Former Equifax employee indicted for insider trading | Hacker News Reader

Former Equifax employee indicted for insider trading

justice.gov

186 points_vvdf83 comments

While I'm quick to render my own verdict, especially in the tech realm where I live, work, and play, I was glad the article included this:

"Members of the public are reminded that the indictment only contains charges. The defendant is presumed innocent of the charges and it will be the government’s burden to prove the defendant’s guilt beyond a reasonable doubt at trial."

Trial by Internet and Guilty-by-default isn't a good world to live in.

Either the CEO is incompetent and didn't know about a huge failure of his organization or he's a criminal, either way the verdict of public opinion is not going to be kind.

The (non-technical) CEO pushed for new products and an aggressive sales quota company culture.

This is a common recipe for disaster when the actual product quality/security is no longer a core value.

The CEOs in these environments honestly have no clue what an "outdated Struts patch" is... so it's difficult to hold them criminally responsible.

I'm not excusing this behavior. In fact, quite the opposite. More indictments and congressional pressure on Equifax will hopefully persuade future CEOs to make IT security, data privacy, and consumer trust foundation product values.

When you take charge of an organization, and reap the benefits from being in charge, you accept the responsibility as well.

How could you not hold the CEO criminally responsible for this much damage just because they neglected to get informed on these topics or get expert opinions if they didn't have the ability to become informed.

If that's the case every company should have a head "CEO" who knows nothing and just does what a shadow CEO tells him to do. Then no one would be responsible ever!

But he did accept the responsibility. He's no longer CEO and forfeited his incentive compensation.

That's not good enough. That's like letting bank robbers go just because they got caught and forfeited their gains. The punishment must exceed the monetary gains to account for the less than 100% probability of things like this getting caught.

It does. Dudes like that really care about their careers, and his is undoubtedly over

you assume that. But a lot of these slimy characters keep coming back, end up on boards of directors, or running for public office. It's almost a bad cliche now. It happens even when they get convicted and do time. Watch and see what happens to Shrkelli in 8 years.

It's very unlikely that he didn't know about the security problems, that hadn't be released. I'd say about 99.9% chance that he knew. We know that it's very tempting for otherwise intelligent people to fall victim to this, like our favorite domestic lifestyle wallstreet-er CEO, Martha Stewart.

Stewart was done for obstruction and perjury, not insider trading.

Not to pick on you because I see this response a lot, but that's really misleading. She was also indicted for insider trading and though that charge was thrown away by the judge, the SEC also filed a civil case against her for insider trading. She settled that one by paying $195,000 and agreeing not to serve as an officer of any public company for five years. It's not like the insider trading didn't cost her anything.

https://en.wikipedia.org/wiki/ImClone_stock_trading_case#Rep...

Can you share the dataset you used to calculate the 99.9% probability? Do you have experience with other CEOs in this kind of situation? Do you have inside knowledge of Equifax? I'm not sure how anyone can be so certain in the absence of evidence. Indeed this is the reason we put the burden of proof on the accuser and assume innocence.

I used my own experience working in a variety of companies including large corporations, and the way they sometimes told us information ahead of earnings and how cautious we needed to be about when we might sell something. I have never been more than a second level dev manager, but I can't imagine how this could happen by accident. So I had required training, cautions every quarter ahead of time, reminders when there was an open period, reminders about not talking to the press. This isn't rocket science. So someone who works on earnings announcements, knows the quarterly facts early, has experience with this just forgot or something? It's not credible.

Did you not read the press release? They have texts showing he was aware and knew it was bad.

> On Friday, August 25, 2017, Ying texted a co-worker that the breach they were working on “Sounds bad. We may be the one breached.” The following Monday, Ying conducted web searches on the impact of Experian’s 2015 data breach on its stock price. Later that morning, Ying exercised all of his available stock options held at UBS Financial Services, resulting in him receiving 6,815 shares of Equifax stock, which he then sold.

That does look bad. However, it describes the CIO. You're responding to a conversation about the CEO.

And again, innocent until proven guilty is a good principle, and we need to let the justice system do its work.

Typo on my part, the discussion is about the CIO.

Martha Stewart went to jail for lying to investigators, not for any other crime.

It's really tricky because while you're absolutely right, they generally don't indict innocent people. So when like 90% of these cases are guilty or a plea, it's way too easy to just forget about the 10%.

>So when like 90% of these cases are guilty or a plea

I don't really like how plea agreements work in the US either. Too many of them are "Agree to this lower charge or we will Aaron Swartz you, and you will go bankrupt trying to defend yourself."

Aaron Swartz (most likely) broke the law. The problem there was that many people disliked the law.

The internet is not taking anyone's freedoms away, the internet is punishing people's reputations.

big difference.

Punishment when we have yet to assess guilt.

Plenty of people have assessed guilt. It has not been demonstrated in the court of law which is an important difference.

However, when you consider how many people don't trust the US court system. You can't expect them to reserve judgement based on what they consider a biased system.

What exactly do you mean by "people don't trust the US court system"? That the guilty go free? That the innocent are wrongly convicted? That guilty people are not prosecuted? That justices are corrupt? And approximately how many people have this view?

I'm getting kind of tired of this rhetoric on how the US is so bad/corrupt/untrustable/whatever the word is today. We have some of the best courts in the history of the world. How would you like to get tried in Chinese, Russian, African, or South American court? Or be tried in the middle ages? Are they perfect? No. Will there be miscarriages of justice? Yes. Are you likely to experience one? No. And if you think it's that bad, well, there are plenty of other countries you could move to and find out if they are better. Or you could work to improve the system we do have (after studying it enough to understand it well enough to actually improve and not just change it).

Just because other places are worse doesn't mean the US is good. The US legal system enforces the law, not justice. It does a lot of work to make it more equitable but it's still obvious that if you have money you live by a different set of rules. The majority of the population couldn't pull off what the affluenza teen did, beat up their girlfriend publicly like Chris Brown with little to no affect on their career, or rape a kid and only serve 60 to 120 days in jail[1].

Every one of these instances of injustice degrade people's trust in the system

If I was an average person I'd rather be tried in the US, but if I was rich it seems like it doesn't matter. Our legal system seems pretty equivalent in outcome for the upper class. You only get more than a trivial punishment if you manage to upset someone with more money or power than you

[1]http://articles.chicagotribune.com/2014-06-07/news/sns-rt-us...

What exactly do you mean by "people don't trust the US court system"? (exactly what I said) That the guilty go free? (yes, happens all the time.) That the innocent are wrongly convicted? (Yes, just look at all the death row inmates that where proven innocent. Now consider most crimes have lower standards.) That guilty people are not prosecuted? (Yes, look at banking crimes etc.) That justices are corrupt? (Mark Ciavarella is one name among many, and that's without considering politics.) And approximately how many people have this view? (~2/3 of the people I know personally.)

The US is an extremely corrupt society. There are worse places, but it's the difference between standing in shit and swimming in it. You're still in shit either way.

In terms of improving the system. It does what it's intended to do, which has little to do with justice. Keep the powerful out of prison, keep the middle class in line, and keep the lower classes in fear. I am not going to waste my time time to change things, but I am going to call a corrupt system exactly what it is.

>What exactly do you mean by "people don't trust the US court system"? That the guilty go free? That the innocent are wrongly convicted? That guilty people are not prosecuted? That justices are corrupt? And approximately how many people have this view?

Eh, in the US, probably a huge portion of the black population for sure.

Me personally, working around police and elected officials for years, I don't have much trust for it either.

Your whataboutism doesn't help your case.

>Or you could work to improve the system we do have (after studying it enough to understand it well enough to actually improve and not just change it).

Improve it for whom, and how? Not everyone is going to want it improved and they are going to fight to keep the system at is. The people for whom it would improve the most are the most disempowered and least likely to change it.

Exactly. Criminal convictions have a higher standard than civil, which obviously have a much higher standard than the court of public opinion. Just because you don't get arrested and convicted in criminal court does not mean you aren't "guilty" using a less stringent standard.

What punishment would that be?

People inside the company sold right before the dip. That is a fact.

Seems like you are arguing they should be free of consequences. We judge people on their actions all the time, it is difficult to know their intentions.

Other people have to be on the otherside of that trade. It’s publically good to know there are possible untrustworthy actors in a company, especially when it is extremely difficult to prove white collar crimes

Selling before a dip is not a crime.

I feel like I'm being misunderstood. My point is that if you are a leader in a company and you sell before the dip which is based on some pretty negative event, you should not necessarily go to prison or have freedom's taken from you.

BUT, I don't think that means you shouldn't be subject to some reputational consequence.

Should we trust your statements when you get on that investor call? Isn't your prior actions relevant?

I don't see the benefit to this system. If we assassinate reputation based on coincidence then we have introduced an unnecessary element of chance. I would much rather base my opinion on facts. If the CEO lied to shareholders on a call or used inside knowledge to sell shares illegally then the reputation damage will come from the conviction. In the absence of this evidence I see no benefit in assuming guilt or otherwise damaging the CEOs reputation.

