An open letter to Adam Shostack, the man who raped my wife.


UPDATE - Two Weeks Before OWASP 2023 Global AppSec Dublin

It has been an interesting week. An old friend has been having health issues for a couple years now. Bad health issues. My wife and I have been as supportive as we can. I guess that brought him to the conclusion that we are real friends and made him think about the bad choices he made. Anyway, he wrote an apology/confession letter about how he protected Adam Shostack. I feel sort of touched and disgusted at the same time. If that is a thing, the Germans probably have a word for it. Anyway, he said I could publish it, but to not use his name or Twitter handle on this website, so as not to have an outrage mob come after him for finally doing the right thing. However, people who know him will likely recognize him from context, and he said that anyone can contact him privately and he will confirm that his leter is authentic.

The letter is not completely forthcoming. Based on conversations with him, I learned that the part where it says, "when the dust settled," is refering to a several year period in which he hooked Adam up professionally with the woman mentioned in the update below, in order to give him cover and her more infosec cred, then spent those years working to promote both of them while telling lies about my wife and I to everyone. I believe this spree of slander only ended when he had some sort of falling out with them. However, I have forgiven him and I would ask others to do the same. He is a PR guy and, in part, was just doing his job. Plus, Adam Shostack was a friend of his once, and it is hard not to defend friends, even when they do very bad things. Also, if karma is a real thing, the health problems he has experienced are punishment for far more than just these crimes.

It may also be that the woman mentioned below is not as calculatingly self interested as I thought, but instead, simply believed those lies. Although, when people block you online and avoid talking to you, the message they send is often that they do not want to hear what you have to say, because it would be inconvenient for them if it were true, so they are carefully avoiding actually hearing any evidence.

Anyway, click here for his apology letter.

Sean Hastings
New York, NY
February 3rd, 2023

UPDATE - And it is somehow 6 years later. Tempus Fugit!

I got back on Twitter at some point. I had fled all social media for a while because I knew too many people who knew Adam Shostack and were still in regular contact with him, and social media algorithms seem designed to make you interact with people whom you would rather forget existed. But I started to play Dungeons and Dragons with my daughter and found the Twitter TTRPG community helpful. So I got back on. I was also trying to get help promoting the kids science fiction book I wrote, meant to encourage girls to learn science and technology, with my daughter as the inspiration for the main character, and I reached out to a few people I had helped with their own projects in the past.

This brought the discovery that a woman who did a kickstarter for her book that I supported with a signficant contribution, and whom I did everything else I could for, to support her career, was now buddies with Adam Shostack, and wouldn't even respond to me. I helped her because I thought having strong women as leaders in the infosec community would help put a stop to the kind of thing that happened to my wife. What I did not realize is that clever predators seek protective cover from strong leaders and that clever strong leaders, women or not, can use this as leverage over them, to advance their own interests.

You can read the details on Twitter if you click here.

Sean Hastings
New York, NY
March 11, 2022

P.S. This was mostly all written on the indicated date, but somehow did not get edited and coppied to this website until I also published the update above.

UPDATE - One Week after RSA 2016

So I don't know why I even continue to be skeptical about these things. Maybe because deep down I really wanted to believe that what Adam Shostack did to my wife was only a one time mistake on his part. I tried really hard to figure out how the "Augusta" letter to me (see below) could just be a random troll, and I didn't post the other new entry below to any social sites because the kid, who said he confronted Adam at RSA about his girlfriend ending up in the hospital after having half a drink, said he made a big scene. I was waiting for posts about him confronting Adam to appear on-line and confirm his story. When I didn't see any I became skeptical that any of this was actually real, including his girlfriend's medical records. I asked him why no-one live tweeted about what happened and he said he didn't know.

But then he sends me Video Proof of the confrontation he described.

So I imagine that you if you disrupt a public event to accuse the speaker of anything from littering to murder you would get a bunch of live tweets about it. But accuse a guy of drugging a woman's drink at a security convention and its crickets... All I saw was one tweet about how Adam's talk had a real feel good ending... Did this person really watch the speaker confronted about drugging a woman at a previous convention in Atlanta and manage to feel good after?!?

I also apparently don't want to believe those that say this cover-up culture in endemic to the tech and/or security industry. Do most hacker's just look at obtaining sex as cracking a system? Do they think that using someone sexually when they are semi-conscious from a drug is just a cool exploit? I really really don't want to believe this. But in this context it makes me shudder to read that Adam Shostack authored a card game called "Elevation of Privilege".

Anyway, in the video Adam asks the question, "Why don't they just go to the police?", and this is worth answering: (Although I think Adam already knows these answers well, and understands how the law actually protects smart sneaky rapists by giving them an incredibly high standard of legal proof to point to and then suggest that people should just remain quiet if that standard can't be easily met.)

