An open letter to Adam Shostack, the man who raped my wife.
DOCUMENT UPDATES IN REVERSE CHRONOLOGICAL ORDER
UPDATE - 25 Years after the events of the late evening of July 9th to the early morning of July 10th, 1999
I had planned a very different post on the 25th anniversary of very traumatic events. I have recently found some therapy that actually seems to help with the problem of constantly reliving old traumas. It has achieved what nothing else had for decades, and I now realize that I go days (even more than a week sometimes) without thinking about past trauma, and loved ones I was unable to protect, but simply focusing on current life goals. Thus I was planning on erasing this website and leaving a message saying, “It has been 25 years. I am trying to move on. Look it up on the Internet Archive if you are curious.”
However, quite inexplicably, after nearly 25 years, Adam decided to break his long silence on this matter and launch a full blown DARVO campaign.
I actually kind of respected that he had never lied about this in public (although I always assumed he was probably lying privately) and I had been thinking that, after 25 years, he is likely not even the same guy. He probably isn't engaging in the same sort of behavior anymore, and his older and wiser self is maybe even feeling bad for all the horrible things he has done in his life.
But I guess it turns out that there is still no remorse or responsibility for his actions. I don't know what changed. Maybe someone who knew something died? I never did find out who wrote me the Augusta letter that implied he had paid her off. Maybe she is gone. But all that is pure speculation. No way to know why, but he did finally write a post about this and it deserves a response, so, here goes...
Adam,
Some points in response to your recent DARVO post:
1. Yes, I have issues from very old traumatic events and I may not be entirely neurotypical, but I would suggest you also examine yourself in this regard. When your actions cause people trauma that they are unable to fully process for decades, referring to them as “obsessed with you” stinks of narcissism and/or sociopathy. Your inability to think of other people and their long term feelings as being more important than your short term pleasure, is what brought us here. It seems nothing has changed. Though I hope, at your age, you are not making a regular habit of targeting women too intoxicated to consent.
2. Yes, I was very angry at you, and the animal part of my brain very much wanted to do you violence. This is a perfectly natural reaction to your actions. It is probably also a natural animal instinct, when seeing a pretty lady who is incoherently intoxicated or drugged, to imagine that you could easily have your way with her. However, fully functional human beings, capable of empathy, first imagine the pain such actions might cause others, and then they find themselves able to resist such animal urges. Thus, though it would probably have helped me put the traumatic events you caused behind me, I never touched you, and never will without your consent.
3. This is the first I am hearing about charges filed against me. No one ever contacted me, despite my personal phone number being known to you (given to you because I thought we were friends). You would think the police would have at least called and asked me to come to talk to them. I have also been in and out of Canada and even into Montreal many times since, with no issues, so it seems there is no active manhunt going on. I guess these charges received the same level of inattention the Vegas police were candid enough to tell us they would give to a case against you if we bothered to file charges. Also, for the record, I did not “chase you into a hotel room.” I caught up with you, asked politely to talk, and you invited me into your room. I do imagine that my being completely honest in that talk, about how I was feeling at the time, might have been scary for you. But again, I never touched you and never will. Human beings capable of empathy make sure, before any physical interactions, that there is consent.
4. You imply that the story was different at the beginning. This is not true. My wife has never changed what she said happened that night. It is true that I did not use the R word at first, when you were still willing to talk to me about what happened. I did not have all the information then and it was possible that, although my wife had an almost complete blackout of the later portion of that evening, other people (including you) may have thought she looked less than incoherently intoxicated. When I was able to speak to other witnesses, it became quite clear that she was both non verbal and unable to walk without assistance by the end of that night, and that there was no way you could have thought her in any sort of condition to be able to give consent.
5. Your excerpts from private emails neglect to include the times when I asked you how drunk she was and you either ignored the question or said you didn't think that was the important issue. You always wanted to change the topic to some unidentified 4th party having told you that they thought maybe the reason I was not there that night was that we were “broken up.” You claimed that this person's guess about our relationship status somehow negated even the very clear NO that the wedding ring she was wearing was still communicating to you, even after she was no longer capable of rational speech. The last thing you ever wanted to discuss was whether or not she was capable of consent.
