Cold Open

It’s early afternoon on September 16th, 1986, at the Lawrence Berkeley Laboratory in California.

Clifford Stoll sprints through the office, dashing past cubicles and startled colleagues. A 36-year-old technician with a wild mess of curly dark hair, Cliff has just been alerted to an unverified user inside Berkeley’s computer network. Although their true identity is hidden, Cliff knows who it is—it’s the same hacker he’s been chasing for almost a month.

Cliff bursts into the computer lab, squinting against the sudden harsh white light. All around him, terminals glow, printers chatter, and disk drives rattle like washing machines.

Cliff grabs the phone beside his monitor and immediately dials Ron Vivier, at Tymnet—the company that runs the international computer network used by Berkeley.

Gasping for breath, Cliff says the hacker is back. He listens as Ron quickly contacts the local phone company to set up a trace. 

Cliff then paces the lab, jerking to a halt whenever the phone cord yanks him back.

More people join the call as the trace is followed from region to region, phone company to phone company.

Cliff struggles to follow the telecommunications jargon about rerouting codes, rotary PBX systems, and other technical details. All he wants to know is if the trace has worked. That's when a woman with a thick Southern drawl dials in. She explains the hack is coming from Virginia, but to double-check, she needs to interrupt the connection for a second. If the hacker is ejected from the system, they’ll know they’ve traced the right line. 

Cliff stares at his blue monitor. And sure enough, the hacker drops off. Cliff lets out a cheer because they’ve got him this time. They’ve figured out where the hacker is dialing in from. Now they can finally find out who it is. 

Cliff Stoll will soon realize he’s not just chasing a hacker—he’s chasing a spy.

They are using Berkeley’s system to access other connected networks and sensitive government data. But Cliff is the one who really understands what the hacker is up to. His game of virtual cat and mouse will become the world’s first case of cyber espionage—a new frontier in the Cold War that will eventually culminate in an arrest on June 29th, 1987. 

Introduction

From Noiser and Airship, I’m Lindsay Graham and this is History Daily.

History is made every day. On this podcast—every day—we tell the true stories of the people and events that shaped our world.

Today is June 29th, 1987: The First Cyber Spy.

Act One: The Cuckoo’s Nest

It’s August 26th, 1986, at the Lawrence Berkeley Laboratory in California, three weeks before the hacker is finally traced.

Cliff Stoll stares at his computer in confusion. The monochrome screen flickers back at him, the only source of light in his dim cubicle office. He’s just started a new job as a technician at the lab, and he wants to make a good impression. But this first problem has him stumped.

Cliff is an astronomer by training. But when his grant ran out, the Lawrence Berkeley Laboratory hired him to run their computers. And on just his second day, Cliff’s boss Dave Cleveland asked him to decipher a shortfall in the accounts. Hundreds of people use Berkeley’s computers every day. Charged by the minute, it adds up to thousands of dollars. But Dave wants to know who still owes the lab 75 cents.

After some more thinking, Cliff believes he’s cracked the mystery. He’s spotted a username—“Hunter”—with no account number associated with it. That means whoever was using the alias was able to log on to the system without being charged. That must be the source of the missing 75 cents. 

Cliff shuts the account down. But the very next day, a new problem appears. Dave receives a warning that someone inside the lab has been trying to break into a computer network in Maryland—and once again it’s Cliff who’s asked to solve the mystery. Cliff soon discovers that only one Berkeley user is connected to the Maryland network, and they calls themselves “Sventek”.

But when Cliff takes that information to his boss, Dave just laughs. Sventek is the username of a well-respected software engineer, who doesn’t even work at the lab anymore. There’s no way it can be him.

But there’s no denying the evidence. If it wasn’t the engineer, then someone else must have stolen Sventek’s login. And Cliff is determined to find out who. 

He programs his computer to alert him the moment anyone logs into the system. And after 100 false alarms, Sventek finally signs back in. Whoever is using the account disconnects only a minute later, but they leave behind a clue—a terminal number. 

Tracing that number, Cliff discovers the hacker isn’t in the lab at all. They’re accessing the system from outside Berkeley, using a phone line. But the lab has a lot of phone lines, and Cliff doesn’t know which one the hacker is using. To find out, he connects every line in the office to a printer. When the hacker logs in, the connected printer will unspool a paper trail of exactly what he’s up to.

