Posted in: Batman, Comics, DC Comics, Image, Marvel Comics, Spider-Man | Tagged: diamond, diamond previews
The Day Diamond Tricked Bleeding Cool Over Batman/Spider-Man Crossover
The day Bleeding Cool totally got pwned by a Diamond Comics employee over a Marvel/DC Batman/Spider-Man crossover that wasn't
Article Summary
- Diamond Comics exposed Bleeding Cool's "URL farming" with a fake Batman/Spider-Man crossover scoop.
- Former Diamond staffer Allyn Gibson revealed the backstory behind the infamous 2012 information honeytrap.
- The bait led to internal chaos at Marvel, DC, and Diamond, nearly resulting in staff firings and industry drama.
- The sting fixed Diamond's web security, prompting Bleeding Cool to innovate new methods for sourcing leaks.
This is beautiful. Fourteen years ago, on the 4th of January 2012, Bleeding Cool ran a story claiming that Marvel and DC were to publish a new twelve-issue series, Spider-Man/Batman, headlined "SCOOP: Marvel And DC To Publish New Twelve Issue Crossover – Spider-Man/Batman". I gave the details: "Spider-Man/Batman will chronicle the many meetings of the pair through their respective careers as superhero crime fighters. The first issue, 48 pages long, will show the very first meeting between Peter Parker and Bruce Wayne, and the rest of the series will show the rest of the characters' lives where they intersect". And then shortly afterwards, I had to post a full retraction with a new headline, "PWNED: Marvel And DC Not To Publish New Twelve Issue Crossover – Spider-Man/Batman". You know, as the kids used to say back in 2012.
I had sourced the original story from Diamond Comic Distributors' website through a technique I dubbed "URL farming", taking the URLS of published stories, and tweaking them to see if something unpublished but newsworthy would pop up, and this one had. We had done so previously for stories about Marvel's marketshare, and lists of upcoming comic books for the next two weeks. And they laid a trap. Today, the former Diamond staffer and Previews Magazine wrangler Allyn Gibson confessed on his blog, fourteen years later, that it was he. And why the trap? Well…
"I don't recall exactly when the retailer-only material began appearing on Bleeding Cool. I do recall that it was an issue, and there were back and forths between Dan Manser [Diamond Marketing Director] and David Gabriel [Marvel SVP of Sales & Marketing] about a leaker. David thought someone at Diamond was leaking. Dan said that once it was in Daily (the email newsletter version of Retailer Services), a retailer could feed the information to Bleeding Cool, and Diamond had no way of policing that. And other publishers noticed, too; I remember Eric Stephenson at Image also had concerns about confidential information showing up publicly on Bleeding Cool. This was something running in the background through late 2011; publishers saw a problem — leaks — that needed to be solved, Dan admitted there was a problem but it wasn't ours to solve."
Nope, it was URL farming, and Allyn worked it out. According to Allyn, the only way it worked for me to get access was that the web host had changed how it generated and recognised URLs.
"Over New Year's, I loaded some of the sales charts into News-Manager. December's sales charts appeared on Bleeding Cool. The December sales charts that had not been approved by Marvel and DC. They had them, but I was still waiting on their approvals due to the holidays."
Yeah, um, yeah. That was me. 3rd of January 2012. Didn't seem such a big deal at the time.
"I had angry emails from David Gabriel asking what the hell was going on. I had an email from Eric Stephenson [Image Comics Publisher] asking why he didn't have the charts yet. (I sent Image and Dark Horse a sales charts packet the day before the monthly press release was sent out.) I went to Dan. He had probably already fielded an angry phone call from David that morning.. "What do we do? He got them from us." I didn't name Rich Johnston. I didn't have to. "DC could have leaked them. Marvel could have leaked them." "I have an angry email from David. Marvel didn't leak these. Why would DC leak these?" Dan said nothing. "He got them from us." "Prove it." I went back to my desk, took my index card grid, and pulled up one of the articles. An article which was not scheduled. An article which should not have appeared on any Diamond website. WebDev, in their redesign of what I would call, in WordPress parlance, "The Loop," the routine that pulls a post from the database and outputs it into the webpage, not only removed the publication and section keys. WebDev removed the date limits. Now, Dan was correct. While I could demonstrate that it was possible to display an unscheduled article in the CMS on a Diamond webpage, I could not prove that this is what Rich Johnston had done."
