textfiles/magazines/CUD/cud0444.txt

Computer underground Digest    Sun Sep 20, 1992   Volume 4 : Issue 44

       Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
       Archivist: Brendan Kehoe
       Shadow-Archivist: Dan Carosone
       Copy Editor: Etaion Shrdleau, Srr.

CONTENTS, #4.44 (Sep 20, 1992)
File 1--The Cuckoo's Egg Revisited
File 2--The Egg, Over Easy
File 3--Cuckoo's Egg and Life
File 4--The Egg Hatches
File 5--The Cuckoo's Egg and I
File 6--Comments on Cuckoo's Egg

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost from tk0jut2@mvs.cso.niu.edu. The editors may be
contacted by voice (815-753-6430), fax (815-753-6302) or U.S. mail at:
Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115.

Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL0 and DL12 of TELECOM; on Genie in the PF*NPC RT
libraries; from America Online in the PC Telecom forum under
"computing newsletters;" on the PC-EXEC BBS at (414) 789-4210; and by
anonymous ftp from ftp.eff.org (192.88.144.4) and ftp.ee.mu.oz.au
For bitnet users, back issues may be obtained from the mail server at
mailserv@batpad.lgb.ca.us
European distributor: ComNet in Luxembourg BBS (++352) 466893.

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted for non-profit as long
as the source is cited.  Some authors do copyright their material, and
they should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified.  Readers are encouraged to submit reasoned articles
relating to computer culture and communication.  Articles are
preferred to short responses.  Please avoid quoting previous posts
unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

----------------------------------------------------------------------

Date: Wed, 29 Jul 92 21:17:34 EST
From: Gene Spafford <spaf@CS.PURDUE.EDU>
Subject: File 1--The Cuckoo's Egg Revisited

Cuckoo's Egg Revisited
by Gene Spafford

When I first read Cliff's book, in draft manuscript form (Cliff sent
me an advance copy), I found it gripping.  So did my wife.  We each
found that when we started it, we couldn't put it down until we
finished it -- both of us staying up past 3am on a weeknight to read
through to the end.  We weren't the only ones.  When the book was
published, I bought copies for some friends, several of whom don't use
computers.  Almost all of them had the same reaction: they found the
book engrossing, entertaining, and informative.  Several of them also
reported spending late nights (and early mornings!) reading to the end.

It wasn't that Cliff set down particularly elegant and engrossing
prose that made the book so captivating, although his writing is
certainly better than many others evidence.  It wasn't because Cliff
recounted some high-tech adventure either -- many of the readers
(myself included) already had experience with computer security
incidents.  So why was the book so interesting to us, and to so many
other people?

It wasn't until a few weeks ago, when Jim Thomas asked if I would do a
short retrospective on the "Cuckoo's Egg" that I thought about this
question.  I even went back and skimmed through parts of the book
again.  Now that I've thought about it, I believe I know why "Cuckoo's
Egg" had such an impact: it was a honest sincere, personal accounting
of one person's internal struggle with right and wrong, as well as
being a challenging mystery story.

Cliff's writing portrayed, for many of us, some interesting conflicts
and value judgments. For instance, having strong opinions about some
governmental and commercial entities, but finding that they are
composed of many well-meaning, genuinely nice people. Or discovering
that not every "harmless" act is really harmless when multiplied
many-fold.  Heroic tales often involve journeys of self-discovery and
the loss of innocence; we saw Cliff undergo both.

To give a more concrete example of this, I consider the anecdote about
how Cliff "liberated" several printing terminals to track the logins a
perfect example of how rules, particularly property rules, may
sometimes be ignored by someone hot on a clever "hack," as Cliff was.
As the story unfolded, he made choices that I know he would have
reconsidered later on.

I also think that Cliff's account of keeping his system open, and
observing the cracker break in to other machines through his, is a
perfect example of how difficult some choices are to make, and how
they must be reevaluated as time goes on.  Was Cliff partially
responsible for those break-ins?  Was his notification of the sites
sufficient to counter the harm he had done?  Is the argument that "the
bad guys would have used some other route" a valid argument?  Seeing
those conflicts, even if indirectly, made the book something more than
just entertaining.

Cliff started as a well-meaning academic with strong views (almost
anarchistic, perhaps), and through the course of his personal
experience became someone with a different view of society.  He
underwent a transformation, on the pages before us, from a
happy-go-lucky scientist, to someone obsessed with a problem.  As he
recounted his growing awareness of the vast vulnerability our
increasing reliability on computers and networks presents, he made us
aware.  And with this new awareness, we read about the change in Cliff
and his view of the world...and how those around him changed their
view of him.

Cliff admits that he second-guesses some of his decisions made during
the time of his pursuit.  He's not sure he did the right thing at
every step, and he has paid a high price for doing what he felt was
right -- losing many things he treasured before and after the
publication of the book.  I think that's in the book, too, although
maybe not explicitly.  Or perhaps its because I know Cliff and have
talked to him about being thrust into the spotlight that makes me see
those things when I reread parts of the book.  He lost some cherished
possessions in the midst of battling for his principles, and that is
always a gripping theme.


