Since May, the most prolific online prankster of 2017 has compiled an exhausting list of web personas. He has been Donald Trump Jr., presidential administration officials Reince Priebus and Sebastian Gorka, the White House’s director of social media, actor Hugh Jackman, Uber Technologies’ first CEO, multiple banking executives, a Fox News host, Breitbart Chairman Steve Bannon, and Harvey Weinstein.
Now, he just wants to be himself.
After using a simple email hoax to convince government officials, celebrities, and CEOs that they were talking to friends or associates — and then publishing those conversations online — 39-year-old James Linton says he is stopping the stunts after the disclosure of his true identity. Now the formerly anonymous man, better known as email prankster @Sinon_Reborn, hopes to parlay his antics into a cybersecurity job where he can help combat the same email fraud he perpetrated.
“Email pranking is dead and buried now,” he said, pointing to a Daily Mail story that published photos of his family he feels could have compromised the jobs of his brother and sister, who both work in jobs dealing with personal data.
Linton gave a series of phone interviews to BuzzFeed News from his home near Manchester, England, in which he explained his evolution from a “lazy anarchist” to an activist with loosely defined social values. He also shared two previously unpublished hoaxes on Shark Tank star and cybersecurity executive Robert Herjavec and conservative personality Ann Coulter, and explained why he stopped cold turkey from an obsession that consumed him for five months.
That he’s now seeking a quieter life with a semblance of privacy is an irony that’s not lost on Linton, who tricked former White House Communications Director Anthony Scaramucci into arguing with a fake Priebus and duped Jared Kushner’s lawyer into forwarding a previously unpublished letter from the Senate Intelligence Committee about his client’s use of a private email account. And while he’s not particularly worried about possible legal repercussions from his pranks, Linton conceded that finishing his run with his identity now in the open was the cleanest break.
For Linton, an unemployed web developer with a sharp tongue, there was little technical sophistication to the scheme he used to a make some of the world’s most powerful people look like fools. He describes it as a “parlor trick” he controlled from his iPhone 7, and calls himself more of a social engineer than a hacker. He never brute-forced his way into a database; he didn’t write a single line of code. He simply registered a few strategic email accounts and fired off some evidently pretty believable emails.
Consider Linton’s previously unreleased correspondence with Coulter. One October afternoon, Linton created a bogus email account for Trump surrogate and former Milwaukee County Sheriff David Clarke — sheriffdavidclarke@mail.com — and from it sent a note to an address he guessed might be Coulter’s.
“Ann, I was wondering if you would be kind enough to have a read through an article i'm writing about immigration?” wrote Linton posing as Clarke. “I'm fairly happy with it, but I'd welcome your expert opinion.”
Coulter responded within six hours: “HELLO!!!!!!!!!! SO GREAT TO MEET YOU! (did I reply last week? I was traveling.) Yes! I’d love to. traveling for speeches again this week, so it may take me a few days, but just keep bothering me.”
“It was a very simplistic thing, and it wasn’t anything more than changing the display name of the email address,” Linton said, noting that most people don’t bother checking email addresses if they see a familiar display name. (Coulter did not respond to a request for comment.)
“It’s not illegal, as far as I know, to pretend to be someone, though I’m sure I’ve crossed lines left, right, and center,” he said.
In an age of amateur cybersleuths and armchair Twitter experts, Linton’s online persona, Sinon_Reborn, named after the soldier who convinced the Trojans to accept that catastrophic wooden horse, found a following as “a fact-finding prankster.” Filling the void left by the social justice hacker collectives of the early '90s, Sinon_Reborn’s pursuit of Trump administration officials and conservative pundits provided a bit of comic relief to the summer’s parade of political firestorms. In some cases, he also uncovered tidbits of news that were published in mainstream media outlets including CNN and the Washington Post.
