An old book recently surfaced on the Lobsters book forum—The Cuckoo’s Egg by Clifford Stoll, a memoir of how, in 1986, an astronomer caught a hacker working for the KGB. The title’s metaphor is immediately clear: a cuckoo lays its egg in another bird’s nest, and here a stranger had settled into someone else’s computer system and lived there for nearly a year.
What grabs you is the arithmetic: Stoll was tasked with investigating a discrepancy—75 cents that did not add up in the bills for computer time. Not a million dollars, not a vanished archive, but three quarters of a dollar. That trifle ultimately uncovered a network of break-ins into U.S. military computers, a trial in Celle, Germany, and several human fates—one of them ending with a burned body in the woods.
And the story has another layer. The man who seems to have had the best nose for anomalies of his era publicly declared the internet a fad ten years later—and then laughed at himself for it. More on that at the end.
Lawrence Berkeley Laboratory (LBNL) rented out computer time to remote users, billing by the minute—and one day, an extra entry appeared in those accounts: a new account with no billing address. The job of figuring it out went to 36-year-old Clifford Stoll, a planetary astronomer with a dissertation on Jupiter’s polarimetry, whom the lab had transferred to IT not entirely of his own accord. Thus began one of the most famous detective stories in the history of computing.
For those who like to check their sources, one detail: Stoll’s technical article, published in Communications of the ACM in May 1988, contains no mention of 75 cents. It says something much drier: “an account generated without a corresponding billing address, which prevented our accounting program from balancing.” The figure of three quarters of a dollar appeared in the 1989 book—and from there spread into headlines such as the German “How 75 cents became fatal.”
Once he sorted out the entry, Stoll found something worse than an unpaid bill. An unknown user had superuser privileges (root)—that is, full control of the machine. He had gotten in through a flaw in the movemail function of the GNU Emacs text editor: the mail-transfer utility ran with administrator privileges and did nothing to stop a substituted script from being slipped to the system. The patch that closed the hole was three lines long. But there was no ready-made solution—the intruder had already visited dozens of machines, including sensitive ones.
From there, Stoll behaved like a researcher: rather than walling off the intruder, he began measuring him. He connected printers and recorders to incoming phone lines, and over a long weekend “borrowed” fifty terminals and teletypes from colleagues who had gone away, so he could spread all traffic across the lines. Everything the intruder typed printed out in real time. Stoll programmed his pager to wake him when the hacker came online, and more than once slept beneath his desk.
At the same time, he kept a lab notebook: what the intruder did, how the trace was progressing, whom he spoke to in law enforcement. Months later, it was that notebook that made it possible to spot what they had initially missed in old records: dates, times, and targets that were later used to reconstruct the hacker’s route. A separate question was where exactly he went. He searched files for the words “nuclear,” “sdi,” “kh-11,” and “norad,” downloaded encrypted password files, and cracked them with a dictionary. Only 2 percent of his attempts succeeded completely, but on one of his visits he got into a machine running a real-time medical experiment. It was sheer luck that anyone noticed: if they had not, a patient could have been harmed.
The trace took almost a year and required both hemispheres. The first lead went to Tymnet, a routing service through which the user dialed into the machine he wanted; from there, they reached a modem pool belonging to the defense contractor MITRE in McLean, Virginia. That pool, it turned out, allowed any employee to dial out—and for those who did not know the codes, it had a feature for redialing the last number called. The contractor’s phone bills contained hundreds of short calls all over the country: the intruder was collecting modem numbers and dialing military bases, trying the standard “root,” “guest,” “system” at each one. Many bases recorded such attempts—and not one traced them.
Then the trail went to Germany: the universities of Bremen and Karlsruhe, a public modem in a third city, the Datex-P network. This was where Deutsche Bundespost—the German postal service, which at the time ran the telephone network—entered the picture. But merely having the technical ability to catch the connection was not enough: they had to keep the hacker on the line long enough.
That was when Stoll came up with what today would be called a honeypot, a “pot of honey.” At the lab, he fabricated a nonexistent department supposedly working on a defense contract—complete with an imaginary secretary, Barbara Sherwin, in whose name correspondence was conducted. The department was called SDInet, and it was stocked accordingly: fat files crammed with pseudo-scientific bureaucratic nonsense. The German version of the story adds the crucial part: nobody was trying to make it convincing; what mattered was size. The file was large enough that downloading it took long enough to trace the line. Stoll called the bait his “cuckoo’s egg.”