6. You bring up being in fear for your family. First, I would never harm anyone innocent and you know it, as I am not even capable of harming someone guilty. Second, how dare you try to raise sympathy for your actions because you have a family now? You certainly did not think about my family then. Your actions nearly destroyed a family when it was quite new, and the traumas you caused us remain a difficulty for our family even today.
When you attacked our family, my wife (then married to me for 3 years, together for 5) and I had recently done a lot of talking about the future and planning our family. She had gone off of her birth control and we had decided to have 2 or 3 kids, trying for one boy and one girl, but stopping at 3 if all were the same sex. After what you did, we were not back at a place where we could revisit family planning for another decade. Thankfully, we did end up with one beautiful, brilliant, amazing daughter, whom we love dearly. However, trying for more, we ran out of time and what science could do for us. So, in the long run, your actions ended up costing us 1 or 2 additional children.
Now, I know rationally that this is not the same as you having killed 1 or 2 of my kids. But I do feel the loss of those children, maybe two more daughters, or a son whom I will now never get to know. If there had been a son, I would have raised him right, the way I was raised, the way your parents should have raised you, to respect women and treat them as fellow human beings, and to never ever do anything physical to them when you happen across them in a condition where they are unable to consent.
Sean Hastings
Sailing the Caribbean
July 11th, 2024
P.S. This Is in response to Adam Shostack's blog post on his Shostack and Associates website:
https://shostack.org/blog/why-i-dont-engage-with-sean-hastings/
You will note that he did not provide a link to this website, the content of which he is well aware of, but will not “engage” with. He won't even answer the simple question, “How drunk was she?” Or if she was indeed, only drunk. Other women have told me that they believe that Adam Shostack drugged them. (See earlier updates below)
UPDATE - Two Weeks Before OWASP 2023 Global AppSec Dublin
It has been an interesting week. An old friend has been having health issues for a couple years now. Bad health issues. My wife and I have been as supportive as we can. I guess that brought him to the conclusion that we are real friends and made him think about the bad choices he made. Anyway, he wrote an apology/confession letter about how he protected Adam Shostack. I feel sort of touched and disgusted at the same time. If that is a thing, the Germans probably have a word for it. Anyway, he said I could publish it, but to not use his name or Twitter handle on this website, so as not to have an outrage mob come after him for finally doing the right thing. However, people who know him will likely recognize him from context, and he said that anyone can contact him privately and he will confirm that his leter is authentic.
The letter is not completely forthcoming. Based on conversations with him, I learned that the part where it says, "when the dust settled," is refering to a several year period in which he hooked Adam up professionally with the woman mentioned in the update below, in order to give him cover and her more infosec cred, then spent those years working to promote both of them while telling lies about my wife and I to everyone. I believe this spree of slander only ended when he had some sort of falling out with them. However, I have forgiven him and I would ask others to do the same. He is a PR guy and, in part, was just doing his job. Plus, Adam Shostack was a friend of his once, and it is hard not to defend friends, even when they do very bad things. Also, if karma is a real thing, the health problems he has experienced are punishment for far more than just these crimes.
It may also be that the woman mentioned below is not as calculatingly self interested as I thought, but instead, simply believed those lies. Although, when people block you online and avoid talking to you, the message they send is often that they do not want to hear what you have to say, because it would be inconvenient for them if it were true, so they are carefully avoiding actually hearing any evidence.
Anyway, click here for his apology letter.
Sean Hastings
New York, NY
February 3rd, 2023
UPDATE - And it is somehow 6 years later. Tempus Fugit!
I got back on Twitter at some point. I had fled all social media for a while because I knew too many people who knew Adam Shostack and were still in regular contact with him, and social media algorithms seem designed to make you interact with people whom you would rather forget existed. But I started to play Dungeons and Dragons with my daughter and found the Twitter TTRPG community helpful. So I got back on. I was also trying to get help promoting the kids science fiction book I wrote, meant to encourage girls to learn science and technology, with my daughter as the inspiration for the main character, and I reached out to a few people I had helped with their own projects in the past.
This brought the discovery that a woman who did a kickstarter for her book that I supported with a signficant contribution, and whom I did everything else I could for, to support her career, was now buddies with Adam Shostack, and wouldn't even respond to me. I helped her because I thought having strong women as leaders in the infosec community would help put a stop to the kind of thing that happened to my wife. What I did not realize is that clever predators seek protective cover from strong leaders and that clever strong leaders, women or not, can use this as leverage over them, to advance their own interests.
You can read the details on Twitter if you click here.
Sean Hastings
New York, NY
March 11, 2022
P.S. This was mostly all written on the indicated date, but somehow did not get edited and coppied to this website until I also published the update above.
UPDATE - One Week after RSA 2016
So I don't know why I even continue to be skeptical about these things. Maybe because deep down I really wanted to believe that what Adam Shostack did to my wife was only a one time mistake on his part. I tried really hard to figure out how the "Augusta" letter to me (see below) could just be a random troll, and I didn't post the other new entry below to any social sites because the kid, who said he confronted Adam at RSA about his girlfriend ending up in the hospital after having half a drink, said he made a big scene. I was waiting for posts about him confronting Adam to appear on-line and confirm his story. When I didn't see any I became skeptical that any of this was actually real, including his girlfriend's medical records. I asked him why no-one live tweeted about what happened and he said he didn't know.
But then he sends me Video Proof of the confrontation he described.
So I imagine that you if you disrupt a public event to accuse the speaker of anything from littering to murder you would get a bunch of live tweets about it. But accuse a guy of drugging a woman's drink at a security convention and its crickets... All I saw was one tweet about how Adam's talk had a real feel good ending... Did this person really watch the speaker confronted about drugging a woman at a previous convention in Atlanta and manage to feel good after?!?
I also apparently don't want to believe those that say this cover-up culture in endemic to the tech and/or security industry. Do most hacker's just look at obtaining sex as cracking a system? Do they think that using someone sexually when they are semi-conscious from a drug is just a cool exploit? I really really don't want to believe this. But in this context it makes me shudder to read that Adam Shostack authored a card game called "Elevation of Privilege".
Anyway, in the video Adam asks the question, "Why don't they just go to the police?", and this is worth answering: (Although I think Adam already knows these answers well, and understands how the law actually protects smart sneaky rapists by giving them an incredibly high standard of legal proof to point to and then suggest that people should just remain quiet if that standard can't be easily met.)
And I did talk to the Las Vegas police some 15 years ago. They couldn't get me off the phone fast enough. It happened at a convention and all the possible witnesses were on airplanes to different parts of the world the next morning. The alleged victim couldn't actually remember anything. You know, they said, people get a little crazy in Vegas and do out of character things. They told me that it was unlikely that any prosecutor would touch it, but that if we really wanted to file a complaint, we could fly back to Vegas and make a formal statement, but that was likely as far as it would ever go. There were next to zero odds of any police resources being spent to track down a suspect (who had quickly moved to Canada) or find any witnesses to interview.
Although I did manage to do my own detective work and find some witnesses. Here are some things that they said to me:
"I don't know if it was legally rape, but Adam had to know he was taking advantage of her condition. She was quite amazingly drunk."
"I can't believe that Adam would have tried anything with her in that condition. She was already non-sentient and halfway to unconscious the last time I saw her that night"
"If anyone had sex with her that night, it was rape. She was having trouble speaking in coherent sentences and certainly was not passing anyone's Turing test."
"She was so incoherent that anyone could have had her and she wouldn't have known the difference."
Interestingly, this last quote was from an old friend of Adam's claiming that it could not have been rape. His logic was that since it was obvious to him and everyone else that my wife was in a state where she would not be able to say "no" to anyone or anything, no matter how disgusting or diseased, that she could not possibly have been raped - that she must have said "yes" to Adam even if she couldn't actually remember it. He even had the balls to tell me that I was lucky it was a nice safe clean guy like Adam because it could have been far far worse for my wife if Adam hadn't been there.