So, is "Cuckoo's Egg" still worth reading today?  I think so.  I
didn't find it so gripping this time as the first time I read it, but
I saw more of the internal struggle Cliff went through as he pursued
his investigation.  I also saw how little some things have changed in
the our world of networks.

The book is still entertaining, too.  Cliff's account of drying his
sneakers in the microwave oven sounds like something I'd do, and his
recipe for cookies is still a bonus.

If nothing else, "Cuckoo's Egg" is still a good way to expose the
uninitiated to some of the problems with computer security and
investigation.  For that one reason alone, I think the book will
continue to have value to us -- as a place to get dialog started, if
nothing else.

I reflect on the world in Cliff's book, where sites were regularly
broken into without sys administrators knowing about it, where
security information was difficult to find, and where it was almost
impossible to get law enforcement to care about what was happening.

Then I think back over the past few weeks:
   * I have given several continuing education courses in Unix
     security, here in the US and in Europe, this summer, and turnout
     has been good
   * I've spoken on the phone with people in the FBI and US Attorney's
     office whose full-time job is devoted solely to computer crime issues
   * I've read in the paper about several arrests on computer crime
     charges, in the US and in Europe
   * I've corresponded with representatives of several security
     response teams, charged with helping to deal with computer
     security incidents
   * I've received court papers identifying me as a witness in
     an upcoming trial on computer abuse
   * I've been talking with some law enforcement agents in a (unnamed)
     nearby state who are concerned about how to define laws that help
     them stop the "bad guys" yet don't hurt innocent third parties.

How different the world is now from when Cliff began his adventure and
wrote his book!  Although we still have sites run with a cavalier
attitude towards security, and although there are still people who try
to penetrate whatever systems they can, the situation is not the same.
We now have dedicated security officers, a growing security industry,
new laws and law enforcement efforts, and coordinated responses to
unauthorized access and malicious behavior.  It's far from ideal, but
awareness is growing.

Perhaps "Cuckoo's Egg" has had something to do with those changes?  If
so, we should be grateful, perhaps, that this catalyst was crafted by
someone whose vision is that computers are useful if only we can
maintain sufficient trust in each other, and not someone with an urge
to legislate tight controls.  In a way, that is one of the most
enduring aspects of Cliff's writing.  It is clear that he loved some
aspects of computing.  The challenge of tracking his intruder was
clearly an element of gamesmanship  as well as duty.

Cliff, like many of us, came to realize that the world came to his
workstation through the magic of networks and computers.  That world
view, however, is based on a foundation of 1's and 0's that bear no
definitive stamp of who sent them.  The network provides freedoms to
be free of stereotypes, and to express your thoughts to millions.
Your thoughts come through, and the reader need never know if you are
young or old, tall or short, fat or thin, black or red or oriental or
hispanic or mongrel, male or female, hale or crippled.  That same
freedom, however, requires responsibility to not abuse it, and trust
that the 1's and 0's aren't carrying lies.

It was Cliff's anger at the end of the book -- that his trust in what
came across his computer was violated -- that really brought home the
change.  His anger, about how the abuse of trust by a few threatens the
many, clearly came through to me.  His concern for our reliance on
computers also was clear.  And the irony of the epilogue, tugging at
him again, after he said he was giving it all up; "I'm returning to
astronomy" are his final words in the last chapter.  You can't go back
Cliff.  Sadly, none of us can.

------------------------------

Date: 24 Aug 92 23:27:31 EDT
From: Gordon Meyer <72307.1502@COMPUSERVE.COM>
Subject: File 2--The Egg, Over Easy

The Egg, Over Easy.
Gordon R. Meyer, CuD co-moderator

It's Thursday, August 20, 1992 and I'm watching the President of the
U.S. address his loyal minions.  "Fall of communism...I did that,"
"The reunification of Germany...did that too," "Kuwait is free..thanks
to me," "Events in our country?...blame Congress. It's not my fault".
The telephone suddenly rings...though semi-catatonic I know, just
know, it's the Thought Police.  Shit, what will I tell them?  I was
listening to the President...honest!  You must have me confused with
someone else.  My palms are sweating.  The phone is still ringing.  I
pick it up...

"Guten abend" I say, in my best German accent, hoping it will throw
them off the track.  "Hey Gordon" Jim says without hesitation.  "Jim!
It's you!" Thank God.  I breath easier knowing that it's only Jim
Thomas, co-founder and Keeper-Of-CuD on the line.  I guess I only
thought it was 1984.

