The Spine Collector manuscript thief finally arrested in the US – In The News
An online thief famous for their attempts at stealing unpublished manuscripts from famous authors has finally been arrested at JFK airport, the Department of Justice has announced.
Dubbed ‘The Spine Collector’, the previously unidentified assailant had, since 2016, used a number rudimentary cyber tricks to fool those within the publishing industry to send him yet-unpublished manuscripts penned by a variety of famous authors. Manuscripts that the thief attempted to steal included stories from Margaret Atwood, Ethan Hawke and Sally Rooney.
This largely involved sending emails to those within the publishing industry from domains designed to looked like real publishing domains. So for example, replacing a ‘g’ with a ‘q’, so the reputable @WylieAgency.com became the not-so-reputable @WylieAqency.com.
The Spine Collector would use these spoof domains to create near duplicate email addresses convincing enough to fool almost anyone upon a cursory glance. If the assailant could use this method to persuade a legitimate publishing employee that their spoof email was genuine, they had a good chance of persuading that same employee of hitting the Reply button and sending a potentially valuable manuscript.
Sponsored Content. Continued below...
The Spine Collector would impersonate any number of people within the publishing industry with a host of spoof email addresses, seemingly exploiting the inescapable reality that publishing bestselling books is a complex business requiring a plethora of different people, including agents, editors, judges, translators and publishing companies for each country a book will be released in. That’s a lot of people that need their hands on a manuscript, and thus plenty of people to both target and impersonate.
However this mysterious thief appeared to have one more important trick up their sleeve. An ostensibly intimate knowledge of the publishing industry. The thief knew who to email, and who to impersonate. They used the right abbreviations (e.g. MS = manuscript) and was even able to replicate email style, familiarity and even the email signatures of specific people.
It’s what we call a spear-phishing attack, which is a targeting phishing scam whereby the crook knows personal information related to their target that allows them to tailor each email specifically, and thus increase their success rate.
This was perfectly demonstrated in an email sent to two employees of Norstedts, a Swedish publisher. The email correctly addressed the two employees by name, and included a polite request to resend a link to the manuscript of the latest “Millenium” book originally started by author Stieg Larsson.
Dear Linda and Catherine,
I hope you are well. Could you please re-send me the link to the manuscript of The Man Who Chased His Shadow?
Thank you!
Best,
Francesca
The convincing email appeared to come from the Italian-edition editor, Francesca Varotto. It included her email signature and talking style. However, after some digging, red flags had started to appear. The spoof email used a previous job title in the description (the real Varotto had been promoted 2 month earlier) and the domain used to send the email was .com and not .it.
In this case, the thief actually did manage to get the link sent to them after sending a similar email to the book’s agent, but not the password required to access the link.
Sponsored Content. Continued below...
The Spine Collector successfully stole a number of manuscripts in their years-long tenure, but at no point did the thief demand ransoms or use any other type of blackmail against the publishing industry, which in turn baffled authorities looking into the case as to what the thief’s motive could be.
Could it possibly be just an impatient reader?
Those answers may be forthcoming soon, as the FBI has announced it had finally caught up with the perpetrator, 29 year old Filippo Bernardini, at JFK Airport in New York. And as suspected, he did work in the publishing industry, for well-known publisher Simon & Schuster.
The 29-year-old was charged with wire fraud and aggravated identity theft, and faces a possible 22 year stint in prison.
The full story can be found on Vulture here.