Anyway, I believe that Nevada law disagrees with this theory of "obviously too drunk to be able to say NO to anything so it couldn't be rape":
Nevada statute § 200.366 ¶ 1, "A person who subjects another person to sexual penetration, or who forces another person to make a sexual penetration on himself or herself or another, or on a beast, against the will of the victim or under conditions in which the perpetrator knows or should know that the victim is mentally or physically incapable of resisting or understanding the nature of his or her conduct, is guilty of sexual assault."
Not that they are seemingly interested in actually enforcing the "mentally incapable" part of this law.
The Vegas police really do not want anything to do with this type of case. These industry conventions make a lot of money for that town while being the ideal setup for a sexual predator. A smart one might well arrange his life in such a way as to be able to attend as many as possible. And, if you think about it, such a careful intelligent predator would definitely be someone who presented a kind, risk adverse, and pacifistic public persona while seeking known standing in the community. That way, if there was an issue, everyone would think it was just some sort of horrible mistake. Many of the predator's friends would never believe it, just as I am sure Bill Cosby has many friends who are quite convinced that his problems are all some sort of media driven conspiracy.
And so the victims are just left seriously emotionally scarred - to be triggered every time a TV commercial tells them that "What happens in Vegas stays in Vegas".
And the police not really wanting to investigate this kind of thing is just one reason that people don't like to go to them. There are a lot of others. No one wants the disruption that court cases will bring to their lives. If someone can just forget about it they will. It is absolutely the rational choice. If I could just forget about it I certainly would.
Also, I think the vast majority of people who are raped under the influence of drugs and alcohol decide that it is their own fault. Victim blaming makes others feel better because it makes the world seem safer for those who think they wouldn't make such a mistake. But it can also make the victim feel better. If the victim decides to believe that they did things that contributed and that maybe they really wanted it to happen on some level, well, then they don't have to think of themselves as a victim - it was just a wild stupid thing they did - a mistake to learn from but not get too upset about.
But now I am talking to this latest reported victim and hoping maybe she is willing to press charges. Maybe seeing her boyfriend being asked that question by Adam will do the trick? He is asking her, "why don't you just go to the police?" Well maybe she should go ahead and do this for him. Maybe he really wants to be stopped. We are still within the statute of limitations on this one. Atlanta probably isn't as inclined to want to suppress reporting of this kind of crime as Las Vegas so obviously is. Others may come forward if an actual police investigation is launched.
And just maybe "attempted rape" is a crime that makes everyone involved a little bit less victim blamey than actual successful rape does...
Sean Hastings
New York, NY
March 10th, 2016
UPDATE - RSA conf 2016
So, I occasionally get people contacting me with stories about what Adam Shostack has done to them, and I always tell them that I will only publish their stories if they can offer some evidence that they are not just trolling me. A few months ago, a woman told me that she once had a single drink with Adam and that she ended up in the hospital from an allergic reaction to an unknown substance. So I told her to send me the hospital records and I would publish the story. She said she would and that was all I heard of it for a long time.
Flash forward to today, and I get an email from the woman's boyfriend (or possibly the boyfriend of another woman who was her friend - it wasn't totally clear) saying that they are going to go to RSA conference and confront Adam and hand out flyers. They also tell me that they sent the medical records. So I go check my snail-mail, and sure enough I have received copies of very official looking medical records from an Atlanta hospital that detail a visit by this woman for extreme abdominal pain. She was admitted October 2nd, 2014 which Google shows me would correspond to the last day of the ISC2 Security Congress where Adam was indeed speaking.
So this now seems pretty credible, even if the Letter I was told I could publish, that seems to contain accounts by both the woman who got sick and a friend she was with, seems a bit garbbled.
I will also black out the woman's name and scan some of these medical records shortly. If I have done it, the image files will be Here. [Edit - uploading the medical records now, having received permission from the patient to do so. Scan05.png is very interesting.]
Sean Hastings
New York, NY
March 3rd, 2016
UPDATE - one year later
Here is an Email exchange I had concerning some anonymous letters sent out by yet another woman saying she was drugged and raped by Adam Shostack.
