Cliff Stoll: The 75-Cent Clue Behind The Cuckoo's Egg
Cliff Stoll never wanted to be in computer security. He was an astronomer whose grant ran out, and the lab that employed him shuffled him into the basement to look after its computers.
On his second day, his boss handed him a puzzle: the system's accounting ledger was off by 75 cents. Stoll pulled on that thread for ten months, slept under his desk, wired a pager to the login system and invented, more or less from scratch, the way the world still hunts intruders.
The thread led out of Berkeley, through military bases and defense contractors, across the Atlantic and into the hands of the KGB. And the guy following it was a long-haired Berkeley hippie who thought he was chasing a bored undergraduate.
Cliff Stoll at a Glance
- Born in Buffalo, New York, in 1950, Stoll studied astronomy at home and in Arizona, where he earned a PhD in 1980, and went to Lawrence Berkeley Laboratory to design telescope optics.
- In 1986 the money ran out and he was moved to the lab's computer center, where a 75-cent discrepancy in the usage accounts revealed an intruder who'd used nine seconds of time without paying.
- He watched the hacker on borrowed printers for months as the intruder used Berkeley as a springboard into Army, Navy and Air Force systems, looking for files on nuclear weapons and "Star Wars."
- When the FBI, CIA and NSA wouldn't commit, Stoll baited a trap: a fake "SDINET" department stuffed with bogus documents that kept the hacker on the line long enough to trace him to Hanover, West Germany.
- The hacker was Markus Hess, one of a ring selling what they stole to the Soviet KGB. Stoll testified at the 1990 trial, and Hess got a 20-month suspended sentence.
- His 1989 book The Cuckoo's Egg sold more than a million copies and became the founding text of incident response.
- He spent the following decades as a happy contrarian, warning in 1995 that the internet was overhyped, and selling hand-blown Klein bottles from a crawlspace under his Oakland house.
- In August 2026, forty years after the 75 cents, he told the story again on the main stage at DEF CON 34.
The Life of Cliff Stoll
Stoll's Buffalo Years
Clifford Stoll was born on June 4, 1950, in Buffalo, New York, and grew up tinkering with electronics and radio. He earned a bachelor's degree in astronomy at the University at Buffalo in 1973, then headed to the University of Arizona for a PhD in planetary science, finished in 1980.
Astronomy was the dream job. By the mid-1980s he was at Lawrence Berkeley Laboratory designing telescope optics for the Keck Observatory, a wiry, wild-haired 36-year-old with his head in the stars.
Then his grant money ran out. "Luckily for me," he said later, "LBL recycled used astronomers." He was transferred to the computer center in the basement of the same building as a systems manager.
Seventy-Five Cents
In 1986, on his second day in the job, his new boss asked him to resolve a 75-cent error in the accounts that billed users for computer time. Stoll traced the discrepancy to an unauthorized user who'd used about nine seconds and not paid for it.
He assumed it was some kid on campus yanking his chain. Then he noticed the intruder had root access and was using it to read other people's mail, so he decided to watch rather than lock him out.
Stoll borrowed every printer and teleprinter he could find and hung them on the lab's incoming lines, so that every keystroke the hacker typed was transcribed on paper in real time. He programmed his pager to beep when the hacker logged in, which tended to happen in the middle of the night, so he started sleeping on a cot under his desk.
It was, without anyone calling it that yet, the first intrusion detection system.
The Cuckoo in the Nest
What the printouts showed was unsettling. The intruder was using Berkeley's computers as a stepping stone, hopping through the Defense Department's MILNET into an Army base in Alabama, the White Sands Missile Range, Navy shipyards, Air Force bases and defense contractors, and searching for files containing words like "nuclear" and "SDI."
Stoll traced the connection as far as a defense contractor in McLean, Virginia, down the road from CIA headquarters, and then overseas to West Germany. The hacker was like a cuckoo, he decided, laying its egg in another bird's nest and letting someone else raise it.
He also documented everything in a logbook, mapped every system the intruder touched and briefed anyone who'd listen. The three-letter agencies were fascinated and useless in equal measure, as none of them had handled a computer break-in before and none would commit to taking the case.
Operation Showerhead
The problem was that tracing a call across the Atlantic took hours, and the hacker never stayed connected long enough. Stoll got the answer in the shower.
