The most basic story of insider trading goes something like this: a corporate insider learns secret company information in the course of doing her job.

She then goes out and trades on it, making (or saving) a bunch of money.  This is not allowed!  The information was the company's, not the insider's, and when she misappropriated it to her own benefit in her trading activity, she violated the law.

But what does it mean to learn secret company information?  Usually, this issue is also straightforward enough.  The insider has received testing results for a product, or has worked on an upcoming merger, or has seen the earnings report in advance of release.  But what if the insider hasn't been told something, but instead makes an educated deduction that turns out to be right?  Is insider guessing illegal?

This issue recently came up in the case of Jun Ying.  Ying was an executive at Equifax, a major credit ratings agency that suffered a massive data breach.  Equifax asked Ying, a credit information officer, to help respond to a breach.  Critically, the company told Ying that the breach dealt with a specific customer.  However, after he started the work, Ying came to suspect that the breach was actually of Equifax—a suspicion he memorialized in a text to a coworker.  He then researched how much Experian's stock had dropped after its own data breach, exercised all of his available Equifax stock options, and sold the stock—saving himself from a loss of about $117,000 when the news of the breach was later made public.  The U.S. Department of Justice ("DOJ") and the Securities and Exchange Commission ("SEC") accused Ying of insider trading.

Now, Equifax never told Ying about the breach.  In fact, the company explicitly lied to him about it.  The company had told other officers and employees about the breach (and notified them about trading restrictions in light of this knowledge).  Ying argued to the federal court in the Northern District of Georgia that his actions did not, as a matter of law, constitute insider trading.  In December, the court disagreed and allowed the indictment to stand.  Now, this month, Ying has entered a guilty plea to the insider trading charge, so he will not be able to test his defense in front of a jury.  Ying will be sentenced in June; the federal Sentencing Guidelines recommend a punishment of 15 to 21 months' imprisonment.

More than a month before Ying executed his trade, and days after the data breach was discovered, Equifax's Chief Financial Officer and three other executives sold company stock for more than $1.8 million.  None of these individuals face criminal charges or SEC action. 

The SEC and DOJ rarely bring cases involving insiders who trade on non-public information they have deduced, but Ying's case demonstrates that the reach of insider trading laws are broader than what might be intuitive.  There is also an important lesson for employers.  Companies limit information internally for all sorts of reasons, such as containing reputational damage—but one reason is to avoid exposing employees to potential accusations of insider trading or tipping.  It is entirely possible that Equifax was motivated, at least in part, to not fully inform Ying in order to protect him.  Unfortunately for all involved, their information shield was insufficient to protect a perceptive employee from himself.