And I did talk to the Las Vegas police some 15 years ago. They couldn't get me off the phone fast enough. It happened at a convention and all the possible witnesses were on airplanes to different parts of the world the next morning. The alleged victim couldn't actually remember anything. You know, they said, people get a little crazy in Vegas and do out of character things. They told me that it was unlikely that any prosecutor would touch it, but that if we really wanted to file a complaint, we could fly back to Vegas and make a formal statement, but that was likely as far as it would ever go. There were next to zero odds of any police resources being spent to track down a suspect (who had quickly moved to Canada) or find any witnesses to interview.

Although I did manage to do my own detective work and find some witnesses. Here are some things that they said to me:

"I don't know if it was legally rape, but Adam had to know he was taking advantage of her condition. She was quite amazingly drunk."

"I can't believe that Adam would have tried anything with her in that condition. She was already non-sentient and halfway to unconscious the last time I saw her that night"

"If anyone had sex with her that night, it was rape. She was having trouble speaking in coherent sentences and certainly was not passing anyone's Turing test."

"She was so incoherent that anyone could have had her and she wouldn't have known the difference."

Interestingly, this last quote was from an old friend of Adam's claiming that it could not have been rape. His logic was that since it was obvious to him and everyone else that my wife was in a state where she would not be able to say "no" to anyone or anything, no matter how disgusting or diseased, that she could not possibly have been raped - that she must have said "yes" to Adam even if she couldn't actually remember it. He even had the balls to tell me that I was lucky it was a nice safe clean guy like Adam because it could have been far far worse for my wife if Adam hadn't been there.

Anyway, I believe that Nevada law disagrees with this theory of "obviously too drunk to be able to say NO to anything so it couldn't be rape":

Nevada statute § 200.366 ¶ 1, "A person who subjects another person to sexual penetration, or who forces another person to make a sexual penetration on himself or herself or another, or on a beast, against the will of the victim or under conditions in which the perpetrator knows or should know that the victim is mentally or physically incapable of resisting or understanding the nature of his or her conduct, is guilty of sexual assault."

Not that they are seemingly interested in actually enforcing the "mentally incapable" part of this law.

The Vegas police really do not want anything to do with this type of case. These industry conventions make a lot of money for that town while being the ideal setup for a sexual predator. A smart one might well arrange his life in such a way as to be able to attend as many as possible. And, if you think about it, such a careful intelligent predator would definitely be someone who presented a kind, risk adverse, and pacifistic public persona while seeking known standing in the community. That way, if there was an issue, everyone would think it was just some sort of horrible mistake. Many of the predator's friends would never believe it, just as I am sure Bill Cosby has many friends who are quite convinced that his problems are all some sort of media driven conspiracy.

And so the victims are just left seriously emotionally scarred - to be triggered every time a TV commercial tells them that "What happens in Vegas stays in Vegas".

And the police not really wanting to investigate this kind of thing is just one reason that people don't like to go to them. There are a lot of others. No one wants the disruption that court cases will bring to their lives. If someone can just forget about it they will. It is absolutely the rational choice. If I could just forget about it I certainly would.

Also, I think the vast majority of people who are raped under the influence of drugs and alcohol decide that it is their own fault. Victim blaming makes others feel better because it makes the world seem safer for those who think they wouldn't make such a mistake. But it can also make the victim feel better. If the victim decides to believe that they did things that contributed and that maybe they really wanted it to happen on some level, well, then they don't have to think of themselves as a victim - it was just a wild stupid thing they did - a mistake to learn from but not get too upset about.

But now I am talking to this latest reported victim and hoping maybe she is willing to press charges. Maybe seeing her boyfriend being asked that question by Adam will do the trick? He is asking her, "why don't you just go to the police?" Well maybe she should go ahead and do this for him. Maybe he really wants to be stopped. We are still within the statute of limitations on this one. Atlanta probably isn't as inclined to want to suppress reporting of this kind of crime as Las Vegas so obviously is. Others may come forward if an actual police investigation is launched.

And just maybe "attempted rape" is a crime that makes everyone involved a little bit less victim blamey than actual successful rape does...

Sean Hastings
New York, NY
March 10th, 2016

UPDATE - RSA conf 2016

So, I occasionally get people contacting me with stories about what Adam Shostack has done to them, and I always tell them that I will only publish their stories if they can offer some evidence that they are not just trolling me. A few months ago, a woman told me that she once had a single drink with Adam and that she ended up in the hospital from an allergic reaction to an unknown substance. So I told her to send me the hospital records and I would publish the story. She said she would and that was all I heard of it for a long time.

Flash forward to today, and I get an email from the woman's boyfriend (or possibly the boyfriend of another woman who was her friend - it wasn't totally clear) saying that they are going to go to RSA conference and confront Adam and hand out flyers. They also tell me that they sent the medical records. So I go check my snail-mail, and sure enough I have received copies of very official looking medical records from an Atlanta hospital that detail a visit by this woman for extreme abdominal pain. She was admitted October 2nd, 2014 which Google shows me would correspond to the last day of the ISC2 Security Congress where Adam was indeed speaking.

