Years ago I read The Cuckoo’s Egg by Cliff Stoll. It is one of those technology books that somehow sticks in your memory, probably because it hardly feels like a technology book at all. It is more like a detective story, except that the detective is an astronomer turned system administrator, the clues are hidden inside Unix systems and telephone networks, and the whole thing starts with an accounting discrepancy of just 75 cents.
That tiny discrepancy eventually led Stoll into a year-long hunt for cyber criminals who were breaking into American computer systems and passing information to the East German Stasi and the Soviet KGB. This was 1986, long before cybersecurity became an industry filled with SOCs, SIEMs, threat intelligence platforms and impressive-looking dashboards.
I hadn’t thought about the book for a long time. Then I came across a recent video of Stoll speaking at DEF CON 34, forty years after that original 75-cent discovery. And yes, he is quite a remarkable presenter.
No cyber, just curiosity
Stoll describes how they had essentially none of the tools we now associate with cybersecurity. There was no budget, no roadmap and not even much of a vocabulary for what they were doing. Instead, they used soldering irons, shell scripts, printers, logbooks and lots of improvisation.
Watching him talk about it reminded me why I have always liked the world of developers and hackers so much. Not the criminal kind of hacker, obviously, but the original meaning of the word: people who are intensely curious about how things work. People who see something strange and immediately want to understand why. People who happily open things, connect things that were never supposed to be connected, write a little piece of software to solve a problem and then build something slightly ridiculous because it might just work. Stoll seems to embody that attitude almost perfectly.
Following the strange little clue
There is also something wonderfully old-fashioned about the whole story. Today, a 75-cent discrepancy would probably generate a ticket somewhere. It might be assigned a severity level, automatically enriched with telemetry and eventually end up on somebody’s dashboard. Stoll simply wanted to know why the numbers didn’t add up. And that curiosity turned a tiny accounting error into an investigation that crossed networks and international borders.
Technology has changed enormously since then. The internet has changed. Cybersecurity has become a huge professional industry. Attackers have changed too. But perhaps one thing hasn’t changed at all. Someone still has to look at something slightly unusual and think: That’s strange. I wonder why that happened. And then keep digging.
Maybe that is why I enjoyed watching Stoll’s presentation so much. It isn’t only an interesting piece of computing history. It is also a reminder that some of the most interesting things in technology still start with curiosity, experimentation and somebody refusing to ignore a tiny detail. That wonderfully stubborn, slightly (very?) eccentric hacker mentality.
I hope we never professionalise it out of existence.