Clifford Stoll’s The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage is the first-person account of how an astronomer working as a systems manager at Lawrence Berkeley Laboratory followed a 75-cent discrepancy in the laboratory’s computer-usage accounts to an intruder in West Germany who was searching American military networks, and whose group was selling what it found to the KGB. Published by Doubleday in 1989, it reads as a detective story. For an auditor it is also a vivid demonstration of three things the profession teaches and does not always practise: that a small unexplained difference deserves an explanation before it is written off; that evidence has to be recorded as it is gathered if it is to be believed later; and that systems are often protected by little more than the assumption that nobody will try to get in. The book also records the frustration of a lone investigator trying to interest agencies whose jurisdictions overlapped and whose priorities lay elsewhere, a problem any small audit function that has escalated a suspected intrusion will recognise. This guide summarises the book without reproducing it, checks the facts of the case against the court’s verdicts and contemporary sources, maps its lessons to IT audit and to the small audit function, and ends with a worked example of a food manufacturer’s one-person audit function and its co-source IT auditors applying them.
In this guide
- The book in one page
- Who Clifford Stoll is, and how the book came about
- The structure: fifty-six chapters and an epilogue
- The case, checked against the record
- How Stoll worked: the investigator’s methods
- What the intruder exploited, and what has changed since
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: an IT audit map
- The criticisms, and what the book leaves out
- Editions and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Brightwater Foods follows a small difference
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it? | A first-person account of a year-long hunt for a computer intruder, told as a story rather than a technical report. The Doubleday first edition of 1989 runs to 326 pages; the British edition’s contents list fifty-six short numbered chapters and an epilogue. |
| What happened? | In 1986 a 75-cent shortfall in the laboratory’s computer accounts, about nine seconds of computing time that nobody had paid for, led Stoll to an unauthorised user. Over roughly ten months he watched the intruder use the laboratory as a stepping stone into military computers, traced the connection through a packet network, a defence contractor’s dial-out modems and a satellite link to West Germany, and kept the intruder online with invented files about the Strategic Defense Initiative until the West German postal service could locate him in Hanover. |
| Who was the intruder? | Markus Hess, a programmer in Hanover, one of a small group that sold material to the KGB. In 1990 the Higher Regional Court in Celle convicted him and two others of espionage and gave all three suspended sentences. |
| What did the intruder exploit? | Systems that still had factory-set passwords, a flaw in the GNU Emacs editor that let him become the superuser on the laboratory’s Unix system, and the laboratory’s own network connections, which made it a stepping stone to other systems. |
| What did Stoll do that an auditor should copy? | He did not write off the small difference; he recorded what he saw in a logbook and on printouts as it happened; he set an alarm so that he knew when the intruder was active; he followed the evidence across organisational boundaries; and he kept going when the agencies he alerted were slow to act. |
| Why read it as an auditor? | Because it is a case study in professional scepticism about a trivial number, in the preservation of evidence, in privileged access and default credentials, and in escalation when nobody owns the problem, all told by an astronomer rather than an auditor. |
| Length | 326 pages in the 1989 Doubleday edition and 432 in the 2024 Gallery Books paperback; the chapters are short and the book reads quickly. |
Who Clifford Stoll is, and how the book came about
Stoll was an astronomer with a doctorate in the subject who had been designing telescope optics for the Keck Observatory project at Lawrence Berkeley Laboratory. When his grant money ran out, he was moved to the laboratory’s computer centre as a systems manager, and one of his first tasks there was the accounting problem that began the case. The intrusion turned him into a witness: he testified at the hackers’ trial in Germany and before the US Senate, received a certificate of appreciation from the CIA, and played himself in a docudrama about the case made for PBS’s NOVA series. His later books, Silicon Snake Oil (1995) and High-Tech Heretic (1999), argued against over-reliance on computers and drew strong criticism from technology enthusiasts. A 2016 profile in California, the magazine of the Cal Alumni Association at Berkeley, found him running a one-man business making glass Klein bottles from his home in North Oakland.