But Linton didn’t initially want to wade into US politics. Having perfected his email pranks on his bosses and colleagues at the ad agency where he worked, Linton used his methods for the first time on a public target in May for complete self-interest: his own debt. As a compulsive gambler who has a self-professed addictive personality, he had come to owe Barclays Bank some £20,000 ($26,000), and was shocked when the bank’s app continued to approve what he saw as predatory loans.
After receiving little response from the bank through his own personal emails, Linton decided to take another route. He set up an email account under the name of the bank’s chairman and sent a garbled note to Barclays CEO Jes Staley following a company shareholder meeting. Within 30 minutes he was engaged in an email conversation, which was later published on the newly formed Sinon_Reborn Twitter account.
He then moved on to Goldman Sachs CEO Lloyd Blankfein, Citigroup CEO Michael Corbat, and Morgan Stanley CEO James Gorman, all meant to show how absurd it was that the men who oversaw companies with trillions of dollars in assets couldn’t handle basic email security. "It started off as a very personal mission, as an ego trip — or perhaps an alter ego trip," he said. The scalps that followed included British politicians, an Uber executive (targeted after stories about the company’s improper acquisition of a passenger’s medical records), and actor Kevin Spacey in a gag in which Linton pretended to be Hugh Jackman.
By July, Linton says he was registering a dozen or so email addresses each week in hopes of pulling off another gag. At work, he took frequent breaks, cigarette in one hand and iPhone in the other, monitoring multiple inboxes and crafting new messages and replies. Linton’s employer became worried about his antics around the time he started hitting the White House. After an internal investigation determined Linton had been using company computers in service of his hijinks, the ad agency where he worked suspended him.
“When they told me I had to stop, it was like someone told me the ice cream man wasn’t coming on a hot day,” Linton deadpanned. He quit within a month.
When Donald Trump Jr.'s 2010 Zimbabwe hunting photos began recirculating online this past summer, Linton — an animal rights supporter — saw an opportunity to prank the White House. Prior to that, he had tried to guess President Donald Trump's email address, as well as that of Hillary Clinton's, but came up short on both occasions.
Unable to find Trump Jr.'s email address, he tried brother Eric instead, sending him a link to a National Rifle Association-affiliated website from the freshly created account donaldtrumpjr.trump@gmail.com. Eric replied, but soon realized he'd been duped. In a follow-up email, he told Linton he'd notified law enforcement, effectively ending the conversation.
“In America, the cronyism seemed to be operating at the highest levels,” Linton offered as justification for the goof. “Donald Trump came across as a horrendous human being, one that was definitely not fit to be running one of the most powerful countries in the world.”
Linton’s White House antics brought Sinon_Reborn some notoriety, but his extended prank on Scaramucci garnered global attention. The day after the communications director was fired just 10 days into the role, Linton emailed him posing as former White House chief of staff Priebus. The note he had sent exploited the reported tension between the two, and called a tweet that Scaramucci had sent about Priebus being a leaker “breathtakingly hypocritical.”
“You know what you did,” Scaramucci wrote in response. “We all do. Even today. But rest assured we were prepared. A Man would apologize."
A brief, but heated, call-and-response ensued and then Scaramucci went silent. The former White House staffer did not respond to a request for comment for this article.
"You live by the sword and you die by the sword. I totally get the irony."
Emboldened by his successful duping of Scaramucci, Linton moved on to White House press secretary Sarah Sanders and Trump lawyer Ty Cobb. He pranked Jared Kushner attorney Abbe Lowell, who later accidentally forwarded him a letter from the Senate Intelligence Committee. There was also Trump attorney Michael Cohen, whose Twitter account still shows a photo Linton convinced him to post while posing as Eric Trump.
“I had a lot of fun trying to match the character and the language of the person I was impersonating,” Linton said. His impressions were often spot on. The terse and incendiary message Linton sent to Breitbart News staffers as Steve Bannon are uncannily similar to some of the Breitbart chairman’s real emails. Others may have been a bit over the top. “I realized that no one in America uses the word 'soiree,'” Linton said of an email invitation he sent to homeland security adviser and cybersecurity policy expert Tom Bossert as Jared Kushner. Bossert responded anyway.
By August, Linton says he was managing some 150 email accounts. He memorized them all, adding new ones and purging others when they became useless. I had a “miniature empire in my head," he said. “I could barely organize to pay my own car, but I could keep all those plates spinning."
A sloppy mistake with a GoFundMe page, which Linton set up to fund his pranks while he was suspended at his job, brought the whole thing crashing down. Though he'd been careful to conceal his identity online, he failed to notice when GoFundMe imported some identifying information, while another fundraising page sent receipts with PayPal information associated with his real email address. The Daily Mail used that information to deduce Sinon_Reborn's true identity and convince him to sit down for an interview. (Wired UK was the first to reveal who was behind the online persona after Linton simply told the outlet who he was as the situation with the Mail unfolded.)
“You live by the sword and you die by the sword,” he said. “I totally get the irony.”
"My pranks were small wins for the average human."
His true identity revealed, Linton left many pranks half finished, like Coulter, or unpublished, like street artist Banksy, whose true identity he claims to know but refuses to disclose. He also hit Harvey Weinstein by pretending to be his lawyer, eliciting a forlorn response from the disgraced Hollywood producer: “I’m sick.” But with his time limited, he took to new targets in the cybersecurity world, including Ian Levy, technical director of the National Cyber Security Centre, the public information arm of Britain’s Government Communication Headquarters.
“I was lucky not to fall for this,” Levy told BuzzFeed News, explaining that Linton has been able to take advantage of the faith that users place in email, which hasn’t changed its security standards in 20 years. Levy avoided being duped by checking the fake email address, and wrote a blog post about the experience with Linton’s help.
Linton’s final victim, Shark Tank personality Robert Herjavec, didn’t have the same happy ending.
Beyond passing judgement on startup pitches, Herjavec is also CEO of IT security software outfit the Herjavec Group, which touts itself as "your trusted advisor in information security" on its website. In that branding, Linton saw a challenge. He created a bogus email address using the name of another company executive and messaged Herjavec. He had him hooked and responding to his emails in a matter of hours.
At one point, he invited the CEO to a toga party. At another, Herjavec unwittingly carbon copied him on an email that included fourth-quarter financial projections. At still another, Linton received an email forwarded from the true address of the executive he was impersonating, suggesting that the bogus address he'd created had been added to a companywide address book.
Herjavec declined an interview request from BuzzFeed News, and would not provide comment. He subsequently published a note commenting on the incident to the Herjavec Group website as part of the company's "Cybersecurity Month."
“It could have been worse — no confidential customer information or personal data was shared,” Herjavec wrote. “It was really an unfortunate series of events including me not clearing my Outlook cache after I realized the issue with the initial communication.”
Linton jokes that he likely won’t be invited to present on Shark Tank anytime soon, and says that for now, translating what he’s learned over the last five months into lessons for people who might fall for gambits like his may be his best chance at finding work. He’s registered a new website and aims to start his own consulting company if no one will employ him. “I do feel like I cut a hole in a fence and I’m trying to put it together again on my way back through,” Linton said.
When asked whether he misses the thrill of it all, Linton pauses and takes a giant swig of Coke. During a week in which the news cycle has been dominated by more allegations of Russian election interference and indictments against Trump’s former campaign chairman, Linton says he would have no shortage of targets if he was still in the game.
“I guess a little bit of me does miss it,” he said. “With new names and new lawyers popping up all over the place, I definitely guarantee I could have pranked as least one.”
Given that, is Linton truly finished with his pranks? He says he's still interested in animal rights and gets the occasional message from fans asking for his help with some personal injustice. “Don’t rule out me going back in and doing some stuff," he declared, making it clear it would only be for the right cause.
“My pranks were small wins for the average human,” he said. ●