On April 1, 2015, the SEC instituted a first-of-its-kind enforcement action against KBR, Inc. (KBR), a Houston-based global technology and engineering firm, for violating SEC Rule 21F-17 of the Dodd- Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act), based on language contained in KBR's confidentiality agreements with its employees. KBR had required employees interviewed in connection with internal investigations to sign a form confidentiality statement that prohibited employees from discussing their internal investigation interviews and the subject matter of such interviews without prior authorization from KBR's law department and under penalty of disciplinary action, including termination of employment.

SEC Rule 21F-17, which was enacted under the Dodd-Frank Act and which became effective on August 12, 2011, provides that "[n]o person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications."

Notably, in this settled cease-and-desist proceeding, the SEC found that KBR had violated SEC Rule 21F-17 even though the Commission was unaware of any instances in which a KBR employee had in fact been prevented from communicating with the SEC about a potential securities law violation and despite the fact that KBR had not enforced the confidentiality statement at issue. Rather, the SEC found that KBR's violation stemmed only from the language contained in KBR's confidentiality statements, which provided as follows: "I understand that in order to protect the integrity of this review, I am prohibited from discussing any particulars regarding this interview and the subject matter discussed during the interview, without the prior authorization of the Law Department. I understand that the unauthorized disclosure of information may be grounds for disciplinary action up to and including termination of employment."

KBR entered into a settlement agreement with the SEC without admitting or denying the SEC's charges. As part of the settlement, KBR agreed to pay a civil money penalty of $130,000 to the SEC, and it also agreed to amend its confidentiality agreements to expressly state that said agreements do not prohibit KBR employees from reporting possible violations of federal law or regulation to the SEC or other federal agencies. KBR further agreed to amend its confidentiality agreements to further state that KBR employees did not need prior authorization from KBR before making any reports or disclosures to the SEC or other federal agencies.

The SEC's pursuit of this enforcement action against KBR signals the Commission's broad interpretation of SEC Rule 21F-17, as well as its ongoing commitment to investigating conduct at companies that it views as potentially silencing the reporting of securities violations by whistleblowers. Indeed, following the release of the settled cease-and-desist proceeding with KBR, SEC Enforcement Director Andrew Ceresney stated that the SEC has a number of similar ongoing investigations involving whistleblowers and that the Commission "will vigorously enforce" SEC Rule 21F-17.

The SEC’s recent investigative activity suggests that certain company practices designed to protect confidentiality during internal investigations may be viewed as violating SEC Rule 21F-17. Accordingly, in light of the KBR proceeding, companies should consider evaluating their employment or confidentiality agreements, as well as their internal investigation interview processes.

With respect to written employment agreements (including confidentiality agreements, nondisclosure agreements, settlement agreements and/or severance agreements), companies may want to consider including express carve-outs for protected whistleblowing conduct. For example, as KBR agreed pursuant to its settlement with the SEC, companies may want to consider including language which expressly states that employees are not prohibited from communicating with government agencies about possible violations of federal law. In connection with instructions given to employees during internal investigations, companies should continue to adhere to the standard Upjohn warning, but they should be mindful of the scope of the instructions given to employee interviewees.