WESTERN DISTRICT OF WASHINGTON CHRISTOPHER J HADNAGY, SOCIAL ENGINEER LLC, CASE NO. 2:23-cv-01932-BAT Plaintiffs, ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANTS’ JEFF MOSS, DEF CON Defendants.
Defendants Jeff Moss (“Moss”) and Def Con Communications, Inc. (“Def Con”) move to dismiss the Complaint of Plaintiffs Christopher J. Hadnagy (“Hadnagy) and Social-Engineer LLC (“Social-Engineer”). Dkt. 37. Plaintiffs assert seven causes of action against Defendants. Dkt. 1-1. For the reasons stated herein, the Court grants Defendants’ motion to dismiss Plaintiffs’ claims of Alter Ego, Business Disparagement; Unjust Enrichment, Quantum Meruit, and Injunction; denies Defendants’ motion to dismiss Plaintiffs’ Defamation claims (2/9/22 Transparency Report and 1/13/23 Update); and grants Defendants’ motion to dismiss, with leave to amend, Plaintiffs’ claims of Defamation (“Injurious Falsehoods” by Defendant Moss); Tortious Interference with Contractual Relations; and Prospective Business Relations. A. Plaintiffs’ Allegations – Dkt. 1-1 Complaint Defendants Moss and Def Con have held an annual hacker conference in Las Vegas, Nevada (the “Event”) in August for the past thirty years. Dkt. 1-1 ¶¶ 32–36. The Event is one of
the largest, is highly regarded in the industry, and is attended by members of law enforcement agencies and large corporations. Id. ¶¶ 37-38. In 2025, Def Con implemented an Event Code of Conduct (“Code of Conduct”). Dkt. 1-1, ¶ 60 (Dkt. 37, Ex. 1). The Code of Conduct prohibits “harassment,” which includes “deliberate intimidation and targeting individuals in a manner that makes them feel uncomfortable, unwelcome, or afraid.” Id. The Code of Conduct applies to “everyone,” and Def Con reserves the “right to respond to harassment in the manner we deem appropriate, including but not limited to expulsion.” Id. In 2017, Def Con began to publicly share a summary of incidents which occurred at the Event for a given year (the “Transparency Report”). The Event hosts a multitude of “villages,” inviting smaller groups of attendees to
participate in cybersecurity challenges and demonstrations related to different topics. Id. ¶ 40. In the past, Plaintiff Hadnagy hosted a village focused on social engineering (the “SEVillage”). Id. ¶¶ 45–46. In January 2022, Def Con informed Plaintiff Hadnagy that he could no longer attend the Event based on reported violations of the Code of Conduct. Id. ¶¶ 58–59. On February 9, 2022, Def Con published a Transparency Report announcing Plaintiffs’ ban from future Events: We received multiple [Code of Conduct] reports about a DEF CON Village leader, Chris Hadnagy of the SE Village. After conversations with the reporting parties and Chris, we are confident the severity of the transgressions merits a ban from DEF CON. Id. ¶ 58 (the “2/9/22 Transparency Report”).1 On July 28, 2022, Defendants published an Updated Transparency Report explaining treatment of Code of Conduct violations, including meeting with parties, witnesses, and victims; reviewing evidence; and determining permanent bans for repeat offenders and egregious offenses. Defendants based their safeguards on
recommendations from the National Network to End Domestic Violence and the Violence Against Women Office at the US Department of Justice. Dkt. 37, Ex. 2 at 2-4 (7/28/22 Update). Plaintiffs deny violating the Code of Conduct, meeting or discussing allegations of code violations with Defendants, and alleges Defendant Moss ignored his attempts to meet and provided no reason for the lifetime ban. Dkt. 1-1, ¶ 61, ¶ 62. Defendants ignited a firestorm within the information technology and security communities across social media platforms and prominent media outlets after posting the Transparency Report. These outlets quoted Defendants' statements and asserted Plaintiff Hadnagy was a sexual predator. Id. ¶ 66-72. Defendants were aware that presenting the Transparency Report would lead the public to understand it in this manner as Defendants’ past lifetime bans were exclusively due to extreme
sexually predatory behavior. Dkt. 1-1, Compl. ¶¶ 100-101, 103-104, 107-108. False rumors about Plaintiff Hadnagy spread rapidly, tarnished his reputation, and he was likened to the “Harvey Weinstein” of the information security industry in a public post. Id. ¶ 108. In January 2023, Plaintiffs sued Defendants in the Eastern District of Pennsylvania. Following dismissal of that lawsuit for lack of personal jurisdiction, Defendant Moss published an update to Def Con’s website (the “Update”): “During our investigation we spoke directly with Mr. Hadnagy about claims of his violations of our Code of Conduct. He confirmed his behavior and agreed to stop. Unfortunately, the behavior did not stop […] Our investigation also revealed
1 Defendants refer to this publication as the Ban Announcement. that DEF CON is not the only security conference to receive complaints about Mr. Hadnagy’s behavior. For example, Black Hat received complaints, conducted their own investigation, and removed Mr. Hadnagy from their Review Board.”