Or maybe not.  Before I know it Jim is asking me to write a review of
'The Cuckoo's Egg' for the next issue of CuD.  I check my watch...it's
still ticking.  A quick glance at the calendar on the wall...'1992'.
Hmmmm.  Maybe Jim  is still in his own RNC-induced trance.  "Didn't we
review Cliff's book about..oh...two and half years ago?," I ask
quietly, trying not to wake him too abruptly.  "Yeah."  (It's a full
sentence for Jim, trust me, he can say a lot in  one word.)  Admitting
my confusion, I ask him to explain. "There has been a lot of water
under the bridge since Cliff's book, it'd be good to take another look
at it and see what it has to offer now.  Besides," he added, "we
already have retrospectives from lots of other folks." "Nothing like
good old fashioned peer pressure" I mumble, trying to sound
enthusiastic.  I ask him when he needs the article, knowing the answer
won't be as far in the future as I'd like, say eight or nine months
from now.  "Wednesday latest, tuesday if you can."  Great, so I've got
around five days to find, then re-read, then review the book. How will
I convince him it can't be done?  I start to voice my objections,
starting with "I don't have time to read...," when he cuts me off
before I can finish. "So don't read it again, just review it." Huh?
No, wait, oddly enough it starts to make some sense.  Or least more
sense than what I could hear coming from the television in the other
room.  We discuss the idea a bit more and hang up with me promising to
send the article by wednesday, and Jim making me say "By wednesday the
24th of August 1992 anno Domini, cross my heart and hope to die."
Sheesh, what a slave driver...

I'm determined *not* to refer to my copy of The Cuckoo's Egg (The Egg)
for this exercise.  I really do know where it is though, I can see it
on the shelf about ten feet away as I write this, but I'm not going to
cheat and look at it.  I don't need to.  Well, except to see how the
hell to spell "Cuckoo," but that doesn't count. There's no need for me
to tell you what the book says, you know that...or at least you
should.  If you don't know then you haven't read it.  Do so.  Now.
End of review.  (And if you choose to ignore this advice, and not read
it, I swear to God you will regret it because the very first
non-computer person you meet, who finds out about your interest in
security/hackers, will regale you with an enthusiastic 20-minute
summation of 'that one hacker  book'.  So either read it, or never
_ever_ admit you haven't. Trust me.)

Let's look at The Cuckoo's Egg not as a book, but as a landmark...A
cultural/historical icon that escaped from cyberspace into the 'real'
world.  The Egg, for the most part, was the first to introduce to
mainstream (i.e., Non-cyberspace) society the concepts, magic,
implications, and yes, possible dangers, of the networked world.  The
Egg uses popular and familiar "Hollywood" elements (espionage,
government agents, goofy liberal scientists) , and melds them with the
unfamiliar and obtuse (networks, Unix). Classical elements,
fascinating story...It'll sell a zillion copies!  And it did. The Egg
has been in paperback, on Nova, in Congressional hearings, featured on
the Wily Hacker Trading Cards, retold in JPL Comics, selected as a
Book-of-the-Month Club Alternate Selection, and the ultimate in
mainstream acceptance and recognition...condensed for Readers Digest.

No, The Egg is certainly not just a book.  I want to liken it to
_Hell's Angels_ by Hunter S. Thompson.  But I'm not old enough to do
so with any credibility. Thompson introduced people to the outlaw
motorcycle gangs, and showed their lifestyle and organization in a way
that outsiders had never before seen.  We share with HST as he learns
about the Angels, and we wince when gets beat-up at the end.  In The
Egg, we mock Cliff's obsession with the teeny tiny accounting error
that leads to the discovery of The Intruder.  Then, after enticing us
with a Brownie Recipe, he gets us caught up in the chase until we
cheer when the Bundepost gets a trace on the hacker's line. _Hell's
Angels_ is every bit as much as a 'must read' to be able to converse
about motorcycle outlaw gangs, as The Egg is to talk about the
problems of computer security.  Only more so, as I don't think Readers
Digest has ever heard of Hunter Thompson.  (Note to Jim: Don't worry,
I've deleted the discussion of the phallic symbolism of pistols and
yo-yo's.)

The Egg is also important as it documents an era when the FBI, SS,
CIA, Telco Security, and everyone else would laugh off hackers and/or
espionage.  Those days have ended.  In fact, the pendulum has swung so
far in the other direction that Stoll's experience with the laise-
faire authorities seems quaint. For researchers, The Egg marks
somewhat of a transition between Esquire's Cap'n Crunch article, Bill
Landreth's confessional book, and the ill-directed Operation Sun
Devil.

To my knowledge we've never really heard about the 'national defense'
impact any of the information Stoll's hacker may have passed on to the
Soviets.  This is regrettable as The Egg has almost certainly had an
effect on concern about computer espionage.  It would be interesting
to know how this 'classic case' (and oft cited) harmed, or failed to
harm, our "National Security."   Regardless of the affect, it's a
reasonable assumption that Stoll's work has been used as justification
for more than one corporate security program sales pitch.  The Egg is
destined to be a part of Bibliography's and "suggested reading" lists
for many years.

Finally The Egg has also given us its author, Cliff Stoll.  If it
wasn't for his book, and his willingness to share it with the world
(quite literally, I understand, though haven't confirmed, that it has
been translated into many languages) Stoll might well be known only to
his fellow Astronomers. That would be a shame, for although I don't
always agree with Stoll's suggested solutions or characterizations of
the Computer Underground, I think the computer security community
would be a bit more boring without him.

So there you have it, The Cuckoo's Egg thus far.  I'll be interested
in seeing how the book holds up over the next two or three years.  I
predict it will do just fine, joining the ranks of _Hackers_ and _Soul
of a New Machine_, as dog-eared after dog-eared copy gets passed
from one computer enthusiast to another.

