Ask HN:

If it were me, I would start two parallel tasks.

1. Start looking for a new job, so I could be free to report the problems.

2. Start working internally to fix the problem. This sounds like it will have to happen outside normal channels. And while you may have a gatekeeper that will block the acceptance of "the fix", at least if it is ready to go, when the sh* hits the fan you can propose "the fix" and have it implemented faster.

I did #2 once and sat on a software patch for about 3-4 months because politically people in the organization people were trying to block me. The work wasn't officially approved, I decided to do it as an extra effort on my time. However, a new requirement came down which needed the new margin of safety calculated correctly and my patch already did the job. Suddenly my "unapproved" software work was in production within 2 weeks.

Look for another job while you try, using the utmost discretion and caution, to confirm that what your former colleague has told you is as true as you seem to think that it is. Document your findings/concerns carefully and without drama.

If and when the evidence of a threat to life become overwhelming, or incontrovertible (a tricky call, I realise), pass on your findings via an industry or societal whistleblowing platform; maybe even a reputable media organisation, if you believe in such a thing - but try to ensure that any and all information provided cannot be "triangulated" to identify yourself uniquely as the source.

The bottom line, though, is your conscience. If someone does die, or it comes out that someone has done already, because of your company's actions, it will also be partly because you kept silent. Avoid posting too much in forums etc.

So, look for a career exit, and - if you are sure that your fears are rational and well-grounded - blow the whistle when it is imperative to do so, even if you haven't yet found another job.

Perhaps anyone reading this thread who is a principled lawyer, or just a principled person with influence - and better advice than mine - will add something more useful. Whatever happens, I wish you well. Apologies for having so little to offer by way of constructive advice.

In reverse order:

1. Inform the relevant regulator.

2. Get legal advice before you do this.

3. To avoid being identified for reprisal, do not post on random forums before you perform the steps above. I know from personal experience that whistle-blowers get royally shafted.

Lawyer