The bottle as an attack surface

Play the film · 3:50

This archive has a sentence it repeats: a rare bottle without custody is just a story. The two notes before this one worked that sentence from the defender’s chair. N.º 020 laid down the doctrine — a label is an identity claim, provenance is authentication, custody is the log. N.º 019 read the one case that proves the doctrine, from the court record only. This note takes the other chair.

In security work we do not ask whether a system is trustworthy. We ask who could deceive it, through which surface, and what evidence would survive the attempt. A bottle of fine wine gives a more interesting answer than most systems, because its most persuasive evidence is also the easiest to destroy.

The bottle is not the system

An attack surface is every point through which a system can be compromised. Applied to wine, the bottle is only the most visible part. The system is larger: the content (the wine itself); the container and the seal (glass, cork, capsule, any tamper-evident device); the record (label, invoice, producer chronology, warehouse identity, photographs, custody history); and the identity and the transaction (seller, buyer, custodian, account, payment instruction, and the authority to release a bottle).

Microsoft’s STRIDE model — six categories of threat, written for software in 1999 — is useful here as a list of questions, not as a claim that a bottle is an application. Spoofing: a false producer, seller, account or bank beneficiary. Tampering: substituted liquid, a refilled bottle, a replaced capsule, an altered invoice. Repudiation: a custodian denies a transfer because no reliable event record exists. Information disclosure: leaked allocations and addresses reveal what is worth stealing and where it sleeps. Denial of service: stock that cannot be located, released or sold because the account or the records are unavailable. Elevation of privilege: a compromised account changes title or authorises a withdrawal the owner never approved.

The forensic standard for digital evidence, ISO/IEC 27037, describes four activities: identification, collection, acquisition, preservation. Wine is not digital evidence and has no hash that can be recalculated at each step. But the discipline transfers whole: identify the object, acquire the supporting evidence, preserve its state, and record every material handoff. The previous note called the principle zero trust. From the attacker’s chair it reads as a rule of thumb: trust is not inherited from the previous transaction; it is re-earned at every boundary.

The shape of a full-chain attack

N.º 019 tells the Kurniawan case as the record tells it, and this note will not tell it twice. What matters here is its shape. According to the United States Attorney for the Southern District of New York, one man blended cheaper wines to imitate rare ones, poured them into authentic empty bottles, fitted corks and counterfeit labels, and sold the result at auction with invented provenance — every layer of the system, attacked at once. The break came not from chemistry but from a producer’s own chronology: vintages that could not exist. Independent records are stronger than self-asserted identity. Hold that sentence; it will be tested against this archive before the end.

Layer one — the content

The most fundamental attack is substitution: the outside identifies one wine, the inside contains another. In October 2020, Italy’s Guardia di Finanza described a counterfeit-Sassicaia operation built on lower-value Sicilian wine, bottles sourced in Turkey and packaging from Bulgaria; the seizure, reported by the trade press from the police statements, ran to some 700 cases — around 4,200 bottles. The supply chain was international because the attack was not an object. It was an assembly process.

The evidence can live in the wine itself. Caesium-137 is an artificial isotope that did not exist before atmospheric nuclear testing, and low-background gamma spectrometry can measure it through sealed glass. The best-established peer-reviewed work — Hubert and colleagues, 2009 — shows the method dating wines of the nuclear-test era, particularly vintages from 1952 to roughly 1980, and exposing a purported nineteenth- or early-twentieth-century wine when post-1952 caesium is present. Later work notes that the signal becomes too weak for many recent vintages: the method is better at excluding impossible ages than at certifying an exact modern one. Other full-bottle screening exists in the literature — dielectric and diamagnetic measurements on intact bottles — as specialist techniques, not as routine services with published error rates. Strontium isotope ratios can support geographical-origin analysis when read against local geology and proper reference material; they are a research and forensic tool, not a universal vineyard fingerprint, and they are not the basis of the European Union’s wine databank, which rests on isotopic analysis of ethanol and water.