Id. ¶¶ 80, 98. Plaintiff Hadnagy denies Defendants ever spoke with him about the alleged Code violations and he never “confirmed his behavior.” Id. ¶¶ 61-62, 84. Most of Plaintiffs’ business associates in Las Vegas, including Black Hat, terminated their contracts with Plaintiffs based on Defendants’ statements in the Transparency Report. Id., Compl. ¶¶ 42-43; ¶¶ 73-76. Defendant Moss published these statements (and additional statements that Plaintiff’s employment practices were racially discriminatory and fostered a hostile work environment based on gender) in private to “other industry leaders who host similar annual conventions in Las Vegas, Nevada, including the organizers of Black Hat.” Id. ¶ 113. Around February of 2022, Black Hat representatives issued a ban of Plaintiffs from Black Hat’s conference, citing Defendants’ Transparency Report. Dkt. 1-1, Compl. ¶¶ 73-76. Black Hat’s website lists Defendant Moss as a director of Black Hat. Id., ¶ 77. Defendant Moss continued to make disparaging and false statements to other Black Hat representatives, including allegations that Plaintiff Hadnagy perpetrated repeated sexual harassment and admitted to these acts. Id. ¶¶ 78-79. Defendant Moss intended to “entangle Plaintiffs in controversy and thwart Plaintiffs’ efforts to conduct a standalone version of the SEVillage, and benefit from Plaintiffs’ SEVillage by using a replica village (the “Social Engineering Community Village”) meant to attract the same audience and goodwill Plaintiffs had cultivated for years. Id. ¶¶ 94, 140. B. Procedural History Plaintiffs sued Defendants in the Eastern District of Pennsylvania, and on January 5, 2023, Judge Wendy Beetlestone dismissed the case for lack of personal jurisdiction. See Hadnagy v. Moss, No. CV 22-3060, 2023 WL 114689 (E.D. Pa. Jan. 5, 2023). On August 9, 2023, Plaintiffs filed a Complaint in the Eighth Judicial District Court, Clark County, Nevada. See Christopher J. Hadnagy et al. v. Jeff Moss et al., Case No. A-23- 875618-C. Defendants removed the action to the Federal District Court of Nevada on August 29, 2023 (Dkt. 1) and thereafter, filed a motion to dismiss, or in the alternative, a motion to transfer
venue to the Western District of Washington. Dkt. 15. Judge Cristina D. Silva granted the motion to transfer venue to this Court and did not reach the merits of Defendants’ motion to dismiss. Dkt. 21 at 1, n.1 (“Transfer Order”). Under Rule 12(b)(6), a court conducts a two-step inquiry to test the legal sufficiency of the complaint. First, well-pleaded facts are accepted as true, while mere legal conclusions may be disregarded. Ashcroft v. Iqbal, 556 U.S. 662, 678–79 (2009). Second, once the well-pleaded factual allegations have been isolated, the court must determine whether they are sufficient to show a “plausible claim for relief.” Id. at 679. A claim “has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is
liable for the misconduct alleged.” Id. at 678. If a motion to dismiss is granted, a court should normally grant leave to amend unless it determines the pleading cannot not possibly be cured by allegations of other facts. Cook, Perkiss & Liehe v. N. Cal. Collection Serv., 911 F.2d 242, 247 (9th Cir.1990). In deciding a motion to dismiss, courts generally consider only the allegations contained in the complaint, exhibits attached to the complaint, and matters of public record. Courts may not consider additional facts alleged in opposition to a motion to dismiss. See Schneider v. California Dep't of Corrections, 151 F.3d 1194, 1197 n. 1 (9th Cir. 1998). A court may consider a document whose contents are alleged in a complaint, so long as no party disputes its authenticity. See Branch v. Tunnell, 14 F.3d 449, 453 (9th Cir. 1994), overruled on other grounds by Galbraith v. County of Santa Clara, 307 F.3d 1119 (9th Cir. 2002).” Attached to Defendants’ motion to dismiss as Exhibits 1, 2, and 3 are the Code of
Conduct, Transparency Reports, and Update. Neither party raises concerns about these exhibits and Plaintiffs’ claims are based on these exhibits. Thus, the Court has considered the exhibits in determining this motion. A. Personal Jurisdiction and Applicable Law Following a transfer under 28 U.S.C. § 1404(a), the Court would ordinarily apply the law of the transferor court. See, Van Dusen v. Barrack, 376 U.S. 612, 639 (1964). Where the transferor court lacked personal jurisdiction over the defendant, however, the transferee court must apply its own law regardless of whether the transfer is based on Section 1404(a) or Section 1406(a). See Nelson v. Int’l Paint Co., 716 F.2d 640, 643–44 (9th Cir. 1983); Intertex, Inc. v.