I mean, he could have asked, and I would probably have told him. At that point, the jig would have been up.
"As unlikely and absurd as I personally thought the idea of DC or Marvel leaking the sales charts to Bleeding Cool was, it was not impossible. I truly think that Dan was willing to let the problem go at this point. Andrew Gertz, who was the editor of Diamond Daily and the retailer website, was not. And he said to me, "So how do we prove it?" "Well, we have to plant a honey pot in News-Manager. Something so rich and tempting that when he sees it he can't not touch it. Something he had to report immediately because it's such a scoop. "Something," I said, "like a Marvel-DC crossover." And I outlined what we do. We would write a fake story. Put it in News-Manager. Leave it unscheduled so that no one should know it was there. And if it appeared on Bleeding Cool, then we know with absolute certainty that Rich Johnston had found a way to steal stories from our CMS. Andrew liked the idea. We took it to Dan. Dan liked it and approved. Late in the afternoon of January 3, 2012, I opened up Notepad and typed up a short article, probably not more than 150 words, about Marvel and DC teaming up on a Batman and Spider-Man mini-series that would be featured in the April PREVIEWS… It was the DC/Marvel crossover I would have written."
I did point out that such a venture was unlikely, given the recent behaviour of DC and Marvel toward each other. But the provenance was so good that I fell for it hook, line, and sinker.
"The morning of January 4th. I wake up. I make coffee. I sit down at my computer and go to Bleeding Cool to see if there's anything about a Marvel/DC crossover… The lead story? Marvel and DC are teaming up on a Spider-Man/Batman mini-series. I sent Dan an email that the article was on Bleeding Cool. He had also been checking, and we knew that we had Rich. The only way he could have gotten this story was from us, and the only way he could have gotten it from us was by doing some URL manipulation."
Allyn, it's URL farming. It's more like manual labour. Seriously, you have to go to work, change those URL numbers, one at a time, churning through them manually until something pops out. I put the hours in.
"To my surprise, Dan suggested more false stories to plant for Rich Johnston to pick up, like Robert Kirkman was taking The Walking Dead to Dark Horse Comics. Besides the fact that that was transparently ridiculous, I also didn't think it was necessary. We had what we needed, proof that our CMS was hackable, and we could go on from that. I am not going to say that embarrassing Rich publicly was not a goal — it absolutely was — but the primary goal was fixing the damn security leak in our websites by making WebDev see there was a problem. Before I left for work, I opened two tabs to News-Manager, copied all of the article data from one, I think it was product article for an import statue or figure, and pasted it into the article I'd used for the fake Spider-Man/Batman story. Rich had seen it, if he went back to the article it would be gone and he'd see something else. It would be like it had never been. By the time I got to work, Rich Johnston had updated his article."
It's true. Someone high up at either Marvel or DC, whom I trusted even more than Diamond's website, told me it was bollocks and that I'd been had. But it seems the story did not end there with my humiliation.
"Bob Wayne [Former DC Sales VP] called Diamond's Bill Schanes [Diamond VP Purchasing]. It may be because Rich, in his mea culpa update, asked if he "[detected the influence of Bob Wayne" in this little honey trap. It may be because Diamond had just done something embarrassing to DC, something that could ever jeopardize Diamond's relationship with DC. I was not party to this conversation, I am relaying secondhand."
I mean, it really, really did feel like the kind of thing that, well, Bob Wayne had certainly tried to do to me at a comic convention once, talking loudly about a non-existent project in deliberate earshot. I didn't fall for that one. Was this his second chance?
"What I do know is that Bob Wayne in no uncertain terms wanted whoever was responsible for this fired. Bob, if you ever read this, I never held this against you, either. Again, you were protecting your turf, and I suspect it was made doubly worse by Rich bringing you into a drama you had no involvement with. If there's anyone I want to apologize to, it's you. I respect you too damn much to have ever wanted you involved in my shenanigans. Meanwhile, elsewhere in Manhattan, Arune Singh of Marvel was receiving congratulatory emails from industry people, and he had no idea what he was being congratulated for or why. He certainly wasn't responsible. Again, I was not a party to this. I don't know Arune, I don't know that we ever exchanged an email. This is just what I was told."
