A Seattle court this week dismissed with prejudice the defamation case brought against DEF CON and its organizer Jeff Moss by former conference stalwart Christopher Hadnagy.
Conference organizers banned Hadnagy, founder of infosec outfit Social-Engineer LLC and veteran of DEF CON’s social engineering village, in 2022 following misconduct complaints, per its transparency report.
The details of these complaints weren’t revealed until earlier this year, but the mere mention of misconduct allegations and the resulting conjecture about their nature was enough for Hadnagy to lawyer up.
In March 2024, Washington Judge Brian Tsuchida dismissed six of the seven legal complaints made by Hadnagy against the top computer security conference’s team, which included business disparagement and unjust enrichment claims – but allowed the defamation aspect to proceed.
In February, as part of a motion for summary judgment filed by DEF CON, details of the misconduct claims made by various individuals against Hadnagy came to light for the first time in court documents spanning more than 700 pages.
Described by DEF CON’s lawyers as “shocking acts of harassment against many people over the course of years,” the allegations made against Hadnagy spanned angry outbursts at work, insulting staff, and designing training exercises to introduce topics such as breast size and feminine hygiene products.
In one case, he was also accused of brandishing a switchblade while at work.
However, the main focus of the complaints was Hadnagy’s alleged fixation with the appearance of certain female colleagues.
The Register reported these allegations at length, and Hadnagy’s response to them, earlier this year.
Dismissed with prejudice
On May 13, US federal district Judge Tsuchida dismissed Hadnagy’s defamation case with prejudice, meaning the biz founder cannot refile it. The case is over and serves as a win for DEF CON.
The judgment was ultimately made because Hadnagy, who as plaintiff bore the burden of proving defamation, failed to do so. He was unable to prove that the claims made against him were false, and truth is an absolute defense in defamation cases such as these.
This week’s summary judgment [PDF] collected the material facts of the case. The judgment states that Hadnagy’s defamation claims largely hinged on the idea that DEF CON lacked evidence of the sexual nature to the allegations before it published the transparency report banning him from future conferences.
DEF CON’s transparency report never explicitly detailed the nature of Hadnagy’s misconduct, although subsequent transparency updates suggested lifetime bans, like the one the Social-Engineer CEO received, were reserved only for “the most troubling offenses.”
These stirred rumors of the misconduct being sexual in nature, and these weren’t helped by DEF CON’s sales director Kevin Sugihara claiming in a Reddit post months later that “Hadnagy is this industry’s Weinstein, and it isn’t a well-kept secret amongst those in the industry.”
Key to Hadnagy’s defense was a specific Zoom call during which conference organizers asserted that women gave evidence against Hadnagy.
DEF CON insisted during legal proceedings that this call took place on September 7, 2021, between Moss and approximately 15 other people, before announcing Hadnagy’s ban.
DEF CON stated in a joint report, however, that half a dozen people participated, and Moss could not remember if it even took place over Zoom or was a run-of-the-mill audio-only call.
Hadnagy alleged this call actually took place a month after his ban, but this was later disproved.
Hadnagy probed other holes in DEF CON’s case, including the fact that no notes were taken on this call, and the only log of its existence was the date and time of it happening.
Moss testified that DEF CON had policies and procedures for documenting investigations, but these were never produced at any point during the case, and he expressed uncertainty about what was known about the Hadnagy allegations before the ban.
There was also confusion about the claims made by former Social-Engineer COO Michelle Fincher, that Hadnagy had a fixation on Asian women and had previously referred to her as a “hot Asian.” DEF CON asserted that it relied on Fincher’s claims before publishing the transparency report that banned Hadnagy, but Moss testified that she did not raise any code of conduct violations on the Zoom call.
Moss directed Fincher to DEF CON’s legal team after the ban to discuss her involvement in the discovery phase of the Hadnagy lawsuit.
Fincher, Maxie Reynolds – who was central to the main allegations against Hadnagy – another former Social-Engineer employee Cat Murdock, and DEF CON senior staffer Neil Wyler all said Fincher did indeed raise concerns on the call, however.
Moss additionally said these incidents were “a while ago” and he didn’t “remember specifically who said what.”
Murdock testified she was on the Zoom call in question, despite the first recorded exchange between her and Moss taking place months after.
DEF CON board member Alethe Denis testified Murdock told her she “was not a party to this and that she had more important matters to attend to in her own life.”
When deposed, Denis said she warned DEF CON that Reynolds was trying to “manipulate” others, which in some cases involved offering appearances on a TV show to make complaints against Hadnagy.
Accounts of the allegations made on the call were conflicting. Murdock and Jess Levine, another former Social Engineer staffer whose allegations were read by another participant due to her being on a plane at the time, both referred to Hadnagy brandishing a blade. However, Wyler testified that no knife-related claims were discussed on the call.
Wyler also couldn’t recall any allegations made about Hadnagy’s alleged fixation on Asian women.
Hadnagy’s defamation lawsuit ultimately failed because it was dependent on proving that DEF CON, before banning him from future events, wasn’t fully aware of the allegations against him, which were detailed earlier in the case.
In defamation cases, in the US at least, the truth is one of the few absolute defenses. Because Hadnagy failed to provide evidence proving any of the main allegations against him were false, it meant he could not prove that he was defamed.
His argument that DEF CON didn’t have all the facts before publishing its transparency report, as a result, is superseded by DEF CON’s truth defense.
Essentially, it doesn’t matter whether DEF CON had strong evidence of sexual impropriety before the ban because the allegations were not found to be false.
A victory for attendees
Addressing the win on social media, DEF CON said the ruling was a victory for conference attendees – one it hopes will encourage others to speak up should any similar cases arise in the future.
“We look forward to returning our full attention to the community and conference we love,” it stated.
“We also thank everyone who came forward to help keep our community safe. We know it’s not an easy choice, but the world is better for it.
“This victory is encouraging. We hope it makes attendees feel safe reporting [code of conduct] violations. We hope it demonstrates our commitment to protecting attendees from misconduct. Mostly, we hope our amazing community will continue looking out for each other. We will always have your back.”
Hadnagy told The Register he was “disappointed” with the decision and that being labeled a serial sexual predator had “deeply harmed” him, his family, the organizations he oversees, and their staff. He also said he was relieved and grateful to be able to “speak openly about what really happened.”
“Anyone who has looked at the full record, not just the twisted statements made by DEF CON and their counsel, can see this was a workplace conflict that escalated far beyond what anyone intended.”
He went on to say that all he wanted was for Moss to admit the ban was not due to sexual misconduct, but instead just “workplace bullying and leadership concerns.”
“I hope the community can now move forward, and that the harassment of my family, my staff, the ILF volunteers, and me finally ends,” he added. ILF is the Innocent Lives Foundation, a nonprofit Hadnagy leads that investigates child sexual predators.
“The irony is heartbreaking: the bullying and harassment I was accused of has now been directed at those I care about most. It has taken three years and enormous legal costs just to speak the truth. But now, at least, the truth is out – and that’s a step toward moving forward.” ®
