The Bibliophile

Speaker 1: So back in 2017, a posthumous sequel to the Girl with the Dragon Tattoo book series is set to be published. It's gonna be this big literary event, and the book's Swedish publisher, Norstets, is all hands on deck for the book's launch.

Speaker 2: K.

Speaker 1: Because a book like that isn't one book. It's 27 books. They're in Sweden. There's the English language version, Spanish, Japanese, international launches, translations, media appearances. People are calling, texting, emailing. The big day is coming up for this book. The book's Italian edition editor, Francesca Varetto, sends the folks at Norstead's, as well as the author's manager, an email asking them to resend her the link to the manuscript. Piracy is a really big problem with pre publication books, so what do you do to keep it locked down? Norsteads, the Swedish publisher, was using an encrypted, password protected email service called Hushmail to send the manuscript via email with the password to the manuscript delivered separately via phone for an added layer of security.

Speaker 2: Yeah. Very smart. I like it.

Speaker 1: Emails are flying. Everyone's calling everybody. The author's agent Magdalena Headland sees that email from the Italian publisher friend asking for the manuscript, and she fires her off the hushmail link to the book. Verona then sends an email to both of them. Hey, could I also get the password? The publisher sees this, knows they're supposed to deliver that password over the phone, so they text her, some to the effect of, Hey, you asked for this code? And the Swedish publisher immediately gets a callback saying, No, I did not. Whoever was emailing these people on this big day when everyone is running around trying to get this very locked down copy of this book out the door was not who they said they were.

Speaker 2: Classic. That's what I'd say.

Speaker 1: It's a classic. We're gonna talk about the mechanics of this phishing scam, the domains they registered, the social engineering, all of it. And we're gonna talk about the scale because at the same time as they were messaging Norsteads about this book, that same fake email was emailing other publishers about other books, and emailing yet other publishers about different books using different fake aliases. This was not one incident. It was a phishing spree, and it didn't just last that day. It had been going on for years and would go on for years further. What I want to dwell on is why. Why a person would undertake a project of this scope for as long as they did broadly speaking, you could do it to pirate books. Though spoiler to the end, there's no evidence that any of these titles were ever pirated. You could do it to steal the book and then blackmail the publisher, though there's no evidence that any of these publishers were blackmailed. You could do it because you're someone in Hollywood desperate to find the next piece of big IP everyone's gonna fight over. We talk about that theory for a while. Along with any of the other increasingly obscure practical reasons why you would do this. The why is what makes this one weird. Maybe they just really wanted to read the books.

Speaker 2: Yeah. That's what I'm thinking here. That you guys got a huge literary fan out there that just wants early access. Remember, I remember can't remember, but some movie dramatized that idea of getting a copy of of, the new Harry Potter. I think it was like The Devil Wears Prada or something. It was some really obscure movie. I guess that's probably not that obscure, but obscure to me.

Speaker 1: Obscure motion picture Devil Wears Prada.

Speaker 2: Yeah. Obscure obscure to me. I I'm not sure why I watched it. I remember it being kind of a cute movie, actually, if I recall. But,

Speaker 1: I think that's actually pretty pretty cute film. And weirdly, Harry Potter comes up later in the story.

Speaker 2: I really hope I really hope it's just, you know, some some nerdy hacker who's just figured out that the best thing for him to or them to do is hack their way into getting the story before everybody else. I I really hope that that's the this has, like, a a cute, like, teenage book nerd vibe to it.

Speaker 1: It I think you're gonna I think you're gonna like where this goes. Years later, the pandemic hits, and a bunch of journalists with ties to this publishing industry are stuck inside with nothing to do. And a bunch of them get onto this story, and they start digging. To this story that if it happened in almost any other industry, we'd probably know like a tenth of what we know about this. We know a lot about this one. So we're gonna talk about it now because a month ago, finally, the court case for this whole weird story came to an end. Concerning this person who seemingly, as you said, either really loves books, a bibliophile, or really, I guess, hates book publishers, which we don't really have a word for. So for now, we'll just call this one the bibliophile. Here, on Hacked.

Speaker 2: Is bibliophile a real word?

Speaker 1: Bibliophile is a real word. It's a person who loves books, like, just likes reading books.

Speaker 2: I I I I guess that makes complete Latin sense. I just Totally. Never heard that word before.

Speaker 1: Yeah. You don't hear it trotted out very often. But it is it was the first thing that popped into my head when I bumped up to the maybe this person just loves books a lot. I'm like, it's a bibliophile hacker. Like, they it's a person who loves books so much, they hack them before

Speaker 2: they come out. That I wow. I I'm intrigued and excited to hear the story. It's like it's like, you know, we we've talked about so many things where it's like people doing bad and

Speaker 1: Sure.

Speaker 2: Taking over this and

Speaker 1: Yeah. Sure.

Speaker 2: State sponsored

Speaker 1: hacking. And now

Speaker 2: it's just like it's like no. No. God gave me this great power, and I'm gonna use it, for personal gain because I wanna read more books that I can't get a hold of.

Speaker 1: Well, it's it I well, we won't get ahead of ourselves because there's there's a little bit more to it than that. I think it's a it's a there's some complicated motivations going on here, but we'll we'll dig into that. But not before

Speaker 2: But not before?

Speaker 1: But not before. We thank just the best Patreon on the Internet.

Speaker 2: Okay. Well, I think we have to have a brief chat about this before we jump into the the thanking list. So we got a notification from one of our patrons that we apparently missed. Yes. Anna De Lorenzo.

Speaker 1: Anna De Lorenzo. Thank you so much for your support.

Speaker 2: Yes. That for sure. But what it led to is that we were looking at email notifications from Patreon to see who would become a new subscriber since a specific date.

Speaker 1: Yes.

Speaker 2: And it turns out

Speaker 1: Mhmm.

