How the Tesla Files Whistleblower Decided to Expose the BEV Maker's Issues

In November 2021, Krupski had just learned that Tesla kept top-secret information available to anyone with access to Jira and WARP – respectively, the company's project management system and an in-house-built enterprise resource planning (ERP) system. Even Elon Musk's bills were there. It was still 2021 when he filed a 21-page whistleblower complaint with Aaron Greenspan to the US Securities and Exchange Commission (SEC). Unlike his fellow whistleblower and publisher of PlainSite, Krupski never sold short Tesla. He also reinforced to the German newspaper that he never made money with the company's shortcomings.

On December 14, Tesla contacted Krupski and said it had no intention of reintegrating him after his extended sick leave periods. Straight from the shoulder, it was terminating his position. The company never asked for its laptop back or revoked his access to its systems. The whistleblower noted that it was as if he never existed. The Norwegian labor protection laws rule that workers have three months of notice after the month when they learn they will lose their jobs, which led to his final day at the company being March 31, 2022.

The whistleblower was still waiting for the SEC's response when he was told he would no longer work for Tesla. In fact, CNBC wrote last October 12 that the commission "assigned one person to look at one portion of the complaint, then closed that ticket a few months later." Krupski never heard from the SEC.

The whistleblower tried to present his case to several journalists. Some seemed to be concerned only about the scoop, and he felt played by them. Others wanted to help, but their publishers preferred not to touch the story. He also contacted the Federal Trade Commission (FTC) but never received any response. Handelsblatt was the only media outlet with the necessary legal backup and means to take the story all the way through – the most important of which was courage.

The German newspaper assigned 12 journalists to analyze the 100 GB of documents Krupski provided. Starting in February 2023, they interviewed more than 200 customers and employees that the Tesla Files identified. Some did not understand how Handelsblatt had access to their phone numbers and email addresses, as well as a lot of other personal data. I've seen similar reactions when I revealed that Tesla threw replaced computers filled with customer data in the garbage bin.

The journalists also contacted Tesla to see what the company had to say about the leak. On March 9, the battery electric vehicle (BEV) maker hired a security intelligence investigations team that included a former CIA officer. The German outlet knows quite a bit about the investigation: it was filed as case 23-0081, listed in the "Media Leaks" category. The journalists know even the title: "Handelsblatt Outreach." On May 26, the Tesla Files emerged as a ten-page report, triggering a long sequence of events both for Tesla and Krupski.

German and Dutch authorities are currently investigating how weakly the BEV maker cares for the private data of its executives, employees, and customers. Handelsblatt talked to Dagmar Hartge, the data protection officer in Brandenburg. She said that if the allegations were confirmed, "the matter would be particularly serious from a data protection perspective because of the large number of people affected worldwide." Krupski also discussed the matter with IG Metall, Germany's powerful metalworkers union. On the other hand, Tesla discovered that the whistleblower was involved with the Tesla Files after checking who accessed what the German newspaper presented.

Tesla started threatening to sue him. The BEV maker's legal team said it would report him to the police, get them to examine all his private devices, present criminal charges, demand damage compensations, and whatnot. On June 1, the Norwegian police raided Krupski's apartment and retrieved almost all of his electronic devices. Tesla had managed to secure an injunction to preserve evidence, but it had yet to sue the whistleblower. On the other hand, people affected by how the BEV maker deals with private data are already taking legal measures, even if not yet with the proper perception of what is going on.

A class action against Tesla in the US for the data leak said thieves had stolen the data. Luckily for all people involved, nothing is furthest from the truth. Neither Krupski nor Handelsblatt used the information obtained by the whistleblower in any illegal way. On the contrary, they tried to warn the authorities about how recklessly it was handled by the BEV maker. Krupski faced nothing but trouble and financial burdens since he decided to denounce what Tesla was doing. That's the opposite of taking advantage of what he discovered.

Curiously, some lawyers have contacted Handelsblatt to learn more about the scandal. It is important to stress that the German newspaper cannot share any information contained in the files with these attorneys, only discuss the circumstances that led to the leak. Handelsblatt has a search tool for anyone to check if they are involved with the Tesla Files. Considering they include workers from all factories and customers worldwide, I advise you to give it a try if you have ever bought any vehicle, hired any service, or worked for Tesla – especially if you are in the US, the company's largest market. Too bad that American agencies and institutions have yet to demonstrate any serious interest in the situation. SEC, FTC, Department of Justice (DoJ), anyone?

After everything is clarified, the authorities themselves will erase the data Krupski retrieved to prove his point – he has also pledged to do the same. That said, those affected do not have to fear – at least those in the files the whistleblower could check. The main concern for everyone involved with Tesla should be with those who may have stolen data without the BEV maker ever realizing they did that – which is not only possible; it is quite likely. The American class action asks, among several other remedies, that Tesla "provides ongoing credit monitoring and identity theft repair services to Class members." That's not by chance.

Krupski told Handelsblatt that this whole mess is equivalent to a corporate fire. Unlike what the whistleblower did with the lithium-ion booster on March 30, 2019, this is a blaze only the company can extinguish. For Krupski, the least Musk could do should be to thank him for warning about the flames. The Tesla CEO did not do that, but it seems the company is taking measures to kill this data protection failure.

On July 4, a message titled "Jira at Tesla" stated that access rights would be more tightly controlled at the request of the legal department. The email also said sensitive data could no longer be stored at Jira. Ironically, Tesla urged its employees to warn about any issues they found. It is similar to Elon Musk saying he wanted to hear directly from every worker regardless of hierarchy, which nobody can take seriously anymore. Considering how Krupski was treated, there are only two possible outcomes for these workers: washing their hands or also becoming whistleblowers.