If they did not usually trade in such options but suddenly started doing so the day before it had a major market-moving event, that could be the type of "reasonable suspicion" that you need to get a search warrant from a judge. From there on, investigators could demand access to (say) electronic communications to determine if the person doing the trade got a text from a friend saying "yo buy 20k of short term call options on Splunk you won't regret it bro" or something similar.

Especially if the person doing the trade is found to be employed by (or closely related to someone employed by) Cisco or Splunk or one of their banks.