Speaker 2: That we're not getting email notifications for everybody that joins, which seems surprising, but it's the truth. So we might have missed a plethora of people. So yeah. So I I think we should go back to what do you think? Like, April 1, maybe?

Speaker 1: I'm down to go back to April 1. March?

Speaker 2: What are you thinking?

Speaker 1: April fools, Patreon played a prank on us. Yeah.

Speaker 2: Let's go to April 1.

Speaker 1: Let's go back to then.

Speaker 2: Yes. So I recognize some of these names, but they were saying again because, you know, we love you all. Sean Miller, crow four zero four, godly goon, Jade Disarray, whom I do not remember saying before.

Speaker 1: I don't think we got Jade. Yeah. I think that one's new.

Speaker 2: Jesse Anger. I think we got Jesse. Did. Mark Christianson, Marco, Madeline Acosta, the Duchess. And I think I recognize a few of those. Some of those are new. So I I think if we have missed you, jump on Patreon and fire us a message. You will get a personal apology, and we will make sure to, look out for you next time. And thank Anna Di Lorenzo for bringing this to our attention.

Speaker 1: For for blowing the whistle on this Patreon scandal.

Speaker 2: Oh my god. When you thought you could trust a platform you know, you know what I mean? Notifications, wasteful notifications that I just don't care about, I have to mute every day. And the one notification I want

Speaker 1: That really matters. Me. Totally. Like, we'll we'll inform you about some of the people that have been kind enough to support your podcast, but not all of them, and it will be unclear which is which.

Speaker 2: K. Well, let's jump back into bibliophiles.

Speaker 1: The bibliophiles.

Speaker 2: Again, a word that I had don't think I've ever heard, but I It's

Speaker 1: a pretty good word. Love. I I definitely re googled it to make sure I was using it right, and I'm presently re googling it to make sure that I'm using it right. I'm using it right. Cool. A person who collects or has great love of books. I'm good.

Speaker 2: I had I had faith in you. I knew I knew you had it. I was like There's something you're good with, Jordan. It's words.

Speaker 1: It's like I I'm pretty I'm 99% sure. So book piracy. Book piracy. Let's take a little detour and talk about book piracy. Back in the early two thousands when people were starting to get really concerned about Internet piracy for good reason, this idea emerged that the easier it was for people to legitimately get your content, the less piracy was gonna be a problem. I think that is both true and false.

Speaker 2: Yes.

Speaker 1: I was curious how books compared to other media. It's basically reading tea leaves trying to figure out the cost of piracy because a pirated movie does not equal, say, one lost movie ticket or movie rental. There is a lot of content that is only consumed because it is free.

Speaker 2: Yeah. Yeah. Exactly. The economics of piracy.

Speaker 1: It's super interesting. I'd like to do more of these about sort of just the history of piracy on the Internet, but books are an interesting kind of side case study.

Speaker 2: We should we should do that. I have some I have some interesting thoughts on what open access to to software

Speaker 1: and

Speaker 2: stuff, certain things has led to in society. So I think that that's a good episode concept. We should mark that one down.

Speaker 1: We should do that one. I wanna do a LimeWire and Kazaa and Morpheus era peer to peer sharing network retrospective. I feel like there's a lot to dig into there. But so you have to take a lot of these numbers with a grain of salt because they're often the result of research done in a lot of cases to justify, really just harsher legal handlings of piracy. Let's use movies for a comparison. A lot of people steal movies. According to the GIPC and NERA Economic Consulting, quote, in 2020, there was an estimated a 137,000,000,000 visits to film and TV piracy sites globally, which cost The US economy, this is the important number, at least 29,000,000,000 in lost revenue each year. Wow. That is out of the, quote, combined global theatrical and home entertainment revenue representing 99,000,000,000 in 2021 according to the MPA. So if we're doing some probably bad napkin math, that says we're looking at about 30,000,000,000 lost out to piracy in film out of a $100,000,000,000 American film industry. 30 to a 100 do with that ratio what you will. Alternatively, according to a 2019 Forbes analysis, book piracy estimated to cost US publishers $300,000,000 each year. It's not insignificant, but it's about 1% of what you see in film.

Speaker 2: That's a really good narrative on society right there.

Speaker 3: You know?

Speaker 1: Right? When

Speaker 2: it it's like the book people are book people and everyone is a movie person.

Speaker 1: Totally. Like

Speaker 2: that. Just the just based on the scale of you can you can rank the scale of a market by how much piracy exists in it.

Speaker 1: But I I think there's more to it than that because, so the question that asks is, is the publishing industry 1% the size of the film industry? Right? And the answer, it would seem, is no. The most recent numbers I found is that it is about one quarter to one third the size of the film industry, about 30,000,000,000. And yet it is about 1% of the piracy.

Speaker 2: That's still massive. It's way bigger than

Speaker 1: I would have thought. But then I was talking with my partner about this. She was like, you know there's bookstores in every mall. Right? And every airport. And I was like, right. There's, like, whole stores that just sell books.

Speaker 2: Right. Right.

Speaker 1: Books popular. This makes tons of things.

Speaker 2: From just selling books.

Speaker 1: Totally. I I majored in English. I paid money to be taught how to read books I could already read. Like, books are popular. So why? You you really

Speaker 2: you also really have to respect the fact that, you know, in today's kind of climate, we're watching the decline of I guess it's just based on the I'm now just having a conversation with myself, but, you know, magazine magazines have been significantly impacted, you know, or digitized. But I guess it comes down to the amount of consumption required. Like, it would be hard to sit down. I guess Kindle is the digital equivalent of a magazine, but of a digital magazine or the digitization of a magazine. Yeah. I I you know, I guess book books still have that standing power. You know? When I go on vacation, I make sure I pack a physical book.

Speaker 1: Totally.

Speaker 2: And, you know

Speaker 1: One and magazines managed in a lot of cases to make that jump. I'm not even sure if it's better than books. Books did pretty good, but we think of a lot of legacy magazines that are just very, very, very popular websites now. It certainly impacted how they were able to monetize their journalism, but they were able to make that jump in a lot of cases.

