05/02/2026
On his second day at a new job in 1986, an out-of-work astronomer was asked to explain a 75-cent accounting error. Ten months later, he had personally exposed a Cold War KGB spy ring.
His name was Cliff Stoll. By training, he was an astronomer with wild Einstein-style hair and a doctorate in planetary science. He had been working on telescope optics for the future Keck Observatory in Hawaii. Then his grant ran out. With no astronomy money left, the Lawrence Berkeley National Laboratory in California — a major U.S. Department of Energy research facility — quietly reassigned him to their computer center to keep him on payroll. Stoll, who barely knew Unix at the time, was now a sysadmin.
On his second day in the new job, his manager Dave Cleveland walked into his office mumbling about a glitch in the lab's billing system. The lab charged its researchers for every second of computer time. The previous month's books had come out 75 cents short on a total bill of $2,387. Cleveland asked Stoll, more or less casually, to figure out where the missing 75 cents had gone.
Anyone else would have written it off as a rounding error. Stoll did the math by hand and found that the lab's accounting code didn't round.
So someone had used 9 seconds of computer time without paying for it. Which meant somebody, somewhere, was on the lab's computer who shouldn't have been.
The intruder had a username Stoll had never seen before. Just one word.
Hunter.
What followed was one of the strangest one-man manhunts in the history of computing.
Stoll figured out within days that Hunter wasn't a confused student or a curious friend of an employee. Hunter had superuser privileges — full administrative access to the entire system — which he'd obtained by exploiting a flaw in GNU Emacs that almost nobody on Earth knew about yet. From inside Berkeley's computer, Hunter was using the lab as a stepping stone to break into other machines: Air Force bases, Army facilities, defense contractors, NASA, MIT, military command networks across the United States.
Stoll, more curious than alarmed at first, started watching.
He spent one famous weekend rounding up fifty borrowed teleprinters and terminals from the desks of co-workers who were away, dragging them into the lab on hand-trucks, and physically wiring them to the fifty modem lines that fed Berkeley's computer center — so that when Hunter logged in, Stoll could capture every keystroke on a printout in real time. He left the rig running. When the printers chattered, he came running.
He bought a pager. He clipped it to his belt. He gave the number to no one but the lab. Whenever the pager buzzed in the middle of the night, it meant Hunter was online — and Stoll would jump on his bicycle and pedal at full speed across Berkeley to the lab to watch live as a stranger half a world away poked through American defense networks. He slept under his desk for nights at a time. His girlfriend, Martha Matthews, brought him sandwiches and home-knitted sweaters. The unofficial joke around the lab was that Cliff Stoll was now part of the furniture.
He went to the FBI. The FBI essentially laughed him off — no money was missing in any meaningful sense, and the lab handled no classified information. He went to the CIA. They were polite and uninterested. He went to the NSA. He went to the Air Force Office of Special Investigations. He went to anyone who would listen. For months, almost no one in the entire United States intelligence community thought a 75-cent billing discrepancy was worth taking seriously.
So Stoll kept investigating it himself.
He noticed the intruder logged in at the same time of day, in patterns that suggested he was operating from somewhere in central Europe. He noticed he was using a 1200-baud modem connection, slow and intermittent. He helped engineers at the long-distance carrier Tymnet trace the connection across the United States — to a defense contractor in Virginia, then back across the Atlantic, then up through a satellite to West Germany, and finally — astonishingly — to a guy's apartment in Hanover.
But West German police needed him to keep the intruder online for at least 45 minutes at a time to complete a phone trace. Hunter usually logged in for ten or fifteen minutes at most.
So Stoll and his girlfriend Martha invented a solution. In the shower one morning, talking through ideas, they came up with a plan they jokingly called "Operation Showerhead." Stoll would create a fake department on the Berkeley network — a fictitious office working on Ronald Reagan's Strategic Defense Initiative ("Star Wars") — and fill its files with elaborate but completely useless bureaucratic documents. He invented an imaginary secretary named "Barbara Sherwin." He filled her files with hundreds of pages of phony reports designed to dazzle a Cold War spy.
What he had built was, by most accounts, the first honeypot in computer security history.
The bait worked. Hunter, drooling, sat parked on Berkeley's computer for hour after hour, downloading fake SDI documents. The West German police completed the trace. They knocked on the door of an apartment in Hanover and arrested its occupant — a young, hard-living West German hacker named Markus Hess, who, along with his co-conspirators Dirk Brzezinski and Peter Carl, had been hacking into roughly 400 U.S. military computers across the previous several years, packaging up everything they found onto floppy disks, and selling them to a KGB officer code-named "Sergei" through a Soviet trade mission in East Berlin.
The total payment they received from the KGB over the entire operation? Around $54,000 in cash — and, according to legal records, a quantity of co***ne.
Hess and his ring went to trial in 1990. The Berlin Wall had just fallen. The Cold War was visibly ending. The judge concluded that the actual damage to West Germany was minimal. They were given suspended sentences of about two years. They smiled as the verdicts were read. None of them ever served prison time.
Cliff Stoll flew to Germany to testify against them. He went home to Berkeley. He sat down and wrote it all up — first as an academic paper called "Stalking the Wily Hacker" in Communications of the ACM, and then, in 1989, as a New York Times bestselling book called The Cuckoo's Egg, which is still, more than thirty-five years later, on the required-reading list of nearly every major cybersecurity course on Earth.
Stoll never quite stopped being surprised by all of it. He went back to making weird things — most famously, he started a small business in his basement making hand-blown Klein bottles, the strange, mathematically impossible glass shapes that have only one side. He gave joyful, scatterbrained TED talks. He wrote books. He kept his Einstein hair. He was, by every account of every person who ever met him, one of the gentlest, kindest, weirdest, smartest people in the early history of the internet.
He died in May 2024, at the age of 73.
But the lesson he left behind has outlived him, and probably always will.
History does not always turn on dramatic events. Sometimes it turns on a 75-cent error in a billing report that any normal sysadmin, on any normal day, would simply have written off.
The world's first cyber-spy ring was caught because one curious astronomer, on his second day at a new job, refused to do that.
Pay attention to the small things.
Sometimes they are the only signs anyone ever sends you.
