History Daily - The First Cyber Spy

Episode Date: June 29, 2026

June 29, 1987. Markus Hess is arrested after hacking into U.S. Defense computer systems in the first known case of cyber espionage. Support the show! Join Into History for ad-free listening and more. History Daily is a co-production of Airship and Noiser.Go to HistoryDaily.com for more history, daily.

Hey, did you hear? Watermelon is back at booster juice all summer long. Nice! I love the watermelon explosion. And the watermelon wave! Yep, they even got a new watermelon assaye pool this year. The one in a melon bowl. And what does that sound like? Mmm. Like that. Booster Juice.

Canadian-born, blending since 1999. It's early afternoon on September 16. 19, 1986 at the Lawrence Berkeley Laboratory in California. Clifford Stolls sprints through the office, dashing past cubicles and startled colleagues. A 36-year-old technician with a wild mess of dark curly hair, Cliff has just been alerted to an unverified user inside Berkeley's computer network. Although their true identity is hidden, Cliff knows who it is. It's the same hacker he's been chasing for almost a month. Cliff bursts into the computer lab, squinting against the sudden harsh white light.

All around him, terminals glow, printers chatter and disc drives rattle like washing machines. Cliff grabs the phone beside his monitor and immediately dials Ron Vivier at Timnet, the company that runs the International Computer Network used by Berkeley. Gasping for breath, Cliff says the hacker is back. He listens as Ron quickly contacts the local phone company to set up a trace. Cliff then paces the lab, jerking to a halt whenever the phone cord yanks them back. More people join in the call as the trace is followed from region to region, phone company to phone company. Cliff struggles to follow the telecommunications jargon about rerouting codes, rotary PBX systems, and other technical details.

All he wants to know is if the trace has weren't. That's when a woman with a thick southern drawl dials in. She explains the hack is coming from Virginia, but to double check, she needs to interrupt the connection for a second. If the hacker is ejected from the system, they'll know they've traced the right line. Cliff stares at his blue monitor, and sure enough, the hacker drops off. Cliff lets out a cheer because they've got him this time. They've figured out where the hacker is dialing in from.

Now they can finally find out who it is. Cliff Stoll will soon realize he's not just chasing a hacker. He's chasing a spy. They're using Berkeley's system. to access other connected networks and sensitive government data, but Cliff is the one who really understands what the hacker is up to. His game of virtual cat and mouse will become the world's first case of cyber espionage, a new frontier in the Cold War that will eventually culminate in an arrest on June 29, 1987.

From Noisor and Airship, I'm Lindsay Graham, and this is History Daily. History is made every day. On this podcast, Every Day, we tell the true stories of the people and events that shaped our world. Today is June 29, 1987, the first cyberspy. It's August 26, 1986, 1986 at the Lawrence Berkeley Laboratory in California, three weeks before the hacker is finally traced. Cliff Stoll stares at his computer in confusion. The monochrome screen flickers back at him the only source of light in his dim cubicle office.

He's just started a new job as a technician at the lab, and he wants to make a good impression, but this first problem has him stumped. Cliff is an astronomer by training, but when his grant ran out, the Lawrence Berkeley Laboratory hired him to run their computers. And on just his second day, Cliff's boss, Dave Cleveland, asked him to decipher a shortfall in the accounts. Hundreds of people use Berkeley's computers every day. Charged by the minute, it adds up to thousands of dollars. But Dave wants to know who still owes the lab 75 cents. After some thinking, Cliff believes he's cracked the mystery.

He spotted a username Hunter with no account number associated with it. That means whoever was using that alias was able to log onto the system without being charged. That must be the source of the missing 75 cents. Cliff shuts the account down, but the very next day, a new problem appears. Dave receives a warning that someone inside the lab has been trying to break into a computer network in Maryland, and once again, it's Cliff who's asked to solve the mystery. Cliff soon discovers that only one Berkeley user is connected to the Maryland network, and they call themselves Sventek.

But when Cliff takes that information to his boss, Dave just laughs. Sventek is the username of a well-respected software engineer who doesn't even work at the lab anymore. There's no way it can be him. But there's no denying the evidence. If it wasn't that engineer, then someone else must have stolen Sventec's login, and Cliff is determined to find out who. He programs his computer to alert him the moment anyone logs into the system. And after 100 false alarms, Sventek finally signs back in.

