I guess it depends on the intent of the whistle blower. Is there a Project Zero type of way to publish? Wikileaks? Why does it have to go to any gov't body first? If the information is leaked out, do the governing agencies have a responsibility to investigate based on the leaked information or only investigate the suspect for leaking? Paralysis by analysis can be applied here, so just publish and let the chips fall where they may?