The book had a technical predecessor. In May 1988 Stoll published an account of the case for computing professionals, “Stalking the Wily Hacker”, in Communications of the ACM, and the article was later reprinted in an ACM collection on intruders, worms and viruses. The book retold the story for general readers and, according to a 2024 account of the case by a director at the consulting firm Berkeley Research Group, drew on the extensive records Stoll had kept during the investigation. Doubleday published it in New York in 1989 and The Bodley Head published the British edition in London. It has been reissued in several paperback editions, most recently a Gallery Books trade paperback in July 2024, the book’s thirty-fifth anniversary year. The title refers to the cuckoo, which lays its egg in another bird’s nest; Stoll used the bird as his image for the intruder’s trick of slipping his own program into the system so that the system would run it with full privileges.
The structure: fifty-six chapters and an epilogue
| Element | What it is | What it contributes |
|---|---|---|
| Front matter | A note about the author and the acknowledgements | The author’s thanks |
| Chapters 1 to 56 | Numbered chapters without titles, forming one continuous first-person narrative | The case, from the accounting discrepancy to its outcome |
| Epilogue, in four parts | Stoll’s part in tracking the Internet worm of November 1988, written by a Cornell graduate student; the worm’s alleged author was the son of a man who had helped in the German case | A coda on a different kind of attack on the same networks |
| Bibliography | A short list of sources, on pages 325 and 326 of the Doubleday edition | Pointers for the technical reader |
The contents above are those of the British edition, as listed in a table of contents for The Bodley Head edition; the Doubleday edition’s catalogue record confirms the bibliography’s place at pages 325 to 326, and a review of the American edition in February 1990 describes the epilogue’s subject. Because the chapters have no titles, the book has no structure to summarise beyond the story itself, and this guide does not say which chapter covers which event. The next section sets out the story in order from official and contemporary sources rather than from the book.
The case, checked against the record
The core facts are well documented outside the book, and the table brings them together from the publisher’s descriptions, a profile of Stoll in the Cal Alumni Association’s magazine, a 2024 account by a director at Berkeley Research Group, the German computing weekly Computerwoche‘s report of the verdict in March 1990, and other published accounts. It deliberately leaves out details that only the book records.
| When | What happened | What it shows |
|---|---|---|
| 1986 | Stoll finds a 75-cent shortfall in the laboratory’s computer-usage accounts, about nine seconds of unbilled time, the laboratory’s only such shortfall, and traces it to an unauthorised user, code-named “Hunter” in the publisher’s description | The anomaly that starts the case is trivial in money and exact in its implication: something used the system without being accounted for |
| The following ten months or so | Stoll monitors the intruder, attaching a teleprinter to record the sessions, often sleeping at the laboratory because the intruder was active at night. The intruder uses the laboratory’s systems as a stepping stone into military networks, including a computer at Anniston, Alabama, searching for material on nuclear weapons and the Strategic Defense Initiative | Evidence recorded as it happens, and a compromised system used to reach others |
| The trace | The connection is traced, with help from the Tymnet network, to a pool of dial-out modems at MITRE, a defence contractor in McLean, Virginia, and from there, by way of a satellite link, to West Germany: first to Bremen, then to Hanover | An investigation that crosses every organisational and national boundary it meets |
| The bait | Operation Showerhead: Stoll creates a fictitious SDI office and fills its account with official-sounding documents, which keep the intruder online long enough for the West German postal service to locate his home. Someone later writes to the fictitious office’s address, which Stoll takes as confirmation of KGB involvement | Deception used to buy time for a trace, and a letter that suggested the material had travelled |
| March 1989 | West German authorities arrest Peter Carl, the group’s contact with the KGB, and the attacks stop | The intrusions end only when a person is arrested |
| Summer 1989 | Karl Koch, one of the initiators of the group, is found dead and is never charged | The case’s unresolved edge |
| 1990 | The state security senate of the Higher Regional Court in Celle convicts Hess, Carl and Dirk Brzezinski of espionage for the KGB after twelve days of trial and gives all three suspended sentences | A conviction, and a modest penalty |