Speaker 2: Yeah. If not expand the reach. You know? And now we're now we're consuming consuming, like, the production. Like, we've made magazines, you and I. That's a Mhmm. That's a real thing. Yep. It costs a lot of money to make a magazine, like, the physical production of it.

Speaker 1: Tens of thousands of a thing? Yeah. It's not cheap. You could spend that money Or

Speaker 2: hundreds of thousands?

Speaker 1: Totally. Like, you could spend that money, as we have learned, kind of expanding your print product into a whole media thing. It's like there was no reason for you to for a magazine to get into video because you can't print those on paper. But now you can have documentary departments and podcasts all kind of under that banner if you think of it as a

Speaker 2: Sure. Yeah. Cooking, like

Speaker 1: digital first product. But

Speaker 2: Cooking YouTube channels that have spawned out of major lifestyle magazines is it's a Exactly. The digital revolution has been good for content. What was once a was once a dry page in a photo of a dish is now a twenty eight minute YouTube video about how to make it with

Speaker 1: just as many ad breaks as it had in print. Exactly. Go going back to this discrepancy. Right? One quarter of the size, but about 1% of the piracy. There's an unattributed piece in TechCrunch that speculates, that it's all about what the kids are into. Quote, perhaps it was because the kids care less about stealing books than they do about cracking the DRM on movies, which is why bookshops remain unscathed during the London riots while DVD stores down the street were looted. Or maybe it's because the book industry learned from what happened to their audio and visual cousins. Either way, devices like Kindle, Nook, and iPad, and publishers' willingness to embrace them allowed a legitimate and lucrative electronic publishing industry to grow up before the pirate sees the initiative. Books got on to digital distribution early. They're less popular amongst the age demographics that pirate content hardest. If you buy that hole, the easier it is to get your content, the less piracy is gonna be a problem argument. This is a relevant data point.

Speaker 2: Mhmm.

Speaker 1: So then there's this subset of piracy. Right? Kind of its own thing, which is leaking. Like, before a launch, the book leaks. Books being leaked before their launch is a uniquely storied history. You name a popular franchise, odds are one of them snuck online before the book actually hit shelves. Harry Potter, Twilight, 50 Shades of Grey, Let's rush to the present. Number one most recent bestseller, Prince Harry's memoir, all leaked before launch. Books you wouldn't think anyone would care to leak leak before launch. Book books leak.

Speaker 2: Do you think when a book leaks, it impacts sales? Mhmm. Because here's the other thing is, like, book people Yeah. Like to own the book.

Speaker 1: Yep. Mhmm. They sure do.

Speaker 2: So it it's like, if I'm such a fan Yeah. Of 50 Shades of Grey that I seek out If. Big if there.

Speaker 1: Big if.

Speaker 2: That I seek out

Speaker 1: Sure.

Speaker 2: An illegally distributed early release copy.

Speaker 1: Yep.

Speaker 2: I'm gonna bet that I still go out and buy the physical copy.

Speaker 1: I would bet that you're in a lot of cases, right. I'm sure there's a subset of people that go, I'm I already have this book on my Kindle. I got a hold of it pre release. I'm never gonna buy it. I think that's probably true. I think for Yeah. Really ride or die fans, the book come you are able to get a hold of the book a couple days before launch. You start reading it, and then you pick up the book hopefully on launch day when, you know, you can get a physical copy of it.

Speaker 2: Or go to a signing?

Speaker 1: Exactly. And if it's just if it's a thing you wanna have on the shelf, you might you're probably gonna pick up a copy. If you were only ever gonna buy a digital copy once you've got the pirated version, it then takes on, there's, like, an ethical choice to support the author and the publishing industry and retire your pirated copy and go buy a real copy. But that's a very different one is you want the physical thing on the shelf. The other is you want to support the person who created it. There's two different motivations there.

Speaker 2: Mhmm. I don't know. Maybe it's just like, movie piracy is just like I'm bored. I wanna consume something. I need something to distract me from the fact that I'm stuck in existential crisis.

Speaker 1: Exactly. A

Speaker 2: book is like I

Speaker 1: need something to point my senses at so I don't have to think about whatever I was thinking about.

Speaker 2: Ex exactly. Exactly. And it's I feel like I feel like if I'm if I'm if I'm stealing books, then stealing books be like you know, this is my hope for this story is that hope that we're you know, some hackers stealing them because they just can't or they can't wait to get the content. Sure. It's kinda it's kinda like a cute love affair, but in a very legal way.

Speaker 1: Yeah. That's

Speaker 2: that's part of it. Part of it. Okay. Okay.

Speaker 1: This brings us back to that fake version of the real Italian publisher of the book from the intro, Francesca Verodo. That spoofed email. The real Verodo works at an Italian publisher called Marcilio Editore, and their IT department starts digging into these spoofed emails. Turns out same day, the fake Verodo went after The Girl with the Draken tattoo. They also went after a bunch of other books. The spoof version of the email was actually the correct, like domain, but .com instead of it. So they, they got a better version of the URL. The fraudulent domain was registered through GoDaddy to an Amsterdam address created the day before the scam attempt and had a Dutch phone number registered. They call up the phone number, and it is the Dutch hotline for IBM. Best guess is this person, imitating Verodo, had actually started back, probably, like, a year or two earlier. Fall of twenty sixteen, first phishing email starts circulating amongst a select group of people, managing the flow of prelaunch manuscripts between countries, this very insular part of the publishing industry. Foreign rights manager in Greece, an editor in Spain, an agent promoting international writers in China, which is where we start to kind of make the case that this person might be an insider. During the attempted girl with the dragon tattoo heist, only a handful of people worldwide were aware that that book was being distributed to foreign publishers and that the specific people at that Swedish publisher were in charge of giving out the hushmail and password links to it. The hacker knew that they also knew if he go through all of these emails, a lot of the lingo, Scott, say you get an email from someone in publishing and they use the acronym M S What what would you guess that stood for?

