Defamation Lawsuit Against Def Con Cybersecurity Conference Dismissed

"[I]t is irrelevant that Defendant Def Con did not know at the time the Transparency Reports were published whether Hadnagy had or had not engaged in sexual misconduct. Rather, if the sexual misconduct implications were in fact true at the time the Transparency Reports were published, Def Con is shielded by the truth defense."

A short excerpt from today's long decision by Magistrate Judge Brian Tsuchida in Hadnagy v. Moss (W.D. Wash.):

This case involves a defamation claim brought by Plaintiff, a past participant of the Def Con annual cybersecurity and hacking conference, against Defendant, the Def Con conference organizer. Plaintiff Hadnagy hosted a social-engineering village called SEVillage at the Def Con conference. Def Con's Code of Conduct prohibits "harassment," which includes "deliberate intimidation and targeting individuals in a manner that makes them feel uncomfortable, unwelcome, or afraid" and Def Con reserves the right to expel participants for harassment. Def Con permanently bans "repeat offenders and those who commit more egregious offenses."

Based on a report of retaliation by Hadnagy made by a former employee and a Zoom call in which others complained of Hadnagy's conduct, Def Con banned Hadnagy from its conferences and on February 9, 2022, issued the following "Transparency Statement":

We received multiple CoC [Code of Conduct] violation reports about a DEF CON village leader, Chris Hadnagy of the SE Village. After conversations with the reporting parties and Chris, we are confident that the severity of the transgressions merits a ban from Def Con.

Hadnagy alleges in his lawsuit that this statement led to wide-spread speculation the transgressions were sexual in nature.

On July 28, 2022, Def Con posted another Transparency Report clarifying the significance of the lifetime ban by stating: "[i]n the case of the most troubling offenses or those who we feel may represent on ongoing risk to the community, we take the extra step of naming them publicly" so as not "to provide cover for these individuals to quietly find new and unsuspecting victims elsewhere." On January 13, 2023, Def Con posted the following "Transparency Update:" During our investigation we spoke directly with Mr. Hadnagy about claims of his violations of our Code of Conduct. He confirmed his behavior and agreed to stop. Unfortunately, the behavior did not stop.

Hadnagy contends there are factual disputes that Def Con spoke directly with him and whether he "confirmed his behavior and agreed to stop." Hadnagy bears the burden of proving the challenged statements are false or left a false impression by omitted facts and in publishing the statements, Def Con knew or in the exercise of reasonable care, should have known the statements were false….

Def Con has submitted evidence obtained during written and deposition discovery in this lawsuit to confirm a "pattern of retaliation and disparagement" by Hadnagy against others in the infosec community….. Hadnagy has not provided evidence that disputes: (1) his fixation on [his former employee] Maxie [Reynolds'] appearance or his attacks on her as a "awful psycho bitch"; (2) his repeated references to [former employee] Michele Fincher as a "hot Asian," and her discomfort of his sexualized trainings or his repeatedly bullying and screaming; (3) that he threw a phone at [former employee] Cat Murdock, belittled employees, and joked about pulling out a switchblade to stab people; (4) Jess Levine's testimony she saw Hadnagy drunkenly brandish a switchblade, berated her to the point of tears and unlawfully withheld her paycheck; (5) Sam Gambles' testimony Hadnagy regularly commented on her physical appearance in a way that made her uncomfortable, made sexually explicit remarks to her in 2021, and gave her an unwanted kiss on the forehead; (6) Geoffrey Vaughan's 2016 emails regarding Hadnagy's inappropriate behavior in training sessions which included references to pornography; and (7) Hadnagy's own acknowledgment that his conduct was inappropriate or could be perceived as inappropriate….

Def Con argues Hadnagy has not and cannot dispute that before Def Con issued its first Transparency Report, Hadnagy actually had engaged in misconduct involving fixating on the bodies of females, violent temper outbursts, berating and insulting employees, sexual fetishization of Asian women, holding inappropriate sexualized trainings, and brandishing a switchblade at the Def Con conference and in the workplace….

Hadnagy's challenge focuses upon what evidence Def Con actually knew about at the time it issued its Transparency Reports. Hadnagy contends, when Def Con issued the Transparency Report and Transparency Updates, they lacked information of any impropriety of a sexual nature. Hadnagy argues while Def Con's Transparency Report "does not explicitly state the ban was related to sexual misconduct, Defendants knew of should have known the context in which it was made was 'capable of' that defamatory meaning." … Essentially, Hadnagy reasons that absent … knowledge [of sexual misconduct], Def Con's Transparency Reports were false and defamatory when issued, even though subsequent discovery establishes the sexual misconduct implications are in fact true….

The court rejected the claim, relying on the Restatement (Second) of Torts § 518(h), which provides, "if the defamatory matter is true, it is immaterial that the person who publishes it believes it to be false; it is enough that it turns out to be true."

[I]t is irrelevant that Defendant Def Con did not know at the time the Transparency Reports were published whether Hadnagy had or had not engaged in sexual misconduct. Rather, if the sexual misconduct implications were in fact true at the time the Transparency Reports were published, Def Con is shielded by the truth defense. The restatement's language "if the reports ultimately are true," further suggests that evidence discovered after Def Con's Transparency Reports were published may be used in a truth defense, if that evidence sets forth acts committed by Hadnagy before the Transparency Reports were published….

Hadnagy's argument that Def Con cannot rely upon information discovered after the Transparency Reports were issued to prove the statements contained in the publications are true is also critical as to whether the Transparency Reports proximately caused the harm Hadnagy alleges. There is no dispute the language of the Transparency Reports do not state Hadnagy engaged in sexual misconduct, which is the focus of Hadnagy's claim. Hence the language of the Transparency Reports alone did not proximately harm Hadnagy.

The harm Hadnagy alleges flows from the implication he was banned from Def Con due to sexual misconduct. However, even assuming Def Con should have known the potential defamatory impact of the Transparency Reports, the fact the allegations of Hadnagy's sexual misconduct have ultimately been shown to be true is a complete defense as true statements are not defamatory and thus cannot proximately cause harm….

David Perez and Matthew Joseph Mertens (Perkins Coie LLP) and John S. Stapleton and Jonathan L. Cochran (LeVan Stapleton Segal Cochran LLC) represent defendant.