to describe and hard to defend.

NSA, for its part, didn't contest the findings. It concurred with the IG's recommendations and said it would assign responsibility for fixing the paperwork to its chief of staff. No dispute, no pushback, no claim that the omission was intentional or defensible. Just an acknowledgment, and a promise to correct it going forward — which leaves open the question of every employee who signed the old versions.

What silence by omission actually does

Nobody at NSA had to lie to keep this system working. No employee was ever told, in writing, that they couldn't report misconduct — that would have been an illegal instruction, easy to challenge, easy to point to. Instead, the agency just never told them the opposite. The chilling effect doesn't require a threat. It only requires a gap where the reassurance should have been, filled instead by an employee's own reasonable assumption that broad secrecy language means broad secrecy.

That distinction is the whole story. A rule that suppresses reporting is a scandal. A form that simply forgets to mention a legal right is an oversight — until you notice it's the same form, filled out the same way, for years, at the agency built entirely around controlling what information moves and where. Whether that gap gets closed for real, or just gets a new sentence added to a template while the culture underneath stays exactly as it was, isn't something an inspector general's report can settle. It's something only the next person who almost says something will find out.

Sources

Read next