Hadnagy v. Moss

— 1 — — 2 — — 3 — — 4 — 5 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 6 AT SEATTLE — 7 — CHRISTOPHER J HADNAGY, SOCIAL ENGINEER LLC, 8 CASE NO. 2:23-cv-01932-BAT Plaintiffs, 9 ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANTS’ 10 MOTION TO DISMISS JEFF MOSS, DEF CON 11 COMMUNICATIONS INC, 12 Defendants. 13 Defendants Jeff Moss (“Moss”) and Def Con Communications, Inc. (“Def Con”) move to 14 dismiss the Complaint of Plaintiffs Christopher J. Hadnagy (“Hadnagy) and Social-Engineer 15 LLC (“Social-Engineer”). Dkt. 37. Plaintiffs assert seven causes of action against Defendants. 16 Dkt. 1-1. 17 For the reasons stated herein, the Court grants Defendants’ motion to dismiss Plaintiffs’ 18 claims of Alter Ego, Business Disparagement; Unjust Enrichment, Quantum Meruit, and 19 Injunction; denies Defendants’ motion to dismiss Plaintiffs’ Defamation claims (2/9/22 20 Transparency Report and 1/13/23 Update); and grants Defendants’ motion to dismiss, with 21 leave to amend, Plaintiffs’ claims of Defamation (“Injurious Falsehoods” by Defendant Moss); 22 Tortious Interference with Contractual Relations; and Prospective Business Relations. — 23 — 1 FACTUAL AND PROCEDURAL BACKGROUND 2 A. Plaintiffs’ Allegations – Dkt. 1-1 Complaint 3 Defendants Moss and Def Con have held an annual hacker conference in Las Vegas, 4 Nevada (the “Event”) in August for the past thirty years. Dkt. 1-1 ¶¶ 32–36. The Event is one of 5 the largest, is highly regarded in the industry, and is attended by members of law enforcement 6 agencies and large corporations. Id. ¶¶ 37-38. In 2025, Def Con implemented an Event Code of 7 Conduct (“Code of Conduct”). Dkt. 1-1, ¶ 60 (Dkt. 37, Ex. 1). The Code of Conduct prohibits 8 “harassment,” which includes “deliberate intimidation and targeting individuals in a manner that 9 makes them feel uncomfortable, unwelcome, or afraid.” Id. The Code of Conduct applies to 10 “everyone,” and Def Con reserves the “right to respond to harassment in the manner we deem 11 appropriate, including but not limited to expulsion.” Id. In 2017, Def Con began to publicly share 12 a summary of incidents which occurred at the Event for a given year (the “Transparency 13 Report”). 14 The Event hosts a multitude of “villages,” inviting smaller groups of attendees to 15 participate in cybersecurity challenges and demonstrations related to different topics. Id. ¶ 40. In 16 the past, Plaintiff Hadnagy hosted a village focused on social engineering (the “SEVillage”). Id. 17 ¶¶ 45–46. In January 2022, Def Con informed Plaintiff Hadnagy that he could no longer attend 18 the Event based on reported violations of the Code of Conduct. Id. ¶¶ 58–59. On February 9, 19 2022, Def Con published a Transparency Report announcing Plaintiffs’ ban from future Events: 20 We received multiple [Code of Conduct] reports about a DEF CON Village leader, Chris Hadnagy of the SE Village. After conversations with the reporting 21 parties and Chris, we are confident the severity of the transgressions merits a ban from DEF CON. — 22 — — 23 — 1 Id. ¶ 58 (the “2/9/22 Transparency Report”).1 On July 28, 2022, Defendants published an 2 Updated Transparency Report explaining treatment of Code of Conduct violations, including 3 meeting with parties, witnesses, and victims; reviewing evidence; and determining permanent 4 bans for repeat offenders and egregious offenses. Defendants based their safeguards on 5 recommendations from the National Network to End Domestic Violence and the Violence 6 Against Women Office at the US Department of Justice. Dkt. 37, Ex. 2 at 2-4 (7/28/22 Update). 7 Plaintiffs deny violating the Code of Conduct, meeting or discussing allegations of code 8 violations with Defendants, and alleges Defendant Moss ignored his attempts to meet and 9 provided no reason for the lifetime ban. Dkt. 1-1, ¶ 61, ¶ 62. Defendants ignited a firestorm 10 within the information technology and security communities across social media platforms and 11 prominent media outlets after posting the Transparency Report. These outlets quoted Defendants' 12 statements and asserted Plaintiff Hadnagy was a sexual predator. Id. ¶ 66-72. 13 Defendants were aware that presenting the Transparency Report would lead the public to 14 understand it in this manner as Defendants’ past lifetime bans were exclusively due to extreme 15 sexually predatory behavior. Dkt. 1-1, Compl. ¶¶ 100-101, 103-104, 107-108. False rumors 16 about Plaintiff Hadnagy spread rapidly, tarnished his reputation, and he was likened to the 17 “Harvey Weinstein” of the information security industry in a public post. Id. ¶ 108. 18 In January 2023, Plaintiffs sued Defendants in the Eastern District of Pennsylvania. 19 Following dismissal of that lawsuit for lack of personal jurisdiction, Defendant Moss published 20 an update to Def Con’s website (the “Update”): 21 “During our investigation we spoke directly with Mr. Hadnagy about claims of his violations of our Code of Conduct. He confirmed his behavior and agreed to 22 stop. Unfortunately, the behavior did not stop […] Our investigation also revealed — 23 — 1 Defendants refer to this publication as the Ban Announcement. 1 that DEF CON is not the only security conference to receive complaints about Mr. Hadnagy’s behavior. For example, Black Hat received complaints, conducted 2 their own investigation, and removed Mr. Hadnagy from their Review Board.” 3 Id. ¶¶ 80, 98. Plaintiff Hadnagy denies Defendants ever spoke with him about the alleged Code 4 violations and he never “confirmed his behavior.” Id. ¶¶ 61-62, 84. Most of Plaintiffs’ business 5 associates in Las Vegas, including Black Hat, terminated their contracts with Plaintiffs based on 6 Defendants’ statements in the Transparency Report. Id., Compl. ¶¶ 42-43; ¶¶ 73-76. Defendant 7 Moss published these statements (and additional statements that Plaintiff’s employment practices 8 were racially discriminatory and fostered a hostile work environment based on gender) in private 9 to “other industry leaders who host similar annual conventions in Las Vegas, Nevada, including 10 the organizers of Black Hat.” Id. ¶ 113. 11 Around February of 2022, Black Hat representatives issued a ban of Plaintiffs from Black 12 Hat’s conference, citing Defendants’ Transparency Report. Dkt. 1-1, Compl. ¶¶ 73-76. Black 13 Hat’s website lists Defendant Moss as a director of Black Hat. Id., ¶ 77. Defendant Moss 14 continued to make disparaging and false statements to other Black Hat representatives, including 15 allegations that Plaintiff Hadnagy perpetrated repeated sexual harassment and admitted to these 16 acts. Id. ¶¶ 78-79. Defendant Moss intended to “entangle Plaintiffs in controversy and thwart 17 Plaintiffs’ efforts to conduct a standalone version of the SEVillage, and benefit from Plaintiffs’ 18 SEVillage by using a replica village (the “Social Engineering Community Village”) meant to 19 attract the same audience and goodwill Plaintiffs had cultivated for years. Id. ¶¶ 94, 140. 20 B. Procedural History 21 Plaintiffs sued Defendants in the Eastern District of Pennsylvania, and on January 5, 22 2023, Judge Wendy Beetlestone dismissed the case for lack of personal jurisdiction. See 23 Hadnagy v. Moss, No. CV 22-3060, 2023 WL 114689 (E.D. Pa. Jan. 5, 2023). 1 On August 9, 2023, Plaintiffs filed a Complaint in the Eighth Judicial District Court, 2 Clark County, Nevada. See Christopher J. Hadnagy et al. v. Jeff Moss et al., Case No. A-233 875618-C. Defendants removed the action to the Federal District Court of Nevada on August 29, 4 2023 (Dkt. 1) and thereafter, filed a motion to dismiss, or in the alternative, a motion to transfer 5 venue to the Western District of Washington. Dkt. 15. Judge Cristina D. Silva granted the motion 6 to transfer venue to this Court and did not reach the merits of Defendants’ motion to dismiss. 7 Dkt. 21 at 1, n.1 (“Transfer Order”). 8 LEGAL STANDARD 9 Under Rule 12(b)(6), a court conducts a two-step inquiry to test the legal sufficiency of 10 the complaint. First, well-pleaded facts are accepted as true, while mere legal conclusions may 11 be disregarded. Ashcroft v. Iqbal, 556 U.S. 662 , 678–79 (2009). Second, once the well-pleaded 12 factual allegations have been isolated, the court must determine whether they are sufficient to 13 show a “plausible claim for relief.” Id. at 679 . A claim “has facial plausibility when the plaintiff 14 pleads factual content that allows the court to draw the reasonable inference that the defendant is 15 liable for the misconduct alleged.” Id. at 678 . If a motion to dismiss is granted, a court should 16 normally grant leave to amend unless it determines the pleading cannot not possibly be cured by 17 allegations of other facts. Cook, Perkiss & Liehe v. N. Cal. Collection Serv., 911 F.2d 242 , 247 18 (9th Cir.1990). 19 In deciding a motion to dismiss, courts generally consider only the allegations contained 20 in the complaint, exhibits attached to the complaint, and matters of public record. Courts may not 21 consider additional facts alleged in opposition to a motion to dismiss. See Schneider v. California 22 Dep't of Corrections, 151 F.3d 1194 , 1197 n. 1 (9th Cir. 1998). — 23 — 1 A court may consider a document whose contents are alleged in a complaint, so long as 2 no party disputes its authenticity. See Branch v. Tunnell, 14 F.3d 449, 453 (9th Cir. 1994), 3 overruled on other grounds by Galbraith v. County of Santa Clara, 307 F.3d 1119 (9th Cir. 4 2002).” Attached to Defendants’ motion to dismiss as Exhibits 1, 2, and 3 are the Code of 5 Conduct, Transparency Reports, and Update. Neither party raises concerns about these exhibits 6 and Plaintiffs’ claims are based on these exhibits. Thus, the Court has considered the exhibits in 7 determining this motion. 8 DISCUSSION 9 A. Personal Jurisdiction and Applicable Law 10 Following a transfer under 28 U.S.C. § 1404 (a), the Court would ordinarily apply the law 11 of the transferor court. See, Van Dusen v. Barrack, 376 U.S. 612, 639 (1964). Where the 12 transferor court lacked personal jurisdiction over the defendant, however, the transferee court 13 must apply its own law regardless of whether the transfer is based on Section 1404(a) or Section 14 1406(a). See Nelson v. Int’l Paint Co., 716 F.2d 640 , 643–44 (9th Cir. 1983); Intertex, Inc. v. 15 Dri-Eaz Prod., Inc., No. C13-165-RSM, 2013 WL 2635028 , at *2 (W.D. Wash. June 11, 2013). 16 “While a transferor court need not have personal jurisdiction to transfer an action under § 17 1404(a), lack of personal jurisdiction precludes application of Van Dusen in the transferee 18 court.” Jaeger v. Howmedica Osteonics Corp., No. 15-CV00164-HSG, 2016 WL 520985 , at *719 8 (N.D. Cal. Feb. 10, 2016). 20 Plaintiffs contend the Nevada District Court expressly ruled that personal jurisdiction 21 existed in Nevada. This is incorrect. The Nevada District Court ruled on Defendants’ motion to 22 transfer venue and specifically did not reach the merits of Defendants’ motion to dismiss. In 23 determining whether transfer to Washington was proper, Judge Silva weighed multiple factors, 1 including familiarity with governing law and, using the most significant relationship test, 2 concluded Nevada had the most significant relationship based primarily on the parties’ 3 interaction at the Event in Nevada. Id. at 4-7. Judge Silva also noted, however, that this factor 4 “weighs slightly against transfer because “[t]he forums’ familiarity with the governing law is 5 typically to be accorded little weight on a motion to transfer venue because federal courts are 6 deemed capable of applying the substantive law of other states.” Id. at 7-8 (internal citations 7 omitted). Judge Silva did not address whether Nevada or Washington had personal jurisdiction 8 over Defendants. 9 Thus, this Court must “consider in the first instance whether personal jurisdiction 10 existed” in Nevada and which state’s law applies.2 See Jaeger, 2016 WL 520985 , at *7. Plaintiff 11 is a resident of Florida and Defendants are citizens of Washington. Thus, to establish personal 12 jurisdiction in Nevada, Plaintiffs must show Defendants purposefully directed tortious action 13 toward Plaintiffs in Nevada. Plaintiffs submit allegations of their own business dealings in 14 Nevada, but it is the Defendants’ “tortious actions” in Nevada that are relevant. 15 The parties agree the Ninth Circuit’s “purposeful direction” test for personal jurisdiction3 16 requires a plaintiff to demonstrate that the defendant (1) committed an intentional act, (2) 17 expressly aimed at the forum state, (3) causing harm the defendant knows is likely to be suffered 18 in the forum state. Freestream Aircraft (Bermuda) Ltd. v. Aero Law Grp., 905 F.3d 597, 605 (9th 19 Cir. 2018) (intentional torts, like defamation, are subject to the purposeful direction analysis). — 20 — 2 Defendants do not assert that Nevada has general jurisdiction over Defendants and in fact, none 21 of the parties are based in Nevada. 3 A purposeful availment analysis is most often used in suits sounding in contract. See, e.g., Doe — 22 — v. Unocal Corp., 248 F.3d 915, 924 (9th Cir.2001). A purposeful direction analysis, on the other hand, is most often used in suits sounding in tort. See, e.g., Dole Food Co., Inc. v. Watts, 303 23 F.3d 1104 , 1111 (9th Cir.2002). 1 The Court concludes personal jurisdiction is lacking in Nevada because Defendants did not 2 “expressly aim” their alleged tortious statements at Plaintiffs in Nevada. 3 For purposes of the personal jurisdictional analysis, an “intentional act” must be the one 4 giving rise to the tort claims at issue. See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 5 797, 806 (9th Cir. 2004) (describing the kinds of potentially tortious “intentional acts” that 6 satisfy the requirement). Here, the alleged tortious acts of Defendants are publishing the 7 Transparency Reports and Update on Def Con’s website. According to a recent Nevada District 8 Court ruling, statements posted online with the intention of being globally accessible do not 9 create personal jurisdiction in Nevada. Wealthy, Inc. v. Cornelia, 2023 WL 4803776 (D. Nev. 10 July 27, 2023). Defendants rely on this case, arguing Def Con’s “systemic” presence in Nevada 11 creates personal jurisdiction in Nevada. Dkt. 19 at 12-13. 12 In Wealthy, the plaintiff (not a resident of Nevada) sued the defendant (not a resident of 13 Nevada) for recording an allegedly defamatory YouTube video with a third person (a resident of 14 Nevada). 2023 WL 4803776 , at *3–5. The court rejected personal jurisdiction over the defendant 15 because the video was posted online with the intention of being broadcast globally, and the 16 defendant did not specifically intend the statements to harm the plaintiff in Nevada. Id. at *3. 17 Had the plaintiff been a Nevada resident, the harm would have been felt in the state, but he was 18 not. Id. at *3–4. The court declined to “exercise jurisdiction over an action where the requisite 19 nexus was the fact that several defamatory statements had a proverbial layover in Nevada as they 20 awaited global publishing on the internet.” Id. at *5. 21 Similarly, there is no personal jurisdiction here in Nevada – non-resident plaintiffs sued 22 non-resident defendants for statements published on a website with global access with nothing — 23 — 1 more than an incidental connection to Nevada.4 Plaintiff Hadnagy suggests Def Con “expressly 2 aimed” its conduct at Nevada and points to the nature and degree of interactivity of Def Con’s 3 website and geographic scope of Def Con’s economic ambitions. Dkt. 39 at 11-13. These facts 4 are outside of Plaintiffs’ complaint and moreover, are not “intentional acts” giving rise to 5 Plaintiffs’ claims. 6 Plaintiff’s also point to Defendants’ “systematic intentional acts directed at Nevada’s 7 hospitality market for over thirty consecutive years”, i.e., event space, insurance, and 8 accommodations for attendees. Plaintiffs argue Defendants’ website is “inextricably connected to 9 the Event and expressly applies to attendees of the Event in Nevada.” Here again, business 10 contacts and dealings within the State of Nevada are not the type of “intentional act” giving rise 11 to the tort claims at issue. 12 Plaintiff Hadnagy also relies on Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218 13 (9th Cir. 2011) for the proposition Defendants expressly aimed conduct at Nevada. Mavrix 14 involved an alleged copyright infringement of photographs by a celebrity gossip website where 15 the defendant made money by selling advertising space to third-party advertisers, many of which 16 targeted California residents. 647 F.3d at 1221–22. The court concluded this was part of the 17 defendant’s “continuous and deliberate exploitation” of the California market for its website, and 18 the website’s business model was core to the defendant’s profitability, which supported — 19 — 4 Plaintiffs allege Defendant Moss’s first offending comments occurred while Plaintiff Hadnagy — 20 — participated in Defcon in 2021 “virtually” (Dkt. 39, Response at 10), ostensibly while Plaintiff resided in Florida. Thereafter, Plaintiff told Defendant he would be “hosting” SEvillage at — 21 — another location and not participating in Defcon. Id. at 11. In February 2022, Plaintiff alleges Defendant issued defamatory statements against Plaintiff even though Plaintiff “did not — 22 — participate in the event [Defcon].” Id. Thus, by Plaintiff’s own admission, Defendant Moss’s statements did not occur in Nevada and were directed towards Plaintiff while he resided in — 23 — Florida. 1 jurisdiction in California. Id. The facts here are dissimilar to those in Mavrix. There is no 2 allegation or evidence the Def Con website “continuously and deliberately” exploits Nevadans 3 for commercial gain as Def Con does not sell advertising space on its website and its website 4 does not target Nevada residents with advertisements, or track visitors via IP address or 5 otherwise. Dkt. 15-1, Declaration of Jeff Moss in Support of Motion to Transfer at ¶ 6, 9. 6 Finally, Plaintiffs argue Def Con knew the harm would be caused in Nevada because it 7 “is the only place where the Event is held.” Dkt. 39 at 13. The tortious activity alleged by 8 Plaintiffs is Defendants’ publication of the Transparency Reports and Updates on Def Con’s 9 website (and additional defamatory statements made by Defendant Moss to Black Hat 10 representatives) – which publications and statements are not alleged to have occurred in the State 11 of Nevada. Defendants’ ban of Plaintiff Hadnagy and publication of the Transparency Reports is 12 presumably (although it is not entirely clear) based on Plaintiff Hadnagy’s behavior at an earlier 13 Event, which presumably occurred in Nevada. However, the alleged defamation did not occur in 14 Nevada, nor was it directed at Plaintiffs in Nevada. Plaintiff Hadnagy offers no affidavit or other 15 evidence to support his claim he was harmed in Nevada. He does not identify any Nevada16 specific contracts with which Def Con tortiously interfered and/or that Def Con was aware of 17 any such contracts. 18 A court may exercise specific jurisdiction over a defendant only where “the defendant's 19 suit-related conduct” created a substantial connection with the forum [s]tate.” Williams v. 20 Yamaha Motor Co. Ltd., 851 F.3d 1015, 1022-23 (9th Cir. 2017) (quoting Walden v. Fiore, 571 21 U.S. 277 , 284-285 (2014). Defendants’ allegedly defamatory statements on its globally 22 accessible website—were not targeted at Nevada residents, did not involve a Nevada resident, 23 did not encourage Nevada residents to read the statements, did not mention the state of Nevada, 1 and were not posted within the state of Nevada. The Court concludes there is no personal 2 jurisdiction in Nevada and therefore, applies Washington law to Plaintiffs’ claims. 3 B. Alter Ego Claims 4 Plaintiff Hadnagy alleges Mr. Moss is the alter ego of Def Con and is thus “liable for the 5 obligations, debts, and liability of Defendant DEF CON arising under this Complaint.” Dkt. 1-1, 6 ¶¶ 19–29. 7 A request to pierce the corporate veil is only a means of imposing liability for an 8 underlying cause of action and not a cause of action in and of itself. Local 159, 342, 343 & 444 9 v. Nor-Cal Plumbing, Inc., 185 F.3d 978, 985 (9th Cir. 1999). The following two elements must 10 be proven before the equitable remedy of corporate-veil piercing applies: 1) the corporate form is 11 used to violate or evade a legal obligation, and 2) corporate-veil piercing is necessary to prevent 12 a loss to an innocent party. See Chadwick Farms Owners Ass'n v. FHC, LLC, 166 Wash.2d 178 , 13 200, 207 P.3d 1251 (2009); Meisel v. M & N Modern Hydraulic Press Co., 97 Wash.2d 403 , 14 410–11, 645 P.2d 689 (1982); Washington v. Davies, 176 Wash. 100, 114 , 28 P.2d 322 (1934). 15 The first element (evasion of a legal obligation) requires “an abuse of corporate form” to 16 the abuser's benefit and to the innocent party's detriment. Meisel, 97 Wash.2d at 410 , 645 P.2d 17 689 . The second element is whether corporate-veil piercing is necessary to prevent a loss to an 18 innocent party. This element focuses on whether the innocent party was harmed by the alter-ego 19 conduct, fraud, bad faith, or other legal-responsibility-evading conduct. Meisel, 97 Wash.2d at 20 410, 645 P.2d 689 ; Morgan v. Burks, 93 Wash.2d 580, 587 , 611 P.2d 751 (1980). The corporate 21 cloak is not lightly thrown aside. Grayson v. Nordic Const. Co., 92 Wash. 2d 548, 553 (1979) 22 (absent fraud or manifest injustice, “the corporation’s separate entity should be respected”). — 23 — 1 Because “fraud is a necessary element of the alter ego doctrine” a party pleading alter ego 2 must satisfy the heightened pleading standard of Rule 9(b). A. Darino & Sons, Inc. v. Dist. 3 Council of Painters No. 33, 869 F.2d 514, 519 (9th Cir. 1989)); see also Ferrie v. Woodford 4 Rsch., LLC, No. 3:19-CV-05798-RBL, 2020 WL 3971343 , at *6 n.4, *8 (W.D. Wash. July 14, 5 2020). For such claims, “a party must state with particularity the circumstances constituting 6 fraud or mistake.” Fed. R. Civ. P. 9(b). 7 Plaintiffs repeat the elements of a veil-piercing claim and associated factors on 8 “information and belief” (see, e.g., Dkt. 1-1, ¶¶ 20-28) but fail to allege sufficient facts to state a 9 prima facie case of alter ego liability under either Rule 8(a)’s notice standard or Rule 9(b)’s 10 heightened pleading standard applicable to this claim. See Ferrie, 2020 WL 3971343 , at *8 11 (dismissing alter ego claim where the allegations are “conclusory” and “not [an] independent 12 cause[] of action”). In opposition, Plaintiffs contend the facts of fraud are within Def Con’s 13 “exclusive control.” However, Plaintiffs must still state the factual basis for their belief of 14 wrongdoing. Because alter ego is not an independent cause of action, Plaintiffs’ claim is 15 dismissed insofar as they assert a separate cause of action under this theory. 16 C. Defamation 17 “A defamation action consists of four elements: (1) a false statement, (2) publication, (3) 18 fault, and (4) damages.” Duc Tan v. Le, 177 Wash.2d 649 , 300 P.3d 356, 363 (Wash. 2013). A 19 plaintiff can allege the false statement prong by alleging facts showing that the statement is 20 provably false or “leaves a false impression due to omitted facts.” See Yeakey v. Hearst 21 Commc'ns, Inc., 156 Wash.App. 787 , 234 P.3d 332, 335 (Wash. Ct. App. 2010) (citing Mohr v. 22 Grant, 153 Wash.2d 812, 108 P.3d 768, 773 (Wash. 2005)). “Defamation by implication occurs 23 when ‘the defendant juxtaposes a series of facts so as to imply a defamatory connection between 1 them.’” Corey v. Pierce Cty., 154 Wash.App. 752 , 225 P.3d 367, 373 (Wash. Ct. App. 2010) 2 (quoting Mohr, 108 P.3d at 774 ). To proceed on a theory of defamation by implication, a 3 plaintiff must allege facts supporting all the elements of a defamation claim but may support the 4 first element by alleging that the statement is false or leaves a false impression. See id.; see also 5 U.S. Mission Corp. v. Kiro TV, Inc., 172 Wash.App. 767 , 292 P.3d 137, 141 (Wash. Ct. App. 6 2013). 7 Plaintiffs’ defamation claim is based on false statements published on Defendants’ 8 website in the 2/9/22 Transparency Report and the 1/13/23 Update, and additional statements 9 made by Defendant Moss to Black Hat representatives (“Injurious Falsehoods”). The Court 10 concludes Plaintiffs have sufficiently plead defamation as to the alleged false statements 11 published on Defendants’ website but have not done so with regard to the Injurious Falsehoods. 12 1. 2/9/22 Transparency Report. In the 2/8/22 Transparency Report, Defendants 13 announce Plaintiff Hadnagy’s lifetime ban from the Event based on receipt of multiple code of 14 conduct violations. Defendants state they spoke to the reporting parties and to Plaintiff Hadnagy, 15 and thereafter concluded the severity of Plaintiff Hadnagy’s “transgressions” merited a 16 permanent ban from Def Con. Defendants argue the statements contained in this publication are 17 mere non-actionable opinions. The Court disagrees. Defendants did not merely ban Plaintiffs 18 from the Event based on their right to associate with anyone they choose or based on an opinion. 19 Rather, Defendants clearly state they instituted the lifetime ban after receiving reports, 20 investigating reports, and confirming the severity of the reported transgressions. The omission of 21 details of the evidence and nature of the transgressions also leaves a false impression, leading to 22 the type of speculation alleged in Plaintiffs’ Complaint. Plaintiffs allege Defendants’ false 23 statements caused speculation and false rumors Plaintiff Hadnagy had committed the worst 1 sexual crimes, and that actual and potential clients began to terminate their relationships and 2 contracts with Plaintiffs following publication of the 2/9/22 Transparency Report. Plaintiffs 3 specifically point to an annual and lucrative teaching arrangement with Black Hat. 4 Plaintiffs contend the 7/28/22 Transparency Report further clarifies the defamatory 5 significance of the lifetime ban by stating: “[i]n the case of the most troubling offenses or those 6 who we feel may represent on ongoing risk to the community, we take the extra step of naming 7 them publicly.” Plaintiff Hadnagy was named publicly so the logical inference is that he is an 8 “ongoing risk to the community.” Defendants argue the 7/28/22 Transparency Report – which 9 was published months later – cannot be used to support a claim that the 2/9/22 Transparency 10 Report is defamatory, nor can it be considered the source of Plaintiffs’ damages because it would 11 not have been considered by anyone before they cut ties with Plaintiff. 12 However, publications on Defendants’ website are “refreshed” and repeated with each 13 later publication. Thus, the 2/9/22 Transparency Report is repeated in the 7/28/22 Transparency 14 Report and therefore, can, and conceivably were, read together. Dkt. 37, Ex. 1 at 4-6. Plaintiffs 15 allege both these publications exacted devasting damages on their business dealings. For 16 example, Plaintiffs allege that in February 2022, after publication of Plaintiffs’ ban, Black Hat 17 also banned Plaintiffs from its conference where, Plaintiffs had received significant monetary 18 compensation for teaching classes. Plaintiff also allege they were damaged after publication of 19 the January 13, 2023 Update and that as of the filing of the Complaint, the defamatory 20 publications can still be seen on Defendants’ website, which has over 400,000 followers. 21 2. 1/13/23 Update 22 In the January 13, 2023 Update, Defendants state that during their investigation, they 23 “spoke directly with Mr. Hadnagy about claims of his violations of our Code of Conduct. He 1 confirmed his behavior and agreed to stop. Unfortunately, the behavior did not stop.” Dkt. 37, 2 Ex. 3. 3 Defendants argue nothing in the Update is defamatory and because the language does not 4 refer to sexual conduct or gender identifiers, it cannot reasonably be inferred Plaintiffs’ ban from 5 the Event was the result of sexual misconduct. This ignores Plaintiffs’ allegations that the Update 6 contains demonstrably false statements because Defendants refused to meet with Plaintiff 7 Hadnagy and provide Plaintiff Hadnagy with information regarding the alleged “behavior”; 8 perpetrators of rumors and online comments interpreted the ban was the result of sexual 9 misconduct (i.e. referring to Plaintiff Hadnagy as the ‘Harvey Weinstein of the infosec 10 community’); and publication of the false statements damaged Plaintiffs’ business dealings. This 11 also ignores the plain implication of the statements in the Update, i.e., that Plaintiff Hadnagy 12 confirmed and admitted to committing acts that were so egregious, he had to be banned from the 13 Event for the rest of his life – all statements Plaintiffs allege are demonstrably false. 14 3. Allegations Regarding Black Hat 15 Plaintiffs allege they were regular participants at Black Hat’s annual 6-day cybersecurity 16 conference in Las Vegas, where Plaintiffs conducted classes for “significant monetary 17 compensation, sometimes reaching into the six-figure range.” Dkt. 1-1, ¶ 5. In February of 2022, 18 Black Hat issued a ban of Plaintiffs from Black Hat’s conference, “specifically in light of 19 Defendants’ publishing of the ‘Transparency Report’ and the online aftermath.” Id. ¶76. 20 Plaintiffs further allege, on information and belief, that Defendant Moss, who is also a 21 director of Black Hat, published false and defamatory statements, purportedly based on an 22 investigation and evidence, to representatives of Black Hat to convince them to ban Plaintiffs 23 from the Black Hat conference. Id. ¶78. These allegedly false and defamatory statements include 1 that Plaintiff Hadnagy perpetrated repeated severe and repugnant sexual harassment against 2 various victims, Plaintiff Hadnagy admitted to perpetrating this harassment, and agreed to stop. 3 (Referred to in Plaintiffs’ Complaint as “Injurious Falsehoods”). Plaintiffs allege that because of 4 these Injurious Falsehoods, coupled with publication of the 2/9/22 Transparency Report and 5 1/13/23 Update, Black Hat removed Plaintiff Hadnagy from its prestigious Review Board and 6 banned Plaintiffs from the Black Hat Convention. Id. ¶¶78-80. 7 Plaintiffs allege facts sufficient to raise an inference that Defendant Moss, through his 8 involvement in both Def Con and Black Hat, was involved in banning Plaintiffs from both events 9 in the same month. However, the allegations of additional Injurious Falsehoods are without 10 plausible factual content. To proceed on a claim of defamation, Plaintiffs must plausibly plead 11 the alleged “false and defamatory” statements, i.e., to whom, when, and where these statements 12 were made. 13 In conclusion, the Court concludes Plaintiffs have sufficiently stated claims of 14 defamation based on Defendants’ publications of the 2/9/22 Transparency Report and the 15 1/13/23 Update on Def Con’s website. The Court grants Defendants’ motion to dismiss 16 Plaintiffs’ claims of “Injurious Falsehoods” by Defendant Moss to Black Hat representatives but 17 also grants Plaintiffs leave to amend the Complaint to plead additional factual allegations to 18 support this claim. 19 D. Business Disparagement Claim 20 Plaintiffs allege that Defendants’ disparaging remarks were intended to destroy Plaintiffs’ 21 reputations, which are paramount in the information security industry. Dkt. 1-1, Compl. ¶¶ 81, 22 88. Plaintiffs also allege Defendant Moss spread additional false and defamatory statements to 23 Black Hat (i.e., racially discriminatory employment practices and a gender-based hostile work 1 environment (See id., ¶ 76). As explained above as to the Injurious Falsehoods, the “additional” 2 defamatory allegations are not properly plead as there are no facts explaining when, what, and to 3 whom the additional defamatory statements were made. 4 A statement may be published in circumstances that disparage the quality of the product 5 and at the same time imply the owner or vendor is dishonest, fraudulent, or incompetent, thus 6 affecting the owner or vendor’s business reputation. In such circumstances, an action may be 7 brought for defamation as well as for disparagement. Waechter v. Carnation Co., 5 Wash.App. 8 121 , 126–27, 485 P.2d 1000 (1971). Here, the alleged defamatory statements are directed toward 9 Plaintiff Hadnagy’s behavior and any damage to Plaintiffs’ business interests flows directly from 10 that defamation. Although Plaintiffs believe and allege Defendants published the defamatory 11 statements about Plaintiff Hadnagy with the intent to harm Plaintiffs’ reputation, there are no 12 allegations that Defendants disparaged the quality of Plaintiffs’ products or services, i.e. 13 Plaintiffs’ expertise in the tech industry – human error and the threat it poses to information 14 security as well as the application of scientifically proven methodologies to uncover 15 vulnerabilities, define risk, and provide remediation. Dkt. 1-1, ¶ 47. 16 Thus, Defendants’ motion to dismiss Plaintiffs’ disparagement claim is granted. 17 E. Tortious Interference with Contractual Relations 18 To establish a cause of action for intentional interference with contractual relations, a 19 plaintiff must demonstrate: (1) the existence of a valid contract between the plaintiff and a third 20 party; (2) the defendant's knowledge of that contract; (3) the defendant's intentional acts designed 21 to induce a breach or disruption of the contractual relationship; (4) actual breach or disruption of 22 the contractual relationship; and (5) resulting damage. MP Med. Inc. v. Wegman, 151 Wash. 23 App. 409, 425 (2009). 1 Plaintiffs allege that, prior to February 9, 2022, they had entered into several long-term 2 agreements for the provision of cybersecurity and IT services for various large national 3 corporations and law enforcement agencies, including Black Hat; defendants were aware of the 4 agreements; and many clients terminated their agreements based on the “Injurious Falsehoods”. 5 Plaintiffs fail to state a plausible claim for tortious interference with contractual 6 relationships as they have failed to identify the existence of any valid contract in place at the 7 time the alleged defamation occurred. For example, Plaintiffs allege they enjoyed lucrative 8 annual contracts with Black Hat for training services at Black Hat’s annual convention (Dkt. 1-1, 9 Compl. ¶¶ 75, 136-137) but do not allege they had a valid and existing contract with Black Hat 10 as of February 9, 2022, when the first alleged defamatory publication was made. Plaintiffs also 11 allege that “multiple of Plaintiffs’ clients” terminated their agreements with Plaintiffs and cited 12 to the Injurious Falsehoods as the reason they were voiding the business agreements. Id., ¶ 135. 13 However, Plaintiffs do not identify any clients or any existing contracts. In addition, and to the 14 extent Plaintiffs rely on the “Injurious Falsehoods” as the reason valid and existing contracts 15 were terminated, Plaintiffs have failed to properly plead those “Injurious Falsehoods”. 16 Accordingly, the Court grants Defendants’ motion to dismiss Plaintiffs’ claim for tortious 17 interference with contractual relationships, with leave to amend for Plaintiffs to properly identify 18 existing contracts breached or disrupted because of Defendants’ defamatory publications. 19 F. Intentional Interference With Prospective Contractual Relations 20 To maintain this tortious interference with business relations claim, Plaintiffs must 21 establish: “(1) a prospective contractual relationship between the plaintiff and a third party; (2) 22 the defendant’s knowledge of this prospective relationship; (3) the intent to harm the plaintiff by 23 preventing this relationship; (4) the absence of privilege or justification by the defendant; and (5) 1 actual harm to the plaintiff as a result.” Bombardier Inc. v. Mitsubishi Aircraft Corp., 383 F. 2 Supp. 3d 1169, 1188 (W.D. Wash. 2019) (citing Evergreen Moneysource Mortg. Co. v. Shannon, — 3 — 167 Wash.App. 242 , 274 P.3d 375, 383 (2012) (citing Pleas v. City of Seattle, 112 Wash.2d 794 , — 4 — 774 P.2d 1158, 1161 (1989)). Plaintiffs have failed to plausibly plead allegations to support this 5 claim. 6 Plaintiffs allege they had been in negotiations with “multiple corporations and 7 government organizations for prospective provision of cybersecurity and related services in 8 conjunction with business activities and operations.” Dkt. 1-1, Compl. ¶ 145. Plaintiffs also 9 allege Defendants spread the “Injurious Falsehoods” to Black Hat representatives to prevent 10 Plaintiffs from continuing to negotiate their annual teaching instructor agreements at the Black 11 Hat conference. 12 As to the multiple corporations and government organizations, Plaintiffs’ allegations are 13 insufficient to state a claim for tortious interference with a business expectancy as Plaintiffs do 14 not identify any third party with whom they had a prospective contractual relationship. Although 15 an enforceable contract is not required to support a tortious interference action, there must be a 16 relationship between parties contemplating a contract, with at least a reasonable expectancy of 17 fruition. Broten v. May, 49 Wash.App. 564 , 744 P.2d 1085, 1088 (1987). As to the Black Hat 18 annual teaching instructor agreement, Plaintiffs allege Defendant Moss intentionally interfered 19 with this prospective agreement by spreading the Injurious Falsehoods, which have not been 20 properly plead. 21 Plaintiffs rely on Motogolf.com, LLC v. Top Shelf Golf, LLC, 528 F. Supp. 3d 1168 (D. 22 Nev. 2021 ) for the proposition they can allege a “certain class” of prospective customers without 23 identifying them specifically. See Dkt. 39 at 20. In Motogolf.com, however, the court predicted 1 the Supreme Court of Nevada would allow a plaintiff to allege a “certain class of prospective 2 customers without identifying them specifically” when the defendant’s alleged wrongdoing had 3 prevented those customers from learning of the plaintiff’s existence. See id. This does not 4 alleviate Plaintiffs’ burden to identify the specific, known persons or entities with whom they 5 were allegedly negotiating. 6 The Court grants Defendants’ motion to dismiss Plaintiffs’ claim for tortious interference 7 with prospective business relationships, but grants Plaintiffs leave to amend their Complaint to 8 identify the third party or parties with whom they had prospective business arrangements and 9 allege facts supporting each element of this claim. 10 G. Unjust Enrichment, Quantum Meruit, and Injunctive Relief Claims 11 1. Unjust Enrichment 12 “Unjust enrichment is the method of recovery for the value of the benefit retained absent 13 any contractual relationship because notions of fairness and justice require it.” Young v. Young, — 14 — 164 Wash.2d 477, 484 , 191 P.3d 1258 (2008). A claim for unjust enrichment consists of three 15 elements: (1) plaintiff conferred a benefit upon the defendant, (2) the defendant had knowledge 16 or appreciation of the benefit, and (3) the defendant’s acceptance or retention of the benefit 17 without payment of its value is inequitable under the circumstances. See Young, 164 Wash.2d at 18 484, 191 P.3d 1258 (quoting Bailie Commc'ns, Ltd. v. Trend Bus. Sys., Inc., 61 Wash.App. 151 , 19 159–60, 810 P.2d 12 , 814 P.2d 699 , review denied, 117 Wash.2d 1029 , 820 P.2d 511 (1991)). 20 Plaintiffs argue their claim of unjust enrichment seeks payment for allegedly growing the 21 Event, instead of rendering services at the Event. Dkt. 39 at 21:22–23. However, for an 22 enrichment to be inequitable to retain, the person conferring the benefit must have a reasonable 23 expectation of payment and the circumstances are such that equity and good conscience require 1 payment for the conferred benefit. Plaintiffs do not allege Defendants induced them to provide 2 the alleged benefits — the creation of the SEVillage (and associated capture-the-flag event) and 3 “investing substantial resources” into the Event — or promised any kind of payment to 4 Defendants for doing so. See Compl. ¶¶ 159–66. In fact, after Defendants rebuffed Plaintiffs’ 5 requests for payment requests in 2012, Plaintiffs continued to provide the SEVillage at the Event 6 for years. Compare Compl. ¶¶ 50, 163 (Defendants rejected Mr. Hadnagy’s requests for payment 7 but changed Event rules in 2012 to allow Mr. Hadnagy to start accepting third-party sponsorship 8 compensation), with id. ¶¶ 45, 46, 58 (Mr. Hadnagy hosted the SEVillage in person or virtually 9 from 2010 to 2022). Therefore, Plaintiffs could have no “reasonable” expectation of payment. 10 Plaintiffs also allege they derived significant benefit from their involvement in the Event, 11 including “a lot of attention, exposure, and income from Sponsorships during the operation of the 12 SEVillage” (Dkt. 1-1, ¶ 50); the generation of “a considerable portion of Plaintiffs’ business 13 agreements . . . through their operation of the SEVillage” (id. ¶ 133); hosting a standalone social 14 engineering convention in 2020 due to “the overwhelmingly positive feedback over the years at 15 SEVillage” (id. ¶ 52); and even procuring a personal meeting with the director of the National 16 Security Agency (id. ¶ 47). 17 Based on these allegations, the Court concludes Plaintiffs have failed to state a plausible 18 claim for unjust enrichment and grant Defendants’ motion to dismiss this claim. 19 2. Quantum Meruit 20 Quantum meruit is a specific equitable theory that falls within the broader category of 21 “unjust enrichment.” Young v. Young, 164 Wash.2d 477, 486 , 191 P.3d 1258 (2008). Washington 22 law distinguishes between quantum meruit claims and unjust enrichment claims. Young, 164 23 Wash.2d at 484–85, 191 P.3d 1258 . Unjust enrichment refers to a method of recovery when, 1 without any direct contractual relationship between parties, one party retains a benefit it has not 2 paid for. Id. at 484, 191 P.3d 1258 . Quantum meruit is a more specific subcategory of unjust 3 enrichment requiring a contract implied in fact between parties: The parties must show a “mutual 4 intention ... to contract with each other.” Id. at 485, 191 P.3d 1258 . Though the two concepts 5 have slightly different labels, both refer to the same general type of relief. 6 The concept of quantum meruit arises in two contexts: contract and restitution. In an 7 action based on a contract implied-in-fact (i.e., when the parties intended to contract and 8 promises were exchanged, the general obligations for which must be sufficiently clear), quantum 9 meruit may be employed as a gap filler to supply absent terms. Aegean Mar. Petroleum S.A. v. 10 KAVO Platanos M/V, 646 F. Supp. 3d 1347 , 1358 (W.D. Wash. 2022). Quantum meruit may 11 also provide restitution for unjust enrichment. Id. In this context, quantum meruit imposes 12 liability for the market value of services as a remedy for unjust enrichment. Id. (citing Certified 13 Fire Prot. Inc., 128 Nev. at 380–81). The plaintiff must establish each element of unjust 14 enrichment to demonstrate entitlement to the remedy of quantum meruit. Id. at 1107 n.4. 15 Plaintiffs have not plead an implied-in-fact contract. There are no allegations the parties 16 intended to contract, exchanged promises, or created sufficient clear obligations pursuant to 17 promises to contract. Further, because Plaintiffs’ unjust enrichment claim fails (as discussed 18 above), quantum meruit’s application as a remedy for unjust enrichment also fails. 19 3. Injunctive Relief Claim 20 Injunctive relief is a remedy, not a separate cause of action. Iliescu, Tr. of John Iliescu, 21 Jr. & Sonnia Iliescu 1992 Fam. Tr. v. Reg’l Transp. Comm’n of Washoe Cnty., 522 P.3d 453 , 22 457 (2022) (upholding dismissal of injunctive relief as an independent cause of action and 23 collecting cases); McKee v. Gen. Motors Co., 601 F. Supp. 3d 901 , 910 (W.D. Wash. 2022), 1 aff’d, 2023 WL 7318690 (9th Cir. Nov. 7, 2023). Plaintiffs do not dispute that injunctive relief is 2 a remedy, not a separate cause of action. Dkt. 37 at 36:5–11. 3 Based on the foregoing, the Court grants Defendants’ motion to dismiss Plaintiffs’ claims 4 of unjust enrichment, quantum meruit, and injunctive relief. 5 CONCLUSION 6 Accordingly, it is ORDERED: 7 1. Defendants’ motion to dismiss Plaintiffs’ Alter Ego, Business Disparagement; Unjust Enrichment, Quantum Meruit, and Injunction claims is GRANTED and 8 these claims are dismissed. 9 2. Defendants’ motion to dismiss Plaintiffs’ Defamation claims as to the 2/9/22 Transparency Report and the 1/13/23 Update is DENIED. — 10 — 3. Defendants’ motion to dismiss Plaintiffs’ Defamation Claim (as to “Injurious 11 Falsehoods” by Defendant Moss); and Tortious Interference with Contractual Relations and Prospective Business Relations Claims is GRANTED, with leave 12 to amend. 13 4. Plaintiffs may file an Amended Complaint consistent with this Order on or before April 22, 2024. — 14 — 15 DATED this 28th day of March, 2024. 16 A — 17 — BRIAN A. TSUCHIDA United States Magistrate Judge — 18 — — 19 — — 20 — — 21 — — 22 — — 23 —