> I don't think that means you shouldn't be subject to some reputational consequence.

Why not? What if they were just unlucky? Why do you get to decided whether their reputation suffers?

When you know of something like the revealing of a huge breach, it is.

Why does the internet have the power to hand out punishment?

On Friday, August 25, 2017, Ying texted a co-worker that the breach they were working on “Sounds bad. We may be the one breached.” The following Monday, Ying conducted web searches on the impact of Experian’s 2015 data breach on its stock price. Later that morning, Ying exercised all of his available stock options...

Always nice when criminals express their intent to perform an illegal act on 3rd party services ahead of time.

I do always wonder where is the record of searches being held? A corporate MITM saving all queries? Or are criminals logging into their Google accounts before running queries on how to commit their crime?

I would be kind of shocked if Equifax wasn't MITM'ing their internal web traffic. Doing so is somewhat par for the course if you want to be able to monitor and filter employee Internet activity, which most traditional corporations with significant security expectations do.

That being said, browser history and Google Account history are both reasonable places to look as well.

I am always a little amazed at the paper trail white collar criminals that get caught leave. If you think you might insider trade on some information, maybe you should talk to coworkers instead of texting them, and do your research on a personal PC[1] in private browsing on a coffee shop Wi-Fi network somewhere.

(None of this should constitute endorsing the crime, it's just like... from a privacy-minded standpoint... there's so much they could've done "better".)

[1]Honestly, if it's a six figure crime, why not a "burner PC". Buy a Chromebook with cash, and leave it at Goodwill when you're done. The last bit may even help soothe the guilty conscience a bit.

I think its because they don't see themselves as criminals doing it. Even blatantly criminal acts can be justified as being un-criminal or "good" pretty easily.

I've found this to be particularly rampant in software development.

Where is it not rampant?

I'm guessing the paper trail is because it is not always obvious that it IS a crime. Nobody tells you on your first day at work what constitutes insider trading. At my first company, you got an email saying "you are now an 'insider' for SEC purposes" if you got important enough (so I heard, anyway). Is it insider trading if you sell your stock because the new manager over the division is terrible? Is it insider trading if you're working on a product that you think is awesome, so you buy some stock? I'm guessing both of those are not insider trading, despite that you are acting on information not available to the public. From there it doesn't seem like too great of a leap to not consider that news of the hacking you are working on is also not insider trading.

If you asked me, "is it insider trading to sell stock because you know the company has been seriously hacked and the price will drop once news gets out?" I'd probably say "yes." But if I were in the situation myself, I'm not sure if that question would occur to me.

Insider trading is normal, routine, and rampant, across corporate America. When people get caught, it's usually because another insider snitched; and it's a standard part of dirty corporate politics.

At a company I used to work for, our CIO was found out to have lied about his educational background on his resume; after working there 15 years. Another board member had been sitting on this dirt for at least 5 years. He had hired a PI to dig up things about the executive staff. It was his opening move on pushing out the old execs, and replacing them with a more acquisition-friendly line up. Then said board member cashed out.

We would frequently also see large blocks of stock traded the day before a big earnings announcement. Only the executive staff would have had that information. Us line employees all had stock options, but were never able to take optimal advantage of price swings, because someone else was beating us to it. We only had the public information. It is routine and the SEC does not give a fuck, unless the case becomes high profile enough that the press will write about it and make a stink.

Nothing against your comment in general, but some companies do tell you. On my first day at my current job I had to complete an insider trading training module and I'm just an average engineer.

I've worked at three publicly traded companies. I don't recall insider trading being mentioned at the first one, but I was in a pretty lowly support role and a former CEO was fined for insider trading. The other two I recall insider trading being mentioned during orientation and in periodic reminders, usually around stock events (such as at least the closed trading window for employees around earnings announcements)

Could also simply be a matter of browser history not being deleted. Equifax doesn't seem to have hired the best lol.

>Or are criminals logging into their Google accounts before running queries on how to commit their crime?

I would imagine it's more of a case of the average person failing to understand just how much data google will store associated with their account.

Perhaps here?

https://goo.gl/maps/yZBSw86yNfL2

This is the turn of a new era.

Someone who actually commits a securities crime goes to jail!

I hope this sends a message to Wall Street and CEO's that they are jail-able.

