Nine Seconds of Time

The Unclaimed Nine Seconds

Eli: August 1986, Lawrence Berkeley Laboratory, a government-funded research lab in California. Clifford Stoll is trying to balance the books, charging every user for their time on the computer. As the Washington Post told it, he kept coming up with 75 cents' worth of time that no one claimed.

Mara: Our listener wants to know how a 75-cent mistake on a computer bill led an astronomer to a hacker selling secrets to the KGB. Today's angle is how a 75-cent mistake led an astronomer to a KGB hacker.

Eli: The trail runs out of that lab, through military computers, across an ocean and into a courtroom. Whether those few cents were a glitch, a prank or something far worse stays open for a while.

Mara: And the man holding the ledger was, by one account, only partly qualified for the job.

Eli: He was an astronomer, 36, with a PhD from the University of Arizona. He'd lost his observatory job to budget cuts and taken a systems post at the lab's computer center. He put it himself: 'I'm an astronomer! I'm an old long-haired from the 60s.' His first housekeeping task: the accounting system, which billed researchers for their computing time, was off by 75 cents. Find the bug.

Mara: So the machine's own log of time used and the bills it sent out disagreed, by pocket change.

Eli: Pocket change worth about nine seconds of processor time. Stoll expected a rounding error. What he found was an account called Hunter: no person behind it, no billing address, no reason to exist. Nobody had authorized it. Whoever Hunter was, Mara, those nine seconds could be a bored kid's joyride or the first footprint of something much bigger.

A Door to the Depot

Mara: Inside the lab, the first guess was the comfortable one. A lab official later said experts thought the intruder was 'probably a student on campus.' Then Stoll looked at what the visitor had actually done. He'd used a flaw in GNU Emacs, a common editing program on the lab's Unix machine, to make himself superuser. That's the master key: the account that can read, change or delete anything on the system.

Eli: Stoll's own image for it: 'He breaks in and lays his program, lays an egg in our computer, turns around and lets our computer hatch it.'

Mara: And with the master key he got busy. He read people's mail. He edited the password file to bring old, dormant accounts back to life. He planted a fake login screen that recorded the names and passwords people typed into it. That's not a campus prank. That's someone collecting ways in.

Eli: A lot of work for nine seconds of free computer time.

Mara: The open part is whether he stays inside Berkeley, or uses that key to reach further.

Eli: Stoll took his printouts to the lab's leadership. The director's answer came back through a manager: 'This is electronic terrorism. Use all the resources you need to catch the bastard. Take all the time you want. Spend three weeks, if you have to.' So instead of locking the intruder out, Stoll built a listening post. One Friday evening he went office to office with a push cart, borrowing colleagues' printers, and wheeled them down to the basement so every keystroke on an incoming line came out on paper.

Mara: The door left open on purpose, to watch who walks through.

Eli: He rigged a Radio Shack dialer to beep his pocket pager whenever the intruder logged on. He slept on the machine-room floor among four dozen old teletypes, waking to the chatter of typing. Then, on September 10th at 7:51 in the morning, the intruder logged in under an account named Sventek and hopped from Berkeley into the U.S. Army depot in Anniston, Alabama, onto a machine run by the depot's Unix manager.

Mara: Berkeley was the doorway. Stoll guessed MILNet, the military's network, looked inviting.

Eli: And he went through every door he could. He probed hundreds of systems. About forty let him in, the Jet Propulsion Laboratory among them, and his attempts reached Army bases, Navy facilities and defense contractors. Once inside, he searched. Stoll said, 'He was searching for key words like nuclear, ICBM, SDI (Strategic Defense Initiative), biological warfare, NORAD.'

Mara: A spy's shopping list, or a kid's game. Nobody yet knew where the calls began.

Tracing Overseas

Eli: Stoll had an Army depot on his printouts, so he went to the agencies. Mostly he met disbelief and confusion. The FBI, the CIA and the NSA had never really dealt with hacking. Officials were keen to hear what he had, but nobody could say whose jurisdiction it was. And the loss on the books was 75 cents. The smallest number in the case was the one holding it back.

Mara: Military system administrators didn't want to believe their systems had been compromised so easily.

Eli: So the trace crawled backward, one step at a time. First, a dial-up port, a phone line callers dialed into, in Oakland on Tymnet, a commercial data network. Then, with a court order and the phone company's help, the calls led to a defense contractor's dial-out modem in McLean, Virginia. The calls into Berkeley were coming from the other side of the country.

Mara: At every stop he gathered passwords: a stockpile of machines to invade on demand.

Eli: And Virginia wasn't the end. The line ran back across the Atlantic, to a university in Bremen, West Germany.

Mara: So those nine seconds on an August bill had crossed an ocean. Who sat at the far end was still unknown. And the phone system made it hard to find out. In 1986 an international trace was done by hand. A technician at each switching point noted the incoming line and phoned the next exchange down the chain. Across several countries that could take an hour. The intruder's sessions lasted minutes.

Eli: Stoll's girlfriend, a Berkeley law student sick of the beeping pager, suggested a trap.