My first thought was that this was just someone trolling me after I had published the open letter below, but as you can see, I did manage to confirm that she contacted the Ada Initiative prior to the publication of my open letter. I was really not sure if I should publish this, but it is Vegas convention time again and I can't help but worry that Adam is going to hurt someone else who doesn't know his history. Follow the link and read from the bottom up for the correct chronology. If you have not read last year's open letter, you might want to keep reading on this page first for context.
Sean Hastings
New York, NY
August 5th, 2015
P.S. I just saw a report that the Ada Initiative is closing down. I am really sorry to hear this, as they seemed to be the only people trying to do something substantial to reduce this kind of sexual predation at tech cons.
ORIGIONAL LETTER
An open letter to Adam Shostack, the man who raped my wife.
Hey Adam,
it has been 15 years since you shattered the lives of two good people who trusted you and considered you to be a friend.
Do you ever even think about it?
I still do, on a regular basis. I still feel guilty at not having been at Def Con that night to protect my wife from you. I still feel angry at her (and ashamed at myself for being so) for her poor choices that led to her being in a situation where she ended up blackout drunk and alone with you (someone she viewed as a safe friend of ours), and for her initial instinct to do anything and everything at all afterwards to avoid having to admit she was a rape victim. And I still feel completely impotent at having done nothing about it for 15 years, despite fantasizing often about how easy it would be to hurt you in oh so many ways, and hating myself a little bit every day for not being the man I sometimes wish I could be; a man who would make you suffer some equivalent to all the pain you caused us.
It probably never even crosses your mind anymore. We never pressed charges, both due to the difficulty and pain that would be involved in pursuing the case, and because you were not a sellout working for a big company like Microsoft then, but rather, on a cool cryptography startup that we did not want to see tainted by scandal. Once it was clear that no one was going to arrest you, and that I didn't really have the balls to come give you the life altering beating you still deserve, you likely just put it out of your mind and never gave it a second thought.
Now you have a new book out and are giving talks at various computer conventions. Congratulations on becoming such a public figure! These are the same kinds of conventions that my wife and I once enjoyed attending together and socializing with the interesting and intelligent people that frequent them. That is both a pleasure and a career building tool we can no longer pursue because it triggers such very bad memories for us and there is always the chance that we might actually run into you.
I even see you had the unmitigated gall to promote your book at a bookstore named after Ada Lovelace in celebration of women in technology. In case this is not clear to you: raping women at tech conventions can have a chilling effect on women in tech. I can only hope that this was a one-time crime of opportunity and that you are not an active sexual predator who regularly sets up these kind of situations. Damn do I really hope that, because otherwise, our failure to take legal or other action is far far worse and you will have hurt many more people by now.
Today you are giving a keynote speech at B-sides concerning "Good and Evil" and "burn out" in the field. Well I remember the exact day that your evil burned us out (well maybe we sputtered along for a while, but it was a losing battle), that was the day my wife told me what you had done to her. Once we had dreams of crypto-currencies, jurisdictional arbitrage, and accelerating the future; now I stay home and remodel my house at a sedate pace and turn down the occasional offers to be the CEO or CTO of new startups because I know from experience that such work will regularly provide little reminders of what happened to my family the last time we were involved in that world, while my wife had to take up a new career in an entirely different field. We can barely even tolerate visits from other good people who were in that same social crowd we were once a part of, so you even ruined our ability to enjoy the company of old friends.
Now we are raising a beautiful daughter and living in fear of one day having to send her out into a world that contains monsters like you, capable of disguising themselves so well that anyone might be fooled into thinking they are friends.
Anyway, it is an anniversary of sorts, and you seem to be doing well, so I just thought that maybe you should take some time out to think about what you did. You know it was wrong in every way imaginable, that you deserved to pay a very high price for it, and that you got off far too easily. And if you don't know that then you are either completely self-delusional or a sociopath. You should definitely count yourself lucky that the worse you will ever likely get from me is the occasional open letter to make sure you never forget about us.
Please know that your victims are still here together 15 years later thinking about what you did; still in pain; still wounded but surviving.
Yours truly,
Sean Hastings
New York, NY
August 5th, 2014