He invented a department, SDINET, and filled a folder with hundreds of pages of impressive-sounding nonsense about the Strategic Defense Initiative. Military gobbledygook, he explained, is academic gobbledygook with the job titles changed: "undergraduate" to "lieutenant," "professor" to "colonel," "dean" to "general."
The hacker bit, spent hours reading the fake files, and the Deutsche Bundespost traced the line to a home in Hanover. Not long after, a letter arrived asking for SDINET documents that existed only in Stoll's imagination, proof that the stolen material was being passed along to someone who took it seriously.
The hacker was Markus Hess. He and a small ring of German hackers had been selling what they found to the Soviet KGB, which made Stoll's 75 cents the first documented case of state-sponsored hacking.
Stalking the Wily Hacker
Stoll wrote up the chase in May 1988 as "Stalking the Wily Hacker" in Communications of the ACM, a paper that security people still pass around. The next year Doubleday published The Cuckoo's Egg, which read like a detective novel because it was one.
The book became a phenomenon. PBS turned it into a NOVA episode, "The KGB, the Computer, and Me," in October 1990, with Stoll telling the story himself. It's sold more than a million copies, and the royalties paid off his mortgage.
- Cliff Stoll's true story of tracing a tiny billing discrepancy at Berkeley to a KGB-funded hacker, told like a thriller. The first great hacker-hunting book, still unmatched.
In 1990 Stoll flew to Germany to testify at the trial in Celle. The court gave Hess a 20-month suspended sentence. One member of the ring, Karl Koch, had been found dead in a forest near Celle the year before, a death ruled a suicide.
The lasting effect was on the defenders. Lawrence Livermore engineers who'd watched Stoll work got a grant to automate what he did by hand, producing the first network security monitoring software, which eventually ran on more than 100 Air Force networks.
The Internet? Bah!
Stoll could've ridden the book into a career as a security guru. He went the other way.
In 1995 he published Silicon Snake Oil, and in a Newsweek essay that February he mocked the idea that commerce would move to networks, that newspapers and books would be bought online or that computers belonged in classrooms. The essay was wrong about nearly everything, and he's been cheerfully reminded of it ever since.
- The 1995 book in which the man who caught the KGB's hacker argued that online shopping, digital newspapers and classroom computers were overhyped. Wrong about nearly everything, and he will tell you so himself.
He followed it with High-Tech Heretic, argued against computers in schools, taught physics to kids and generally refused to be impressed by the industry he'd helped create.
"I'm not very interested in cybersecurity today," he told Wired in 2019. "I wish I could help people defend their systems. Instead, I went back to figuring out how to make a Klein bottle that can sit without wobbling."
- Stoll's follow-up argues that screens are no substitute for a teacher, a lab bench or a library card. Read it for the voice: the same contrarian who refused to become a security guru.
Acme Klein Bottle
That isn't a figure of speech. Stoll is the sole proprietor and sole employee of Acme Klein Bottle, which sells hand-blown glass Klein bottles, one-sided topological oddities with no inside or outside, from his home in North Oakland.
The inventory lives in the crawlspace under the house. To fetch an order, he flips up his desk, opens a hatch in the wall and drives a homemade robotic forklift through the dark by remote control. The Numberphile YouTube channel's videos about the bottles and the man who sells them have been watched millions of times, which is how a new generation found him.
He never fully left the hunt behind, either. In 2019 he reverse-engineered a malware-laced spreadsheet on a lark, just to see how the code was hidden. And in August 2026, forty years after the 75 cents, he stood on the main stage at DEF CON 34 to retell the story, soldering irons, shell scripts, logbooks and all.
Cliff Stoll: The Hunter Who Never Wanted the Job
Everything incident responders do today, from logging every keystroke to planting honeypots and mapping an attacker's path across a network, Stoll improvised in 1986 with borrowed printers and too much coffee. He did it because somebody was breaking into a community he belonged to, and it made him angry.
Today he's 76, still in Oakland, still shipping Klein bottles between trips, and still telling the story with the energy of a man who can't quite believe the fuss.
He went looking for 75 cents and found the KGB. The next clue could look just as small.
What Is a Honeypot?
Intrusion Detection: How Effective Can It Be?
QUOTE:
"Amateurs hack systems, professionals hack people."