Cliff Stoll's Seventy-Five Cents: the Printer That Listened to the Intruder
In 1986 a 75-cent accounting error led Cliff Stoll to wire printers to his lab's lines and follow an intruder all the way to Hanover.
In August 1986 Clifford Stoll, an astronomer who had ended up running the computers at the Lawrence Berkeley Laboratory in California, was given a minor task: make the accounts balance. The lab charged users for machine time, in fractions of a second, and two accounting programs disagreed. Seventy-five cents were missing. Years later Stoll put it this way: an unauthorized user had used about nine seconds without paying for them. It was a new account with no billing address, because nobody had ever created it properly.
A printer on every line
At first Stoll assumed it was a student from the nearby university pulling his leg. Soon afterwards a message arrived from the National Computer Security Center: someone coming from the lab had tried to break into one of their computers through MILNET, the military part of the network of the time. Deleting the account was not enough. So Stoll did something simple, almost handmade: he attached printers and recorders to all the incoming lines and let paper keep track of every character typed. When the intruder came back, the printer showed how he used a flaw in the GNU Emacs editor to gain system manager privileges.
That was the start of a pursuit which, according to the Washington Post, lasted eighteen months. The Hacker Culture Museum, which tells the story today, notes that federal agencies were not interested at first: nobody wanted a case about a few dollars. The intruder's connections were too short to be traced back to their source, so Stoll set a lure: a fictitious office, "SDInet", full of invented documents that looked classified. The intruder stayed long enough to be followed across the Atlantic, to Hanover. In March 1989 West German authorities arrested Markus Hess, a programmer from that city, suspected of passing to Soviet agents data gathered from American systems.
The number you do not round away
Stoll described the case in an article for Communications of the ACM, "Stalking the Wily Hacker", and then in the book The Cuckoo's Egg, published in 1989. But the object that remains, more than the book, is that roll of paper running beside a telephone line. A printer that does not judge or interpret: it writes what passes, in the order it passes. In a system where the intruder was trying to alter the accounting records themselves, the most reliable witness was an outside machine that nobody could correct after the fact.
In the essay Security as an Operating Habit I write that everyday defence is made of attention more than of exceptional tools. The Berkeley story shows it with an absurd figure. A seventy-five cent gap could have been put down to rounding and forgotten. Stoll treated it as a fact to be understood, and wrote everything down, like the Harvard operators who in 1947 taped a moth into the logbook. A log stops no one on its own. But it keeps the trace at the moment it happens, and lets someone, later, read what would otherwise have stayed a small crooked number.
Sources: The Washington Post, Computer detective followed trail to hacker spy suspect (4 March 1989); California Magazine, How a Berkeley eccentric beat the Russians (2016); Clifford Stoll, Stalking the Wily Hacker, Communications of the ACM (1988); The Hacker Culture Museum, The Cuckoo's Egg (accessed 1 November 2026).
> ln -s ./linked-nodes
- [PART OF] Operational Cyberinfrastructure
- [RELATED] Security as an Operating Habit
- [RELATED] The Mark II Moth: the Logbook That Corrected Memory