Author: Mr Adrian Ramdat (Director of Training & Consultancy)
September 2026
Whistleblowing and Covert Human Intelligence Sources (CHIS) are not normally things that you would expect to see discussed together. A whistleblower is generally someone who has information about wrongdoing and decides to report it, often because they believe that something needs to be investigated or put right.
A CHIS, on the other hand, is someone who establishes or maintains a relationship for a covert purpose, uses that relationship covertly to obtain information or provide access to information, or covertly discloses information obtained through that relationship.
For most organisations, there will be no connection between the two. However, there are some organisations that receive whistleblowing reports which are also public authorities with powers under RIPA, RIPSA or RIPL. For those organisations, it is important to recognise that a person who makes a whistleblowing disclosure may, depending on the circumstances, also meet the definition of a CHIS.
So, can a whistleblower become a CHIS? Yes, in some circumstances. But making a whistleblowing disclosure does not automatically make someone a CHIS, and neither does providing information voluntarily. The important question is how the information is being obtained and provided, and whether the person's relationship with another individual is being established, maintained or used for a covert purpose.
That distinction is important because it is very easy to look at the way the relationship started and miss what is actually happening.
A whistleblower does not automatically become a CHIS
Simply providing information to an organisation does not make someone a CHIS. A person does not become a CHIS because they make a whistleblowing disclosure, nor does providing information on a number of occasions automatically change their status.
The RIPA Code of Practice is quite clear that not all human sources of information are CHIS. It gives the example of a member of the public who volunteers information about something they have witnessed. If the information has not been obtained through a relationship that was established or maintained for a covert purpose, that person is not a CHIS. The Code also gives the example of someone contacting a confidential hotline to disclose information about criminal or terrorist activity. Again, that person is not automatically a CHIS simply because they have provided information.
This is an important starting point when considering whistleblowers. A person may have information because of their employment, their position within an organisation or their personal relationships and may decide to report that information. They may even continue to provide information over a period of time. None of that, by itself, makes them a CHIS.
The question is what is happening within the relationship from which the information is being obtained and whether that relationship is being used for a covert purpose.
What actually makes someone a CHIS?
This is where the distinction needs to be understood.
Under RIPA, a person is a CHIS where they establish or maintain a personal or other relationship with another person for a covert purpose connected with obtaining, providing access to or disclosing information. They may also be a CHIS where they covertly use such a relationship to obtain information or provide access to information to another person, or where they covertly disclose information obtained through that relationship.
The word covert is therefore important.
The Code explains that a relationship is established or maintained for a covert purpose where it is conducted in a way calculated to ensure that one of the parties to the relationship is unaware of that purpose. Similarly, a relationship is used covertly where it is used in a way calculated to ensure that the other party is unaware of that use.
That gives us a much better way of looking at the whistleblower question.
It is not enough to say that the whistleblower has a relationship with the person who is the subject of the investigation. They may quite legitimately work with that person, be their manager, be managed by them, socialise with them or have some other personal or professional relationship.
It is the purpose for which the relationship is being established or maintained, or the way in which it is being used, that may bring the relationship within the CHIS definition.
How could this happen with a whistleblower?
Consider an employee who contacts a regulator and reports wrongdoing within their organisation. They explain what they have seen, identify the people involved and provide information which enables the regulator to begin an investigation.
At this stage, there is nothing particularly unusual. The person is a whistleblower who has provided information about something they believe needs to be investigated.
The person may continue to provide information because they remain concerned about what is happening. They may tell the investigator about conversations they have had with colleagues, things they have personally observed or information that is already within their knowledge. They may do this entirely voluntarily.
Again, that does not automatically make them a CHIS.
The position changes if the existing relationship with another person is being maintained or used covertly for the purpose of obtaining or providing information, or if the person is being asked to maintain that relationship so that information can be obtained from it.
For example, imagine that the whistleblower works closely with the person suspected of wrongdoing. The whistleblower already has a genuine working relationship with them and has provided information about things they have personally witnessed.
The investigator then asks the whistleblower to continue maintaining that relationship because it provides an opportunity to obtain information about what the individual is doing. The individual does not know that the relationship is now being maintained or used for that covert purpose.
That is very different from someone simply reporting what they have seen.
The issue is not whether the whistleblower has been given a formal written tasking document. The issue is whether the relationship is being established, maintained or used covertly for the purpose of obtaining or providing information.
Does a whistleblower have to be tasked to be a CHIS?
No, not in the sense that there has to be a formal instruction before the statutory definition can be met.
Tasking may be an obvious indication that an organisation intends to use a person's relationship for a particular purpose, but the absence of formal tasking does not answer the question either way.
The Code itself recognises that a person may provide information voluntarily and that circumstances can change. It gives examples of people such as employees of travel agents, housing associations and taxi companies who may have access to personal information because of their work and who may voluntarily provide information to public authorities on a repeated basis. The Code says such people need to be managed appropriately and that their status should be considered.
This is particularly relevant to whistleblowers because they may already have the relationship that provides them with access to the information. The relationship itself may be completely legitimate and may have existed for years before the whistleblowing disclosure was ever made.
The important question is whether that relationship is subsequently being maintained or used for a covert purpose.
That is why asking simply "Have we tasked them?" is not enough. A better question is "What is the relationship being used for, and does the other person know that purpose?"
Voluntary information is not necessarily CHIS information
This is probably the most important distinction for organisations to understand.
The fact that a whistleblower continues to volunteer information does not automatically make them a CHIS. If they are simply telling the organisation what they know, what they have witnessed or information that they have acquired through their ordinary work or circumstances, there may be no CHIS activity at all.