Mara: So they invented a program. SDINET, a plausible-sounding network for the Strategic Defense Initiative, America's missile-defense effort. Stoll filled a directory with hundreds of pages about it: budget memos, personnel rosters, forms. Deliberately tedious, deliberately long, nothing real inside. The idea was to hand the intruder something that took ages to read, long enough for the phone trace to reach him.

Eli: Paperwork as bait, Mara. Whether a man who'd been typing NORAD into Army computers would sit still for it, or smell the setup and vanish, was now the whole case.

The Decoy in Hanover

Mara: He sat still. Stoll's directory was a honeypot: a decoy stuffed with fake documents, there to lure an intruder in and keep him busy. By leaving the compromised computer open to incoming calls and filling it with invented defense files, Stoll had turned the lab from an unwitting transit point into an active counter-espionage trap. The intruder stayed online, reading and copying. The trace ran down the overseas lines to a phone in Hanover, West Germany. On the other end was a programmer named Markus Hess.

Eli: Eight months after that 75-cent error, they had an address.

Mara: Then something stranger came in the mail. Months later a letter arrived, not from Germany but from Pittsburgh, from a man asking for more information on SDINET. A network that existed only in Stoll's fake files. The only way to know about it was through the files that went from Berkeley to Hanover.

Eli: Hess denied hacking for the KGB. But the judges later accepted that letter, from a man described as a U.S.-based KGB agent, as proof the fake file had traveled east to Soviet intelligence. The presiding judge, Leopold Spiller, called Hess an industrious supplier and an eager searcher.

Mara: So the trail behind those nine seconds ended, by the court's reckoning, at Soviet intelligence.

Eli: In 1987, West German postal agents arrested Hess at his home in Hanover and carried off plenty of evidence. He hadn't worked alone. The idea to sell came from Peter Carl, a casino croupier with chronic money troubles. Prosecutors said Carl met a KGB contact known as Serge at a Soviet trade mission in East Berlin. In September 1986 he handed over a first sample. Serge wasn't impressed. The group got 30,000 marks anyway.

Mara: Those searches for NORAD and SDI had a buyer, then.

Eli: Hans Heinrich Hübner, who went by Pengo, told Der Spiegel they'd wanted to sell themselves to the KGB as hackers: access information, even training. One member of the circle needed cash for an expensive cocaine habit. Curiosity and big international phone bills did the rest.

Mara: Hübner, Carl, Hess and Judge Spiller read it as cash-hungry freelancers selling whatever turned up.

Eli: Stoll and Friedrich Zimmermann read it as a directed Soviet effort, aimed at specific American defense technology. The Pittsburgh letter sits at the center of that reading: someone in America chasing a file that had gone to Hanover.

Mara: What Moscow asked for, and did with the disks, would settle it.

Eli: One member never reached a courtroom. In July 1988, Hübner and the hacker with the cocaine habit turned themselves in and confessed, under an espionage amnesty that protected them from prosecution. In late May 1989 that hacker went missing. A week later his charred body was found in a forest in the Gifhorn district. Police said he had apparently doused himself with gasoline and set it alight. Officially, the cause was recorded as self-immolation.

Mara: Hess and Carl still faced a West German court. What selling to the KGB would cost them was open.

The Celle Verdict

Eli: February 1990, the Higher Regional Court in Celle, near Hanover. Stoll flew over to testify. In the courthouse washroom he ran into one of the arrested hackers, who complained to him that his life was being ruined. One of them told the news cameras, 'At the beginning, I wasn't thinking of anything. I was just sitting there hacking.'

Mara: The ring's toll had already landed: one of them was dead before the trial began.

Eli: It was West Germany's first computer hacker trial. Judge Spiller read the verdict. Carl, Hess and a third member of the ring were convicted and given suspended sentences of up to two years. His reason: 'No serious damage to West Germany has arisen.'

Mara: The KGB link was proved, as the court saw it. The harm wasn't.

Eli: Stoll wrote the case up, first as a technical paper for the ACM, 'Stalking the Wily Hacker,' then as a bestselling book, The Cuckoo's Egg. It showed foreign spies working American networks. After it came dedicated cybercrime units, tougher passwords and more cooperation across borders. Describing how Stoll read logs and connection patterns, J.J. Widener said 'he definitely wrote the book on some of this stuff.'

Mara: So that's the road from 75 cents to the KGB. Those nine seconds were Markus Hess, a programmer in Hanover, using Berkeley as an unwatched doorway into American defense computers and selling what he found to Soviet intelligence. It surfaced because an astronomer new to the job wouldn't leave a ledger unbalanced.

Eli: What's still open is the size of it. KGB files evaluating what Moscow received aren't public; declassified, they'd show how much was transferred and studied beyond the disks. And counterintelligence records could show whether the passwords and system maps Hess took were used again, in intrusions nobody caught.

Mara: A man asleep on a machine-room floor, nursing printers over stolen computer time, ended up showing others how to watch a network. The first clue was small change, and he was the one who counted it.

Eli: For more on the decoy strategy, look into honeypots.

Mara: Follow security with us as networks confront unseen intruders.

Eli: That's where we'll leave it. I'm Eli.

Mara: And I'm Mara. Thanks for listening. Until next time on Angle.