Speaker 2: I'm gonna assume manuscript.

Speaker 1: Nice. I ding ding ding ding ding.

Speaker 2: Thank you.

Speaker 1: Yep. That's good. That's good. One down. You you're welcome. W e l rights.

Speaker 2: World exclusive license, I guess, licensing?

Speaker 1: Oh, pretty good. That's pretty good. World English language rights. You got world right.

Speaker 2: Ah, k. K. Yeah. Not bad.

Speaker 1: So I Good. Good. Wouldn't have known that. The hacker did. So this case, maybe they're on the inside. But what kind of insider? There's a job in publishing called a literary scout. So folks in film and other mediums are constantly looking for IP. Books often get turned into movies. There's money to be made getting early access to books to be able to advise the people buying your clients. What what's a book you might wanna take a look at before it even comes out?

Speaker 2: Interesting.

Speaker 1: Yeah. It's not a common job. There's probably only like a few dozen people worldwide who do this. But it's a really specific job that would fit the MO that's kind of emerging here.

Speaker 2: So you're like an internal critic?

Speaker 1: Kind of. You're almost like a book spy. Like, you're you're trying to get a hold of books before that. You don't work at a publisher. You're just trying to get early copies of books to show to people that license books. Hey, give this a read. It's gonna be coming, it's gonna go public in a few days and you can have made up your mind if you want it and get in early. Right?

Speaker 2: Okay. Okay.

Speaker 1: You're working behind the scenes to help make these deals. You're cultivating those relationships with publishers so that they can give you they call those early, things slips, which are manuscripts acquired secretly from well informed sources inside publishing. You get a slip, you give your client a competitive edge. So maybe this is someone trying to generate slips. Also, it's not a very common job. So if you're looking at scouts as the possible hacker, you're looking at a nice small suspect pool.

Speaker 2: Sure.

Speaker 1: In this weird, obscure job, you rarely see people working together trading manuscripts because you're kind of getting too friendly with your competition. But in 2018, a scout named Natasha excitedly messages are one of her clients. I've got a potential manuscript trade for this hot upcoming new book. Another scout named Jane Southern had reached out to her offering to exchange Ian McEwen's, you know, hot upcoming new novel for a significant release that Natasha had. Natasha is pumped. She makes this trade, gets an early copy of the Ian McEwen book, goes to show it to her, like, clients. But then she bumps into Southern while she's at like a trade conference book fair in Frankfurt. This is the person she's doing the trade with. And she goes up to them and thanks them. Hey, thanks for making that trade with me. And Southern says, I have no clue what you're talking about. And just like the intro, Natasha realizes that the person she'd been talking with and trading books was the thief. The hacker had gotten a copy of Ian McEwan's book from another phishing scam and then turned around and used it as lure, kind of bait in this trade for yet another book they didn't have a copy of.

Speaker 2: To get more. To get more. So they're re upping.

Speaker 1: They're re upping. They're reinvesting. They're, like, stealing a book and then using it to steal another book. Wow. So the focus is starting to to hone in on this Hollywood IP scouting system, Then it accelerates by 2018 or so word of this person is starting to make its way really through the publishing world. People know about this. And by this point, there are people who have basically been in months long catfishing relationships with the book hacker thinking they're talking to someone else until like Francesco and Southern someone bumps into someone in person or realizes they weren't talking to who they thought they were talking to. Or they don't because spoiler there's probably people who up until very recently like last year were still talking with this person thinking they were someone else.

Speaker 2: I guess this just demonstrates how effective social engineering and phishing can be

Speaker 1: So much. When you

Speaker 2: go quality over quantity. Totally. Like, when you have when you have 10 or 15 prospective, you know, targets, Like, look at how effective you can be Mhmm. Like, years of of manipulation Yep. Versus, you know, 400,000 bulk emails that nobody reads Totally. And get auto deleted by spam filters and corporate security systems.

Speaker 1: Mhmm.

Speaker 2: Like, that's just that's amazing. Like, that's a that's a, like, a that's like a movie. This needs to be a move this needs to be a book. If these people are book people, turn this into a book.

Speaker 1: Oh, I'm sure someone's gonna write a book about this. I think I know who's gonna write a book about this, but we'll get to that. So right before the pandemic, people start to go more public with this. One of those scouts, tells a big British trade publication called The Bookseller about the situation. Publishers Weekly does an interview with someone about the book hacker. A New York scout reaches out to the state attorney general's office who is advised to consider talking to the FBI given that this is a weird complicated jurisdictional nightmare. But paranoia is starting to kind of start to simmer in the publishing industry. You've got people signing NDAs for really obscure novels no one has ever heard of. And it's not just the publishers being impacted. Writers were starting to get emails from this person pretending to be their publisher or agent asking for copies of the books while they were being written. This person is just on a tear and they have the attention of the entire publishing industry.

Speaker 2: You figure if they were internal

Speaker 1: Mhmm.

Speaker 2: If this was an inside job, they would know that people were getting close. So it's like, why would you speed up? I guess this is like the like the what do you call it when you, like, you take the last gasp before you die? It's like that, like

Speaker 1: Right.