Whoever is using the account disconnects only a minute later, but they leave behind a clue, a terminal number. Tracing that number, Cliff discovers the hacker isn't in the lab at all. They're accessing the system from outside Berkeley using a phone line. But the lab has a lot of phone lines, and Cliff doesn't know which one the hacker is using. To find out, he connects every line in the office to a printer, and when the hacker logs in, the connected printer will unspool a paper trail of exactly what he's up to. But rushing around the office is exhausting, and after connecting the final printer, Cliff falls asleep in his office.

When he wakes up, he's surrounded by 80 feet of printed paper. Cliff scans through the pages with growing alarm. The hacker hasn't just logged in this time. They've taken over Berkeley's entire computer system. They can now see every document and every file. They can change them, move them, erase them, and leave without a trace. Whoever this hacker is, they're good, and they're interested in far more than what the researchers at Berkeley are up to.

The next time the hacker logs in, Cliff finds something extraordinary. According to the printout, the hacker is using Berkeley's system as a gateway into U.S. military and government networks. Cliff grabs a pen and paper and scribbles down the aliases the hacker is using. There's Hunter again, but also Yeager, Benson, and Hedges. Cliff tries to find a link that might give him some clue about the hacker's identity, but all he can come up with is that Yeager is the German word for Hunter, and the hacker probably smokes Benson and Hedges cigarettes.

Cliff alerts the authorities, and the local district attorney obtains a warrant to trace the hacker. So when they next log in, Cliff immediately speed dials Ron Bavir, a network manager at Timet. He successfully tracks the hacker. across the country to a computer in Virginia. But when Cliff asks for more precise information, Ron throws a curveball. The district attorney's warrant only applies to California and has no jurisdiction across state lines. The phone company can tell Cliff that the signal came from Virginia, but they're not authorized

to give him anything more than that. Cliff is exasperated. After a month of relentless work, he just wants to know who he's chasing. So back in his office, he checks the hacker's latest activity. Hunter has been scouring the networks for information about the CIA. They found agents' names and even their phone numbers. Cliff feels he has to do something. But when he reaches out to the CIA,

the agency says domestic counterintelligence isn't its responsibility, and the FBI shows no interest at all. But the stakes are high. National security is at risk, and no one except Cliff seems to realize how serious the situation is. So Cliff won't give up. He'll keep pursuing his faceless enemy, and soon, Hunter,

will become the hunted. It's mid-October, 1986, inside the Lawrence Berkeley Laboratory in California, a month after the hacker was traced to Virginia. Cliff Stoll sits in front of a small monitor on the floor of the computer lab, scribbling notes. Colleagues weave around him, carefully stepping over tangled wires and crumpled pieces of paper. By now, they know better than to disturb Cliff when he's on the hunt for his digital nemesis. But to Cliff's frustration, the trail has gone cold. He's finally been informed that the phone line in Virginia belongs to the U.S. military contractor

MITR, but it turns out the hacker was accessing their computer from another unknown location. To narrow down the list of possibilities, Cliff has gone back to what he knows best, science. So on the lab floor, he's calculating the distance between Berkeley and the hacker's location. And the results are intriguing. It takes around a second for Cliff's computer to communicate with the East Coast, but the hacker's signal takes more than double that, almost three full seconds. So the hacker must be breaking into Berkeley's computers from outside the country. But exactly where remains a mystery.

And while Cliff puzzles that out, the hacker continues to delve deeper into the secrets of the United States government. Although Midor has shut down the hacker's account, it doesn't take them long to find another way in. And over the next few weeks, Cliff watches them break into another 40 military computers. It's impressive. Whoever this hacker is, they're making a mockery of U.S. cybersecurity. Soon, Cliff is obsessed. He constantly checks his computer and even starts sleeping in his office, hoping to catch the hacker online for long enough to launch another trace.

One Saturday morning, Cliff is at home when he learns that Sventek has logged in again. Cliff quickly calls Ron Vavere from TimeNet. Ron is at home watching his van when Cliff calls, but he agrees to run the trace. And this time, Ron can see that the hacker is accessing the system through Vestr 3, a satellite that connects the United States with Europe. It's confirmation of Cliff's theory that the hacker is somewhere abroad. From his house, Cliff bikes over to the lab. Luckily, by the time he gets there, the hacker is still online.