Dri-Eaz Prod., Inc., No. C13-165-RSM, 2013 WL 2635028, at *2 (W.D. Wash. June 11, 2013). “While a transferor court need not have personal jurisdiction to transfer an action under § 1404(a), lack of personal jurisdiction precludes application of Van Dusen in the transferee court.” Jaeger v. Howmedica Osteonics Corp., No. 15-CV00164-HSG, 2016 WL 520985, at *7- 8 (N.D. Cal. Feb. 10, 2016). Plaintiffs contend the Nevada District Court expressly ruled that personal jurisdiction existed in Nevada. This is incorrect. The Nevada District Court ruled on Defendants’ motion to transfer venue and specifically did not reach the merits of Defendants’ motion to dismiss. In determining whether transfer to Washington was proper, Judge Silva weighed multiple factors, including familiarity with governing law and, using the most significant relationship test, concluded Nevada had the most significant relationship based primarily on the parties’ interaction at the Event in Nevada. Id. at 4-7. Judge Silva also noted, however, that this factor “weighs slightly against transfer because “[t]he forums’ familiarity with the governing law is
typically to be accorded little weight on a motion to transfer venue because federal courts are deemed capable of applying the substantive law of other states.” Id. at 7-8 (internal citations omitted). Judge Silva did not address whether Nevada or Washington had personal jurisdiction over Defendants. Thus, this Court must “consider in the first instance whether personal jurisdiction existed” in Nevada and which state’s law applies.2 See Jaeger, 2016 WL 520985, at *7. Plaintiff is a resident of Florida and Defendants are citizens of Washington. Thus, to establish personal jurisdiction in Nevada, Plaintiffs must show Defendants purposefully directed tortious action toward Plaintiffs in Nevada. Plaintiffs submit allegations of their own business dealings in Nevada, but it is the Defendants’ “tortious actions” in Nevada that are relevant.
The parties agree the Ninth Circuit’s “purposeful direction” test for personal jurisdiction3 requires a plaintiff to demonstrate that the defendant (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm the defendant knows is likely to be suffered in the forum state. Freestream Aircraft (Bermuda) Ltd. v. Aero Law Grp., 905 F.3d 597, 605 (9th Cir. 2018) (intentional torts, like defamation, are subject to the purposeful direction analysis). 2 Defendants do not assert that Nevada has general jurisdiction over Defendants and in fact, none of the parties are based in Nevada. 3 A purposeful availment analysis is most often used in suits sounding in contract. See, e.g., Doe v. Unocal Corp., 248 F.3d 915, 924 (9th Cir.2001). A purposeful direction analysis, on the other hand, is most often used in suits sounding in tort. See, e.g., Dole Food Co., Inc. v. Watts, 303 F.3d 1104, 1111 (9th Cir.2002). The Court concludes personal jurisdiction is lacking in Nevada because Defendants did not “expressly aim” their alleged tortious statements at Plaintiffs in Nevada. For purposes of the personal jurisdictional analysis, an “intentional act” must be the one giving rise to the tort claims at issue. See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d
797, 806 (9th Cir. 2004) (describing the kinds of potentially tortious “intentional acts” that satisfy the requirement). Here, the alleged tortious acts of Defendants are publishing the Transparency Reports and Update on Def Con’s website. According to a recent Nevada District Court ruling, statements posted online with the intention of being globally accessible do not create personal jurisdiction in Nevada. Wealthy, Inc. v. Cornelia, 2023 WL 4803776 (D. Nev. July 27, 2023). Defendants rely on this case, arguing Def Con’s “systemic” presence in Nevada creates personal jurisdiction in Nevada. Dkt. 19 at 12-13. In Wealthy, the plaintiff (not a resident of Nevada) sued the defendant (not a resident of Nevada) for recording an allegedly defamatory YouTube video with a third person (a resident of Nevada). 2023 WL 4803776, at *3–5. The court rejected personal jurisdiction over the defendant
because the video was posted online with the intention of being broadcast globally, and the defendant did not specifically intend the statements to harm the plaintiff in Nevada. Id. at *3. Had the plaintiff been a Nevada resident, the harm would have been felt in the state, but he was not. Id. at *3–4. The court declined to “exercise jurisdiction over an action where the requisite nexus was the fact that several defamatory statements had a proverbial layover in Nevada as they awaited global publishing on the internet.” Id. at *5. Similarly, there is no personal jurisdiction here in Nevada – non-resident plaintiffs sued non-resident defendants for statements published on a website with global access with nothing more than an incidental connection to Nevada.4 Plaintiff Hadnagy suggests Def Con “expressly aimed” its conduct at Nevada and points to the nature and degree of interactivity of Def Con’s website and geographic scope of Def Con’s economic ambitions. Dkt. 39 at 11-13. These facts are outside of Plaintiffs’ complaint and moreover, are not “intentional acts” giving rise to
Plaintiffs’ claims. Plaintiff’s also point to Defendants’ “systematic intentional acts directed at Nevada’s hospitality market for over thirty consecutive years”, i.e., event space, insurance, and accommodations for attendees. Plaintiffs argue Defendants’ website is “inextricably connected to the Event and expressly applies to attendees of the Event in Nevada.” Here again, business contacts and dealings within the State of Nevada are not the type of “intentional act” giving rise to the tort claims at issue. Plaintiff Hadnagy also relies on Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218 (9th Cir. 2011) for the proposition Defendants expressly aimed conduct at Nevada. Mavrix involved an alleged copyright infringement of photographs by a celebrity gossip website where
