The 75-Cent Spy

In 1986, the computer center at Lawrence Berkeley Laboratory had an accounting problem worth 75 cents.

Clifford Stoll was asked to find it. An astronomer whose funding had run out, he had moved from designing telescope optics to helping run the laboratory’s computers. At first, he suspected a Berkeley student. Stoll’s recollections

The discrepancy came from an unauthorized user who, according to Berkeley Lab’s history, had not paid for nine seconds of computer time. The money was almost irrelevant. The machine had done something its accounting could not explain.

Stoll found an account without a billing address. Removing it did not stop the activity. Someone was still inside, using administrator privileges and trying to alter the records. With the laboratory’s support, he began recording the incoming traffic. Contemporary account, pages 484–485

A printer let him follow the visitor’s commands and see what came back. He could watch someone working at his computer without the person knowing he was there.

The visitor showed little interest in astronomy. He used Berkeley to reach military computers, then searched them for terms such as NORAD and SDI. SDI was the Strategic Defense Initiative, the proposed missile-defense program. Berkeley did unclassified research. Yet through its network connections, Stoll was watching a stranger hunt for defense information.

This was the point at which the student-prank explanation stopped fitting. Stoll called the FBI. In his 1989 interview, he recalled an agent asking how much money the laboratory had lost.

Seventy-five cents.

The military searches were alarming; the financial loss sounded ridiculous. Stoll recalled being advised to change the password and cut off the connection. He chose to keep watching.

The people who could help belonged to institutions he had not expected to work with. In that interview, the self-described 1960s holdover recalled his surprise at finding common purpose with people in suits and secret agencies.

Following a connection that kept moving

The investigation began taking over the astronomer’s life. He programmed a pager to alert him when the intruder returned and sometimes slept under his desk. Nights at the laboratory also created friction at home, as Wired’s later profile recounts. The computer user could appear on his own schedule; following him meant arranging a life around it.

One trace led to MITRE, a defense contractor in Virginia. The trail eventually reached Germany. Stoll’s recollections

An address along the route was only another place to investigate. A computer could receive a connection from elsewhere and send it onward. Stoll needed people who could follow each part of that chain while the intruder was still using it.

Telephone technicians and network operators joined the effort. Short sessions repeatedly frustrated the final trace. The investigators could identify a German city, but reaching an individual telephone required a longer connection. Contemporary account, pages 486–488

The person was close enough for Stoll to read his commands and still too far away to identify. Watching longer had revealed his interests. Now those interests offered a way to make him stay.

Something worth stealing

Stoll created a folder of fictitious SDI documents. Academic bureaucracy supplied the official-sounding language. As he later explained, change a professor to a colonel and a dean to a general, and the prose acquired the appropriate military air. Stoll’s recollections

The files did not have to reveal a real secret. They had to take time to read.

The intruder found them and stayed for more than an hour. While he read, the telephone technicians completed the trace. Stoll’s team celebrated with strawberry milkshakes. Contemporary account, page 488

The trail identified Markus Hess, a programmer in Hanover, West Germany. Stoll’s recollections

Then the invented documents produced something Stoll could hold.

They had offered further material by mail from a nonexistent secretary. Months later, someone in the United States wrote to her requesting information. The bait had apparently traveled beyond the person being watched in Germany. Stoll’s contemporary account says the letter convinced his team they were seeing attempted espionage. They left that investigation to the FBI. Contemporary account, page 488

The secretary did not exist. Her correspondent did.

The customer behind the searches

The wider investigation connected Hess to a group selling computer passwords and access codes to the Soviet KGB. An official U.S. counterintelligence history, on pages 396–397, describes the group pursuing highly privileged access to Western military and research organizations. The monitored intruder had attacked about 450 systems and entered more than 30.

Useful information could be sold, but so could the means of getting more. A password was a product.

Formal arrests came in March 1989. In February 1990, Hess and two associates were convicted of selling military computer codes to the KGB. They received suspended sentences. Court report

Unclassified information was part of that trade. Berkeley’s connections had been worth stealing.

For a business, the comparable asset might be an employee account that reaches a customer’s ordering system or a supplier’s portal. Its value extends beyond the documents saved in it. That is a reason to understand those connections, even when the work inside the company seems unremarkable.

Stoll came to care about something beyond finding the person on the other end of the line. He later described anger at the suspicion the intrusions spread, pushing people to put up barriers and disconnect. The networks supported a community he belonged to. The researchers elsewhere, he said, “even if they weren’t my friends, were still my colleagues.” Stoll’s recollections

He had been trying to keep their computers useful. By the end, that meant preserving their willingness to use them together.