Maybe because it's the weekend, they think no one will be paying attention. But the longer they're online, the more Clifax. Cliff can find out about them. That's when the phone rings. It's another technician, an Englishman at Timet International. He's taken up the trace from Ron and can confirm that the hacker is somewhere in West Germany, but that's about as much as he can say right now. The authorities there will have to take up the search from this point. Cliff hangs up and stares at the blinking machines around him. It all makes sense, the connection lag, the German username. He just hopes that the West Germans are able to put the final pieces of the puzzle together.

And by Monday, they have traced the hacker to the city of Hanover, but he isn't staying online long enough to establish a precise location, so they come back to Cliff for help. By now, Cliff knows exactly the kind of information that interests the hacker, and he decides to create a honeypot, a fake cache of documents seated with tempting keywords like classified, nuclear, and missile program. The hope is that the hacker will find this irresistible

and stay online long enough for the German authorities to track them down. Cliff creates the folder and lays his trap. The next time the hacker logs in, they take the bait. As Cliff watches them trawl through the fake classified documents, he alerts the German authorities. This could be it. And as the minutes tick by, Cliff doesn't dare move from his computer terminal. He just stares at the screen.

If the hacker disconnects before the trace is confirmed, they'll be back to square one. But the honeypot does its jump. The hacker can't tear themselves away, and finally, the phone rings again. Cliff snatches up the receiver. The German authorities have found him, and Cliff punches the air. After a grueling, months-long hunt, he's finally trapped the hunter. But Cliff still isn't told the identity of the hacker.

It will be another six months before German authorities have enough evidence to make an arrest, and only then will Cliff Stoll finally learn the truth that he wasn't just dealing with a spy, but an entire spy ring. It's June 29, 1987 in Hanover, West Germany, six months after a hacker was traced to the city. In the backseat of an unmarked police car, Marcus Hess stares out at the streets rolling by and the people going about their everyday business.

Marcus wonders if he'll ever be one of them again. Marcus is the hacker known as Hunter, and he's just been arrested by German police. He knew this was coming. A few days ago, his apartment was raided. He wasn't at home at the time, but his computer, notebooks, and dozens of floppy disks were seized as evidence. Now, the authorities have caught up with him as well. Marcus is in his mid-20s, and he didn't set out to become a cyber spy.

After he dropped out of college, hacking into computer systems became a hobby, a game he played with his programmer friends. But then Marcus and his buddies realized that there was money to be made. One of them had a contact in East Berlin, and soon, deal was made with the Soviet intelligence agency, the KGB. The offer was simple, tens of thousands of Deutschmarks in exchange for sensitive information from U.S. military and research computers. Now, though, Marcus and his co-conspirators have been caught, and they're facing a landmark trial in the world's first case of cyber espionage. Cliff Stoll flies in from California to testify as an expert witness, and as he walks to the courthouse in the quaint German town of Zela,

Cliff can't help thinking about the strange turn his life has taken. A 75-cent accounting error has carried him from Berkeley to the other side of the world. Eventually, the German court finds all defendants guilty. They receive suspended sentences up to two years, a surprisingly light punishment given that the hackers sold information to the KGB. Following the trial, Cliff returns to the United States and his computer lab on the West Coast. He's helped break the world's first cyber spying, but he knows that this is only the beginning.

The hackers have proved something terrifying. With just a phone line, a home computer, and the right knowledge, anyone can breach a computer network from thousands of miles away. In the decades that follow, the world would become even more interconnected. The advent of the Internet will spark an arms race between hackers and cybersecurity experts. And the CIA and the FBI will never again be as dismissive as they were when Cliff Stoll warned them about the hacker infiltrating their systems, a young German man on the other side of the ocean

who was finally arrested on June 29, 1987. Next on History Daily, June 30th, 1934. Adolf Hitler consolidates his grip on the Nazi party with the deadly purge of his political enemies. From Noisor and Airship, this is History Daily, hosted, edited, and executive produced by me, Lindsay Graham. Audio editing by Muhammad Shazi, sound design by Molly Bach.

This episode is written in research by Angus Gavis. McLeod. Edited by William Simpson. Managing producer Emily Burke. Executive producers are William Simpson for airship and Pascal Hughes for Noiser.