Cannot wait to see what happens when the SEC starts to look at people pumping and dumping cryptocurrencies if the decide to regulate it besides ICO's. (https://www.sec.gov/fast-answers/answerspumpdumphtm.html)

I work in a Hedge Fund: my first reaction reading this article was to wonder how someone can be so stupid to even try something like that. Then I read your comment and realize that in fact, the rest of the world (people not in Finance) actually think that you can get away with this. He probably thought that everybody is doing it, so why not? Well, turns out that no, you can't do that, and yes, you can and will get prosecuted for it.

So no message sent to Wall Street, we got that memo a long long time ago. Geeks thinking they know everything and disregarding all regulations, however, should take a long, hard look at it. Finance and anything touching it (like securities, which most crypto-currencies are) is very very very heavily regulated.

I mean, at this point three of the four DID get away with it. Not to mention we haven't heard a peep about the Intel CEO also selling stock prior to the meltdown/spectre public announcements. So...

https://www.cnbc.com/2017/11/03/equifax-special-committee-sa...

I'm going to take the cynical approach: assuming that all politicians are corrupt anyway, a newly elected senator might accept a huge amount of cash in an envelope in exchange of legislation/contracts/whatever. That will make any other senator laugh: you have to be way way way more sophisticated about it. Be paid to do a talk at some random conference (after your term), get a nice cozy seat at the board of said company you helped (after your term), etc.

If the article is correct, what this guy did is just plain stupid. But I'm not claiming you can't get away with doing something similar with good enough legal advice. This I do not know (IANAL).

>: assuming that all politicians are corrupt anyway,

Why would the politician need money. After the change insider trading where congress cannot be investigated, all you need to do it tip them off before major news and they can make their own 'cash envelope'.

Ah yeah, I remember when people went to jail because of the 2008 financial crisis.

(sure, apparently nothing illegal was done, it was just recklessness and poor judgement, but I see why people would think wall street always get off scot-free)

Except for that part where people did go to jail[1], it's just that they were all from smaller institutions rather than any of the top executives from national banks. That is certainly a problem, but it does illustrate that if you (like most of us) are a nobody, you're not necessarily gonna get away with anything.

[1] http://money.cnn.com/2016/04/28/news/companies/bankers-priso...

Well the example they give, Edward Woodard, is someone who got 23 years sentence for fraud, which is not really related to what happened during the 2008 financial crisis?

>From 2008 to 2011, Woodard and Stephen Fields, a former executive vice president and commercial loan officer at the bank, hid the bank’s financial condition, authorities said. Bank insiders also gave preferential financing to troubled borrowers to buy properties Bank of the Commonwealth owned, prosecutors said.

So that was after the crisis - they wanted to hide how bad it affected them?

That's the second time in two days I've seen that cited in response to the claim no Banker went to jail. But as far as I can make out it's about Tarp fraud, which came at the crisis. Wheres it coming from, first Google result?

> commits a securities crime

>> the 2008 financial crisis

The problem evidenced by the 2008 crisis was that many destructive behaviors were not, in fact, illegal. (Some were, and many of those people are barred from industry or going to jail [1].)

[1] http://money.cnn.com/2015/08/03/news/libor-scandal-tom-hayes...

Yeah which is too bad.

If you're reckless in your car and get into an accident, can you be jailed? Yes, for reckless endangerment.

Why is there no such thing in the financial world, especially after 2008 :(

> Why is there no such thing in the financial world, especially after 2008

Recklessness is well defined in respect of cars. (It wasn't when they first came out.) Recklessness is well defined in respect of selling stocks and bonds. (It wasn't a century ago.) Recklessness was not well defined in respect of certain new financial products in 2008. It is now.

> Recklessness was not well defined in respect of certain new financial products in 2008. It is now.

I am not too well-versed with laws and legislations (especially because everything sounds partisan) but are you talking about Dodd Frank? https://en.wikipedia.org/wiki/Dodd%E2%80%93Frank_Wall_Street... The last I read about it, Congress is trying to get rid of it, no? Is there some other regulation that makes what was not against the law in 2008 (actually I don't know much about this either) against the law now?

Meanwhile, on Monday, the statute of limitations ran out for indicting James Clapper (then DNI) for lying to congress under oath when he told them that the US military does not spy on millions of americans.

Two classes in this country.

While that does seem unfair, how airtight would that case have to be?

As outlined in another comment here, the CFO and CMO of Equifax appear to have dumped just as much if not more than this employee being indicted, however they're yet to be prosecuted, possibly due to less evidence.

Would James Clapper be able to either claim a different definition of spying (i.e. "We collected this information but only accessed it when relevant"), or to claim it was "necessary for national security" to lie?