| July 2024 | Gallery Books reissues the book in trade paperback, thirty-five years after first publication | A book about 1986 that is still in print |
The verdict, as Computerwoche reported it, adds detail that an auditor will find instructive. Carl, a former croupier who had handled the sales and made about twenty-five trips to East Berlin, received two years; Brzezinski fourteen months; and Hess, the programmer, twenty months, all suspended, with orders to repay parts of the spy money. According to the report, Hess had made about 450 attempts to break into computers and had succeeded about thirty times, roughly one success in fifteen. The parties had settled on a total payment from the KGB of 90,000 marks after the hackers first asked for millions, a figure from which the judge inferred that the Soviets could make little use of what they bought, and the court found no provable damage to West Germany. Of the five people involved, according to the 2016 profile, one cooperated with prosecutors, one died and three were convicted. The gap between the effort of the investigation and the size of the penalty is part of the story’s lesson: the controls that matter are the ones that prevent and detect, because the legal consequences after the event may be slight.
How Stoll worked: the investigator’s methods
Stoll came to the case as an astronomer, not a security specialist, and the book’s lasting value for auditors lies less in the technology, which is long obsolete, than in the habits he brought to the problem. A scientist’s instinct that a measurement which does not balance means something; a refusal to let a small number be absorbed into a rounding adjustment; and a meticulous record of what he saw and when, are the same habits the profession calls professional scepticism and adequate documentation. The table sets them out with the modern control each corresponds to and the audit test that checks for it.
| Stoll’s method | What he did | The modern control | The audit test |
|---|---|---|---|
| Refusing to write off a small difference | Pursued 75 cents of unbilled time to its cause | Reconciliations that require unexplained items to be explained, whatever their size, before they are cleared | Sample cleared reconciling items below the write-off threshold and ask what caused each; see the reconciliations programme guide |
| Recording as he went | Kept a logbook and printed records of the intruder’s sessions | Centralised, tamper-resistant logging with adequate retention; incident records kept from the first alert | Ask for the logs for a date three months ago; test whether an incident timeline could be rebuilt; see the guide to documenting analytics as evidence |
| Knowing when the intruder was active | Wired a pager to his monitoring computer | Real-time alerting on privileged and out-of-hours activity, routed to a named person | Trigger a test alert at night and record who received it and when |
| Watching before shutting the door | Kept the intruder connected long enough to trace him | An incident response plan that decides, with legal advice, when to contain and when to monitor | Read the plan for the decision rights on containment versus monitoring; see the incident response audit guide |
| Deception | Created the fictitious SDI office and its files | Deception technologies run by the security function | Ask whether they are used and governed; this is security’s work, and audit’s role is assurance over it |
| Following the trail across boundaries | Followed the trail through a network operator and a defence contractor’s systems, and worked with the West German postal service and US agencies | Pre-agreed contacts with providers, insurers, counsel and law enforcement | Test that the plan’s external contacts are current and that someone has authority to call them |
| Persisting through indifference | Kept alerting agencies whose jurisdictions overlapped and whose interest was slow to come | An escalation route that does not depend on one person’s persistence | Trace one past escalation from first report to decision; see the first 48 hours guide |
Two of these deserve emphasis for a small audit function. The first is the logbook. Stoll testified at the trial in Celle years after the events, and his book was built from the records he kept at the time; the equivalent for an auditor is a workpaper discipline in which every step of a sensitive inquiry is dated and sourced as it is taken, which the workpaper practices guide describes. The second is the willingness to follow evidence outside the organisation’s boundary. Stoll’s intruder came through a network provider, a contractor and a university before reaching anything Stoll controlled, and the modern equivalents, managed service providers, software vendors with remote access and cloud platforms, are among the places an audit of cybersecurity in a mid-sized company has to look. The third-party risk guide covers the contractual side.