Arune Singh, of course, before he worked in Marketing for Marvel, was my editor at Comic Book Resources, when I wrote Lying In The Gutters which evolved into the Bleeding Cool website. Just think of all the typos he had to winnow out. That would at least have been motivation.
"Joe Quesada [Marvel EIC] and Brian Michael Bendis [Marvel writer] were tweeting about this Batman/Spider-Man project enthusiastically. And David Gabriel called Bill Schanes to say, "Good job, you guys really stuck it in Rich Johnston's eyes!" Bill Schanes had a problem. One of Diamond's two biggest vendors wanted someone fired. The other of Diamond's biggest vendors was congratulating Diamond for embarrassing someone they considered a little bit of a pest. And Bill had absolutely no idea what any of them were even talking about. You don't leave Upper Management hanging like that. You just don't. Dan, who not even six hours earlier had told me we should run a fake story about The Walking Dead, let me know that my fate was hanging in the balance. I was being thrown under the bus, and I knew that. Eric Stephenson emailed me. "I know you can't confirm or deny anything, you may not even know who did, what happened today is appreciated." I wrote back, "I can't say, but if I could I'd say thank you." In the afternoon Dan called Andrew Gertz and myself into his office. I was not being fired. Marvel basically saved my job. I was not to ever do anything like that again, as I had put Diamond's business relationships at risk. "WebDev did that," I said. "All I did was prove that they created a security problem." Dan grimaced and went on. A note would be placed in my permanent file. I shrugged. It clearly annoyed him that I wasn't contrite, maybe even a little proud of what I'd done. Dan let me go. I closed the door behind me. Andrew got reamed — I could hear Dan yelling from down the hall, by Vince Brusio's cubicle — and I never understood why, as his only role in the whole affair was to like my plan enough for us to take it to Dan for his approval. Andrew told me later it really wasn't anything, Dan was just furious that Andrew hadn't stopped me. "Dan signed off on everything," I said. "I know," said Andrew. Dan would have thrown the Pope under the bus. And I say that with great affection for Dan. Seriously. Truly. Not sarcastic. Great affection."
Dan Manser, crazy name, crazy guy. After 13 years at Diamond, he left to become a Digital Marketing Manager at Ambu USA five years ago and never had to worry about Bleeding Cool again. Until today…
"In the days following, a few people at Diamond who knew what happened said to me, privately and quietly, that they wanted to give me some kudos for what I'd done. They could never say so loudly, but Diamond was in many ways the industry's punching bag, Diamond never stood up for itself, and they appreciated that someone one day basically said no, stood up for the company, and punched back. "I'm sorry you got in trouble," one said. "I'm not," I said philosophically. "It needed to be done." Within a week, WebDev put a partial date lock back on the websites. Any article in News-Manager could appear on any of the websites, but only if the date were after the scheduled start date for the article. Thus, once an article was written, even if it was past the scheduled date range, it could be linked to and opened."
I'm just glad DC Comics didn't work it out on their own website for a little longer, which is how we got all those New 52 leaks. Or Diamond on their website search function, which returned articles not yet published if you knew what you were looking for – and sometimes I did.
"Dan Manser and Bill Schanes might have felt I'd put Diamond's relationships with the industry at risk, but from where I sat then, from where I sit today, even with all of the chaos of the past five years, what I did in January 2012, poking Bleeding Cool in the eye, was about protecting the relationships because we had done something to protect our vendors. And I feel it was worth it. Rich Johnston backed off a little — he was still a thorn in the side, but that's just who he is — and life went on. History became legend, and legend became myth, and the story of the time Diamond pwned Bleeding Cool became legend. I always promised myself that, when the day came and I left Diamond, I would peel back the legend and reveal the history. I expect some "recollections may differ" from others, but this is how it happened. Rich, it wasn't Bob Wayne who orchestrated this. It's been long enough, and you of all people deserve the truth. It was me. In my best Dame Diana Rigg, I want you know it was me. No hard feelings?"
None whatsoever, Allyn. You've earned even more respect from me. You played the game well, and I'm just upset that Bob Wayne tried to fire you for something he himself had once tried to do. I am glad you were able to fix your systems, gain some internal cred, and have a story to tell in your upcoming job interviews, of which I hope there are many. But, as you know, information wants to be free, so as one channel closed, I just found other methods…