Postscript:  For those who just can't get enough of the saga of the
egg, a book published in Germany, _Hacker for Moscow_, tells the tale
as seen from the other side of the terminal.  If you were hungry for
more information about the German/East German connection, and you want
a more detailed description of the actual methods used to gain access,
as only the intruder himself can give, check it out.  Unfortunately,
as far as I know, it hasn't been translated into english...outside of
Langley, VA of course.

------------------------------

Date: Sun, 2 Aug 92 18:51:50 PDT
From: brendan@CYGNUS.COM(Brendan Kehoe)
Subject: File 3--Cuckoo's Egg and Life

Life can take you in any number of directions, some of which may bring
you through Andy Warhol's proverbial fifteen minutes of fame.  Cliff
Stoll found himself propelled into that limelight, caught quite
unawares.  The tale of a six-bit accounting discrepancy leading to
spies and intrigue took the world by storm.  His life has apparently
calmed down now, but the results of his experience are still being
realized by the computing community.  Advances in technology, groups
like CERT and companies with full-time security alert personnel are
all, in part, testament to the work represented by his book.

The cosmopolitan appeal of The Cuckoo's Egg cannot be ignored,
however.  Fully half the importance of a message is its capacity to be
conveyed to as many people as possible.  Cliff accomplished this, in
spades.  Rather than limit the audience to technophiles who would eat
up the juicy details, The Cuckoo's Egg offered readers an insight into
how a "diamond in the rough" might go about dealing with what amounted
to an impossible situation.  Following Cliff as he was knocked about
from pillar to post, finding no help at all from those we would assume
are paid to investigate such things, made for truly fascinating and,
sometimes, disturbing reading.

Just over two years ago, I spent Christmas with a friend and his
family, the cost of returning to my native Maine proving prohibitively
high.  While browsing a North Pennsylvania mall, we happened upon The
Cuckoo's Egg in a bookstore, and my friend chose to buy it as a gift
for his father.  Someone I consider to be the perfect example of a not
terribly advanced, but quite comfortable, computer user, his dad was
instantly captured by the engaging story.  He literally inhaled it,
along with dozens of cigarettes, over the course of not more than two
days.  Chapter One on Tuesday, "THE END?" on Thursday evening.  A
flurry of questions hit over the weekend: was the network used at
Widener University, where we were Computer Science majors, capable of
these things?  had we ever seen anything like what had happened to
"that astronomer"?  wouldn't it be cool to have it happen to us?

The notoriety Cliff Stoll gained from what could be termed an ordeal
was not, in my opinion, the reason The Cuckoo's Egg had to happen.
Rather, it accomplished precisely what it set out to do: bring the
concerns of information security into the thoughts and conversations
of thousands of people.  People who would otherwise not have ever
encountered what may well prove to be one of the most decisive factors
in our world's future as we fast approach the new millennium.

------------------------------

Date: Mon, 14 Sep 92 11:14:49 CDT
From: Jim Thomas <cudigest@mindvox.phantom.com>
Subject: File 4--An Ideal(istic) Egg

Cliff Stoll, the hippy, might appreciate the irony of The Cuckoo's Egg
(TCE) symbolizing for the "hacker generation" what Altamont did for
the counter-culture of the sixties. Cliff Stoll, the socially
committed astronomer would take little pleasure in the prophetic power
of his observations.  For those of the sixties, the free Rolling
Stones concert at Altamont was seen as a west-coast version of
Woodstock--a chance to frolic, engage in the excesses of "freedom from
responsibility," and live out a fantasy inspired by a romantic image
of the flower-power culture. A beating death by the Hell's Angels
"peace keepers," seemingly high numbers of drug overdoses, and
spiritual rain darkened the event.

Altamont itself did not kill the "hippy dream" any more than TCE had a
terminal effect on the hacker counterculture. Nonetheless, the
experiences recounted in TCE provided an icon for the passing of a
romantic era of hacking into one in which personal responsibility (or
lack of it), personal excesses, and increasing abuse without concern
for the consequences were eroding a culture from within.  Like the
decay of the sixties' culture, the hacker culture of the 1980s was
invaded by newcomers who lacked the romantic idealism of those who had
come before them. As access to computers increased, a hoard of
newcomers moved in, bringing with them the problems that face any
community in a population explosion.  In TCE, Cliff only documents one
slice of the problem by describing one incident that symbolized the
problems of a new society when trust and respect for the rights of
others breaks down.

In long-lost correspondence, Eric Smith once suggested that TCE
represented a turning point for Cliff, for the "hacker community," and
for computer users who who lived outside the pale of exploratory
computer use.  Cliff's work raised consciousness, a few hackles
(including my own), praise, and criticism. It was written before
Operation Sun Devil, but was read by many of us in the context of the
Legion of Doom and Phrack indictments. It was cited by some law
enforcement agents in documents and other media as a means of
exaggerating the "Hacker Menace" as a national security threat to
justify their excesses in early 1990.  As a consequence, it was not a
work that received many neutral readings.  Ironically, much of the
criticism directed at Cliff and his work reflected the same passion
that prompted Cliff to write it:  Betrayal of trust and opposition to
injustice and predatory behavior.  The metaphors of betrayal and loss
permeate TCE. Openness, whether in our personal relationships or on
computer systems, require trust. When that trust is violated, we lose.
Cliff's persona seeps continually out of the book. One can picture him
with keyboard in one hand, yoyo in the other, chocolate chip cookie
crumbs scattered about, and sneakers steaming in the microwave,
sharing each chapter with the woman he loves with joy and
anticipation.  The intellectual and other rewards he reaped from his
labor also carried a burden.  The nearly three years' experience and
corresponding time to reflect on events since then cannot but make a
re-reading of The Cuckoo's Egg a somewhat sad experience.  Cliff has
written elsewhere of his personal losses: Some friends abandoned him,
he was unfairly criticized, his relationship dissolved, and he found
himself at the center of controversy not of his own making.

What was the cause of all this? By now, most know that TCE was about
tracking an intruder into UC/Berkeley's computer system who was
noticed as the result of a miniscule accounting error.  Cliff
discovered that his system was being used by the hacker to access
other systems, and, like a cyber-bloodhound, followed the intruder
into other systems and then retraced the steps and ultimately located
him on a system in Germany.  The narrative made a fascinating
detective story, and when read from the protagonist's perspective, one
couldn't help root for the detective. Methodologically, patiently,
painstakingly, the narrator pursued his quarry. Guided by the same
passion for solving a puzzle that motivates hackers (and researchers)
and by the feeling that if things are not quite right they should be
fixed, Cliff combined curiosity and technology in a way that one
might argue celebrates the original hacker ethos while adamantly
opposing its excesses.

When I first read the Cuckoo's Egg in early 1990, the Legion of Doom,
Phrack, and Len Rose were facing legal problems. Sun Devil was still a
few months away.  Prosecutors, the media, and others alluded to the
work to demonstrate the "hacker menace," to raise the spectre of
threats to national security through espionage or disrupting the
social fabric, and to generally justify the need to bring the full
weight of law enforcement down upon teenage joyriders.  Although Cliff
has taken a strong and unequivocal stand on civil liberties and has
publicly denounced excesses that violate Constitutional rights, he had
no power of the use of the images that some took from the book. This
led some at that time, myself included, to associate him with the
excesses.  Ironically he was in a sense victimized by the same law
enforcement excesses as others in early 1990. By attempting to alert
us to a problem, he was unwittingly caught up in it, and the messenger
was mistaken for the message. As a series of posts on
comp.org.eff.talk indicated this past summer, the mistake lingers.

And what *IS* Cliff's message? In TCE and elsewhere, he has made it
quite clear: Cyberspace must be based on trust.  The sixties' idealism
of a better world through cooperation and respect for others' rights
is not simply a "PC" perspective, but an ethos that is essential if
computer technology and its benefits are to be widely shared.  Those
who intrude on others subvert this trust, and virus-planters are akin
to putting razor blades in the sand at the beach.  The attitude of
some that it's a right to try to hack into systems with impunity
subverts the freedom of others, and when trust dissolves, so does
freedom.

In some ways, Cliff Stoll *is* The Cuckoo's Egg.  His persona has been
planted in our psyche, his images have become part of our lore, and
his non-compromising insistance on establishing a culture of trust and
mutual respect provide a model for teaching young computer users that
responsibility comes with knowledge. Gordon Meyer provides the best
summary for the legacy of The Cuckoo's Egg: It has hatched and his
given us Cliff Stoll and an image of curiosity, decency, and class
that can help civilize the cyber-frontier.  And there aren't many
books or authors about which that can be said.

------------------------------

Date: Thu, 17 Sep 92 23:23:46 EDT
From: Mike Godwin <mnemonic@EFF.ORG>
Subject: File 5--The Cuckoo's Egg and I

THE CUCKOO'S EGG and I
By Mike Godwin

Copyright (c) 1992, Mike Godwin

I won't say that THE CUCKOO'S EGG is *the* book that changed my life,
but it's certainly *one* of those books. Here's how it happened:

In the middle of my last year of law school (1989-90), I was getting
bored with the local BBS scene in Austin, Texas. So, I decided it was
finally time to do what I'd been planning for a few years--getting an
account on a University of Texas system and participating in the huge,
distributed, free-floating conference system called Usenet.

By sheer chance, this decision came at a time when the Net was
particularly hungry for information about hackers and the law. Usenet
was still abuzz with discussion about the Internet Worm case, and
there was also a lot of talk about the so-called "Legion of Doom"
searches and seizures, which focused on three alleged hackers in
Atlanta. (As a third-year law student preparing to become a Texas
prosecutor, I had plenty of answers to the legal questions that
flooded Usenet newsgroups like misc.legal and comp.dcom.telecom.)

And, of course, there were lots of references to a book by some guy
named Stoll, who apparently had caught some hacker spies. A fellow
Austin BBSer named Al Evans told me he'd been enthralled by the book,
and when I saw it listed in the new acquisitions at my law school's
library, I decided to check it out.

The book was a revelation, and it kept me up half the night--I ended
up reading it in one sitting. The mystery of the Hannover Hacker was
only part of what fascinated me--the book, almost incidentally,
included the first *interesting* discussion I'd come across of the
structure and dynamics of the Internet. The image I formed of the
Hacker's leaping from network to network helped me begin to appreciate
the vast, complicated, deeply connected computer and telephone
networks that crossed the oceans and pierced national borders without
a pause.

I found Cliff's story also to fit well with what I knew, from my own
associations with researchers, what life can be like for working
scientists. There is a point in the book where Cliff's curiosity and
desire to find "the answer" kicks into overdrive--it's then that you
see why he became an astronomer. For me, one of the most inspiring
passages in the book is Cliff's account of his discussing the Hacker
with Nobel Prize-winner Luis Alvarez:

   "Permission, bah. Funding, forget it. Nobody will pay for
    research; they're only interested in results," Luie said.
    "Sure, you could write a detailed proposal to chase this
    hacker. In fifty pages, you'll describe what you knew, what
    you expected, how much money it would take. Include the names
    of three qualified referees, cost benefit ratios, and what
    papers you've written before. Oh, and don't forget the
    theoretical justification.

   "Or you could just chase the bastard. Run faster than him.
    Faster than the lab's management. Don't wait for someone
    else, do it yourself.  Keep your boss happy, but don't let
    him tie you down. Don't give them a standing target."

    That's why Luie won the Nobel Prize....

And yet, the same singleminded approach that Cliff (and I) found so
inspiring in Alvarez also inspired a lot of the criticism that Cliff
has faced from some quarters since the book was published. (More about
this later.)

At the time I read the book, it had not yet come out in paperback.
When I finished CUCKOO'S EGG, I looked again at the forward and
discovered that the author had left an e-mail address. Although not
always swift on the uptake, I managed to deduce from this that Cliff
wanted feedback from his readers, so, after some hesitation, I sent
him a letter in e-mail, giving him my reactions, and making a joke
about a humorous grammar error in Chapter 45 (for the curious, it's in
the top two lines on page 255 in the Pocket Books paperback).

To my surprise, I had mail back from Cliff the next day! He was
interested to hear my reactions, and was surprised to discover that I
was a law student--his wife, Martha, had been a Berkeley law student
during the events chronicled in the book, and was now a clerk for
Supreme Court Justice Harry Blackmun! We discussed the need for more
people on the Net with genuine knowledge of the law--few people had
had more experience than Cliff in running up against the "two
cultures" division between those representing the legal system (not
just lawyers, but also the FBI and the Secret Service) on the one
side, and the programmers, scientists, and students who populated the
Net on the other.

And as our correspondence progressed, we found ourselves talking from
time to time about the "hacker cases" that were being reported on
Usenet and in the news media. Cliff had seen what happened when
well-meaning and informed law-enforcement agents, like Mike Gibbons of
the FBI, took on a case in which a computer intruder clearly sought to
steal military secrets and sell them to Eastern Bloc spies. What we
both were seeing now were cases in which law-enforcement agents and
prosecutors were making obvious mistakes and damaging people's rights
in the process. The "Legion of Doom" hackers, for example, were
accused of stealing the source code for the Emergency 911 System from
a BellSouth computer--yet to anyone with even basic knowledge of what
a computer program looks like, the E911 "source code" was nothing more
than a bureaucratic memorandum of some sort, with a few definitions
and acronyms thrown in.

(The myth that the Legion of Doom defendants had access to the E911
source code persists to this very day: columnist "Robert Cringely" of
INFOWORLD once reported the "fact" that the AT&T crash of 1990 was due
to Legion of Doom sabotage, and that same "fact" appears, along with
numerous other egregious errors, in the diskette-based press kit for
the new movie "Sneakers.")

My growing interest in these hacker prosecutions, my discussions with
Cliff and others, and my reflections on THE CUCKOO'S EGG started
changing my postings on Usenet. Whereas before, I'd limited myself to
fairly dry and academic dispositions in answer to abstract legal
questions, I found myself getting emotional about some of these cases.
The more I learned about how the seizures and prosecutions were
hurting individuals and chilling free discussion on the Net (I even
lost an account myself as one sysadmin ended public access to his
system in order to minimize risk of having his system seized), the
more I found myself arguing with those whose justified anger at
computer intruders led them to justify, uncritically, any and all
overreaching by law enforcement.

And then this War On Hackers struck closer to home. On March 1, 1990,
an Austin BBS, run by the nationally famous role-playing-game
publisher Steve Jackson Games was seized by the United States Secret
Service. Although neither Jackson nor his company turned out to be the
targets of the Secret Service's criminal investigation, Jackson was
told that the manual for a role-playing game they were about to
publish (called GURPS Cyberpunk and stored on the hard disk of the
company's BBS computer) was a "handbook for computer crime."

The seizure, which shocked Austin's BBS community, had the potential
to put Jackson, an innocent third party, out of business. The sheer
magnitude of the effect on Jackson and his business outraged the
members of an Austin BBS called "Flight," which numbered both me and
Jackson among its users. Even more outrageous was the failure of the
media to pick up on the injustice that had occurred--one Flight user
pontificated that this was because the mainstream press had no
interest in BBSs, which publishers saw as nothing more than potential
competition.

I thought this theory was crazy. I had worked as a newspaper
journalist before I went to law school, and I'd even taken time off
from law school to edit my university's newspaper. I started arguing
on Flight that the media hadn't covered the story because they didn't
know about it. Or, at least, they didn't understand the issues.