the defendant made money by selling advertising space to third-party advertisers, many of which targeted California residents. 647 F.3d at 1221–22. The court concluded this was part of the defendant’s “continuous and deliberate exploitation” of the California market for its website, and the website’s business model was core to the defendant’s profitability, which supported
4 Plaintiffs allege Defendant Moss’s first offending comments occurred while Plaintiff Hadnagy participated in Defcon in 2021 “virtually” (Dkt. 39, Response at 10), ostensibly while Plaintiff resided in Florida. Thereafter, Plaintiff told Defendant he would be “hosting” SEvillage at another location and not participating in Defcon. Id. at 11. In February 2022, Plaintiff alleges Defendant issued defamatory statements against Plaintiff even though Plaintiff “did not participate in the event [Defcon].” Id. Thus, by Plaintiff’s own admission, Defendant Moss’s statements did not occur in Nevada and were directed towards Plaintiff while he resided in Florida. jurisdiction in California. Id. The facts here are dissimilar to those in Mavrix. There is no allegation or evidence the Def Con website “continuously and deliberately” exploits Nevadans for commercial gain as Def Con does not sell advertising space on its website and its website does not target Nevada residents with advertisements, or track visitors via IP address or
otherwise. Dkt. 15-1, Declaration of Jeff Moss in Support of Motion to Transfer at ¶ 6, 9. Finally, Plaintiffs argue Def Con knew the harm would be caused in Nevada because it “is the only place where the Event is held.” Dkt. 39 at 13. The tortious activity alleged by Plaintiffs is Defendants’ publication of the Transparency Reports and Updates on Def Con’s website (and additional defamatory statements made by Defendant Moss to Black Hat representatives) – which publications and statements are not alleged to have occurred in the State of Nevada. Defendants’ ban of Plaintiff Hadnagy and publication of the Transparency Reports is presumably (although it is not entirely clear) based on Plaintiff Hadnagy’s behavior at an earlier Event, which presumably occurred in Nevada. However, the alleged defamation did not occur in Nevada, nor was it directed at Plaintiffs in Nevada. Plaintiff Hadnagy offers no affidavit or other
evidence to support his claim he was harmed in Nevada. He does not identify any Nevada- specific contracts with which Def Con tortiously interfered and/or that Def Con was aware of any such contracts. A court may exercise specific jurisdiction over a defendant only where “the defendant's suit-related conduct” created a substantial connection with the forum [s]tate.” Williams v. Yamaha Motor Co. Ltd., 851 F.3d 1015, 1022-23 (9th Cir. 2017) (quoting Walden v. Fiore, 571 U.S. 277, 284-285 (2014). Defendants’ allegedly defamatory statements on its globally accessible website—were not targeted at Nevada residents, did not involve a Nevada resident, did not encourage Nevada residents to read the statements, did not mention the state of Nevada, and were not posted within the state of Nevada. The Court concludes there is no personal jurisdiction in Nevada and therefore, applies Washington law to Plaintiffs’ claims. B. Alter Ego Claims Plaintiff Hadnagy alleges Mr. Moss is the alter ego of Def Con and is thus “liable for the
obligations, debts, and liability of Defendant DEF CON arising under this Complaint.” Dkt. 1-1, ¶¶ 19–29. A request to pierce the corporate veil is only a means of imposing liability for an underlying cause of action and not a cause of action in and of itself. Local 159, 342, 343 & 444 v. Nor-Cal Plumbing, Inc., 185 F.3d 978, 985 (9th Cir. 1999). The following two elements must be proven before the equitable remedy of corporate-veil piercing applies: 1) the corporate form is used to violate or evade a legal obligation, and 2) corporate-veil piercing is necessary to prevent a loss to an innocent party. See Chadwick Farms Owners Ass'n v. FHC, LLC, 166 Wash.2d 178, 200, 207 P.3d 1251 (2009); Meisel v. M & N Modern Hydraulic Press Co., 97 Wash.2d 403, 410–11, 645 P.2d 689 (1982); Washington v. Davies, 176 Wash. 100, 114, 28 P.2d 322 (1934).
The first element (evasion of a legal obligation) requires “an abuse of corporate form” to the abuser's benefit and to the innocent party's detriment. Meisel, 97 Wash.2d at 410, 645 P.2d 689. The second element is whether corporate-veil piercing is necessary to prevent a loss to an innocent party. This element focuses on whether the innocent party was harmed by the alter-ego conduct, fraud, bad faith, or other legal-responsibility-evading conduct. Meisel, 97 Wash.2d at 410, 645 P.2d 689; Morgan v. Burks, 93 Wash.2d 580, 587, 611 P.2d 751 (1980). The corporate cloak is not lightly thrown aside. Grayson v. Nordic Const. Co., 92 Wash. 2d 548, 553 (1979) (absent fraud or manifest injustice, “the corporation’s separate entity should be respected”). Because “fraud is a necessary element of the alter ego doctrine” a party pleading alter ego must satisfy the heightened pleading standard of Rule 9(b). A. Darino & Sons, Inc. v. Dist. Council of Painters No. 33, 869 F.2d 514, 519 (9th Cir. 1989)); see also Ferrie v. Woodford Rsch., LLC, No. 3:19-CV-05798-RBL, 2020 WL 3971343, at *6 n.4, *8 (W.D. Wash. July 14,