The correct conclusion is narrower than the brochures and stronger for it. Content analysis can falsify a claim. It rarely authenticates the whole bottle by itself.

Layer two — the container and the seal

A genuine bottle is not the same thing as genuine wine. The full-chain attack depended on authentic empties, which is why glass shape, embossing, mould marks, fill level, cork, capsule construction and any sign of recapsulation matter. They are evidence of the package, not an assay of the liquid. The civil litigation around the so-called Jefferson bottles showed how engraving technique and glass manufacture become forensic questions; Hardy Rodenstock was never criminally convicted, and what exists is a default judgement, expert work and reporting.

Producer-applied seals help when they are bound to a producer record at bottling. Château Lafite Rothschild publishes an authentication system built on a unique bubble pattern paired with a code, applied since the 2009 vintage; NFC and RFID tags can play the same role when the antenna is designed to break on opening. Their limit is structural: a seal binds a producer record to a package; it does not analyse the liquid. A refilled authentic bottle, a transferred seal, an implementation flaw or a false record upstream can still defeat it — and none of these devices can retroactively secure the old vintages, which are the ones worth faking.

Then there is the empty bottle. Prestige empties have a secondary value precisely because they are attack infrastructure: in 2011 CNN reported empties of Château Lafite fetching up to HK$10,000 in China’s black market, unblemished ones commanding the premium. Opening a bottle does not erase every kind of evidence, but it consumes the tamper-evident state, changes the object, and creates a reusable container. The defensible rule is operational, not a claim about what every producer mandates: for high-risk bottles, photograph the capsule, cork, fill and label before opening — and irreversibly mark or destroy the empty afterwards.

Layer three — the record

An earlier draft of this note called this layer paper. That is too narrow. The record is the producer’s chronology and release history; invoices and confirmations; warehouse identifiers, serials and vouchers; condition photographs and inspection reports; title transfers and release instructions; account logs; and the link between the physical bottle and its digital entry. A fraudster can print a label. He can equally alter a PDF, clone a domain, or issue a plausible certificate. The record needs a provenance of its own.

Which is why the principle the trade most often omits belongs in one sentence. Bond is a custody control, not an authenticity oracle. Professional bonded storage reduces handling, and a transfer of title without moving the bottle preserves condition and starves the substitution opportunity. But if a counterfeit enters a warehouse, excellent custody preserves that counterfeit perfectly. The evidential value of in bond depends on what was checked at entry, how the bottle was identified, and whether every later title event stays linked to the same physical object.

Liv-ex’s published materials show what a layered approach looks like: member vetting, provenance and photographs requested before trading in higher-risk cases, warehouse inspection under ultraviolet light, checks of producer-specific measures — microprint, holograms, codes, capsules, seals, cork, sediment, glass. Maureen Downey, whose inspection work supported the FBI and the Department of Justice in the Kurniawan case, built a method around more than a hundred physical checks; like every proprietary visual system, it publishes no audited error rate, and this note treats it as expert practice rather than as measurement.

And the guarantee. Sotheby’s current conditions of business — at auction, in private sale and on its marketplace — limit the authenticity guarantee for wine to producer and vintage, with a claim period of twenty-one days. Not condition, not provenance, not rarity; three weeks on a bottle that may be thirty years old. So the question at purchase is not whether there is a guarantee. It is: what exactly is guaranteed, for how long, by whom, and what evidence must remain intact to make a claim?

Layer four — identity, account and payment

This layer steals the value without touching the bottle.

The seller can sell what does not exist. John Fox, owner of Premier Cru in Berkeley, pleaded guilty to a wine Ponzi scheme: according to the United States Attorney, he sold or attempted to sell around $20 million of “phantom wine” he had never bought, and when the business failed customers were owed around $45 million for wine not delivered. He was sentenced to 78 months. Nothing was forged. The inventory record was.

The auction seller can know more than the buyer. In Koch v. Greenberg, a jury found fraud over 24 bottles bought through a Zachys auction and awarded $355,811 in compensatory damages, $24,000 in statutory damages and $12 million in punitive damages; the court later reduced the compensatory award to $212,699 and remitted the punitive to $711,622, and the Second Circuit upheld the finding in 2015. The lesson is not the headline number. It is that counterparty knowledge and the buyer’s right to inspect are part of the attack surface.

And the payment can be redirected. Business Email Compromise counterfeits nothing; it compromises a legitimate transaction — usually by sitting quietly inside a supplier’s mailbox until a real invoice appears, then changing one string: the bank account. The FBI’s Internet Crime Complaint Center put exposed losses at more than $55 billion worldwide between October 2013 and December 2023. The controls are ordinary and they work: confirm every change of beneficiary through a known second channel, never through the contact details in the request itself; multi-factor authentication on mail, marketplace and bank; dual approval above a threshold; an approved-beneficiary list; and — the most transferable habit of all — treat payment, transfer of title and physical release as three separate events that must each bind to the same legitimate transaction.

Verify at every boundary

Authentication is not a ceremony performed once. It is a sequence. At purchase, the failure is a false bottle, seller or guarantee; the minimum evidence is producer chronology, provenance documents, current condition, the guarantee’s actual terms and the counterparty’s identity — with diligence scaled to producer, age, value, format, price anomaly and provenance gaps. At admission to storage, the failure is the wrong object entering the record; the evidence is a unique physical-to-digital identifier, photographs, quantity, format, condition and seal state, reconciled before acceptance. At title transfer, a record that changes without the bottle, or a bottle that moves without the record; transfer within custody where possible, with independent confirmation of authority. At payment, a genuine transaction paying a fraudulent beneficiary: out-of-band confirmation, dual approval. At release, the wrong bottle or destination: serial, release authority, condition at dispatch, two-person reconciliation for high-risk lots. At opening, the seal evidence disappears and the empty becomes reusable: record the opening, mark or destroy the empty.

Risk is not a price threshold. A €700 bottle carrying an impossible vintage deserves more diligence than a €5,000 bottle bought directly from the domaine. The variables that matter are value, the fraud history of the producer and vintage, age, format, price anomaly, custody gaps, movement history and counterparty risk.

How a bottle enters this archive — and how the record once got it wrong

Every bottle in this cellar carries a ledger line before it carries a story: acquisition cost, the custodian’s own serial or voucher, condition at entry, and a reference value we compute ourselves and label as ours, never as an appraisal. Custody sits with professional bonded warehouses; releases leave through a venue that, by its own terms, does not hold the physical goods. Title, custody and condition are three columns, not one — because they fail separately.

This summer the record tested us. A 2023 Burgundy in the ledger carried the custodian’s name for a grand cru that the domaine’s publicly documented range did not include. A market check found no listing for the wine — only for a village cuvée from the same estate with a similar name and a similar price. The archive’s own verification returned a verdict: this wine does not exist as labelled.

It did. The bottle, photographed, reads exactly what the custodian’s record said. The public chronology had simply not caught up with a new parcel — and our check had converted an absence in the record into a negation of the object. Independent records are stronger than self-asserted identity; but an incomplete record is not evidence of anything, and a verification that cannot fail in both directions is not a verification. The label was the primary source. Everything else was commentary that arrived late.

We kept the wrong verdict in the file, dated, beside the correction. That is what a record is for.

The buying rule

No single control authenticates a bottle. Chemistry can contradict the liquid; the package can show tampering or an anachronism; a producer’s record can make a vintage impossible; bonded custody preserves the state from admission onward; a seal binds a package to a record; identity and payment controls protect the transaction. Trust appears only where independent controls agree — and where a disagreement between them is visible rather than silent.

That is the useful translation from security to wine. Not put the bottle on a blockchain. Not add a chip. Not buy only in bond. Define the asset. Identify the boundary. Verify what changed. Preserve the evidence.

A rare bottle without custody is just a story. A rare bottle with custody is a story with witnesses.

The bottle is not the system. The chain is.