What the intruder exploited, and what has changed since
The intruder’s methods relied less on sophistication than on persistence, which is an uncomfortable point for anyone responsible for controls. He tried a great many doors and found a few open. Accounts that still had the passwords their manufacturers had set; a flaw in a program on the laboratory’s system, the GNU Emacs editor, that let an ordinary user become the superuser; and the connections between networked computers, which turned each compromised system into a route to the next: these were enough, at about one success in fifteen attempts, to reach military systems. Forty years on, the technologies have changed beyond recognition, and the categories have not. The table pairs each weakness with the control that now addresses it and the site’s guide to testing that control.
| What was exploited | Why it worked | The control in 2026 | Where to test it |
|---|---|---|---|
| Factory-set passwords | Nobody had changed them, and the intruder knew what they were | Hardening standards that remove default credentials before a system goes live, with periodic scanning | Configuration reviews; see the guide to testing system configurations |
| A flaw in a program that gave superuser rights | The flaw let an ordinary user gain superuser rights | Vulnerability management and least privilege for software, not only for people | The patch and vulnerability management audit guide |
| Superuser access once inside | Superuser rights let him act with the system’s full authority | Privileged access management, session recording and alerting | The privileged access audit guide |
| Trust between connected systems | A compromised system was a starting point for the next | Network segmentation, multi-factor authentication for remote access, monitoring of outbound connections | The cybersecurity programme audit guide |
| Accounts nobody owned | An account existed that no one had authorised or billed | Identity lifecycle management tied to joiners, movers and leavers | The user access review guide |
| A slow and fragmented response | Each agency could reasonably say the case belonged to another | An incident response plan with named roles, external contacts and decision rights | The incident response audit guide |
Alongside the technology, what has changed since 1986 is the organisation’s obligations. Cybersecurity is now a standing subject of assurance, and internal auditors who perform that assurance work to the Institute of Internal Auditors’ Cybersecurity Topical Requirement, issued on 5 February 2025 and in effect since 5 February 2026. It applies when cybersecurity is the subject of an assurance engagement in the internal audit plan, when it is identified while performing another engagement, or when it is the subject of an engagement request outside the plan, and individual requirements may be excluded only with a documented justification. The topical requirement workbook and the NIST CSF 2.0 assessment method set out how to apply it.
The nine ideas worth keeping
- A small difference is a signal before it is a rounding error. Seventy-five cents was trivial in money and decisive in meaning: something had used the system without being accounted for.
- Record evidence as it happens. A dated logbook and contemporaneous printouts gave Stoll a record he could rely on years later, in court and in print; reconstruction afterwards is weaker evidence.
- Accounting data is security data. The intrusion surfaced through a usage-accounting reconciliation, not a security tool; the people who reconcile are part of the detection system.
- Default credentials are open doors. Factory-set passwords left in place were among the intruder’s routes in.
- Privilege is the prize. Once the intruder became superuser, he had the system’s full authority; privileged activity needs its own monitoring.
- A compromised system attacks its neighbours. The laboratory was a stepping stone; every connected system inherits some of the risk of the weakest one it trusts.
- Attackers need only a few successes. About thirty successes in about 450 attempts was enough; controls are judged by the doors left open, not the ones that held.
- Escalation needs an owner. Overlapping jurisdictions produce delay; an organisation that has not decided in advance whom to call will lose time it cannot recover.