2020). For such claims, “a party must state with particularity the circumstances constituting fraud or mistake.” Fed. R. Civ. P. 9(b). Plaintiffs repeat the elements of a veil-piercing claim and associated factors on “information and belief” (see, e.g., Dkt. 1-1, ¶¶ 20-28) but fail to allege sufficient facts to state a prima facie case of alter ego liability under either Rule 8(a)’s notice standard or Rule 9(b)’s heightened pleading standard applicable to this claim. See Ferrie, 2020 WL 3971343, at *8 (dismissing alter ego claim where the allegations are “conclusory” and “not [an] independent cause[] of action”). In opposition, Plaintiffs contend the facts of fraud are within Def Con’s “exclusive control.” However, Plaintiffs must still state the factual basis for their belief of wrongdoing. Because alter ego is not an independent cause of action, Plaintiffs’ claim is
dismissed insofar as they assert a separate cause of action under this theory. C. Defamation “A defamation action consists of four elements: (1) a false statement, (2) publication, (3) fault, and (4) damages.” Duc Tan v. Le, 177 Wash.2d 649, 300 P.3d 356, 363 (Wash. 2013). A plaintiff can allege the false statement prong by alleging facts showing that the statement is provably false or “leaves a false impression due to omitted facts.” See Yeakey v. Hearst Commc'ns, Inc., 156 Wash.App. 787, 234 P.3d 332, 335 (Wash. Ct. App. 2010) (citing Mohr v. Grant, 153 Wash.2d 812, 108 P.3d 768, 773 (Wash. 2005)). “Defamation by implication occurs when ‘the defendant juxtaposes a series of facts so as to imply a defamatory connection between them.’” Corey v. Pierce Cty., 154 Wash.App. 752, 225 P.3d 367, 373 (Wash. Ct. App. 2010) (quoting Mohr, 108 P.3d at 774). To proceed on a theory of defamation by implication, a plaintiff must allege facts supporting all the elements of a defamation claim but may support the first element by alleging that the statement is false or leaves a false impression. See id.; see also
U.S. Mission Corp. v. Kiro TV, Inc., 172 Wash.App. 767, 292 P.3d 137, 141 (Wash. Ct. App. 2013). Plaintiffs’ defamation claim is based on false statements published on Defendants’ website in the 2/9/22 Transparency Report and the 1/13/23 Update, and additional statements made by Defendant Moss to Black Hat representatives (“Injurious Falsehoods”). The Court concludes Plaintiffs have sufficiently plead defamation as to the alleged false statements published on Defendants’ website but have not done so with regard to the Injurious Falsehoods. 1. 2/9/22 Transparency Report. In the 2/8/22 Transparency Report, Defendants announce Plaintiff Hadnagy’s lifetime ban from the Event based on receipt of multiple code of conduct violations. Defendants state they spoke to the reporting parties and to Plaintiff Hadnagy,
and thereafter concluded the severity of Plaintiff Hadnagy’s “transgressions” merited a permanent ban from Def Con. Defendants argue the statements contained in this publication are mere non-actionable opinions. The Court disagrees. Defendants did not merely ban Plaintiffs from the Event based on their right to associate with anyone they choose or based on an opinion. Rather, Defendants clearly state they instituted the lifetime ban after receiving reports, investigating reports, and confirming the severity of the reported transgressions. The omission of details of the evidence and nature of the transgressions also leaves a false impression, leading to the type of speculation alleged in Plaintiffs’ Complaint. Plaintiffs allege Defendants’ false statements caused speculation and false rumors Plaintiff Hadnagy had committed the worst sexual crimes, and that actual and potential clients began to terminate their relationships and contracts with Plaintiffs following publication of the 2/9/22 Transparency Report. Plaintiffs specifically point to an annual and lucrative teaching arrangement with Black Hat. Plaintiffs contend the 7/28/22 Transparency Report further clarifies the defamatory
significance of the lifetime ban by stating: “[i]n the case of the most troubling offenses or those who we feel may represent on ongoing risk to the community, we take the extra step of naming them publicly.” Plaintiff Hadnagy was named publicly so the logical inference is that he is an “ongoing risk to the community.” Defendants argue the 7/28/22 Transparency Report – which was published months later – cannot be used to support a claim that the 2/9/22 Transparency Report is defamatory, nor can it be considered the source of Plaintiffs’ damages because it would not have been considered by anyone before they cut ties with Plaintiff. However, publications on Defendants’ website are “refreshed” and repeated with each later publication. Thus, the 2/9/22 Transparency Report is repeated in the 7/28/22 Transparency Report and therefore, can, and conceivably were, read together. Dkt. 37, Ex. 1 at 4-6. Plaintiffs
allege both these publications exacted devasting damages on their business dealings. For example, Plaintiffs allege that in February 2022, after publication of Plaintiffs’ ban, Black Hat also banned Plaintiffs from its conference where, Plaintiffs had received significant monetary compensation for teaching classes. Plaintiff also allege they were damaged after publication of the January 13, 2023 Update and that as of the filing of the Complaint, the defamatory publications can still be seen on Defendants’ website, which has over 400,000 followers. 2. 1/13/23 Update In the January 13, 2023 Update, Defendants state that during their investigation, they “spoke directly with Mr. Hadnagy about claims of his violations of our Code of Conduct. He confirmed his behavior and agreed to stop. Unfortunately, the behavior did not stop.” Dkt. 37, Ex. 3. Defendants argue nothing in the Update is defamatory and because the language does not refer to sexual conduct or gender identifiers, it cannot reasonably be inferred Plaintiffs’ ban from
