Suppose company X has a product P. An independent InfoSec expert M found a vulnerability in product P that can turn it into a significant safety hazard. Under the responsible disclosure guideline, M has alerted X of the vulnerability. X disregarded it repeatedly. According to the usual vulnerability disclosure guideline, M should disclose the issue to the general public. This is likely to cause the stock prices of X drop significantly.

Can M short the stocks of X before disclosing this information?

  • 1
    In Spain there was (is?) a financial analysis firm that has become famous by researching and investigating business that cook the book, releasing reports exposing them and profitting from shorting its stocks. AFAIK, if the info they use is not privileged (insider) information and the report is true (not a lie with the intention of manipulating the market), they are off the hook. YMMV.
    – SJuan76
    Feb 14, 2017 at 9:12
  • @SJuan76 The researchers themselves are professionals in relevant non-financial technology, discovered the technical problem themselves with reliable, reproducible experiments, have disclosed the information to the company, and is to disclose it to the general public and the press. Feb 14, 2017 at 9:51
  • 2
    Important: in case you have not read the FAQs, this site does not give legal advice. If your question is about you are actually planning to do, check a lawyer (your lawyer) about it.
    – SJuan76
    Feb 14, 2017 at 10:03
  • @SJuan76 No. This is not advice seeking. This question originated from a Defcon keynote where a few ethical hackers discovered a life-threatening vulnerability in some cars (yes, hackers could kill you from the other end of the world by remote controlling your car and intentionally crashing it) and the resulting callback caused a near 50% drop in the car maker's stock price. Feb 14, 2017 at 10:35
  • @K-C These are not regulations. The rule is an ethical guideline of hackers. Feb 14, 2017 at 23:24

1 Answer 1


The issue is whether the discloser shorting the stock has engaged in securities fraud of some kind. In the case of a publicly traded company (which seems to be implied in the question), under U.S. law, the answer would generally be that this is not illegal.

"Insider trading" is prohibited, which generally involves confidential information obtained by the company itself or by someone contractually connected to it (i.e. "insiders"). If the information is generated independently, then it is not insider information and is not subject to disclosure.

In a closely held corporation context, in the context of a person-to-person transaction, there might be an issue of fraudulent concealment of a fact from the person on the other side of the trade. But, generally, in a publicly held share context, there would not be a duty of disclosure of non-insider information to the person on the other side of a short transaction (whose name you in all likelihood will never even learn).

I have no opinion on how the securities laws of other countries might handle this issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .