The 75-Cent Spy

In the summer of 1986, an astronomer named Clifford Stoll sat down at his desk at the Lawrence Berkeley Laboratory and tried to figure out why his computer center was 75 cents short.

Stoll was not a computer scientist. He was an astronomer whose grant had run out, and he’d drifted into the world of mainframes and network cables the way academics often do—because the money for the thing he really wanted to do had dried up. But a discrepancy is a discrepancy, and so Stoll went looking for the missing seventy-five cents.

What he found was a ghost.

Someone, it seemed, had been using the laboratory’s computers without authorization. According to the lab’s own history, this phantom user had failed to pay for a grand total of nine seconds of computing time. Nine seconds is nothing. Seventy-five cents is nothing. But that was the point. The machine had done something it wasn’t supposed to do, and the accounting system had noticed.

Spying on the Spy

Stoll dug deeper. He found an account with no billing address. He deleted it. The activity continued. Whoever this was had administrator privileges and was trying to cover his tracks. So Stoll—who, by his own account, was a 1960s holdover with a beard and a deep suspicion of authority—did something radical. With the lab’s blessing, he decided to spy on the spy.

He hooked up a printer to the network. It was a crude device, but it was brilliant: every command the intruder typed, every response the computer sent back, would be preserved on paper. Stoll could sit at his desk and watch a stranger rummage through the Berkeley system in real time, without the stranger ever knowing he was being observed.

At first, Stoll assumed he was dealing with a prankster. Maybe some Berkeley undergraduate, some computer-science student playing a game. But the stranger wasn’t interested in the things students are interested in. He wasn’t poking around the astronomy files. He was using the Berkeley computers as a launching pad to reach into military systems. He was searching for keywords: NORAD. SDI—the Strategic Defense Initiative, Ronald Reagan’s proposed missile shield. Berkeley did unclassified research. But through the tangle of network connections, Stoll could see someone hunting for defense secrets.

This was the moment when the story stopped being about a billing error.

Stoll called the FBI. In an interview a few years later, he remembered the response he got. The agent wanted to know how much money the lab had lost.

“Seventy-five cents,” Stoll said.

The agent was unimpressed. The military searches were troubling, but seventy-five cents was seventy-five cents. Change the password, he was told. Cut the connection. Move on.

Following the Signal

Stoll didn’t move on. He kept watching. And the more he watched, the more he became obsessed. He programmed his pager to go off whenever the intruder logged on. Sometimes he slept under his desk. The stranger could appear at any hour, and if you wanted to follow him, you had to build your life around the possibility that he might. Stoll’s girlfriend was not always thrilled with this arrangement.

The trail led out of Berkeley and across the country—to MITRE, a defense contractor in Virginia—and then across the Atlantic, to Germany. Every connection, though, was another dead end unless you could follow it in real time. A computer could receive a signal from one place and pass it on to another. Stoll had to assemble a kind of posse: telephone technicians, network operators, other systems administrators, all of them ready to trace the next link in the chain the moment the stranger appeared. But the stranger was cagey. He’d log on for a few minutes, then disappear. The investigators could get as far as a German city. But to find a specific person at a specific telephone required a much longer connection.

A Reason to Stay

Stoll realized he had to give the stranger a reason to stay.

So he invented a reason. He created a directory filled with fake documents about the Strategic Defense Initiative. Academic prose, it turns out, is not so far from bureaucratic military prose. Change a professor to a colonel, a dean to a general, and the language takes on the right air of official importance. Stoll wasn’t giving away real secrets. He was just hoping that his SDI phantasmagoria would take a little while to read.

It worked.

The intruder found the directory and settled in—for more than an hour. And in that hour, the telephone technicians traced the call. Stoll and his team celebrated with milkshakes made from homegrown Berkeley strawberries.

The KGB Connection

The trail led to a programmer in Hanover, West Germany, named Markus Hess. And here the story took one final turn. Months earlier, as part of the trap, Stoll had invented a fictitious secretary and hinted that if the intruder wanted more information, he could write to her and she would send it. Now, out of the blue, a letter arrived at Berkeley—from someone in the United States—asking the fictitious secretary for the promised material. The bait, apparently, had been passed along. At that moment, Stoll’s team concluded that they were witnessing attempted espionage.

Hess, it turned out, was part of a group selling computer passwords and access codes to the KGB. An official U.S. counterintelligence history would later describe the group as being in relentless pursuit of privileged access to Western military and research institutions. The hacker Stoll had watched so closely had tried to break into some 450 computer systems and succeeded in more than 30. Useful information could be sold. But so could the means of acquiring useful information. A password was a product, too.

Formal arrests were made in March of 1989. The following February, Hess and two associates were convicted of selling military computer codes to the KGB. They were given suspended sentences.

An Atmosphere of Trust

In the end, though, what stayed with Stoll was not the fact that he’d found a spy. It was something larger. He later described how the break-ins had hurt the wider community of researchers and computer people. The damage went beyond stolen information: fear of another intrusion was leading people to put up barriers and disconnect from networks.

Stoll belonged to the world of open computer networks. He had friends and colleagues at universities and laboratories around the world. He described them as people who, “even if they weren’t my friends, were still my colleagues.” He’d set out to keep their computers running. But in the end, he found himself fighting for something more—for the idea that his community could continue to work the way it always had, in an atmosphere of trust.

References

1. Berkeley Lab, Computing Sciences. “History,” 1986 entry: “The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage.”
   The 75-cent discrepancy and nine seconds of computer time.
2. Clifford Stoll. “Stalking the Wily Hacker.” Communications of the ACM 31, no. 5 (May 1988): 484–497. National Security Archive copy.
   Contemporary firsthand account: detection and monitoring, pp. 484–486; network traces, SDI decoy, milkshakes, and subsequent letter, pp. 486–488; attack totals, p. 484.
3. C-SPAN, Booknotes. Interview with Clifford Stoll about The Cuckoo’s Egg. December 3, 1989.
   Stoll’s recollections of the FBI response, his countercultural background, and the route through MITRE in Virginia.
4. Martin Snapp. “How a Berkeley Eccentric Beat the Russians—and Then Made Useless, Wondrous Objects.” California magazine, March 28, 2016.
   Stoll’s recollections of his astronomy funding, the SDI documents’ bureaucratic language, and his sense of responsibility to fellow researchers.
5. National Counterintelligence Center. A Counterintelligence Reader, Volume 3: Post-World War II to Closing the 20th Century. “The ‘Hannover Hackers,’” pp. 396–397. Hosted by ODNI.
   The KGB connection, the trade in passwords and access codes, and the March 1989 arrests.
6. Reuters. “2 W. Germans Get Suspended Terms as Computer Spies.” Los Angeles Times, February 16, 1990.
   February 1990 convictions and suspended sentences.
7. Andy Greenberg. “Meet the Mad Scientist Who Wrote the Book on How to Hunt Hackers.” WIRED, December 18, 2019.
   Retrospective on the pager, overnight monitoring, and strain on Stoll’s personal life.