the Event was the result of sexual misconduct. This ignores Plaintiffs’ allegations that the Update contains demonstrably false statements because Defendants refused to meet with Plaintiff Hadnagy and provide Plaintiff Hadnagy with information regarding the alleged “behavior”; perpetrators of rumors and online comments interpreted the ban was the result of sexual misconduct (i.e. referring to Plaintiff Hadnagy as the ‘Harvey Weinstein of the infosec community’); and publication of the false statements damaged Plaintiffs’ business dealings. This also ignores the plain implication of the statements in the Update, i.e., that Plaintiff Hadnagy confirmed and admitted to committing acts that were so egregious, he had to be banned from the Event for the rest of his life – all statements Plaintiffs allege are demonstrably false. 3. Allegations Regarding Black Hat
Plaintiffs allege they were regular participants at Black Hat’s annual 6-day cybersecurity conference in Las Vegas, where Plaintiffs conducted classes for “significant monetary compensation, sometimes reaching into the six-figure range.” Dkt. 1-1, ¶ 5. In February of 2022, Black Hat issued a ban of Plaintiffs from Black Hat’s conference, “specifically in light of Defendants’ publishing of the ‘Transparency Report’ and the online aftermath.” Id. ¶76. Plaintiffs further allege, on information and belief, that Defendant Moss, who is also a director of Black Hat, published false and defamatory statements, purportedly based on an investigation and evidence, to representatives of Black Hat to convince them to ban Plaintiffs from the Black Hat conference. Id. ¶78. These allegedly false and defamatory statements include that Plaintiff Hadnagy perpetrated repeated severe and repugnant sexual harassment against various victims, Plaintiff Hadnagy admitted to perpetrating this harassment, and agreed to stop. (Referred to in Plaintiffs’ Complaint as “Injurious Falsehoods”). Plaintiffs allege that because of these Injurious Falsehoods, coupled with publication of the 2/9/22 Transparency Report and
1/13/23 Update, Black Hat removed Plaintiff Hadnagy from its prestigious Review Board and banned Plaintiffs from the Black Hat Convention. Id. ¶¶78-80. Plaintiffs allege facts sufficient to raise an inference that Defendant Moss, through his involvement in both Def Con and Black Hat, was involved in banning Plaintiffs from both events in the same month. However, the allegations of additional Injurious Falsehoods are without plausible factual content. To proceed on a claim of defamation, Plaintiffs must plausibly plead the alleged “false and defamatory” statements, i.e., to whom, when, and where these statements were made. In conclusion, the Court concludes Plaintiffs have sufficiently stated claims of defamation based on Defendants’ publications of the 2/9/22 Transparency Report and the
1/13/23 Update on Def Con’s website. The Court grants Defendants’ motion to dismiss Plaintiffs’ claims of “Injurious Falsehoods” by Defendant Moss to Black Hat representatives but also grants Plaintiffs leave to amend the Complaint to plead additional factual allegations to support this claim. D. Business Disparagement Claim Plaintiffs allege that Defendants’ disparaging remarks were intended to destroy Plaintiffs’ reputations, which are paramount in the information security industry. Dkt. 1-1, Compl. ¶¶ 81, 88. Plaintiffs also allege Defendant Moss spread additional false and defamatory statements to Black Hat (i.e., racially discriminatory employment practices and a gender-based hostile work environment (See id., ¶ 76). As explained above as to the Injurious Falsehoods, the “additional” defamatory allegations are not properly plead as there are no facts explaining when, what, and to whom the additional defamatory statements were made. A statement may be published in circumstances that disparage the quality of the product
and at the same time imply the owner or vendor is dishonest, fraudulent, or incompetent, thus affecting the owner or vendor’s business reputation. In such circumstances, an action may be brought for defamation as well as for disparagement. Waechter v. Carnation Co., 5 Wash.App. 121, 126–27, 485 P.2d 1000 (1971). Here, the alleged defamatory statements are directed toward Plaintiff Hadnagy’s behavior and any damage to Plaintiffs’ business interests flows directly from that defamation. Although Plaintiffs believe and allege Defendants published the defamatory statements about Plaintiff Hadnagy with the intent to harm Plaintiffs’ reputation, there are no allegations that Defendants disparaged the quality of Plaintiffs’ products or services, i.e. Plaintiffs’ expertise in the tech industry – human error and the threat it poses to information security as well as the application of scientifically proven methodologies to uncover
vulnerabilities, define risk, and provide remediation. Dkt. 1-1, ¶ 47. Thus, Defendants’ motion to dismiss Plaintiffs’ disparagement claim is granted. E. Tortious Interference with Contractual Relations To establish a cause of action for intentional interference with contractual relations, a plaintiff must demonstrate: (1) the existence of a valid contract between the plaintiff and a third party; (2) the defendant's knowledge of that contract; (3) the defendant's intentional acts designed to induce a breach or disruption of the contractual relationship; (4) actual breach or disruption of the contractual relationship; and (5) resulting damage. MP Med. Inc. v. Wegman, 151 Wash. App. 409, 425 (2009). Plaintiffs allege that, prior to February 9, 2022, they had entered into several long-term agreements for the provision of cybersecurity and IT services for various large national corporations and law enforcement agencies, including Black Hat; defendants were aware of the agreements; and many clients terminated their agreements based on the “Injurious Falsehoods”.