But rushing around the office is exhausting, and, after connecting the final printer, Cliff falls asleep in his office. When he wakes up, he’s surrounded by 80 feet of printed paper. Cliff scans through the pages with growing alarm. The hacker hasn’t just logged in this time—they’ve taken over Berkeley’s entire computer system. They can now see every document and every file. They can change them, move them, erase them—and leave without a trace.

Whoever this hacker is, they’re good. And they’re interested in far more than what the researchers at Berkeley are up to. The next time the hacker logs in, Cliff finds something extraordinary. According to the printout, the hacker is using Berkeley’s system as a gateway into U.S. military and government networks.

Cliff grabs a pen and paper and scribbles down the aliases the hacker is using. There’s “Hunter” again, but also “Jaeger,” “Benson,” and “Hedges.” Cliff tries to find a link that might give him some clue about the hacker’s identity. But all he can come up with is that Jaeger is the German word for Hunter, and the hacker probably smokes Benson and Hedges cigarettes. 

Cliff alerts the authorities, and the local district attorney obtains a warrant to trace the hacker. So when they next log in, Cliff immediately speed-dials Ron Vivier, a network manager at Tymnet. He successfully tracks the hacker across the country to a computer in Virginia. But when Cliff asks for more precise information, Ron throws a curveball. The district attorney’s warrant only applies to California. It has no jurisdiction across state lines. The phone company can tell Cliff that the signal came from Virginia. But they’re not authorized to give him anything more than that.

Cliff is exasperated. After a month of relentless work, he just wants to know who he’s chasing. So back in his office, he checks the hacker’s latest activity. “Hunter” has been scouring the networks for information about the CIA. They’ve found agents’ names and even their phone numbers. Cliff feels he has to do something. But when he reaches out to the CIA, the agency says domestic counterintelligence isn’t its responsibility. And the FBI shows no interest at all.

But the stakes are high. National security is at risk. And no one except Cliff seems to realize how serious the situation is. So Cliff won’t give up. He’ll keep pursuing his faceless enemy. And soon “Hunter” will become the hunted.

Act Two: Hunted

It’s mid-October 1986, inside the Lawrence Berkeley Laboratory in California, a month after the hacker was traced to Virginia.

Cliff Stoll sits in front of a small monitor on the floor of the computer lab, scribbling notes. Colleagues weave around him, carefully stepping over tangled wires and crumpled pieces of paper. By now, they know better than to disturb Cliff when he’s on the hunt for his digital nemesis. 

But to Cliff’s frustration, the trail has gone cold. He’s finally been informed that the phone line in Virginia belongs to the U.S. military contractor MITRE, but it turns out the hacker was accessing their computer from another unknown location. 

To narrow down the list of possibilities, Cliff has gone back to what he knows best—science. 

So on the lab floor, he’s calculating the distance between Berkeley and the hacker’s location. And the results are intriguing. It takes around a second for Cliff’s computer to communicate with the East Coast. But the hacker’s signal takes more than double that—almost three full seconds. So the hacker must be breaking into Berkeley’s computers from outside the country.

But exactly where remains a mystery. And while Cliff puzzles that out, the hacker continues to delve deeper into the secrets of the United States government.

Although MITRE has shut down the hacker’s account, it doesn’t take them long to find another way in. And over the next few weeks, Cliff watches them break into another 40 military computers. It’s impressive. Whoever this hacker is, they’re making a mockery of U.S. cybersecurity. 

Soon Cliff is obsessed. He constantly checks his computer and even starts sleeping in his office, hoping to catch the hacker online for long enough to launch another trace. One Saturday morning, Cliff is at home when he learns that “Sventek” has logged in again. Cliff quickly calls Ron Vivier from Tymnet. 

Ron is at home washing his van when Cliff calls. But he agrees to run the trace. And this time, Ron can see that the hacker is accessing the system through Westar 3, a satellite that connects the United States with Europe. It’s confirmation of Cliff’s theory that the hacker is somewhere abroad.

From his house, Cliff bikes over to the lab. Luckily, by the time he gets there, the hacker is still online. Maybe because it’s the weekend they think no one will be paying any attention. But the longer they’re online, the more Cliff can find out about them.

