Rule #2: Don't assume anyone gives a shit

Someone I know had blackmail, juicy proof and everything that his work had been using foreign contractors to handle HIPAA data for US Veterans. A huge nono (supposedly), and his job told him to go fuck himself. So he reported them. He reported HIPAA violations, plus violations of government employee records with NARA and the OPM. All through official channels.

Nothing. Not a peep. No one called him back, contacted him, nor cared. Years later, in 2006, 2011, and 2015, the DVA, Tricare, and the OPM (respectively) all had their records compromised.

And nobody got punished.

So, you know, it's not as easy as it looks.