A defamation lawsuit filed by cybersecurity figure Chris Hadnagy against DEF CON was dismissed after evidence revealed his inappropriate behavior matched the conference’s claims.

At a Glance

• Christopher Hadnagy, founder of Social-Engineer LLC, sued DEF CON after being banned in 2022 for alleged misconduct
• The lawsuit claimed DEF CON’s transparency reports damaged Hadnagy’s reputation by implying sexual misconduct
• Court evidence revealed patterns of harassment, inappropriate comments about female coworkers, and explosive behavior
• Magistrate Judge Brian Tsuchida ruled that true statements cannot be defamatory, dismissing Hadnagy’s claims
• The case highlights the legal protection of factual information even when damaging to reputation

The Ban and Lawsuit

Christopher Hadnagy, founder of Social-Engineer LLC and longtime participant at DEF CON cybersecurity conference, was banned from the event in 2022 following allegations of misconduct. DEF CON’s decision came after reports of harassment and retaliation, with the organization issuing a Transparency Statement regarding their actions. Hadnagy responded by filing a lawsuit against DEF CON and its founder, Jeff Moss, claiming that the ban and subsequent statements severely damaged his professional reputation in the cybersecurity community.

The lawsuit initially contained multiple claims, but a judge narrowed the case to focus primarily on defamation. Hadnagy argued that DEF CON’s Transparency Reports falsely implied he had engaged in sexual misconduct, an accusation he vehemently denied. His legal team maintained that these implications were particularly damaging in the post-#MeToo era, when such allegations could be career-ending.

Revelations in Court

As the case progressed, a motion for summary judgment filed by DEF CON’s legal team revealed detailed allegations against Hadnagy. Court documents described a pattern of inappropriate behavior, including sexualized comments about female employees, angry outbursts, and designing training exercises with inappropriate content. The evidence presented painted a troubling picture of Hadnagy’s professional conduct.

Specific allegations included a fixation on female coworkers’ appearances, with comments documented in the court records. In one instance, when discussing a potential hire, Hadnagy allegedly stated, “She’s hot and she’s Asian. She’s in.” The court documents also described incidents of public humiliation of employees and attempts to sabotage a former employee’s book promotion, reflecting what DEF CON’s lawyers characterized as “shocking acts of harassment.”

Legal Standard: Truth as a Defense

The crucial turning point in the case came when Magistrate Judge Brian Tsuchida addressed the fundamental legal principle at stake. In his ruling, Judge Tsuchida emphasized that for a statement to be defamatory, it must be false. The court’s analysis focused not on whether DEF CON knew all the facts at the time of publication, but whether the statements were factually accurate regardless of the organization’s knowledge.

This ruling clarified that even if DEF CON published its reports without complete information at the time, the truth of the underlying implications provided an absolute defense against defamation claims. The court found that the evidence presented substantiated DEF CON’s statements about Hadnagy’s behavior, confirming that the implications in the Transparency Reports were factually accurate, and therefore not defamatory.

Implications for Transparency in Professional Communities

The dismissal of Hadnagy’s lawsuit reinforces an important precedent for professional communities enforcing codes of conduct. By upholding DEF CON’s right to publish factual information about violations of community standards, the court affirmed that truthful transparency reports serve a legitimate purpose in maintaining safe and respectful environments.

The case demonstrates that when organizations take action based on substantiated misconduct, they can communicate those decisions without legal liability.
For the cybersecurity community and conference organizers, this ruling provides reassurance that addressing violations of codes of conduct through transparent processes is legally protected when based on truth. The case stands as a reminder that while reputation is valuable, it does not override the public’s interest in factual information about professional conduct, especially in matters related to harassment and misconduct.