That's when the phone rings. It’s another technician—an Englishman at Tymnet International. He’s taken up the trace from Ron and can confirm that the hacker is somewhere in West Germany. But that’s as much as he can say right now. The authorities there will have to take up the search from this point.

Cliff hangs up and stares at the blinking machines around him. It all makes sense—the connection lag, the German username. He just hopes the West Germans are able to put the final pieces of the puzzle together.

And by Monday, they have traced the hacker to the city of Hanover. But he isn’t staying online long enough to establish a precise location. So, they come back to Cliff for help. 

By now, Cliff knows exactly the kind of information that interests the hacker. And he decides to create a “honeypot”—a fake cache of documents seeded with tempting keywords like “classified,” “nuclear,” and “missile program.” The hope is that the hacker will find this irresistible—and stay online long enough for the German authorities to track them down.

Cliff creates the folder and lays his trap.

The next time the hacker logs in, they take the bait. As Cliff watches them trawl through the fake classified documents, he alerts the German authorities. This could be it. And as the minutes tick by, Cliff doesn’t dare move from his computer terminal. He just stares at the screen. If the hacker disconnects before the trace is confirmed, they’ll be back to square one. But the honeypot does its job. The hacker can’t tear themselves away. And finally, the phone rings again. Cliff snatches up the receiver. The German authorities have found him. And Cliff punches the air. After a grueling, months-long hunt, he’s finally trapped the "Hunter". 

But Cliff still isn’t told the identity of the hacker. It will be another six months before German authorities have enough evidence to make an arrest. And only then will Cliff Stoll finally learn the truth—that he wasn’t just dealing with a spy, but an entire spy ring.

Act Three: The KGB and Me

It’s June 29th, 1987, in Hanover, West Germany, six months after a hacker was traced to the city.

In the back seat of an unmarked police car, Markus Hess stares out at the streets rolling by, and the people going about their everyday business. Markus wonders if he’ll ever be one of them again.

Markus is the hacker known as “Hunter,” and he’s just been arrested by German police. He knew this was coming. A few days ago, his apartment was raided. He wasn’t home at the time, but his computer, notebooks, and dozens of floppy disks were seized as evidence. Now, the authorities have caught up with him as well.

Markus is in his mid-twenties. And he didn’t set out to become a cyber spy. After he dropped out of college, hacking into computer systems became a hobby—a game he played with his programmer friends. But then Markus and his buddies realized there was money to be made. One of them had a contact in East Berlin. And soon, a deal was made with the Soviet intelligence agency, the KGB. The offer was simple—tens of thousands of Deutschmarks in exchange for sensitive information from U.S. military and research computers.

Now, though, Markus and his co-conspirators have been caught, and they’re facing a landmark trial in the world’s first case of cyber espionage.

Cliff Stoll flies in from California to testify as an expert witness. As he walks to the courthouse in the quaint German town of Celle, Cliff can’t help thinking about the strange turn his life has taken. A seventy-five-cent accounting error has carried him from Berkeley to the other side of the world.

Eventually, the German court finds all defendants guilty. They receive suspended sentences of up to two years—a surprisingly light punishment, given that the hackers sold information to the KGB.

Following the trial, Cliff returns to the United States and his computer lab on the West Coast. He’s helped break the world’s first cyber spy ring, but he knows that this is only the beginning. The hackers have proved something terrifying. With just a phone line, a home computer, and the right knowledge, anyone can breach a computer network from thousands of miles away. 

In the decades that follow, the world will become even more interconnected. The advent of the internet will spark an arms race between hackers and cybersecurity experts. And the CIA and the FBI will never again be as dismissive as they were when Cliff Stoll warned them about the hacker infiltrating their systems—a young German man on the other side of the ocean, who was finally arrested on June 29th, 1987. 

Outro

Next on History Daily. June 30th, 1934. Adolf Hitler consolidates his grip on the Nazi Party with a deadly purge of his political enemies.

From Noiser and Airship, this is History Daily, hosted, edited, and executive produced by me, Lindsay Graham.

Audio editing by Muhammad Shahzaib.

Sound design by Mollie Baack.

This episode is written and researched by Angus Gavan McHarg.

Edited by William Simpson.

Managing producer Emily Burke.

Executive Producers are William Simpson for Airship, and Pascal Hughes for Noiser.