On April 1, 2015, the U.S. Securities and Exchange Commission (SEC) announced the resolution of its first enforcement action against a company for violations of the whistleblower protection provisions of the Dodd-Frank Act regulations. Under a “no admissions” resolution, KBR, Inc. has agreed to pay a $130,000 penalty to resolve charges that the language it used in its confidentiality agreements during internal investigations violated SEC Rule 21F-17. As a voluntary “remedial action,” KBR has also amended its internal investigation confidentiality agreements to expressly state that employees are not prohibited from reporting, without prior company consent, violations of federal law to the Department of Justice, SEC, or other relevant federal agencies.

As alleged in the SEC’s cease-and-desist order, as part of its internal investigation process, KBR required employees to agree to – and in some instances sign – a written confidentiality agreement warning that the employee could be subject to discipline (including termination) if, without “prior authorization of the Law Department,” he or she “discuss[ed]” with outside parties “any particulars regarding [the internal investigation] interview [or] the subject matter discussed during the interview.” The SEC alleged that, by requiring an employee to agree to this provision at the outset of an internal investigation interview regarding potential securities violations, KBR violated SEC Rule 21F-17. That rule, enacted under the Dodd-Frank Act, prohibits a company from taking “any action to impede a whistleblower from communicating directly” with the SEC about a securities violation, “including enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications.” The SEC pursued an enforcement action against KBR notwithstanding that the SEC “is unaware of any instances” in which a KBR employee was actually prevented from reporting any legal violations to the SEC or in which KBR actually sought to enforce the confidentiality provisions against a potential whistleblower. Implicitly, the SEC concluded that the mere act of requiring employees to sign this particular confidentiality agreement at the outset of an internal investigation interview had a sufficient potential to intimidate whistleblowing activity, so as to render it in violation of Rule 21F-17.

In addition to agreeing to pay a $130,000 fine, KBR has voluntarily amended its confidentiality agreements to specifically inform employees that “[n]othing” in the company’s confidentiality agreement “prohibits [the employee] from reporting possible violations of federal law or regulation to any government agency or entity” without “the prior authorization of the Law Department . . . .” The SEC’s cease-and-desist order, however, does not indicate that including such a disclaimer in a confidentiality agreement will be treated as an automatic safe harbor under Rule 21F-17, nor does the SEC’s cease-and-desist order indicate that such a disclaimer is a necessary component of any internal investigation employee interview protocol.

While it is always possible that the SEC could seek to cast an even broader net in the future, the enforcement action against KBR does not suggest that garden-variety confidentiality provisions included in general employment or organizational documents would violate the Dodd-Frank Act. Nor does the SEC’s enforcement action suggest that a company or its lawyers violate Rule 21F-17 by giving an employee, at the outset of an internal investigation interview, a standard oral “Upjohn warning” explaining that the interview is subject to the company’s attorney-client privilege. Instead, what the SEC apparently found problematic was that KBR used a written agreement, specially drafted and used as part of the internal investigation interview process, that included language that goes beyond a standard “Upjohnwarning.” Rather than warning the employee at the outset of an internal investigation interview that the interview itself is subject to the company’s attorney-client privilege and should remain confidential (the standard “Upjohn warning”), KBR went further and warned the employee not to discuss even the “subject matter” of the interview with third parties. At a minimum, the SEC appears to have been concerned that an employee could reasonably construe that to be a warning not to disclose even non-privileged underlying facts to a federal agency without company approval. The SEC’s enforcement action against KBR shows that these sorts of variations from the standard oral “Upjohn warning,” though seemingly minor, are, in the SEC’s view, material under Rule 21F-17. The action against KBR therefore underscores the importance of companies and their outside counsel ensuring that employees interviewed as part of any internal investigation are given confidentiality instructions that are consistent with the company’s legitimate need to maintain its attorney-client privilege but that do not inadvertently imply that “unauthorized” disclosure of non-privileged information to government enforcement agencies will subject an employee to an adverse employment action.

The SEC’s press release can be found here.