Plaintiffs fail to state a plausible claim for tortious interference with contractual relationships as they have failed to identify the existence of any valid contract in place at the time the alleged defamation occurred. For example, Plaintiffs allege they enjoyed lucrative annual contracts with Black Hat for training services at Black Hat’s annual convention (Dkt. 1-1, Compl. ¶¶ 75, 136-137) but do not allege they had a valid and existing contract with Black Hat as of February 9, 2022, when the first alleged defamatory publication was made. Plaintiffs also allege that “multiple of Plaintiffs’ clients” terminated their agreements with Plaintiffs and cited to the Injurious Falsehoods as the reason they were voiding the business agreements. Id., ¶ 135. However, Plaintiffs do not identify any clients or any existing contracts. In addition, and to the extent Plaintiffs rely on the “Injurious Falsehoods” as the reason valid and existing contracts
were terminated, Plaintiffs have failed to properly plead those “Injurious Falsehoods”. Accordingly, the Court grants Defendants’ motion to dismiss Plaintiffs’ claim for tortious interference with contractual relationships, with leave to amend for Plaintiffs to properly identify existing contracts breached or disrupted because of Defendants’ defamatory publications. F. Intentional Interference With Prospective Contractual Relations To maintain this tortious interference with business relations claim, Plaintiffs must establish: “(1) a prospective contractual relationship between the plaintiff and a third party; (2) the defendant’s knowledge of this prospective relationship; (3) the intent to harm the plaintiff by preventing this relationship; (4) the absence of privilege or justification by the defendant; and (5) actual harm to the plaintiff as a result.” Bombardier Inc. v. Mitsubishi Aircraft Corp., 383 F. Supp. 3d 1169, 1188 (W.D. Wash. 2019) (citing Evergreen Moneysource Mortg. Co. v. Shannon, 167 Wash.App. 242, 274 P.3d 375, 383 (2012) (citing Pleas v. City of Seattle, 112 Wash.2d 794, 774 P.2d 1158, 1161 (1989)). Plaintiffs have failed to plausibly plead allegations to support this
claim. Plaintiffs allege they had been in negotiations with “multiple corporations and government organizations for prospective provision of cybersecurity and related services in conjunction with business activities and operations.” Dkt. 1-1, Compl. ¶ 145. Plaintiffs also allege Defendants spread the “Injurious Falsehoods” to Black Hat representatives to prevent Plaintiffs from continuing to negotiate their annual teaching instructor agreements at the Black Hat conference. As to the multiple corporations and government organizations, Plaintiffs’ allegations are insufficient to state a claim for tortious interference with a business expectancy as Plaintiffs do not identify any third party with whom they had a prospective contractual relationship. Although
an enforceable contract is not required to support a tortious interference action, there must be a relationship between parties contemplating a contract, with at least a reasonable expectancy of fruition. Broten v. May, 49 Wash.App. 564, 744 P.2d 1085, 1088 (1987). As to the Black Hat annual teaching instructor agreement, Plaintiffs allege Defendant Moss intentionally interfered with this prospective agreement by spreading the Injurious Falsehoods, which have not been properly plead. Plaintiffs rely on Motogolf.com, LLC v. Top Shelf Golf, LLC, 528 F. Supp. 3d 1168 (D. Nev. 2021) for the proposition they can allege a “certain class” of prospective customers without identifying them specifically. See Dkt. 39 at 20. In Motogolf.com, however, the court predicted the Supreme Court of Nevada would allow a plaintiff to allege a “certain class of prospective customers without identifying them specifically” when the defendant’s alleged wrongdoing had prevented those customers from learning of the plaintiff’s existence. See id. This does not alleviate Plaintiffs’ burden to identify the specific, known persons or entities with whom they
were allegedly negotiating. The Court grants Defendants’ motion to dismiss Plaintiffs’ claim for tortious interference with prospective business relationships, but grants Plaintiffs leave to amend their Complaint to identify the third party or parties with whom they had prospective business arrangements and allege facts supporting each element of this claim. G. Unjust Enrichment, Quantum Meruit, and Injunctive Relief Claims 1. Unjust Enrichment “Unjust enrichment is the method of recovery for the value of the benefit retained absent any contractual relationship because notions of fairness and justice require it.” Young v. Young, 164 Wash.2d 477, 484, 191 P.3d 1258 (2008). A claim for unjust enrichment consists of three
