For years, a mysterious figure has been stealing books before their release.
Or a complete waste of time?
Save this article to read it later.
Find this story in your accountsSaved for Latersection.
Update: This article was published on August 17, 2021.
On March 23, 2023, the perpetrator was sentenced.
Here is ourupdateon the case.
The books, which follow hacker detective Lisbeth Salander, have sold more than 100 million copies.
Norstedts was guarding the series closely.
Mork and Altrov Berg, who handle foreign rights at Norstedts, consulted with other publishers of blockbuster books.
Everyone would have to sign an NDA.
Could you yo re-send me the link to the manuscript of The Man Who Chased His Shadow?
Hedlund sent her friend the link to the manuscript.
Im sorry M, she wrote.
Varotto said that her password was disabled/expired.
Could Hedlund send a new one?
Back at Norstedts, Mork also received an email from Varotto.
Sorry Catherine, the message read.
Could you like give me the Hushmail code?
Altrov Berg dashed off a separate message to Varotto, asking if everything was okay.
Suddenly, her phone rang.
Why are you sending me this?
Altrov Berg explained what was happening.
She hadnt sent any emails to Norstedts all day.
With Varotto on the phone, the two Norstedts employees scrolled through the messages.
Then, with Varotto still on the line, Mork got yet another email asking for the password.
They scanned the messages again.
The Millennium team was in a panic.
But the books publication came and went without a hitch.
The manuscript never reappeared.
What was Fake Francesca Varotto after?
Much more than Lisbeth Salanders best-selling exploits, it turned out.
Even stranger, the thief had other identities.
The assistant didnt exist.
The manuscripts werent being pirated, as far as anyone could tell.
Fake Francesca wasnt demanding a ransom.
We assumed it was the Russians, Mork said.
But we are the book industry.
Its not like were digging gold or researching vaccines.
Was the thief simply an impatient reader?
A strung-out writer in need of ideas?
I texted a friend in publishing to find out more.
She quickly replied, The culprit has been identified.
Many in publishing were too paranoid to discuss it.
He seemed to conduct his business almost entirely over email.
Even more intriguing: Someone, I was told, had proof.
On the spectrumof cyberattacks, this one wasnt very complex.
There was no malicious software or actual hacking involved.
Some of the earliest victims used Gmail accounts for work, which were easy and free to spoof.
What did seem sophisticated was the thiefs knowledge of the business.
Whats more, the thief seemed to have a strong grasp of the rarefied world of international publishing.
Were the ghost in the publishing machine, Jon Baker, who works as a scout, said.
If anybody is going to be randomly asking you about something thats coming out, its a scout.
The most common shorthand is to say that scouts are the book worlds spies.
Its probably more like 60, but its not in the triple digits.
People eyed less-established players with suspicion.
The person Id been urged to look into was also a scout.
Intrigued, my colleague Lila agreed to take up the case again with me.
If the evidence was good, the mystery could be solved.
Actual proof was harder to come by.
No one I spoke to at the literary agency seemed to know anything about it.
Several scouts noticed that a former colleague had recently started an e-book company that would presumably need content.
He happened to be from Holland.
But the registrations appeared to be a red herring.
The scouting theory also had considerable holes.
Many of the books were ones that any scout could get without much trouble.
The scheme seemed like a lot of work for little reward.
And it came with great risk.
A few days earlier, she had received a message from a scout named Jane Southern offering a trade.
Natasha saw Southern at a dinner and thanked her for the slip.
Southern had no idea what she was talking about.
After a quiet summer, the thief was back with a new tactic.
They didnt just want the McEwan.
The McEwan was bait.
The thief did possess a tenacity more common in Hollywood than the book world.
If a target didnt respond, the thief would often follow up with an identical request several hours later.
One person received nine emails from the thief in a single day.
Maybe its another level down, one literary agent whispered.
Several people decided it was time to ask for outside help.
meant she might be better off trying the FBI.
In the spring of 2019, Baker conducted a sting.
But the PDF never turned up.
Others tried similar gambits to no avail.
Three years into the crime spree, an industry based on trust and relationships faced a growing paranoia.
Agencies started password-protecting minor books.
(I got a 70-page Dutch novella with an NDA, one scout said.
An NDA for a 70-page Dutch novella!)
A scout and an agent developed a code word they included in emails to authenticate their conversations.
People were suddenly distrustful of colleagues they had worked with for years.
The attacks felt personal.
Many writers were vulnerable to the ruse, eager to kindly someone they thought was their agent or editor.
Others experienced it as yet another letdown.
Hes been quite stuck, she said.
Multiple people told me they were convinced the thief was someone they knew pursuing a personal vendetta.
Theres a new submission over here thats the talk of the town, Baker wrote.
They asked, Can you share the MS pls?
Our investigationwas moving slowly.
More leads were coming in, each less helpful than the last.
A new suspect would surface, only for the evidence to fall apart under minimal scrutiny.
The smoking gun Id been promised remained elusive.
The domain had been registered to an address in Manhattan, somewhere above Central Park.
I turned to the emails themselves.
But each victim had only a tiny glimpse of the thiefs body of work.
It was difficult to find anything meaningful.
The thief largely emailed on weekdays, during New York working hours, but there were exceptions.
They asked for favours and spread rumours, but also wished American victims a Happy Fourth of July.
They wrote poorly in many languages: Hebrew, Icelandic, Korean, Swedish.
