Corporate training courses tow the SEC line, but the outcomes of actual civil and criminal prosecutions would be far swifter and harsher if the law was as the SEC says.
In short, in some contexts friends and family absolutely can trade on material non-public information. In fact, in no case are they directly committing a crime; their liability is vicarious--it stems from some illegal behavior of the actual insider, which turns on more elements than the simple act of disclosing material, non-public information. If that illegal insider behavior is lacking then friends and family are no different than some random member of the public who caught an anonymous tip.[1]
Of course, as with anything illegal you have to factor in the risk of a jury wrongly convicting, especially when the legal elements so heavily rely on circumstantial evidence and even insinuation as with insider trading.
[1] If the SEC had their way then even trading on an anonymous tip would be illegal. Indeed, if the SEC had their way they could prosecute damn near anyone they wanted, at any time, because their legal theory is so ridiculously broad it would effectively shift the burden of proof onto the defendant.
After any corporate action, the SEC (and various other agencies) trace back through trade records to look for suspicious trades. Family members are a matter of public record. And friends are now announced on LinkedIn, Twitter, Facebook, et cetera.
While the SEC can undertake the tedious process of clearing all individuals with knowledge of the breach, a more effective tactic would be to look at suspicious trades and investigate potential insider knowledge. In that method, SEC looks at unusual volume/patterns in options contracts and security sales. The SEC will comb through each suspicious security sale that occurred prior to the breach announcement and cross reference the account owner's information with their list of insiders. If they have reasonable suspicion that a crime occurred, investigators obtain a warrant and complete the picture with phone records, email accounts, Facebook info (if not already obtained via parallel construction), etc.
So let's say in theory you could add a great deal of people as friends (thousands even) and in that case it would be quite difficult for the FBI to run that down (as they say). Besides they would have to supoena records from Facebook at a certain point if the 'friend' was not someone they could easily determine just from a picture or limited contact info.
And don't even get into 'linkedin' that is filled with more people you don't really know or care about than any service.
Most likely they will just work the other way. Someone makes a trade and they then see if they are linked to anyone in anyway at the company.
Take the fifth?