The RIPA Code specifically recognises this distinction. It says that many sources provide information they have observed or acquired other than through a relationship established or maintained for a covert purpose, and that such a source is not a CHIS.
The position can be different where the organisation is relying upon the person's relationship with another individual to obtain information covertly. In those circumstances, the organisation needs to consider whether the relationship is now being used in a way that falls within the CHIS definition.
That is the point at which a whistleblowing relationship can potentially cross into CHIS activity.
Why does this matter?
Whistleblowers can be an extremely valuable source of information because they are often already inside the organisation or environment being investigated. They may have access to people, conversations, documents or activities which the investigating organisation would otherwise find difficult to access.
That can be very useful to an investigation, but it can also create risks.
If a whistleblower has an existing relationship with someone who is the subject of an investigation, there is a temptation to see that relationship simply as an existing source of information. However, if the organisation begins to rely on that relationship for the covert purpose of obtaining information, it needs to recognise that the nature of what it is doing may have changed.
This is not simply a question of terminology. Where the circumstances amount to the use or conduct of a CHIS, there are requirements around authorisation, management, risk assessment, record keeping and the welfare of the source. The Home Office Code emphasises the need for CHIS activity to be properly authorised, managed and reviewed.
There is also a practical danger where an organisation continues to receive information from the same individual over a period of time. Because the relationship may have started as a straightforward whistleblowing disclosure, it can become easy to concentrate on the information being provided rather than considering how that information is being obtained. That is why the circumstances need to be kept under review.
Not every organisation will have this issue
This is not something that applies to every organisation which receives whistleblowing reports.
Being a prescribed person for whistleblowing purposes does not, by itself, give an organisation the power to authorise a CHIS. The relevant CHIS provisions apply to public authorities within the applicable legislation and within the scope of their statutory powers, with the precise position differing between RIPA, RIPSA and RIPL.
Equally, an organisation having CHIS powers does not mean that every person who makes a whistleblowing disclosure is a CHIS.
The two regimes have different purposes and, in most cases, they will operate quite separately. The point is simply that organisations which sit within both frameworks need to be aware of the potential overlap.
For those organisations, whistleblowing procedures should therefore sit alongside, rather than in isolation from, the organisation's wider arrangements for covert activity. Those responsible for receiving and managing disclosures do not necessarily need to be CHIS specialists, but they do need sufficient awareness to recognise when the circumstances may require further consideration.
Recognising when the question needs to be asked
The practical answer is not to start treating every whistleblower as a potential CHIS. That would be both unnecessary and unhelpful.
Instead, organisations with relevant powers should ensure that those dealing with whistleblowing reports understand the circumstances in which the CHIS question can arise.
If a whistleblower simply provides information that they already know or have obtained through their ordinary activities, there may be no CHIS issue. If, however, an organisation is asking them to maintain a relationship with another person for the covert purpose of obtaining information, or is otherwise using that relationship covertly to obtain information or provide access to information, the position is different.
The questions should therefore be quite specific. What relationship does the person have with the individual from whom the information is being obtained? Is that relationship being established or maintained for a covert purpose? Is the relationship being used covertly to obtain information? Is the other person unaware of the purpose for which the relationship is being maintained or used? And does the activity meet the statutory definition applicable to that organisation?
Those questions are much more useful than simply asking whether the person is a whistleblower or whether they have been formally tasked.
It is also important to consider the potential consequences for the person providing the information. If they are being used to obtain information from someone with whom they have an existing relationship, there may be risks to their employment, personal relationships or even their physical safety if their role becomes known. That is one reason why the welfare and duty of care considerations associated with CHIS activity should not be treated as an afterthought.
A whistleblower may remain simply a whistleblower throughout an investigation. They may provide information repeatedly and still not be a CHIS. In other circumstances, the way in which their relationship with another person is established, maintained or used may mean that they are a CHIS.
The important thing is to understand the distinction and recognise when the circumstances mean that the CHIS question needs to be asked.
Why this is an issue worth understanding
Having worked both in law enforcement and in the private sector, I have seen the issue from different perspectives. My earlier career included responsibility for covert activity and investigative practice, while I have also worked in a large PLC where I had overall responsibility for whistleblowing activity.
Those two areas are usually treated as completely separate, and quite reasonably so. They have different purposes, different processes and different considerations. However, where an organisation has both whistleblowing responsibilities and statutory powers to conduct covert activity, there can be a point where the two overlap.
That is why awareness matters.
It is not about turning whistleblowers into CHIS unnecessarily. It is about ensuring that organisations understand the difference between a person who voluntarily provides information and a person whose relationship with another individual is being established, maintained or used covertly to obtain or provide information.
Recognising that distinction early can help an organisation make the right decision about whether CHIS considerations, including authorisation and management arrangements, need to be brought into play.
Whistleblowing and CHIS Training
We provide practical Whistleblowing Training for organisations that need to develop a sound understanding of how disclosures should be received, assessed and managed. Our training can be tailored to the organisation and the nature of the risks it faces, and we also provide regular bite-sized events for those who want to focus on particular aspects of whistleblowing without committing to a full training day.
We also provide CHIS Awareness Training for organisations whose staff need to understand when the CHIS provisions may become relevant, what the definition means in practice, and the responsibilities and risks associated with using and managing a CHIS.
For organisations that operate in both areas, bringing those two subjects together can be particularly valuable. Staff do not need to become covert investigators or CHIS specialists, but they do need to be able to recognise the difference between information that is simply being volunteered and circumstances in which a relationship may be being used for a covert purpose.
Our training is delivered in-house and can be tailored to the organisation, its role and the types of investigations it undertakes.
If you would like to discuss your whistleblowing or CHIS training requirements, get in touch with us.