(A Brazilian caught on when the thief wrote to him in European Portuguese.)
Their favorite emoticon was ;).
Its almost like theyve hired someone else to do it.
The attack presented new wrinkles.
Atwoods representatives assumed that piracy was the goal.
But, yet again, no pirated manuscript appeared online.
(The only leak came from the industrys other disruptor: Amazon accidentally shipped 800 copies early.)
Some in publishing were beginning to question whether manuscripts were even the end goal.
In early 2020, an explanation presented itself.
Somehow, the thief had instantly re-created a private message between two real people.
Several months later, Trenchard was emailing with an editor friend when she realized her friend was being impersonated.
Trenchard sent a separate email asking if she knew about the scam.
the friend wrote back.
NO, I didnt!!!
The thief, it seemed, was somehow reading Trenchards emails.
(Trenchard has changed her password and hasnt had any such incidents of late.)
Several people told me about similar experiences with other publishing companies.
This suggested an operator that textual analysis wasnt going to unmask.
We had no choice: Bring in the hackers.
This was enough to prevent our hackers from identifying the thief, but it didnt suggest a sophisticated operation.
Others decided it was time to bring in the big guns.
Last summer, several people approached the FBI, sharing the thiefs emails with the bureau.
(The bureau declined to comment.)
The pandemic disruptedthe book business just like everything else.
The only constant was email, and the thief took advantage.
to ask if the assistant might have Joshua Ferriss new novel.
Are you in Italy now?
I heard things are now opening up there which is great!!
Hows working from home for you?
I did find one unusual sequence of events.
During the third week of last August, the thief seemed to snap.
In several cases, they pasted text from the manuscripts they had to make the threat real.
They signed one such email xxx.
The most menacing message came on August 17.
The thief, it seemed, didnt actually know her world all that well.
Altrov Berg sent a defiant reply: Keep on dreaming!
This time, however, they shot back a reply: Hoppas att du dor av coronaviruset.
In English, the message translated to: Hope you die of the coronavirus.
COVID was bringingout a more vicious side of the thief.
There was no telling who they might go after next.
Do you know him?
Is he someone legit?
Bettina
The email wasnt accurate.
Gately hadnt given me Schrewes name.
How did the thief know I was on the case?
I had spoken to more than 50 people in publishing, some of whom were suspects themselves.
I called Lila to workshop a response.
Should we let the thief know we were onto them?
We chose the latter.
Could we provide a home address?
Ill pay the postage of course, the thief wrote.
Each was a warped but nearly identical version of the others.
But the thief quickly dismissed all of this as pointless.
Its stupid and ridiculous, the thief wrote.
Only a waste of time.
Was the thief referring to our investigation, I asked, or the caper itself?
As the conversation stretched over several days, other strange things occurred.
The thief impersonated my book agent for the first time.
Anonymous accounts tried to connect with me on LinkedIn.
Lila, meanwhile, had begun her own exchange with the thief.
She wanted to be more direct.
Would you be up for a phone call?
she wrote to the thief.
The thief suggested an in-person meeting instead.
When Lila said she lived in Brooklyn, the thief said they did, too.
Lila then suggested meeting in Cobble Hill, at which point the conversation turned.
How about Fuck You Hill?
the thief wrote back.
Or can I meet you at Silly Cunt Square?
The message went on.
TAKE MY ADVICE, the thief wrote.
DROP THIS STUPID ARTICLE AND STOP WITH IT IMMEDIATELY!!!
The thief wasntthe only one who wanted me to stop.
The world was sick and on fire with actual cyberattacks knocking hospitals and pipelines offline.
It was time to write the ending.
Most people couldnt tell me much about him, but the details they shared fit the thiefs profile.
He was from another country, and his English wasnt great.
His manner, in person and in writing, could be brusque.
He wasnt on the literary social scene, which made people presume he was resentful.
Then again, one scout admitted to me, Do we all just think its him because hes weird?
The smoking gun the mistaken domain registration teased by my friend was meant to provide more substantial proof.
After a seemingly endless game of tag, we finally got to the source.
But upon closer inspection, I found the proof was a mirage.
The address wasnt the suspects.
Lila and I scrambled for an explanation.
Wasnt it suspicious, at least, that the thief had used this particular address?
Maybe our suspect was being framed?
Our smoking gun had misfired.
I had come too far not to exit the loop.
In early August, I spoke to the suspect on Zoom.
He was shocked to hear that his colleagues in the industry suspected him and denied the accusation.
In other words, all you deserve.
The suspect said he had a simple explanation for why people thought there was something odd about him.
He was, by his own admission, kind of an odd guy.
He rarely got invited to parties and wasnt the pop in to crash them.
Even if Im an introvert, he said, Im not a hacker.
This felt likethe final chapter.
I felt less like Lisbeth Salander than one of M. C. Eschers monks, wandering endlessly in circles.
Maybe the thief was right.
Or … was the pointlessness the point?
Did they care to comment?
The thief hasnt written back.
they said, jokingly admitting guilt, after I asked whether they had just received my email.
Wouldnt that be the best twist of all?
And now, here was this source, beckoning me to join them even deeper in the maze.
They were calling to tell me a story they hadnt told anyone else.
For two years, they had harbored a suspicion about a widely respected figure in the industry.
It could mean everything, my fellow obsessive said.
Or it might mean nothing at all.
Thank you for subscribing and supporting our journalism.
