Hacker News Reader

Comment by zaroth | Hacker News Reader

On Friday, August 25, 2017, Ying texted a co-worker that the breach they were working on “Sounds bad. We may be the one breached.” The following Monday, Ying conducted web searches on the impact of Experian’s 2015 data breach on its stock price. Later that morning, Ying exercised all of his available stock options...

Always nice when criminals express their intent to perform an illegal act on 3rd party services ahead of time.

I do always wonder where is the record of searches being held? A corporate MITM saving all queries? Or are criminals logging into their Google accounts before running queries on how to commit their crime?

View on HN

I would be kind of shocked if Equifax wasn't MITM'ing their internal web traffic. Doing so is somewhat par for the course if you want to be able to monitor and filter employee Internet activity, which most traditional corporations with significant security expectations do.

That being said, browser history and Google Account history are both reasonable places to look as well.

I am always a little amazed at the paper trail white collar criminals that get caught leave. If you think you might insider trade on some information, maybe you should talk to coworkers instead of texting them, and do your research on a personal PC[1] in private browsing on a coffee shop Wi-Fi network somewhere.

(None of this should constitute endorsing the crime, it's just like... from a privacy-minded standpoint... there's so much they could've done "better".)

[1]Honestly, if it's a six figure crime, why not a "burner PC". Buy a Chromebook with cash, and leave it at Goodwill when you're done. The last bit may even help soothe the guilty conscience a bit.

I think its because they don't see themselves as criminals doing it. Even blatantly criminal acts can be justified as being un-criminal or "good" pretty easily.

I've found this to be particularly rampant in software development.

Where is it not rampant?

I'm guessing the paper trail is because it is not always obvious that it IS a crime. Nobody tells you on your first day at work what constitutes insider trading. At my first company, you got an email saying "you are now an 'insider' for SEC purposes" if you got important enough (so I heard, anyway). Is it insider trading if you sell your stock because the new manager over the division is terrible? Is it insider trading if you're working on a product that you think is awesome, so you buy some stock? I'm guessing both of those are not insider trading, despite that you are acting on information not available to the public. From there it doesn't seem like too great of a leap to not consider that news of the hacking you are working on is also not insider trading.

If you asked me, "is it insider trading to sell stock because you know the company has been seriously hacked and the price will drop once news gets out?" I'd probably say "yes." But if I were in the situation myself, I'm not sure if that question would occur to me.

Insider trading is normal, routine, and rampant, across corporate America. When people get caught, it's usually because another insider snitched; and it's a standard part of dirty corporate politics.

At a company I used to work for, our CIO was found out to have lied about his educational background on his resume; after working there 15 years. Another board member had been sitting on this dirt for at least 5 years. He had hired a PI to dig up things about the executive staff. It was his opening move on pushing out the old execs, and replacing them with a more acquisition-friendly line up. Then said board member cashed out.

We would frequently also see large blocks of stock traded the day before a big earnings announcement. Only the executive staff would have had that information. Us line employees all had stock options, but were never able to take optimal advantage of price swings, because someone else was beating us to it. We only had the public information. It is routine and the SEC does not give a fuck, unless the case becomes high profile enough that the press will write about it and make a stink.

Nothing against your comment in general, but some companies do tell you. On my first day at my current job I had to complete an insider trading training module and I'm just an average engineer.

I've worked at three publicly traded companies. I don't recall insider trading being mentioned at the first one, but I was in a pretty lowly support role and a former CEO was fined for insider trading. The other two I recall insider trading being mentioned during orientation and in periodic reminders, usually around stock events (such as at least the closed trading window for employees around earnings announcements)

Could also simply be a matter of browser history not being deleted. Equifax doesn't seem to have hired the best lol.

>Or are criminals logging into their Google accounts before running queries on how to commit their crime?

I would imagine it's more of a case of the average person failing to understand just how much data google will store associated with their account.

Perhaps here?

https://goo.gl/maps/yZBSw86yNfL2

Reply on news.ycombinator.com