Speaker 2: Last jolt. Maybe they're just trying to maximize output Maybe. Right before they go, like, you know, ghost. Yeah. But, anyway

Speaker 1: That would suggest, though, that people were anywhere close to finding the person. And they were trying. So people start laying traps, and I I like this one. So you got this this hot upcoming book coming out soon and someone's people you're getting emails from people asking for it. Most of them legit, but you know some aren't. So some people started swapping out the real text of books partway through the book for other copy from other old books. Like, it would just be Jane Austen copy halfway through the book and it would switch over. And the idea is that you could use those custom doctored versions to try and suss out who the hacker is because if that doctored version ever made it up to some IP person, or some other publisher, or get used in one of these trading scams, you could work your way back to who had that original doctored copy. Pretty clever. Kind of a honey pot. Mhmm. The hacker never falls for it. And this just keeps going. Over time people start to question the it's a scout theory that's been dominating this very intense but insular discussion. In 2019, the sequel to, Handmaid's Tale book called The Testaments became the thieves chosen obsession. They're just hammering people trying to get it. If you come back to the why, if it's about rights, that book, The Testaments, it's foreign publishing and film and TV options. All of that stuff was long since sold by the time the hacker started going after it. Sure. It's not really valuable to a scout. It's no good to them. All the thing they would be selling has been sold. So you go down the list. Is it piracy? Well, none of the other books were ever pirated. That book was never pirated. Ironically, the only public leak of the testaments prior to its launch was when Amazon accidentally shipped just shy of a thousand copies off before the launch date.

Speaker 2: Classic.

Speaker 1: It's a classic. Right? Scouting doesn't really track. Piracy doesn't track. And just going down the list of old reliable culprits, if it was like a nation state actor, a, weird target. And b, they knew way too much about a very small corner of the publishing industry.

Speaker 2: Turns out there's just, you know, Kim Jong Un is like a massive

Speaker 1: book. What if it's a great deal?

Speaker 2: File. Yeah. He's a massive biblio file. Biblio file. Just turns the

Speaker 1: entire bibliophile.

Speaker 2: Like, information infosec sector into, like, getting him books that he can't get.

Speaker 1: I need Prince Harry's memoir before anybody else.

Speaker 2: Yeah. I need the dramas.

Speaker 1: Exactly. That's I need to know the drums. One handful of cybersecurity professionals brought in discovered that the thief had kind of started upping their security measures in 2019. Over time, it looks like they registered over 300 fake domains, but they'd added like slightly better digital security certificates, right around 2019. Those certificates, they were able to suss out reveals that a single entity controlled all of these different domains. Other investigators, because there was multiple groups of investigators working on this independently, inquired about potential credit card information and the thief's expenses. However, GoDaddy confirmed that it had reclaimed several of these domains likely due to payment fraud. As it appeared that the thief was using stolen credit cards to do all of this. Some more insiders turned to the FBI for assistance, sharing the thief's emails with the bureau. But the case remains kind of low on the priority list, it seemed, because this person wasn't really doing financial harm. They weren't leaking the books, weren't pirating them, they weren't blackmailing the publishers. It was just very, very weird waste of time, really. But I guess, remember, at least two parties have now contacted the FBI about this because that becomes relevant later during COVID the hacker got a little mean. At the end of that first pandemic in August, a woman named Linda Altrov Berg, who is part of the, Swedish publisher from the intro, gets a message. Was a thief impersonating a Spanish editor asking for a book that Berg knew the editor would never want. She knew, okay, I'm talking to the hacker. And she sends a message back, keep on dreaming. Just a pretty polite way to respond to someone trying to hack you. Mhmm. Previously, the the thief had kind of, like, retreated when being confronted, But this time, they replied in Swedish, which in English means hope you die of coronavirus.

Speaker 2: Wow.

Speaker 1: They start tricking low level publishing people to work for, like, bad pay that they never actually paid them, like, translating books for a $150 and then ghosting them without payment. Just, like, weird kind of petty stuff. It's really out of character with their MO up until now, which has really just been about trying to get these books.

Speaker 2: Could it could it could it be that there's multiple people?

Speaker 1: It doesn't seem like that's what's going on. Seems like that purse this person, whoever they were, was just having a hard time with coronavirus and was acting like kind of a jerk.

Speaker 2: Just just just got in their head the the feels, the mental health aspect of being locked away.

Speaker 1: I I think that's part of it. So Vulture, New Yorker, all the coverage that I read, interestingly, had this very cryptic reference to a suspect. This unnamed person who everyone was secretly convinced was behind this, like, again for years.

Speaker 2: So wait there was a, like, a unanimous unanimous theory that it was a specific person?

Speaker 1: Not quite unanimous, but over time, it sounds like a name started to percolate.

Speaker 2: Interesting.

Speaker 1: First, only a couple people thought it, but then as more and more people became aware of this and everyone goes, well, who do we think it is? This name starts to, you know, rise up. To quote that Vulture article, he was from another country, and his English wasn't great. His manner in person and writing could be brusque. His client list was small. His scouting business sometimes struggled. One former client told us that after parting ways with the scout, he would, like, kind of he sent her so many texts that she had to block his number. He wasn't on the literary social scene, which made people presume he was kind of resentful. Then again, one scout admitted to vulture, do we all just think it's him because he's weird? After the break, I want to talk about the person who was arrested in January for this very strange years long hacking spree. The funniest thing about this story that gets in my opinion, a little less funny from here out is a tweet. And it concerns that suspect, the person everyone was certain was behind this just for years, an open secret that everyone was convinced it was this person. Last January, the FBI arrests a man at JFK Airport, In that same day, literary agent Kent Wolf posts a tweet, quote, which of us is in charge for ordering the gift basket for the poor soul everyone was fingering as the manuscript scammer? Because the FBI had arrested 29 year old Filippo Bernardini, who pretty much no one throughout this whole story had ever heard of. His story, his arrest, and the result of his court case after the break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you Get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button that's used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts sort of getting abandoned in the parking lot and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked.

Speaker 4: No one goes to Hank's for spreadsheets. They go for a darn good pizza. Lately though, the shop's been quiet, so Hank decides to bring back the $1 slice. He asks Copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more at m365copilot.com/work.

Speaker 3: This episode is brought to you by Fox one. Watch all 104 matches of the FIFA World Cup live in four k for just $19.99 a month with three days free. Build your own multi view, choose up to three streams, and follow player spotlights. Stay on top of every moment with live stats, highlights, and instant replays. The FIFA World Cup, streaming live on Fox one, offers a subject to change. See fox.com for complete terms and conditions.

