Unplug whitelist

Creating for code review.
this is tri-state, so returning null should be the default, no?