Then it hit me. Why was I sitting at my terminal *talking* about
reaching the media, when what I should be doing is making sure that
the story gets publicized? With something of the same singlemindedness
I think Alvarez was talking about, I set out to see that the story of
the Steve Jackson Games raid, and of the other cases, got reported in
the mainstream press. I gathered together several postings from local
BBSs and from Usenet, and I drove down to the Austin
American-Statesman office to talk to a reporter I'd been referred to
by a friend of mine who worked on the newspaper's copy desk. I took
with me photocopies of the statutes that give the Secret Service
jurisdiction over computer crime and lots of phone numbers of
potential sources. At the same time, I called and modemed materials to
John Schwartz, a friend and former colleague who was now an editor at
Newsweek.

The story made the front page of the American-Statesman the following
weekend.  And John Schwartz's story, which covered the Steve Jackson
Games incident as well as the Secret Service's involvement in a
nationwide computer-crime "dragnet," appeared in Newsweek's April 30
issue. When the latter story appeared, I realized that (in a much
smaller way, of course) I'd managed to do to the media what Markus
Hess had done to Lawrence Berkeley Labs, and what Cliff Stoll had done
to the puzzle created by Markus Hess:  I'd hacked it!

And yet, really, I can't take full credit for getting the story of the
SJG raid out; if I hadn't read THE CUCKOO'S EGG, I'd never have
started a dialog with Cliff, and I'd never have begun to piece
together the significance of the wrongheaded hacker prosecutions that
we heard so much about it 1989 and 1990.

That's why it always strikes me as odd, and even offensive, when some
net.yahoo decides that Cliff's book is responsible for all the
offenses committed by law-enforcement agents in their efforts to fight
computer crime. As Cliff himself has remarked,

    I've found [the book] used to justify increased security,
    raids on bulletin boards, and monitoring of network traffic.
    It's also used to refine legislation, to expand the Internet,
    to better define what constitutes asocial behavior on the
    networks.

It started out as a good story, but Cliff has seen it become the
justification for all sorts of actions, both positive and negative.
And yet Cliff, because he actually took the leap and tried to explain
to law enforcement what was going on, often gets much of the blame for
the negative results, and little of the credit for the positive ones.

This shortsighted, "kill the messenger" mentality may explain why a
few readers have gone so far as to vilify Cliff and his book, saying
things like "Cliff Stoll is just as much amoral a hacker as Markus
Hess." Even when those readers are making the criticism in good faith
(and I think many of them are simply motivated by the common American
vice of Let's Criticize the Famous), I think they're victims of a
basic confusion. True, Cliff was as *singleminded* as Markus Hess was.
(It takes a singular obsession to start wearing a beeper designed to
go off whenever a certain user logs in.) But the moral and
philosophical dimension of his actions was far different from those of
Hess, Pengo, and their associates. Although a few of them justified
their actions in political terms, for the most part the East German
hackers cracked systems in order to get money or drugs; in the book
Cliff tracks the hackers partly in order to solve what had become to
him a "scientific" problem, but also--as he begins to realize himself
in the book--in order to restore a community order that has been
violated and disrupted.

It is this same sense of a need to protect this vast, virtual
community that has led Cliff to change the way he talks about the
Cuckoo's Egg case over the last few years. I've had the privilege
several times of seeing Cliff entertain an auditorium full of rapt
listeners with the story of that tiny accounting error on the LBL
computer. Nowadays, he ends his presentation on an
uncharacteristically sober note: he reminds his audience that the need
to keep computers secure and to instill shared values in our online
communities *never* justifies the government's violation of the civil
liberties of individuals.

To me, all this casts Cliff and his book in a different light. Even
now, I can't say I necessarily approve of all the actions Cliff took
in trying to catch the East German hackers. (It is a measure of how
much the world has changed since CUCKOO'S EGG that it seems odd to
write the words "East German.") But when I reflect for a moment and
try to imagine what kind of people I'd want to share this networked
community with, it's hard to think of a person better than Cliff
Stoll--ferociously smart, passionately curious, self-doubting,
idealistic, and (to his own surprise, perhaps) deeply moral.

------------------------------

Date: 29 Jun 92 06:11:10 GMT
From: stoll@ocf.berkeley.edu (Cliff Stoll)
Subject: File 6--Hatching the Cuckoo's Egg

HATCHING THE CUCKOO'S EGG

   Copyright (c) 1992 by Cliff Stoll
   This version is posted to Usenet; ask me before you repost or
   reprint it.  Resend it across networks or archive it on
   servers, but don't include in any digests, publications, or
   on-line forums.  Ask me first, and I'll probably say OK.

Yes, I'm active on the Usenet, often reading, seldom posting.  I
keep a low profile partly because I'm busy (writing a book about
astronomy) and because I worry that my opinions are given too
much attention due to my notoriety.

You'll find my e-mail address in the front page of every copy of
Cuckoo's Egg.  I read and reply to all my mail.  However, because of
the huge number (about 18,000 in 3 years), I seldom write more than a
short answer.  Often I get 3 weeks behind in replying to my mail.