So this now seems pretty credible, even if the Letter I was told I could publish, that seems to contain accounts by both the woman who got sick and a friend she was with, seems a bit garbbled.

I will also black out the woman's name and scan some of these medical records shortly. If I have done it, the image files will be Here. [Edit - uploading the medical records now, having received permission from the patient to do so. Scan05.png is very interesting.]

Sean Hastings
New York, NY
March 3rd, 2016

UPDATE - one year later

Here is an Email exchange I had concerning some anonymous letters sent out by yet another woman saying she was drugged and raped by Adam Shostack.

My first thought was that this was just someone trolling me after I had published the open letter below, but as you can see, I did manage to confirm that she contacted the Ada Initiative prior to the publication of my open letter. I was really not sure if I should publish this, but it is Vegas convention time again and I can't help but worry that Adam is going to hurt someone else who doesn't know his history. Follow the link and read from the bottom up for the correct chronology. If you have not read last year's open letter, you might want to keep reading on this page first for context.

Sean Hastings
New York, NY
August 5th, 2015

P.S. I just saw a report that the Ada Initiative is closing down. I am really sorry to hear this, as they seemed to be the only people trying to do something substantial to reduce this kind of sexual predation at tech cons.


An open letter to Adam Shostack, the man who raped my wife.

Hey Adam,

it has been 15 years since you shattered the lives of two good people who trusted you and considered you to be a friend.

Do you ever even think about it?

I still do, on a regular basis. I still feel guilty at not having been at Def Con that night to protect my wife from you. I still feel angry at her (and ashamed at myself for being so) for her poor choices that led to her being in a situation where she ended up blackout drunk and alone with you (someone she viewed as a safe friend of ours), and for her initial instinct to do anything and everything at all afterwards to avoid having to admit she was a rape victim. And I still feel completely impotent at having done nothing about it for 15 years, despite fantasizing often about how easy it would be to hurt you in oh so many ways, and hating myself a little bit every day for not being the man I sometimes wish I could be; a man who would make you suffer some equivalent to all the pain you caused us.

It probably never even crosses your mind anymore. We never pressed charges, both due to the difficulty and pain that would be involved in pursuing the case, and because you were not a sellout working for a big company like Microsoft then, but rather, on a cool cryptography startup that we did not want to see tainted by scandal. Once it was clear that no one was going to arrest you, and that I didn't really have the balls to come give you the life altering beating you still deserve, you likely just put it out of your mind and never gave it a second thought.

Now you have a new book out and are giving talks at various computer conventions. Congratulations on becoming such a public figure! These are the same kinds of conventions that my wife and I once enjoyed attending together and socializing with the interesting and intelligent people that frequent them. That is both a pleasure and a career building tool we can no longer pursue because it triggers such very bad memories for us and there is always the chance that we might actually run into you.

I even see you had the unmitigated gall to promote your book at a bookstore named after Ada Lovelace in celebration of women in technology. In case this is not clear to you: raping women at tech conventions can have a chilling effect on women in tech. I can only hope that this was a one-time crime of opportunity and that you are not an active sexual predator who regularly sets up these kind of situations. Damn do I really hope that, because otherwise, our failure to take legal or other action is far far worse and you will have hurt many more people by now.

Today you are giving a keynote speech at B-sides concerning "Good and Evil" and "burn out" in the field. Well I remember the exact day that your evil burned us out (well maybe we sputtered along for a while, but it was a losing battle), that was the day my wife told me what you had done to her. Once we had dreams of crypto-currencies, jurisdictional arbitrage, and accelerating the future; now I stay home and remodel my house at a sedate pace and turn down the occasional offers to be the CEO or CTO of new startups because I know from experience that such work will regularly provide little reminders of what happened to my family the last time we were involved in that world, while my wife had to take up a new career in an entirely different field. We can barely even tolerate visits from other good people who were in that same social crowd we were once a part of, so you even ruined our ability to enjoy the company of old friends.

Now we are raising a beautiful daughter and living in fear of one day having to send her out into a world that contains monsters like you, capable of disguising themselves so well that anyone might be fooled into thinking they are friends.

Anyway, it is an anniversary of sorts, and you seem to be doing well, so I just thought that maybe you should take some time out to think about what you did. You know it was wrong in every way imaginable, that you deserved to pay a very high price for it, and that you got off far too easily. And if you don't know that then you are either completely self-delusional or a sociopath. You should definitely count yourself lucky that the worse you will ever likely get from me is the occasional open letter to make sure you never forget about us.

Please know that your victims are still here together 15 years later thinking about what you did; still in pain; still wounded but surviving.

Yours truly,
Sean Hastings
New York, NY
August 5th, 2014