- Prevention and detection matter more than punishment. A year of investigation ended in suspended sentences; the controls that count are the ones that act before and during an intrusion.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the story | What it looks like in an audit |
|---|---|---|
| Accounting discrepancy | The 75-cent gap in computer-usage charges that started the case | An unexplained reconciling item, however small |
| Unbilled time | About nine seconds of computing that no account paid for | Activity in a system that no authorised user explains |
| Unauthorised user | The account that should not have existed | An account with no owner in the access review |
| Superuser | The all-powerful administrator account on a Unix system | Privileged access; the root, admin or service accounts |
| Factory-set password | A manufacturer’s default left unchanged | A default credential found in a configuration scan |
| Stepping stone | A compromised system used to reach others | Lateral movement; the case for segmentation |
| Packet network | Tymnet, the commercial network through which the intruder connected | Third-party network and service providers in the access path |
| Military networks | The defence networks the intruder searched from the laboratory | Connected systems whose risk depends on their neighbours |
| Trace | Following a connection back through each network to its source | Log correlation across systems and providers |
| Logbook | Stoll’s contemporaneous record of each observation | Dated, sourced workpapers and incident records |
| Printout | The paper record of the intruder’s sessions | Preserved logs; evidence that cannot be altered afterwards |
| Honeypot | Bait designed to attract and hold an intruder | A deception control run by the security function, not by audit |
| Operation Showerhead | The invented SDI office and its files | A monitored decoy, which today would need legal advice before it was set |
| Cuckoo’s egg | Stoll’s image for the intruder’s planted program, after the bird that lays its eggs in other birds’ nests | Anything that lives in a system it does not belong to |
What it means for internal audit: an IT audit map
The book is not about internal audit, but almost every stage of Stoll’s investigation corresponds to a control an IT audit tests, and its central episode, a reconciliation difference pursued instead of cleared, is internal audit’s own territory. The table maps the lessons to audit activities and to the procedures they change. The ITGC primer for non-IT auditors and the IT audit plan guide describe the surrounding programme, and the guide to sourcing models covers how a small function obtains the technical skills.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Reconciliations and unexplained items | A small difference can be the only visible sign of a large problem | Require causes for cleared items below threshold in a sample of reconciliations; see the cash and bank reconciliation guide |
| Logging and evidence | Contemporaneous records are what make an investigation usable | Test log retention, integrity and the ability to rebuild an incident timeline from logs |
| Privileged access | Superuser activity looks like administration unless it is monitored | Test the inventory of privileged accounts and the review of their activity; see the Active Directory and Entra ID audit guide |
| Vulnerability and configuration management | Default passwords and unpatched flaws are the easy routes | Scan for default credentials; test remediation times for critical vulnerabilities |
| Remote and third-party access | Intruders arrive through the paths others are trusted to use | Test that vendor and contractor accounts are owned, time-limited and protected by multi-factor authentication |
| Incident response and escalation | Nobody owned the problem, so the investigation depended on one person | Test the plan’s roles, external contacts and decision rights, and trace one escalation |
| Cybersecurity assurance | Assurance has to cover governance as well as technology | Apply the Cybersecurity Topical Requirement and document any exclusions; see the topical requirement workbook |
| The small function’s resources | A non-specialist with the right habits can find what specialists miss, but needs specialist help to finish | Pair the in-house auditor’s scepticism with co-sourced technical skills; see the co-sourcing provider guide |
The last row is the one that matters most for audit functions of one or two people. Stoll found the intrusion because he was curious about a number, and he needed a network operator, a foreign postal service and several government agencies to finish the job. A one-person audit function is in the same position: its value lies in noticing and refusing to let go, and it will need technical help, usually from a co-source provider, to establish what happened. The one-person audit shop manual and the professional scepticism guide describe the two halves of that role.
The criticisms, and what the book leaves out
The book’s age is its main limitation for a modern reader. Its technology, from dial-up connections and packet networks to the particular operating systems and editors involved, is four decades out of date, and a reader has to translate each episode into its present-day equivalent; the categories carry over, the specifics do not. It is also one person’s account. Stoll’s narrative is vivid, and the outline it gives is borne out by the verdict as reported, but the other participants, from the agencies he found slow to the hackers themselves, appear only as he saw them, and the book is no guide to how the agencies weighed the case against their other work.