Letters astonish me with their diversity:  some say I'm a villain,
others a hero. I see myself as neither, but as an astronomer who got
mixed up in a bizarre computer mystery.

I'm now back in Berkeley/Oakland/San Francisco.  I've cut down on
public speaking, mainly because it's exhausting.  I'm a member of the
EFF, ACM, CSPR, BMUG, AAS, ARRL, NSS, pay all my shareware fees, and
floss nightly.


# Point of the book:

I started out by writing a technical summary in the Communications of
the ACM, 5/88.  This article, "Stalking the Wily Hacker" was for
computer techies ... I wrote it in an academic style, and with more
technical detail than Cuckoo.

***     Before asking for more information     ***
***       about Cuckoo's Egg, please read      ***
***           Stalking the Wily Hacker         ***

Throughout that article, as well as the book, I emphasized the many
mistakes I made, the difficult choices I worried about, and the need
for communities to be built upon trust.

I began writing a book about the fundamentals of computer security in
a networked environment.  This was the logical expansion of my CACM
article.  My friend, Guy Consolmagno, read the first 5 chapters and
said, "Nobody will read this book --it's just about computers and
bytes.  Don't write about things.  Write about people."

I'd never given it much thought, so I tried writing in first person.
You know, using "I" and "me".  Weird ... kinda like walking around
nude.  It's a lot safer hiding behind the third person passive voice.
Since I'd never written anything before, I just followed instinct.

I began weaving in different threads:  a textbook, a mystery, a bit of
romance, and with my sister's suggestion, a coming of age story.
Kinda fun to jump from one subject to another.

Although I strongly object to anyone breaking into another's system, I
didn't wish to write a treatise against hackers, crackers, or phone
phreaks.  Rather, I wanted to tell what happened to me and how my
opinions developed.

I wrote the book for fun, not money or fame.  These have no value to
me.

# What's happened since then:

A year after Cuckoo's Egg was published, operation Sun Devil was
carried out, Steve Jackson Games was busted by the Secret Service, and
Craig Neidorff arrested.  I knew nothing about these events, and was
astounded to hear of them.

The Cuckoo's Egg has been misused to justify busts of innocuous
bulletin boards, restrictive new laws, investigations into networked
activity, and who knows what kind of monitoring by big brother.  It's
also been misused as a cookbook and justification by bd guys to break
into computers.  I disagree with all of these.  Strongly disagree.

I've repeatedly testified before congress and state legislatures:  I
don't want to lose the friendly sandbox that our usenet has become.
Our civil rights -- including free speech and privacy -- must be
preserved on the electronic frontier.

At the same time, we must respect each others rights to privacy and
free speech.  This means not writing viruses, breaking into another's
computer, or posting messages certain to cause flame wars.  Just as
important, it means treating each other with civility, respect, and
tolerance.

# On being notorious:

This incident has been good to me in a few ways:
   1) My folks are proud of me.  Nothing makes me feel better.
   2) I've made many friends, over networks, at meetings,
      and by mail.
   3) Several old friends have looked me up.

And there's a downside:
   1) Alas, but the most important person in my life has left.
      Deep sadness and hurt.
   2) I've become a target of phone phreaks and crackers.
   3) No privacy.
   4) I'm stereotyped and pigeonholed.
   5) Some people become jealous.
   6) Several old friends have hit me up for money.

# Answers to specific questions:

1) Did Cliff violate Mitre's computers?  As written in Cuckoo's Egg,
chapter 25, I logged into Mitre Washington Computer Centre and
demonstrated the insecurity of their system.  Immediately afterwards,
I called Mitre and described the problem to them.  Up to that point,
they (and I) didn't know where the problem was coming from.  For a
week prior to touching their system, I was in contact with several
Mitre officers; we had a working arrangement to try to solve our
mutual problem.  Moreover, I contacted the CEO of Mitre (James
Schlessinger) who questioned me at length and thanked me.

2) Did Cliff run off on his own?  At the very start, I contacted three
attorneys:   our general counsel, my local district attorney, and a
friend at the ACLU.  Additionally, I asked several professors of law
at Boalt Hall and a number of law students.  My boss, my lab director,
and my colleagues knew what was happening.  I contacted systems
managers at Stanford, UC/Berkeley, and military sites.  I did my best
to keep these people in the loop.

3) Was Cliff some kind of sheriff of the west, trampling over rights?
Uh, I never thought of myself that way.  Indeed, much of the time, I
felt this was a chance to do science -- apply simple physics to a
curious phenomenon and learn about the environment around me.  As much
as possible, I wished to remain invisible to the person breaking into
my computer, while prodding others to take action.  As a system
manager, I did my best to monitor only the intruder, to keep him from
hurting others, and to find out why he was in our system.

4) Did Cliff track these people to support a political position?  No.

5) Am I happy at the sentences meted out to the German defendants?
They received 1-2 years of probation and stiff fines.  I don't take
joy in wrecking another's life -- rather, I'm sad that this entire
incident happened.  I am glad that they did not end up in prison, glad
that at least one of them has said that he will never again break into
computers.


-Cliff Stoll  29 June 1992

------------------------------

End of Computer Underground Digest #4.44
************************************