Speaker 5: If you've got an insurance question, you could talk to your nana. But she'd probably just tell you how she insured her couch from stains by covering it with plastic. Or you could talk to your local GEICO agent. They'll give you a different kind of warm and fuzzy with personalized assistance for all your insurance needs, like how you could be saving on your policies. So let your nana cover her couch in plastic and let a local GEICO agent help cover you, but not in plastic. To find a GEICO agent near you, visit geico.com/local.

Speaker 2: Okay.

Speaker 1: Okay. Okay. Who's Filippo? Okay. On January 5, 29 year old Filippo Bernardini, working in the foreign rights department at Simon and Schuster's UK division, is arrested by FBI agents at JFK Airport. So before we get to why, who was this dude?

Speaker 2: Let's do do who and how. Do who and how.

Speaker 1: Yeah.

Speaker 2: I don't know who this guy is. Let's do a little How they caught him. Do we have that detail?

Speaker 1: We don't actually have how they caught him. That's one part of this we we do not know. I would I would guess, the full weight of the FBI looking into it is is the short answer. Mhmm. But how they actually found him, I I don't know.

Speaker 2: Interesting.

Speaker 1: So back in 2008, Bernardini is a teenager residing in a small town an hour north of Rome, and teenage Bernardini writes a book. And he gets it published by an independent Milan based publishing house. He uses a pseudonym Filippo B for the publication, and the book is called Bully. And it was about a teenager named Diego who got bullied at school. He's smart, does well in his class. He loves books and hanging out on the internet. Diego in these diary entries that the book takes the form of writes about a struggle stating that people called him gay and that school bullies wanted to beat him up. And in the book, there's this scene where Diego has this rare win. He gets the new Harry Potter book before anybody else impressing all of his schoolmates. But aside from that moment, Filippo's protagonist Diego has a pretty rough go throughout the book. He reflects on how to escape being bullied, and he entertains whether the answer is to become kind of the bad guy himself. He thinks about committing a robbery and says he thinks he'd be really, really good at it. In an English lit class, we would call that foreshadowing. Bernardini pursued a publishing career from a young age. He studies English and Mandarin at an as an undergraduate in Milan in the early twenty tens. He works as a proofreader for the publisher that released bully, for the publisher that released bully. And he posts on Instagram about getting kind of early access, advanced copies of books from authors like Jonathan Franzen and Nick Hornby hashtag uncorrected proof, hashtag advanced readers copy kind of thing. 2015, he moves to The UK to get his master's degree in publishing. He's clear he wants to work in this field. And according to a resume he sent out, the focus of his dissertation was on the children's literature classic Pinocchio, a story about a lying puppet. In English lit, we would call that foreshadowing.

Speaker 2: I'm glad I'm glad your English degree is coming in coming in hot here.

Speaker 1: It was bound to come up eventually. After university, Bernardini begins pursuing a career in publishing. In his resume, he states that he has language skills as a translator and proficiency in PHP and HTML. 2016, Bernardini interns at Andrew Nurnberg Associates, a London based literary agency. He doesn't get a full time job at the end of the internship. And shortly after his departure, the company's website was hacked with pages defaced, personal information exposed on the site, along with insulting comments left behind. Nuremberg never identified the individual responsible for that hack. FBI alleges that Bernardini starts attempting to steal manuscripts during his Nuremberg internship at age 24. He has a tough time finding a job after he leaves. He applies to a bunch of places, doesn't have any luck. Twenty sixteen, he starts pitching himself as a translator. Couple places give him a chance, but he doesn't stick around long as his translations weren't quite up to snuff at that point. If you remember that 2018 attempted hacking of the Margaret Atwood, book The Testaments, sequel to The Handmaid's Tale Mhmm. It's right around now that Bernardini interviews for an assistant position at the very same agency, where he would be responsible for managing several prominent authors. One agent at that place, Curtis Brown, remarks that if Bernardini was the hacker, he sure did apply and come in for a job for an interview at the exact same time he was allegedly hacking them. He is nothing if not confident.

Speaker 2: That's gonna be an interesting vibe in the interview room. Yeah. You're sitting there knowing that you're, like, essentially breaking into this place.

Speaker 1: Pretty much.

Speaker 2: I wonder if that's confidence boosting. I've been

Speaker 1: Just thinking that. Like, you got a little swagger in your stuff when you go into that interview.

Speaker 2: Yeah. You got, like, the you know, those the smirky emoji with just the corner of your, like, lips going up? I feel like that's the attitude you go in with if you're, like, actively breaking into a company that you're also consequently interviewing for a job at.

Speaker 1: Yes. If this was a movie, and I'm sure it will be, that would be a pretty great scene in it. Mhmm. So there's the stretch of time. It was just years applying and pitching himself, applying and pitching himself, trying to climb this corporate ladder that just would not have him. In this industry, books that he's clearly loved for a very, very, very long time. That application rejection cycle starts to tell a bit of a story about a person who's frustrated. He finally starts to have some luck in 2018. When an Italian publisher starts having him translate some bestsellers out of China, he's got, he's got a toehold in the industry and eventually he secures a full time job in the foreign rights department at Simon and Schuster UK. Things are starting to go well. Gets gets promotion, a book he translates ends up on like a fancy 10 books to read last summer list everyone in the industry cares about. After years of struggling, he's starting to break into publishing. And yet it would seem, even as his fortune is kinda turning around a little bit, he keeps up this weird alleged side hustle right, like, right up until the day of his arrest.

Speaker 2: Well, let let let's just hang there for a sec. We say side hustle. Is he making money?

Speaker 1: You make a really good point. We can't even really call it a side hustle. He never made any money or, advanced his career doing it. We now know he's an aspiring publishing professional. It doesn't seem to have helped him at all.