>While that does seem unfair, how airtight would that case have to be?

And therein lies the issue. If you are rich the state has to spend huge amounts of money to prove the case 'beyond a reasonable doubt', unfortunately for the poor it seems 'the preponderance of evidence' seems to be more than enough to get a criminal conviction.

Okay, now what about the actual breach? No one gets in trouble for that and nothing changes. If I missed something that did change, or where someone actually did get in trouble, please enlighten me.

A suggestion to companies: stop using SSN's as usernames/passwords! Get rid of the static numbers and give out encryption certificates or something!

Encryption certificates for grandma and grandpa? We need a solution that works for everyone and until technology supports the mass it won't work.

I agree we need a new solution but we need one that works for everyone.

It doesn't have to be a literal alphanumeric cert in a text file. There could be smart cards distributed, or an app people install on their phones for identity verification. Or even just T/OTP from a phone app to allow credit requests.

Whatever happened to one-time Credit Card numbers for use on a per-transaction basis?

We have those as national identity cards in my country (by the same company that makes a lot of national IDs):

https://www.gemalto.com/govt/customer-cases/uruguay-eid

> an app people install on their phones for identity verification

I believe the consensus in the US that we don't want a form of national ID. Hence the use of Social Security numbers as a proxy for identification.

So your SSN is your national id card

It is if you want to open a bank account or confirm identity to the IRS or any other of the myriad services that seem dependent on it.

They still exist. Capital one provides this functionality that can be easily accessed via a browser plugin.

Most credit cards do this. My daily driver Citi 2% does. In fact Google Pay automatically uses a virtual number by default when used with this card.

And doesn't exclude people at polling locations.

I am strictly referring to bank accounts and the like here. I want no such digital ID for citizenship/residency.

Edit: Granted it would end up being something that could be used like that most likely, but perhaps there is a way to limit the scope?

I didn't remember the CIO being implicated in dumping stocks. Sure enough, a bit of Googling reveals that he wasn't among the original three that were so widely reported.

Will be interesting to see if anything comes from the other executives who dumped their stock:

* John Gamble, Jr. - Chief Financial Officer

* Rodolpho Ploder - Workforce Solutions President

* Joseph Loughran - Chief Marketing Officer

The series of events mentioned in the article say that he texted someone about it before it happened, and that he was searching Google for stock price information.

Maybe the other three didn't leave a clear enough trail or they just haven't been charged, yet? I would hate to think that just dumping all of the charges on the "tech guy" for everything would be what happens here.

I would hate to think that just dumping all of the charges on the "tech guy" for everything would be what happens here.

Remember when the entire worldwide VW cheating & coverup scandal was uncovered, and it was blamed on a single engineer? Thank god there was a preponderance of evidence that was bullshit- but it illustrated that exact knee-jerk reaction nicely.

One can only imagine it works most of the time, otherwise they wouldn't try to pull it every time.

The real test will be if the CEO of Intel faces this same punishment[1]. Seems like this mostly gets enforced at lower rungs.

[1] https://arstechnica.com/information-technology/2018/01/intel...

What's unfortunate is that the government has largely been silent on the culpability of Equifax executives, and the company as a whole.

"Equifax may actually make money off this breach": https://www.marketplace.org/2018/02/28/tech/sen-elizabeth-wa...

>Chief Information Office

I;m assuming these trades needed to be registered in advance with the SEC and he failed to do so?

Poor criminality from a C level employee

Ironically Equifax is only down around $15 a share from its close on the day he sold. That's just over a $100k personal loss in unrealized gains, not a huge amount for someone in his position.

Instead, if found guilty his career is over prematurely.

Not one of the original 3 execs reported, but that doesn't necessarily mean that they're getting away with it. The SEC may well still be investigating the original 3. In my observation, law enforcement tends to keep quiet about ongoing investigations until they're ready to press charges.

We shall have to see if the original 3 execs get charged as well, or if there's a reason why their sales weren't insider trading per the law.

Interesting I wonder why there hasn't been any action taken against the the three senior executive that were previously reported to have done similar:

https://www.bloomberg.com/news/articles/2017-09-07/three-equ...

The biz guys are smart enough not to write down evidence of their crimes.

It would be interesting, after this is off the table to see if there will be any other implications for Equifax, because I'm worried personal data of millions of Americanns floating around in public and noone is held accountable. Has anyone an update on the latest status - is that case rested and we all just live with it?

Reply on news.ycombinator.com