Three further points are the guide’s own. The first is that the book’s hero is an individual who worked late into the night on his own initiative, and an organisation that depends on such a person has a control gap rather than a control: the lesson for management is to build the detection and escalation that do not rely on one person’s curiosity. The second is that the honeypot, which made the trace possible, would today raise questions of legal authority, evidence handling and liability that a security team would need to settle with counsel before starting, and it is not something an internal audit function should run. The third is that Stoll’s later books, which argued against over-reliance on computers and drew strong criticism from technology enthusiasts, should not be read back into this one: The Cuckoo’s Egg is not an argument against networks but a record of what happens when they are run on trust. Readers interested in how the profession’s attention to computer controls developed can place the book in the history of internal audit timeline.
Editions and how to read it
| What | Details | Best for |
|---|---|---|
| First edition | Doubleday, New York, 1989; vi plus 326 pages; bibliography at pages 325 to 326; listed at $19.95 | Collectors and libraries |
| British edition | The Bodley Head, London; subtitled Tracking a Spy Through a Maze of Computer Espionage | UK readers; note the one-word difference in the subtitle |
| Paperbacks | Pocket Books, 1990 (356 pages); a Simon and Schuster reissue of September 2005 (399 pages) | Second-hand copies |
| Current edition | Gallery Books trade paperback, 2 July 2024, 432 pages | The edition to buy |
| Companion reading | Stoll’s article “Stalking the Wily Hacker” (Communications of the ACM, May 1988) for the technical account; the Phoenix Project summary for a modern IT operations story | The technical version of the case |
| Reading plan | Read it straight through, with a notebook: at each turn of the story, note the control that would have stopped the intruder or caught him sooner | An IT auditor or a generalist auditor new to IT |
A one-hour discussion guide for an audit team
- Ten minutes: our seventy-five cents. List the reconciliations in the organisation that clear small differences without explanation. Choose one and find out what its cleared items were last quarter.
- Fifteen minutes: the accounts nobody owns. Take the latest user access review for one critical system and identify every account without a named owner, including service, vendor and administrator accounts.
- Ten minutes: the logbook. Ask how long the organisation keeps the logs of its remote-access and privileged activity, and whether a timeline for an incident three months ago could be rebuilt from them.
- Fifteen minutes: the escalation. Walk through what would happen if the auditor found evidence of an intrusion on a Friday evening: whom to call, who decides on containment, and when outside counsel, the insurer or law enforcement would be involved.
- Ten minutes: the plan. Decide whether any of the gaps belong in the next plan and how the co-source provider’s IT auditors would be used; the risk assessment guide describes how to record the reasoning.
Worked example: Brightwater Foods follows a small difference
Brightwater Foods is a fictional US food manufacturer with $180 million of revenue, three plants, a single internal auditor and a co-source firm that provides its IT audit work. In the first quarter of 2027, as part of a planned review of IT general controls, the internal auditor reconciled the monthly invoice for the company’s remote-access software against the list of approved remote users and found that the company was paying for 37 accounts and had approved 34. The difference was small, and the IT manager had been approving the invoice without comment for a year. The auditor asked the co-source firm’s IT auditors to establish what the three accounts were before the review went any further.
