The manuscript thief: the mystery that baffled the literary world
Hundreds of authors around the world have been targeted by a thief collecting unpublished manuscripts. But when an arrest was made by the FBI last year, the plot only thickened, writes Tim Moore
“People were trying to steal it,” Margaret Atwood told a BBC reporter just after the launch of her novel The Testaments in September 2019. “Really trying. There were fake emails from cybercriminals – we had to use a lot of codewords and passwords.” The sequel to The Handmaid’s
Tale was one of the biggest releases in recent publishing history, but news of attempts to procure its manuscript in advance – “a phishing exercise”, as Atwood put it – still came as a surprise. Booker Prize judging chair Peter Florence, one of a handful of people granted access to the unpublished manuscript, suggested at the time that “the most likely hackers would be people trying to extort ransom money”. This is a familiar practice in Hollywood – stolen first-draft screenplays regularly appear on the dark web, offered to impatient movie fans for a fee. But this sort of thing was rarely seen in the book world – until a few years ago.
When it did happen, Atwood’s agent, Karolina Sutton of Curtis Brown, spoke of a devious relentlessness that went far beyond Hollywood’s worst experiences. She says that the agency had been besieged every day for months, with deceptions of burgeoning complexity. “This was a carefully orchestrated campaign.
Fraudulent emails with addresses indistinguishable from our own were used. We had not seen this level of attack before.” Some emails included threads of purported exchanges between real editors and agents, discussing in detail tweaks to the publicity schedule and so on, adding an ever deeper veneer of authenticity.
The Testaments’ grand debut was tarnished: shellshocked Curtis Brown bosses decided they couldn’t risk sharing the manuscript with some worldwide publishers before domestic release, diluting an anticipated global mega-launch. Yet though Atwood’s manuscript stayed out of the wrong hands, there were no sighs of relief in the industry. Editors, authors, agents and literary scouts all over the world had already been duped into emailing hundreds of other advance manuscripts, generally in the form of PDF documents. Some had been strung along for years. Many put it down to the work of a gang of manuscript thieves, operating since 2016, via identity-theft scams of ratcheting elaboration.
In technological terms, however, the modus operandi was hardly sophisticated. The thieves emailed from a roster of lookalike domain names that closely resembled those of high-profile literary firms – penguinrandornhouse or macrnillan, with “rn” instead of “m”. It’s a frequent ruse in cybercrime, known as “domain typo squatting”. Detecting these micro inconsistencies on a screen demands close scrutiny. And yet the brilliance of the scheme really lay in the perpetrators’ plausibility. Whether posing as a Penguin Random House editor or a Wylie Agency foreign-rights manager, they seemed to know exactly who knew who, and who knew what: the jargon, the news and gossip. They were able to mimic the personalities of individuals across the full spectrum of publishing, from big players to assistants, and in a swathe of languages: Danish, Swedish, Korean, Spanish… They were breezy, polite, empathetic or cheekily waspish as required.
“So much of it was just chit-chat,” says Laurence Laluyaux, head of international rights at RCW, one of the UK’s top literary agencies. “Sort of ‘Hope you’re well, I’m finding it really hard to juggle kids and work in the pandemic.’” Email greetings and sign-offs were pitch perfect, with only the rarest slip-up (an assistant at a US agency deduced that an email purportedly from her blunt boss was bogus when she saw it included the words “please” and “thank you”).
But perhaps the most unsettling part of the mystery was the absence of a traditional motive. No ransoms were demanded. Not one PDF was leaked: the manuscripts simply vanished into a phantom inbox. And while big-name releases by the likes of Atwood, Sally Rooney and Dan Brown were targeted, the thief or thieves also tried to procure obscure experimental novels, works by first-time authors and young-adult fiction. A book described by its own agent as “a modestly-selling author’s fifth novel” was pursued with vigour. As a criminal enterprise, it made no sense.
“An assistant at a US agency deduced that an email from her boss was bogus when she saw it included the words ‘please’ and ‘thank you’”
The biggest surprise of all was the twist the criminal investigation took this year. When, on 5 January, the FBI arrested a suspect at JFK Airport in New York and charged him with wire fraud and aggravated identity theft, it wasn’t the head of a cybergang. Nor was it some unscrupulous e-book merchant. It was Filippo Bernardini, an unassuming 29-year-old Italian who worked in London as a rights coordinator for publishers Simon & Schuster.
The book world processed the news with disbelief. If the FBI is right, a solitary, low-level staffer had duped the entire industry for half a decade. “I’ve been impersonated for five years, sometimes six or seven times a day,” says Laluyaux. A US-based literary scout who prefers to remain anonymous had his business brought to its knees after a rumour spread that he was the manuscript thief. The
thief “didn’t just damage my reputation”, he says. “They singlehandedly created an atmosphere of distrust and suspicion throughout the whole publishing world.” Bernardini pleaded not guilty and was released on $300,000 bail. For now he is staying with a friend in New York’s West Village. He has no previous convictions, and if found guilty, he faces a sentence of between two and 20 years.
Publishing is an old-fashioned business, built on trust, courtesy, friendship and personal favours. But, as the deceptions multiplied, agents and literary scouts took to secreting code words into emails to ensure mutual authenticity. Almost everybody in the trade had a theory on who was behind it. Many feared it must be one of their own, but with at least 160 hijacked identities and 300 faked domains – including 13 variations on the Wylie Agency alone – it was nigh-on impossible for the in-house sleuths to progress beyond a guessing game.
Simon & Schuster suspended Bernardini, saying in an anguished statement that it was “shocked and horrified” to learn of the allegations. The American legal authorities’ official line on the suspect’s apparent motive was laid out with a hammy flourish: “Mr Bernardini was allegedly trying to steal other people’s literary ideas for himself,” Michael J. Driscoll of the New York FBI said after the arrest, “but in the end he wasn’t creative enough to get away with it.” But could anyone really have planned to fillet hundreds of manuscripts – from blockbusters to niche Icelandic novels – to compose or inspire their own masterpiece? It seems an absurd proposition. Especially as almost every stolen manuscript has long since passed into the public domain as a published book.
“Almost everybody in publishing had a theory on who was behind the deception. Agents took to secreting code words into emails”
For a 29-year-old European working in the schmoozy creative world, Bernardini seems to have been unusually reticent online. His social-media cupboard lies bare, with just a LinkedIn page, now deleted. In it he claimed a grasp of ten languages, from Dutch to Korean. A career in publishing is declared almost as a calling: “I have an obsession with the written word and languages… an urge to ensure books can be read and appreciated all over the world.” After studying Mandarin in Italy, he moved to London in 2015 to take a master’s in publishing at UCL. The next year, aged 23, he embarked on a whirlwind of internships and junior positions in the industry, including two months at Granta and three months as a Bloomsbury royalties assistant. By 2019, he had secured a job in foreign rights at Simon & Schuster in London.
In 2021, a US journalist named Lila Shapiro emailed one of the scammer’s impersonated accounts. To her amazement, the scammer replied and suggested meeting up in person, claiming to live near her in Brooklyn. But when she proposed a location in Cobble Hill, the thief abruptly flipped. “How about Fuck You Hill? TAKE MY ADVICE. DROP THIS STUPID ARTICLE AND STOP WITH IT IMMEDIATELY!!!” There were other instances of the thief – or thieves – growing increasingly aggressive. A Swedish editor who sent a curt riposte (“In your dreams!”) to a suspicious Spaniard on the hunt for manuscripts received a reply that said: “Hoppas att du dör av coronaviruset.”
(“Hope you die of the coronavirus.”)
As with all epic sagas, there may be a final twist in the tale. In April 2021, it emerged that £30,000 in prize money, awarded to the winner of the 2020 Rathbones Folio Prize, had been stolen by what were described as “sophisticated cybercriminals”. In fact, the fraud comprised a single email, sent to the organisers by someone pretending to be the winner, Mexican author Valeria Luiselli. In it, the fake Luiselli politely asks if the prize money could be sent to her at once for an urgent personal circumstance, and provides a PayPal address. She signs off with mention of an interview she had given to Radio 4’s
Today programme that morning, adding a hope that this would have provided the organisers and sponsors with some useful publicity. The money was sent and remains unrecovered. That discreet but chatty style, the charm, the informed reference to a media appearance that had taken place earlier – it’s a cut above your typical cyberscam.
“I think there must be a psychological component to this,” says the anonymous US scout. That much seems plain. Even if the culprit was a bibliophile and collected the books for the love of novels, the acquisitions were hardly those of a considered collector, and anyway, the vast bulk of the correspondence had nothing to do with blagging PDFs. Which has led some to speculate that the draw was perhaps the means, not the end.
“This is an international thriller that for now remains an open book,” declared the Italian newspaper Il Messaggero after Bernardini’s arrest. News website Umbria 24, meanwhile, was rather more gushing, describing the suspect as: “Introverted, sweet, sensitive, but above all ingenious.”
Further accounts of Bernardini’s character were provided to local Italian newspapers by former schoolmates. The only child of separated parents, he is described as a shy, nerdish loner. “He was brilliant but troubled,” remembered someone who called themselves Bernardini’s childhood best friend. An angst-ridden teenage memoir, Bulli (literally “Bullies”), released in 2008, has been attributed to Bernardini, though it was published under the name Filippo B. The book centres around Diego, who is consumed by resentment and bent on revenge. “He doesn’t have the right jeans or the right haircut, he wears glasses, he’s gentle, he’s clever,” reads the blurb. “Inevitably, the rumour starts that he is ‘a fag’… But if he can’t make friends, then as a defence against the bullies, he’ll become a bully himself. He doesn’t want to be ‘just like everybody else’, he wants to be better than them.”
The book barely sold, but a copy made its way to Bernardini’s school. Classmates say they were disturbed to find their full names in print, often in scenarios of nastiness that they claim bear no relation to reality. “To us, it was just another aspect of what we believed was his troubled state of mind,” said one. When a local girl approached Bernardini with the book and asked him to sign it, she was rebuffed. “I don’t know anything about that,” he said.
Of the tiny handful of reviews for Bulli that exist online, the most intriguing – and by far the lengthiest – was left on an Italian book site in the year after its publication, by a reader called “Davide”. “I have read the book, and heard all the criticisms aimed at the author, who stands accused of having made it all up,” it begins. “But for me the story is so well told, it feels so utterly real, that I don’t even care if it is true or not. If it really is a fabrication, then whoever created it is simply a genius.”