elements: (1) plaintiff conferred a benefit upon the defendant, (2) the defendant had knowledge or appreciation of the benefit, and (3) the defendant’s acceptance or retention of the benefit without payment of its value is inequitable under the circumstances. See Young, 164 Wash.2d at 484, 191 P.3d 1258 (quoting Bailie Commc'ns, Ltd. v. Trend Bus. Sys., Inc., 61 Wash.App. 151, 159–60, 810 P.2d 12, 814 P.2d 699, review denied, 117 Wash.2d 1029, 820 P.2d 511 (1991)). Plaintiffs argue their claim of unjust enrichment seeks payment for allegedly growing the Event, instead of rendering services at the Event. Dkt. 39 at 21:22–23. However, for an enrichment to be inequitable to retain, the person conferring the benefit must have a reasonable expectation of payment and the circumstances are such that equity and good conscience require payment for the conferred benefit. Plaintiffs do not allege Defendants induced them to provide the alleged benefits — the creation of the SEVillage (and associated capture-the-flag event) and “investing substantial resources” into the Event — or promised any kind of payment to Defendants for doing so. See Compl. ¶¶ 159–66. In fact, after Defendants rebuffed Plaintiffs’
requests for payment requests in 2012, Plaintiffs continued to provide the SEVillage at the Event for years. Compare Compl. ¶¶ 50, 163 (Defendants rejected Mr. Hadnagy’s requests for payment but changed Event rules in 2012 to allow Mr. Hadnagy to start accepting third-party sponsorship compensation), with id. ¶¶ 45, 46, 58 (Mr. Hadnagy hosted the SEVillage in person or virtually from 2010 to 2022). Therefore, Plaintiffs could have no “reasonable” expectation of payment. Plaintiffs also allege they derived significant benefit from their involvement in the Event, including “a lot of attention, exposure, and income from Sponsorships during the operation of the SEVillage” (Dkt. 1-1, ¶ 50); the generation of “a considerable portion of Plaintiffs’ business agreements . . . through their operation of the SEVillage” (id. ¶ 133); hosting a standalone social engineering convention in 2020 due to “the overwhelmingly positive feedback over the years at
SEVillage” (id. ¶ 52); and even procuring a personal meeting with the director of the National Security Agency (id. ¶ 47). Based on these allegations, the Court concludes Plaintiffs have failed to state a plausible claim for unjust enrichment and grant Defendants’ motion to dismiss this claim. 2. Quantum Meruit Quantum meruit is a specific equitable theory that falls within the broader category of “unjust enrichment.” Young v. Young, 164 Wash.2d 477, 486, 191 P.3d 1258 (2008). Washington law distinguishes between quantum meruit claims and unjust enrichment claims. Young, 164 Wash.2d at 484–85, 191 P.3d 1258. Unjust enrichment refers to a method of recovery when, without any direct contractual relationship between parties, one party retains a benefit it has not paid for. Id. at 484, 191 P.3d 1258. Quantum meruit is a more specific subcategory of unjust enrichment requiring a contract implied in fact between parties: The parties must show a “mutual intention ... to contract with each other.” Id. at 485, 191 P.3d 1258. Though the two concepts
have slightly different labels, both refer to the same general type of relief. The concept of quantum meruit arises in two contexts: contract and restitution. In an action based on a contract implied-in-fact (i.e., when the parties intended to contract and promises were exchanged, the general obligations for which must be sufficiently clear), quantum meruit may be employed as a gap filler to supply absent terms. Aegean Mar. Petroleum S.A. v. KAVO Platanos M/V, 646 F. Supp. 3d 1347, 1358 (W.D. Wash. 2022). Quantum meruit may also provide restitution for unjust enrichment. Id. In this context, quantum meruit imposes liability for the market value of services as a remedy for unjust enrichment. Id. (citing Certified Fire Prot. Inc., 128 Nev. at 380–81). The plaintiff must establish each element of unjust enrichment to demonstrate entitlement to the remedy of quantum meruit. Id. at 1107 n.4.
Plaintiffs have not plead an implied-in-fact contract. There are no allegations the parties intended to contract, exchanged promises, or created sufficient clear obligations pursuant to promises to contract. Further, because Plaintiffs’ unjust enrichment claim fails (as discussed above), quantum meruit’s application as a remedy for unjust enrichment also fails. 3. Injunctive Relief Claim Injunctive relief is a remedy, not a separate cause of action. Iliescu, Tr. of John Iliescu, Jr. & Sonnia Iliescu 1992 Fam. Tr. v. Reg’l Transp. Comm’n of Washoe Cnty., 522 P.3d 453, 457 (2022) (upholding dismissal of injunctive relief as an independent cause of action and collecting cases); McKee v. Gen. Motors Co., 601 F. Supp. 3d 901, 910 (W.D. Wash. 2022), aff’d, 2023 WL 7318690 (9th Cir. Nov. 7, 2023). Plaintiffs do not dispute that injunctive relief is a remedy, not a separate cause of action. Dkt. 37 at 36:5–11. Based on the foregoing, the Court grants Defendants’ motion to dismiss Plaintiffs’ claims of unjust enrichment, quantum meruit, and injunctive relief.
Accordingly, it is ORDERED: 1. Defendants’ motion to dismiss Plaintiffs’ Alter Ego, Business Disparagement; Unjust Enrichment, Quantum Meruit, and Injunction claims is GRANTED and these claims are dismissed.
2. Defendants’ motion to dismiss Plaintiffs’ Defamation claims as to the 2/9/22 Transparency Report and the 1/13/23 Update is DENIED. 3. Defendants’ motion to dismiss Plaintiffs’ Defamation Claim (as to “Injurious Falsehoods” by Defendant Moss); and Tortious Interference with Contractual Relations and Prospective Business Relations Claims is GRANTED, with leave to amend.
4. Plaintiffs may file an Amended Complaint consistent with this Order on or before April 22, 2024. DATED this 28th day of March, 2024. A BRIAN A. TSUCHIDA United States Magistrate Judge