— The Empty Drops

Sources & further reading

1. U.S. Attorney’s Office, S.D.N.Y. Kurniawan conviction (18 December 2013) and sentencing (7 August 2014) releases. The case itself is read in N.º 019.
2. Microsoft Learn. “The STRIDE Threat Model” — six categories and their security properties (Kohnfelder & Garg, 1999).
3. ISO/IEC 27037:2012. Guidelines for identification, collection, acquisition and preservation of digital evidence.
4. Forbes; The Drinks Business, October 2020. Guardia di Finanza operation against counterfeit Sassicaia: Sicilian wine, Turkish bottles, Bulgarian packaging; seizure of some 700 cases (~4,200 bottles). Reported from police statements, not a court finding.
5. Hubert, Ph.; Perrot, F.; Gaye, J.; Medina, B.; Pravikoff, M.S. “Radioactivity measurements applied to the dating and authentication of old wines.” Comptes Rendus Physique 10 (2009) 622–629.
6. “Possibility of wine dating using the natural Pb-210 radioactive isotope.” Journal of Environmental Radioactivity 142 (2015) 132–135. Limits of Cs-137 for recent vintages.
7. “Using low frequency full bottle diamagnetic screening to study collectible wine.” Talanta 85 (2011) 2437–2444; “Using low frequency dielectric absorption to screen full intact wine bottles.” Analytica Chimica Acta 702 (2011) 188–194.
8. European Commission, Joint Research Centre. European Wine DataBank; ERM-AE003 reference material — SNIF-NMR / IRMS isotopic analysis of ethanol and water.
9. OIV. Compendium of International Methods of Analysis: multielemental analysis by ICP-MS (elemental strontium; not ⁸⁷Sr/⁸⁶Sr attribution).
10. Decanter. “World’s most expensive bottle claimed fake as renowned collector sued”; “Billionaire Bill Koch wins appeal over fake wine.” Jefferson bottles; Koch v. Rodenstock (civil default judgement).
11. Domaines Barons de Rothschild (Lafite). Official authentication page; Decanter, “All Lafite bottles to carry Prooftag” (from the 2009 vintage). Prooftag, Bubble Tag materials — manufacturer claims, attributed as such.
12. CNN, “Counterfeits in the grape wall of China,” 10 March 2011. Empty Lafite bottles at up to HK$10,000.
13. Liv-ex. “Setting the Standard: Wine Authentication”; Logistics and Standard In-Bond contract materials.
14. Chai Consulting / WineFraud.com (Maureen Downey). Authentication services; work with FBI/DOJ on the Kurniawan case. Proprietary method; no published error rates.
15. Sotheby’s. Conditions of Business for Buyers (London and Hong Kong auctions); Private Sale Conditions of Business; Buy Now Marketplace Conditions. Wine & Spirits authenticity guarantee: producer and vintage, 21-day guarantee period.
16. U.S. Attorney’s Office, N.D. California. “Berkeley Wine Shop Owner Sentenced to Six and a Half Years in Prison for Running Wine Ponzi Scheme,” 14 December 2016.
17. Koch v. Greenberg, No. 1:07-cv-09600 (S.D.N.Y.), Document 508, 31 March 2014; Second Circuit affirmance, September 2015.
18. FBI / IC3. “Business Email Compromise: The $55 Billion Scam,” Public Service Announcement I-091124-PSA, 11 September 2024.
19. The Empty Drops, cellar record, September 2026. The intake episode described above; producer, wine and custodian on file.

On method

STRIDE is used as a list of questions, not as a claim that a bottle is software; ISO/IEC 27037 is an analogy, not a wine standard. Caesium-137 is described as the best-established radiometric method for excluding impossible ages in old wine, not as the only non-destructive technique. Commercial authentication devices are described by function and by limit, with manufacturer claims attributed as such; no audited error rate was found for any proprietary visual method or seal. Bonded custody is treated as preserving history from admission onward, not as proof of what entered. The rule on empties is risk-based, not a published producer policy. The intake episode is this archive’s own; the wrong verdict and its correction are both on file. The framework is ours. The cases are the record’s.