Hadnagy v. Moss
| Decision Date | 05 January 2023 |
| Docket Number | Civil Action 22-3060 |
| Parties | CHRISTOPHER J. HADNAGY Individually and on behalf of SOCIAL ENGINEER, LLC, Plaintiffs, v. JEFF MOSS and DEF CON COMMUNICATIONS, INC., Defendants. |
| Court | U.S. District Court — Eastern District of Pennsylvania |
This suit revolves around Defendants' publication of a so called “Transparency Report” on their website which Plaintiff Christopher Hadnagy, individually and on behalf of SocialEngineer LLC, argues is anything but. Plaintiffs sued Jeff Moss and DEF CON Communications, Inc. bringing Defamation, Intentional Interference with Contractual Relations, Invasion of Privacy/False Light, and Intentional Infliction of Emotional Distress claims. Pursuant to Federal Rule of Civil Procedure 12(b)(2), Defendants have moved to dismiss the Complaint on the basis that this Court has no jurisdiction. In the alternative, Defendants move for dismissal for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). For the reasons that follow Defendants' motion to dismiss for lack of personal jurisdiction will be granted. Accordingly, their motion under Rule 12(b)(6) will not be addressed. Plaintiffs' requests for jurisdictional discovery and to amend will, for the reasons below, be denied.
DEF CON conducts an annual hacker conference in Las Vegas, Nevada. This conference is one of the world's largest hacker conventions, and typically hosts professionals to speak about IT and hacking-related subjects. It hosts break-out sessions, or “villages”, which invite smaller groups of attendees to participate in, for instance, cyber-security challenges, games, or demonstrations. Moss and DEF CON held the first conference in 1993 and every year since it has grown in size. It is now highly regarded in the tech industry. While DEF CON, through its website, promotes “open discussion between participants, where radical viewpoints are welcome and a high degree of skepticism is expected” it also (as of 2015) posted on its website a Code of Conduct which states, in relevant part,
For years, Plaintiffs Hadnagy and Social-Engineer participated in the conference and hosted one of the most attended villages, the SEVillage-focused on Hadnagy's expertise: human error and the threat it poses to information security as well as applying scientifically proven methods to uncover vulnerabilities, define risk, and provide remediation-which hosted a hacking competition where teams attempt to attack and defend computers or networks.
Although the village was so popular that it had required a 13,000 square foot space to accommodate all those who wished to participate, Plaintiffs chose not to participate in the August 2021 conference. Then, in or around January 2022, Defendants informed Hadnagy that neither he nor Social-Engineer could attend, contribute to, or participate at future conferences. The reasons given were violations of DEF CON's Code of Conduct. Plaintiffs deny any such violation and repeatedly requested additional, detailed information regarding the alleged violations, but were ignored.
Then, on or around February 9, 2022, Moss and DEF CON published an announcement, termed the “Transparency Report”, on the DEF CON website stating, This Transparency Report was publicly accessible on the Internet throughout the United States and abroad. A firestorm on social media followed its publication speculating as to what Hadnagy had done including that he perpetrated sexual assault and/or sexual harassment. Others assumed that Hadnagy's behavior must have been abhorrent because the conference typically condones extreme or unique behavior. On February 10, 2022, an article titled “DEF CON bans social engineering expert Chris Hadnagy” was published on TechTarget.com, a renowned and well-known news source in the tech community. Plaintiffs' Complaint alleges that the Transparency Report damaged Hadnagy's reputation and negatively impacted Social-Engineer's business. One of Plaintiffs' leading clients, Northern Trust Corporation, among others, refused to work with Plaintiffs following the publication of the Transparency Report, and specifically referenced the Transparency Report in refusing to work with them.
Federal Rule of Civil Procedure 12(b)(2) provides that a party may seek dismissal of a complaint for lack of personal jurisdiction. If a defendant so moves, the court “must accept all of the plaintiff's allegations as true and construe disputed facts in favor of the plaintiff.” Carteret Sav. Bank, F.A. v. Shushan, 954 F.2d 141, 142 n.1 (3d Cir. 1992). Legal conclusions by a plaintiff that “are no more than conclusions [and] are not entitled to the assumption of truth.” Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). The burden of proof to establish personal jurisdiction is on the plaintiff. D'Jamoos ex rel. Est. of Weingeroff v. Pilatus Aircraft Ltd., 566 F.3d 94, 102 (3d Cir. 2009) (“D'Jamoos”).
The allegations found in the Complaint which are relevant to a personal jurisdiction analysis are: the parties presumed citizenship and principal places of business; that Defendants solicited Plaintiffs to participate in the conference, the Transparency Report; that the DEF CON website was accessible throughout the U.S. and abroad; that the DEF CON conference is one of the world's largest and is highly regarded in Plaintiffs' industry; and, that Plaintiffs suffered negative effects following the Transparency Report.
Here, both parties make frequent reference to the DEF CON website (https://defcon.org/), specifically the Transparency Report and Code of Conduct pages. Plaintiffs' Complaint quotes and hyperlinks to website pages on multiple occasions, while Defendants attach as an exhibit to their Motion to Dismiss screenshots of the Transparency Report and Code of Conduct pages from the DEF CON website.
“To decide a motion to dismiss, courts generally consider only the allegations contained in the complaint, exhibits attached to the complaint and matters of public record.” Pension Ben. Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993). “[A] court may [also] consider an undisputedly authentic document that a defendant attaches as an exhibit to a motion to dismiss if the plaintiff's claims are based on the document.” Id. Defendant's attached screenshots of the Transparency Report and Code of Conduct to their Motion to Dismiss. Neither party raise concerns about these screenshots and Plaintiffs' claims are based, in part, on these webpages. Accordingly, Defendants' exhibits to their motion to dismiss will be evaluated in deciding this motion.
Separately, Plaintiffs ask the Court to consider additional allegations which they set forth in their response to Defendant's motion to dismiss but which are not found in their Complaint. Specifically, they state for the first time in their Response that similar lifelong bans from DEF CON were the result of sexual abuse or predatory behavior, that the conference's success is the direct result of Plaintiffs' SEVillage, and that there were DEF CON groups in Pennsylvania. These facts will not be considered in deciding the motion to dismiss because “[a] party may not rely on new facts in submissions in response to a motion to dismiss to defeat the motion.” Hammond v. City of Phila., 2001 WL 823637, at *2 (E.D. Pa. June 29, 2001). Indeed, “it is axiomatic that the complaint may not be amended by the briefs in opposition to a motion to dismiss.” Com. of Pa. ex rel. Zimmerman v. PepsiCo, Inc., 836 F.2d 173, 181 (3d Cir. 1988) (internal citations omitted). As these facts were not averred in the Complaint, they have no import here.
Personal jurisdiction may be either general or specific. Remick v. Manfredy, 238 F.3d 248, 255 (3d Cir. 2001).[2]Here, Plaintiffs concede that this Court does not have general jurisdiction over Defendants. They do, however, maintain that they have adequately pled sufficient facts to support the Court's exercise of specific jurisdiction over Defendants because of Defendants' forum-specific activities.
According to Federal Rule of Civil Procedure 4(e), “a district court may assert personal jurisdiction over non-resident defendants to the extent permissible under the law of the state where the district court sits.” Remick, 238 F.3d at 255 (internal quotations omitted).
Pennsylvania's jurisdictional statute permits the “exercise [of ]personal jurisdiction over nonresident defendants to the constitutional limits of the [D]ue [P]rocess [C]lause of the [F]ourteenth [A]mendment.” Mellon Bank (E.) PSFS Nat. Ass'n v. Farino, 960 F.2d 1217, 1221 (3d Cir. 1992) (“Mellon Bank”). A forum is able to assert specific jurisdiction over an out-ofstate defendant, who has not consented to suit there, if: 1) “the defendant has ‘purposefully directed' his activities at residents of the forum.” Burger King Corp. v. Rudzewicz, 471 U.S. 462, 472 (1985) (citing Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 774 (1984)) (“Burger King”); see also Miller Yacht Sales, Inc. v. Smith, 384 F.3d 93, 96 (3d Cir. 2004); 2) there is an “affiliation between the forum and the underlying controversy, principally, [an] activity or an...
To continue reading
Request your trial