It worked. The German postal service followed the line to an apartment in Hanover, where Markus Hess, a programmer operating on the network under the handle Urmel, lived. There was a pleasant side benefit: shortly before that, the SDInet lab had received a letter sent through ordinary mail from Hungary—from someone who could only have learned of that address from Hess. Apparently, the KGB was checking that way whether the supplier was inventing what he was selling.
Another result of the year’s work was organizational. Of the four hundred and fifty machines the intruder tried to connect to, only one or two organizations called Stoll back after noticing the break-in. The FBI was not interested at all at first: no big money was involved, and no storage medium containing classified information had been breached. It took several years and new laws before the security services had formal grounds to pursue the case.
By then, a group had formed in Hanover that landed in the textbooks against its will. Karl Koch, nicknamed Hagbard Celine—he took the name of a character from the anarchist trilogy Illuminatus!, which he read at 14 as a documentary account—and Markus Hess; along with them Dirk-Otto Brezinski (DOB) and Hans-Heinrich Hübner (Pengo). They gathered for weekly meetings in Hanover beer halls, where the local chapter of the Chaos Computer Club later grew up.
The idea of selling the stolen data to Soviet intelligence came from Peter Carl, Pedro—a former croupier who was perpetually broke. In early September 1986, he dressed properly, traveled to East Berlin, and walked straight into the Soviet embassy. They did not listen to him immediately and, judging by participants’ later accounts, laughed at first. But the conversation eventually took place: a residency officer known as Sergei asked for test material and handed over a wish list.
The list was not about missiles. It included the Unix, VM, and VMS operating systems, various compilers, and computer-aided design tools. “The Russians saw us first and foremost as a source of pirated software,” Hübner recalled. “You couldn’t buy a compiler for a VAX in a store back then.” Sergei paid cash, in hundred-mark notes: Unix brought the largest amount—25,000 marks, the Securepack software package brought 3,000, plus 600 marks for every visit. Over the years of cooperation, the total came to 90,000 marks, half of which Pedro kept for himself as courier.
It is clear why the list looked the way it did. In the mid-1980s, East Germany was undertaking a “great leap” in microelectronics, for which 120 million hard-currency marks had been allocated; the Robotron combine was supposed to produce the K1840—virtually a copy of DEC’s VAX 11/780, a machine that could not simply be bought because of the Western CoCom embargo. Compilers and Unix from the very VAX they were copying saved years.
There is also a point in this story where the sources diverge. According to court documents in Celle, the group received 90,000 marks in total, of which Hess was supposed to return 10,000. English Wikipedia gives another figure—$54,000 received personally by Hess—citing a Russian book on signals intelligence. These are most likely different calculations at different exchange rates, but there is nowhere to verify which sum is correct: KGB documents remain closed to historians. A heise article mentions a version according to which they are inaccessible in part because a certain Vladimir Putin was the KGB officer overseeing Robotron in Germany. There is no evidence for this version, and it should be treated as a journalist’s conjecture.
On March 2, 1989, the police and the Federal Intelligence Service carried out a series of searches in northern Germany. That same evening, ARD aired a special report calling the affair “the biggest espionage case since Guillaume”—in 1974, the exposure of a Stasi agent had led to Chancellor Willy Brandt’s resignation. Newspapers appeared with headlines such as “SDI betrayed—are we defenseless now?” The uproar was exactly as authentic as it looked: that secret SDInet file bait existed only because Stoll had invented it, cobbling it together from whatever documents were at hand and giving them made-up military names.
The trial was held at the Higher Regional Court in Celle under the chairmanship of Leopold Spiller, and not all the evidence held up strongly. The prosecutors could not name a single software company claiming damages, while the defendants’ motive—“the balance of power” and “work for peace”—was explicitly called by the court a way of soothing their consciences. After twelve days of proceedings, in February 1990, Pedro received two years, Hess one year and eight months, Brezinski one year and two months; all suspended, while 18,000 of the 90,000 marks was ordered returned to the treasury. Hübner, who had cooperated with the investigation, went unpunished. Spiller summed up the outcome this way: “There could not have been much of value in the deliveries to Agent Sergei in East Berlin.” From the fact that the hackers had asked for a million and received ninety thousand, the court concluded that the Soviet side simply did not know how to use it.
A separate thread in this case is Karl Koch. By the time it unraveled, he was deeply addicted to drugs: cocaine and amphetamines stretched his sessions out for many hours, while his psychosis—Hagbard believed in a global Illuminati conspiracy and in the magic of the number 23—grew worse. In the spring of 1986, he was convinced that the Chernobyl disaster had happened because of his own hack into a nuclear power plant, and his friends sent him for treatment. In mid-1988, broke, he offered the NDR editorial office a camera-accessed break-in to the computer of the Jülich nuclear research center for 10,000 marks, while also showing them official documents about the hunt for terrorists that had come into his possession. He turned himself in on July 5, 1988, and gave testimony for months. In the final months of his life, he worked part-time as a courier at a CDU office, which the SPD happily used in its election campaign: “A KGB hacker at CDU headquarters.”
The first accounts of him as the great “brain” of the group came from the press: after the March 1989 raid, Koch was quickly released, and the full weight of the interrogations fell on his troubled psyche. He died on May 23 or 24, 1989. His body was found only on June 1 beside his work vehicle in woods near Celle—badly burned, his boots removed, a circle of scorched ground beside him. Officially, it was suicide by self-immolation; there was no suicide note, and even then two versions spread through the media: a broken addict, or security services getting rid of a witness. The number 23—the day of the “death of all great anarchists” in Illuminatus!—played out in his biography to the day: the 23rd day, the 5th month, the 23rd year of his life.
Another unobvious outcome of the story was a blow to the Chaos Computer Club. The club, which three years earlier had itself organized contacts with the authorities and explained to the public that hacking could be ethical, found itself on the verge of collapse: some members left, and one of the founders publicly argued that a real hacker, by his nature, would never work with an intelligence service. The organization survived—but it was then that the club had to draw a line between the “harmless hacking” of NASA and a group feeding data to the KGB. Another gap in the investigation also emerged: during the search of Hess’s home in June 1987, the phone trace was not confirmed by the court, and the investigation into that episode had to be dropped. Even the date of the search itself varies between sources: June 23 in one version, June 27 in another.
Stoll published the dry technical article “Stalking the Wily Hacker” in the May 1988 issue of Communications of the ACM, then followed it with a book that sold more than a million copies. More than one generation of information-security specialists entered the profession through it, and Stoll himself later came to be regarded as one of the founders of digital forensics and intrusion-detection systems. What he assembled by hand from printers, a pager, and a lab notebook became a standard toolkit within a few years: network monitoring, offline logging, honeypots. Engineers at Lawrence Livermore Laboratory received a grant and wrote the world’s first software for automatically monitoring intrusions—essentially digitizing what Stoll had been doing by hand.
And then the same man made his greatest public mistake. In 1995, his book Silicon Snake Oil came out, along with a Newsweek article in which he argued that the internet was destined to become neither a marketplace nor a source of news, because the network lacked the essential thing—live human contact and trust. “No online database will replace your daily newspaper,” he wrote. When the piece resurfaced on BoingBoing in 2010, Stoll appeared in the comments and admitted: “Among my many mistakes and goofs, few have been as public as my 1995 howler. Now that I think I know what’s going on, I hedge my bets: maybe I’m wrong, Cliff.”
Today, Stoll makes Klein bottles out of glass and sells them through his Oakland shop, storing his stock in the crawlspace beneath his house and retrieving boxes with a homemade robotic forklift. Hess—the very same Urmel—is alive: in July 2026, he took the stage at the Hackover conference in Hanover with a talk titled “From Hacker to Spy,” and, according to the program description, spoke “from a very personal perspective—sometimes seriously, sometimes anecdotally” about the early years of cyberespionage; his website opens with an admission that he was a hacker and a spy, and has remained clean for more than 37 years.
So what did those 75 cents ultimately buy? One astronomer got a year of work with almost no sleep; Germany got a high-profile trial; Karl Koch got death at 23; and the cybersecurity industry got a book that is still used for teaching. The secrets for which the entire performance had been staged were not in the deliveries: the Celle court concluded that the Soviet Union had failed even to make use of pirated compilers. Not one company claimed damages at the trial, so the channel that took ten months to find led to a few dozen programs whose market price fit inside ninety thousand marks.