Shunned researcher Hadnagy sues DEF CON over ban

A security researcher and executive who was banned for misconduct from the DEF CON hacking conference earlier this year is hitting back in court.

Christopher Hadnagy, formerly the organizer of DEF CON's Social Engineering Village, claims that the conference's decision to ban him from the show and publicly announce the move has caused personal and professional damage. He has filed suit against both DEF CON itself and show founder and organizer Jeff Moss in the Pennsylvania Eastern District U.S. court.

"My company and I consistently deny and continue to deny any and all allegations of misconduct," Hadnagy said in a statement to TechTarget Editorial. "To address these false accusations, defamatory statements and innuendos, I have filed a lawsuit against both DEF CON Communications and Jeff Moss."

The complaint stems from DEF CON's announcement in February that it would not allow Hadnagy to attend the 30th edition of the conference or oversee operations in the Social Engineering Village section of the show.

Def Con's transparency report claimed that show organizers had received multiple reports of code of conduct violations involving Hadnagy.

"After conversations with the reporting parties and Chris, we are confident the severity of the transgressions merits a ban from DEF CON," the report stated.

Hadnagy said neither he nor his attorneys have been given any explanation from DEF CON or Moss regarding specific incidents that led to the ban or what violations of the code of conduct actually occurred.

Neither Moss nor DEF CON have responded to TechTarget Editorial's requests for comment on the matter.

The case has breathed new life into a years-long debate over how to handle harassment and bad behavior at security conferences. DEF CON made a point of informing attendees at this year's conference that its staff would watch closely for any misconduct and violators would be promptly removed.

Alyssa Miller, a cybersecurity professional who has been following the saga since February, told TechTarget Editorial that she has seen the community take renewed interest in the matter thanks to this latest turn.

"I think his lawsuit has gotten people talking again for sure," she said.

But Hadnagy's suit claims that rather than seeking to protect attendees from harassment, Moss and other DEF CON leaders issued the ban as a way to oust Hadnagy from his leading role in the village.

"It is believed and therefore averred that Defendant Moss, individually and acting on behalf of Defendant DEF CON, with knowledge and intent, falsely alleged that Plaintiffs violated the Code of Conduct in order to replace Plaintiffs' SEVillage with another 'village' targeted to similar topics but organized and hosted by others," the court filing reads.

Since the ban was issued, Hadnagy has become something of a pariah in the infosec community, with his presentations being canceled. In June, organizers of the Cleveland BSides conference were forced to step down after making Hadnagy a surprise keynote guest.

In the complaint, Hadnagy claims that not only has he suffered personal reputational damage from the ban's fallout, but he has also lost clients and been put at risk of losing his work with the nonprofit Innocent Lives Foundation.

"As a result of Defendants' statements, Plaintiff Hadnagy has become a victim of 'cancel culture' in the tech industry, which has devastated not only the once extremely successful Social-Engineer, LLC, but also the Foundation and its efforts to identify child predators," the court filing states.

The suit seeks a judgment in excess of $75,000 as well as additional punitive damages and costs.