Speaker 2: So looping all the way back to the beginning of this episode. Yes. Theory says evidence points to the fact that this person was literally stealing these books solely for the game of it as well as to probably just read them.

Speaker 1: Yes. Yes.

Speaker 2: Wow.

Speaker 1: It it really does look that way. The charges against Bernardini accused him of committing wire fraud and identity theft. The indictment claims that beside the counterfeit domain names he used, he'd actually started, creating fake phishing web pages, a, quote, minimum of two harmful pages that closely mimicked the main page of a database used by a scouting agency in New York. Like he said in his resume, HTML and PHP. And it's alleged that Bernadini persuaded multiple clients of that agency to go to this link where they would have entered their passwords into the fraudulent site. Possibly if not probably granting him then entry to the real site using their account credentials. That was at the start of last year when he was arrested. He's been in jail since then. This past month, the trial wraps up and Filippo pleads guilty. I managed to research this almost chronologically. Like, I knew he'd been caught while I was reading about it, but not that he'd plead guilty. So the whole time, I'm kind of trying to decide in my head, like, what do I think should happen to this person?

Speaker 2: Yeah. I was I was literally just having that moral discussion in my head as well. Right? It's like like, aside from a bunch of wasted time Yeah. It sounds like the harm was pretty low.

Speaker 1: I would tend to agree.

Speaker 2: And it's, you know, in in today's current you know, crime is becoming definitely a talking point in the political spheres of media. So it's intriguing. I'm I'm intrigued to know what what the penalty for this is.

Speaker 1: So Bernardini pleads guilty to wire fraud. The result, the judge, Colleen Mcmahon, sentences Filippo Bernardini to time served. No additional imprisonment. He has agreed to compensate Penguin Random House with $88,000 to cover cover the legal and expert fees incurred due to his actions. And he's also received a three year supervised release sentence and will probably be deported from The US back to either The UK or Italy where he spent his childhood. The bookseller, that publication from earlier got a hold of a bunch of the court documents in which Bernardini writes in his own words, why at least he says he did this and we finally get an answer in his own words as to why.

Speaker 2: Oh my god. Do tell.

Speaker 1: Regarding the books, he, quote, wanted to keep them closely to my chest, and be one of the fewest to cherish them before anybody else, before they ended up in bookshops. He says he had a burning desire to feel like he was a publishing professional, and that he had no intention of leaking the books he sold. He felt a quote special and unique connection with the author, almost like I was the editor of that book. And then I think the big important quote here, he explains how it all starts. One day, I created a spoof email address for someone I knew of in the publishing industry, and I sent an email to someone else that I knew of asking for a pre publication manuscript. I wrote in the style and using the language that my former colleagues had used, and when that request was successful, from that moment on, this behavior became an obsession. A compulsive behavior. There's a lot of practical reasons to write something like that in the context of what seems like a slam dunk court case against you, but a love for books, a deck, a years long desire to be part of that world, all yielding this compulsion when you figure out what you can do, I kinda buy it.

Speaker 2: It's such an interesting a lot of hackers, if you go back in time enough, they did it they did it for the game. Sure. Nobody ever had malintent. It was a puzzle. You know? We're puzzle gamers. I've made this reference before, and it's Tires. People wanted to yeah. People wanted to crack things, crack the code. Yeah. This guy used identity theft and and phishing and impersonation to crack a code in publishing

Speaker 1: Totally.

Speaker 2: And got him got him a reward that it's very strange. You know? Like and the thing that shocks me about his punishment is that it's it's way more lenient than I expected. Mhmm. Like, you've got to assume that the judge took sympathies.

Speaker 1: I think they did.

Speaker 2: Because, like, we've on this show, we've talked about people that, like, view the source code of a web page and get five years in prison.

Speaker 1: Great. Yes. A 100%.

Speaker 2: And and that's something that's not even illegal and is common functionality and is actually just the way that the Internet communicates

Speaker 1: with

Speaker 2: source code.

Speaker 1: Sure.

Speaker 2: So that's that's that's I'm I'm more shocked that in a digital theft world and in a way that in the world that we're punishing

Speaker 1: Yes.

Speaker 2: You got to assume that their truth in that matter was a significant part of getting them a leniency on their sentence. Yeah. They I bet if they pled not guilty

Speaker 1: Yeah. Might have been definite.

Speaker 2: Proven. Yeah. It might have been a way stronger thing because that just seems shockingly low to me given how severe others get punished.

Speaker 1: They pled guilty. They never made a buck doing it. So what did they do? They impersonated people. Like, don't don't do that. That is a crime. That's bad. But a year in jail, $88,000, and you're deported.

Speaker 2: 88 k.

Speaker 1: Is that it it's like, okay. We're we're in the ballpark there. I don't I certainly don't think it should be more than that. Like but they didn't pirate the books, didn't blackmail the companies, didn't leak them. They got books for free. I do that all the time. I go to the library.

Speaker 2: Mhmm. Exactly.

Speaker 1: You know?

Speaker 2: They just they just got them a few months earlier.

Speaker 1: Yeah. It's like you the impersonation part, that's you shouldn't do that. That's not a good thing to do. You you do do material harm.

Speaker 2: We're not we're not justifying it here in any way.

Speaker 1: Not at all. And punishment? Let's talk about that. But I'm glad that this wasn't we're gonna make an example out of you. I don't think that's what this needed. I think this was a person that kind of stumbled into a bit of a compulsion, and it just lasted for a really, really long time.

Speaker 2: It's such a personal story too. Such an interesting like, you got to imagine there's a hole in, like, especially given the words that they wrote in their plea. There's a whole empowerment angle there. You know? Like, I felt powerful. I was seeking seeking professional esteem and things like that and wasn't getting it, and this this gave me a a bit of a personal power. You know? It made me feel Yes. Probably better than he did on an average Tuesday. And it's it's just it's it's, yeah, it's very interesting. It's a very interesting story. I really hope that it gets turned into a book. Maybe who wrote The Big Short, Michael Lewis?

Speaker 1: I think so. Well, so here here's what's interesting about that. His lawyer described him as being it's kind of part of arguing that he has been punished more than enough for this, which I think I agree with. But they described him as being, quote, effectively banned from the publishing industry as sort of part of how he's been punished in a very intense way, given that we know about him.

Speaker 2: Of course. Yeah.

Speaker 1: The irony here is that while Filippo Bernardini, publishing professional, is, as his lawyer said, probably effectively banned from the industry, Filippo b, the author, would probably have a very good career ahead of him if he was to write a book about this.

Speaker 2: You know you know what?

Speaker 1: Like, I I would read that book.

Speaker 2: Your your theory here, if if Filippo v, if you're listening, I feel like this is you've you've created your own story.

Speaker 1: Well, that was that was the name he used to publish his first book, Bully. And I I it just seems like maybe an opportunity there.

Speaker 2: It feels very like, it's got a Wolf of Wall Street angle to it. Yeah. Like, it's like, you know, a bad person who's been punished then comes out and writes a book about all the bad things they did, and then it gets turned into a huge movie, and then you get wildly successful from that. I feel like this could have an angle like that. Like, I'm I don't think what they did was right by any means. I I think that they No. They were punished. I don't think the punish was nearly as severe as I would have expected. But, also, you know, the my my bigger questions would be, a, can they control the compulsion? Because let's be honest.

Speaker 1: Yes.

Speaker 2: It's probably gonna be tough. And and be are they themselves gonna license the story, or are they going to do it themselves? Because that's interesting. Imagine being somebody sitting in who sued them for the 88 k Penguin?

Speaker 1: It was he had to yes. He had to pay back Penguin for legal costs and then cost they accrued trying to figure out who this hacker was. So probably ended up paying for some of those cybersecurity professionals.

Speaker 2: Totally. Imagine being the literary scout or one of the literary scouts that was conned by him, and then later receiving his manuscript about how he conned you

Speaker 1: You little shit.

Speaker 2: And having people and having, like, big companies like Penguin who were conned by this person then bidding for rights on the story about how they were conned.

Speaker 1: Right.

Speaker 2: I Like, that in itself is another book.

Speaker 1: It feels like people feels like when he starts pitching this book, there's gonna be a lot of people that slam the door in his face. But the real flex would be to recognize if we take our ego out of this, this is a really, really good story.

Speaker 2: Well, that's just and here's the thing too is that I just think that those are monies or sorry. Those are industries dominated by money and revenue, shareholder return. They can't Yeah. It would be an it would be against their fiduciary responsibility to turn their eye on something.

Speaker 1: To not publish this book about how someone did crimes at them. Exactly.

Speaker 2: I can I can just see the cutscene at the end? Like, doesn't isn't that the Wolf of Wall Street? There's a cutscene where the real

Speaker 1: That's literally how The Wolf of Wall Street ends.

Speaker 2: You see that happening here?

Speaker 1: Where all everyone's reading the book and the the the person who hacked all the authors wrote about the time they hacked all the authors. Yeah. Completely. It it will inevitably be a movie. Too many people, even if it's not Filippo b writing about it, like I said at the beginning, this all kinda popped off during the pandemic when a bunch of journalists were stuck inside. It is so thoroughly reported on. There's so many great long form really long form articles that a person could license if they wanted to make a movie. Now this episode of this podcast, get in touch. Well, look.

Speaker 2: My my mind jumped to Michael Lewis. This just felt very, you know, big short. Like, I've read all my books.

Speaker 1: It's

Speaker 2: great at the stuff. The the books that he's written, the screenplays that they get transferred into, also great. I feel like this has just got a natural, you know, large cast, lots of locations. You know, you've got the you it just has a big, short vibe to it. You know? Multiple story lines running in

Speaker 1: the same short vibe.

Speaker 2: Direction. Yeah. I don't know. But I I think that if this isn't gonna be you, Filippo, or, you know, maybe call Michael Lewis. I'd love to to read the the Michael Lewis take on this and watch the the screenplay adapted off of his book. Anyway, those are my end thoughts. What about you, g?

Speaker 1: I'm just gonna end with a quote from from an author named Filippo Bay's first book bully. I don't even know that I agree with this quote, but it sure is relevant to the story. Quote, there is a relationship between tormentors and victims, something close to a real friendship or even love. A person cannot live without the other, just as the tormentor cannot live without his victim.

Speaker 6: This episode is brought to you by Nespresso. Life moves quickly, and taking care of yourself shouldn't feel like another chore. With the new Nespresso virtual up machine, morning routines become rituals. Whether organizing, getting the household moving, or preparing for the day, your coffee shouldn't ask for more. With Vertuo Up, just press brew and your morning begins. Rich aroma, old flavor, zero effort. Effort. Press to explore. Every coffee, a new world. New virtual up. Shop now at nespresso.com.

Speaker 7: Your team just added its sixty seventh AI tool and also your sixty seventh security blind spot. The good news? The Vanta agent works like a GRC engineer in the background, finding every app your team uses, scoring the risk, and drafting fixes for you. Vanta is the platform used by over 16,000 fast moving companies like Ramp, Cursor, and Harvey, who are shaping the future with AI and staying ahead of AI risk. Get started at vanta.com.

Speaker 1: Ryan Reynolds here from Mint Mobile. I don't know if you knew this, but anyone can get the same premium wireless for $15 a month plan that I've been enjoying. It's not just for celebrities, so do like I did and have one of your assistant's assistants switch you to Mint Mobile today. I'm told it's super easy to do at mintmobile.com/switch.

Speaker 8: Upfront payment of $45 for three month plan, equivalent to $15 per month required. Intro rate rate first three months only, then full price plan options available. Taxes and fees extra. Fee full terms at mintmobile.com.