Star social engineer dubbed the ‘human hacker’ sues Def Con after claiming permanent ban constitutes ‘irreversible damage’ to his reputation

You file a lawsuit and take the organizers to court, right? 

That was the answer social engineer and self-described “human hacker” Christopher Hadnagy reached for to defend himself against what he is calling defamation after Def Con, revoked his ability to attend its annual summer event, citing breaches in the code of conduct.

Described as a “master practitioner of understanding human behavior,” Hadnagy claims to provide people the tools they need to establish a rapport with strangers using body language and verbal cues, or if need be elicit their support. 

The ban is all the more unusual given that Hadnagy’s social engineering village drew crowds. It included tips on how to extract information under the theme “get anyone to tell you anything.”

Yet organizers said in February they had received multiple reports of Hadnagy violating Def Con’s code of conduct at last year’s convention.

Following conversations with all parties, it was “confident the severity of the transgressions merits a ban.”

Conference rules are brief and simple—they specifically prohibit harassment against any participant for any reason. According to the code, this extends to any behavior that makes others feel uncomfortable, unsafe, afraid, or unwelcome. 

Organizers have taken steps to make more people feel included, such as providing relief areas for the service animals of disabled hackers and making menstrual products available in all restrooms regardless of gender. 

“It’s not about what you look like, but what’s in your mind and how you present yourself that counts,” according to the Def Con code of conduct. 

Reached by The Verge, Hadnagy denied “any and all allegations of misconduct” in an emailed statement.

He is now suing both the company behind Def Con as well as its chief organizer, Jeff Moss, who goes by the name The Dark Tangent.

In his lawsuit, Hadnagy alleges organizers inflicted “severe and irreversible harm” and “exposed him to public ridicule.”

Moreover, he argues Def Con and Moss intentionally fabricated the allegations in order to replace at this year’s conference, held earlier this month, his company’s social engineering village with that of its own.

“These statements have created a shroud of scandal over [Hadnagy‘s] company thus harming its relationships with longstanding clientele and future business projects,” his suit claims.

Perhaps because it is unclear what precisely is being alleged, the author of a cybersecurity career guide believes the lawsuit may serve an ulterior motive—discovery. 

“This is about CH trying to force the names and full details of his accusers into the public sphere so he can go after them, attack them and try to discredit them,” wrote Alyssa Miller.   

Interestingsly, Hadnagy himself defines social engineering as “any act that influences a person to take an action that may or may not be in their best interest.” 

That would suggest that regardless of who holds them there is an inherent risk social engineering workshops can result in people feeling uncomfortable or unsafe, and therefore be in violation of Def Con’s code of conduct.