A 75-cent accounting error that caught a spy

The story

In 1986, Cliff Stoll was an astronomer who had been moved into running computers at Lawrence Berkeley National Laboratory. One of his first tasks was to explain why two accounting systems for computer time disagreed by 75 cents.

The cause turned out to be an unknown user who had broken in. Instead of simply locking the intruder out, Stoll watched. He connected printers to the incoming lines to record every keystroke, slept under his desk, and followed the intruder as they used the lab’s computers to break into military systems across the United States.

To keep the intruder connected long enough for a trace, Stoll and his partner created a pile of fake files about an invented government program. The bait worked. The trace led to Markus Hess in West Germany, part of a group selling information to the Soviet KGB. Stoll told the story in his 1989 book, The Cuckoo’s Egg.

Why it mattered

It was one of the first documented computer break-ins, and an early case of a hacker selling what he found to a foreign intelligence service. It showed that an intruder could hop from one connected system to the next until reaching the real target. Stoll’s daily logbook and his decoy files, an idea now known as a honeypot, became early models for how intrusions are watched and traced.

The lesson today

The intrusion was found because one person refused to ignore something small and strange. That is still how many attacks are caught today: an odd sign-in, a login at 3 a.m., a mailbox rule nobody remembers creating.

Tools now do most of the watching, but the principle is the same. Someone has to look at the anomalies, and know which ones matter.