| Test | What the function found | Result |
|---|---|---|
| Who owns the three accounts? | One belonged to a packaging-equipment contractor whose contract had ended in 2025 and still had the password set at installation; two had been created by a plant engineer for a vendor’s support staff and were not in any access review | Finding: remote-access accounts to be owned, time-limited and included in the quarterly user access review |
| What do the logs show? | The remote-access tool kept 30 days of logs. In that window the former contractor’s account had connected 11 times, all between 1 and 4 a.m. local time and from addresses outside the United States | Escalated the same day to the chief financial officer and the audit committee chair; log retention extended to twelve months, with logs copied to a central store |
| What could the account reach? | It reached an engineering workstation at one plant that could connect both to the packaging line controllers and to the finance network, because the plant network was not segmented | Finding: segmentation between plant and corporate networks |
| Are default credentials in use? | Two line controllers at the same plant still had their factory-set passwords | Finding: default credentials replaced, and a hardening standard for plant equipment adopted |
| Is there multi-factor authentication? | Remote access required only a password | Finding: multi-factor authentication for all remote access |
| Does the incident response plan work? | The plan named an IT manager who had left in 2026 and gave no guidance on when to involve the insurer, outside counsel or law enforcement | Finding: plan updated with named roles, external contacts and decision rights, and tested in a tabletop exercise |
Management’s response was quick once the logs were seen. The chief financial officer had the three accounts disabled that afternoon and, on the advice of outside counsel, engaged the incident response firm on the company’s cyber insurance panel. Its investigation found evidence that someone had explored the engineering workstation and the finance network’s file shares but no evidence that data had been taken or that the line controllers had been changed; because the logs went back only thirty days, it could not say how long the access had been used. Because a cybersecurity issue had been identified during the engagement, the internal auditor applied the Cybersecurity Topical Requirement to the remainder of the review and documented the reasons for excluding the requirements it did not cover.
The review produced five findings, and the audit committee asked for a follow-up in the third quarter, which the co-source firm performed. The internal auditor’s own contribution was modest in technical terms and decisive in practice: noticing that three accounts did not add up, refusing to treat the difference as an administrative irritation, keeping a dated record of each step from the first reconciliation onwards, and escalating within hours rather than weeks. The chief financial officer’s summary to the audit committee was that the company had been paying for an intruder’s access and approving the invoice. The example is fictional; the discipline it describes, a small number pursued to its cause by someone who writes everything down, is the one the summary above sets out.
Frequently asked questions
Is The Cuckoo’s Egg still worth reading for IT auditors?
Yes, for its habits rather than its technology. The specific systems are long gone, but the weaknesses the intruder exploited, default passwords, an exploitable flaw that gave superuser rights, unowned accounts and connections between systems, are still among the categories IT audits test, and the investigator’s discipline of recording evidence as it happens has not aged at all.
Is it a true story?
Yes. The intruder, Markus Hess, and two members of his group were convicted of espionage for the KGB by the Higher Regional Court in Celle in 1990, and the verdict as reported at the time bears out the outline of the book’s account.
What was the 75-cent discrepancy?
A shortfall in Lawrence Berkeley Laboratory’s computer-usage accounts amounting to about nine seconds of computing time that no account had paid for. Stoll traced it to an unauthorised user, and the unauthorised user to an intruder.
What happened to the hackers?
Peter Carl was arrested in March 1989 and the attacks stopped. In 1990 Carl, Hess and Dirk Brzezinski received suspended sentences of two years, twenty months and fourteen months. Karl Koch, one of the group’s initiators, was found dead in 1989 and never charged, and one member cooperated with prosecutors.
Should internal audit run a honeypot?
No. A honeypot is a security control, with legal and evidential questions that the security function and counsel need to settle. Internal audit’s role is to give assurance over how such controls are governed, and to escalate what it finds, as the first 48 hours guide describes.
What should an auditor read alongside it?
Stoll’s 1988 article “Stalking the Wily Hacker” for the technical account, and the Phoenix Project summary for a modern IT story; the internal audit reading list sets out the wider library by theme.
Related guides
- Auditing Cybersecurity Programs: A Complete Guide for Internal Auditors — the programme the book’s lessons feed into
- How to Audit Incident Response: Detection to Post-Mortem — detection, escalation and response
- How to Audit Privileged Access: Admin Rights, Break-Glass, and Vaulting — the superuser problem today
- The Cybersecurity Topical Requirement: A Conformance Workbook — the IIA requirement in effect since February 2026
- How to Audit Account Reconciliations as a Program — small differences pursued to their cause
- How to Select an Internal Audit Co-Sourcing Provider — the technical help a small function needs
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply