Skip to content

The KGB Hack: Karl Koch, Markus Hess, and the Cuckoo's Egg

Abstract

In 1986, an astronomer-turned-sysadmin at Lawrence Berkeley National Laboratory named Clifford Stoll chased down a 75-cent accounting error in his computer’s billing logs. The error led him, over the next ten months, to an intruder who had tried his way into about 450 US military and research computers across the MILNET and got into more than 30 of them, and then to the discovery that the hacker was selling what he found to the Soviet KGB. The intruder was Markus Hess, a German hacker working with a small ring of young West Germans connected to the early Chaos Computer Club milieu. Among them was Karl Koch, a brilliant, drug-addicted, conspiracy-obsessed young man who called himself “Hagbard” and who, in 1989, was found burned to death in a forest in a still-disputed apparent suicide. The case was the first documented instance of computer espionage between Cold War superpowers, the first time network intrusion was shown to be a tool of statecraft rather than mischief, and (through Stoll’s bestselling book The Cuckoo’s Egg) the story that taught a generation what an intrusion actually looks like from the defender’s side.

A 75-Cent Error

In August 1986, Clifford Stoll was managing computers at Lawrence Berkeley National Laboratory when he was asked to resolve a trivial discrepancy: the lab’s accounting system, which billed users for connect time, was off by 75 cents. Most administrators would have written it off. Stoll treated it as a puzzle, and the puzzle revealed an unauthorized user who had obtained superuser (root) access and was using the lab’s systems as a stepping-stone into the wider MILNET, the US military’s segment of the early internet.

Rather than simply locking the intruder out, Stoll made an unusual decision: he left the door open and watched, meticulously logging every keystroke, in order to learn who the attacker was and what he was after. Over roughly ten months he watched the intruder attack about 450 computers (at military bases, defense contractors, and research institutions) and get into more than 30 of them, searching specifically for material on nuclear weapons, the Strategic Defense Initiative (“Star Wars”), semiconductors, satellites, and aircraft.

The Cuckoo’s Egg

Stoll’s title is a metaphor for what the intruder did: like a cuckoo that lays its egg in another bird’s nest to be raised by an unwitting host, the hacker planted his code and credentials inside trusted systems that then did his work for him. Stoll’s account, published in 1989, was groundbreaking because it documented an intrusion from the defender’s point of view, in granular operational detail, at a time when almost no one understood what network security even meant. It reads as a detective story and functions as the founding text of practical incident response, including the first famous use of a honeypot.

The Honeypot

The intrusions were real, but proving who was behind them (and getting any agency to care) was its own ordeal. Stoll found the FBI, CIA, NSA, and Air Force Office of Special Investigations initially uninterested: the dollar losses were trivial and jurisdiction was murky. To force the issue and keep the hacker online long enough to trace the transatlantic phone connection, Stoll fabricated a trap. He created a fictitious set of files about a non-existent military project, “SDINET” (a supposed Strategic Defense Initiative network office), and salted his systems with them.

The bait worked spectacularly. The intruder spent hours greedily copying the fake documents, keeping the connection open long enough for technicians to trace the call across the Atlantic, and, later, a letter arrived from someone in Pittsburgh requesting more information about the fictional SDINET project, a sign that the stolen material was reaching third parties. The trace led to Hanover, West Germany.

Markus Hess and the Ring

The hacker at the keyboard was Markus Hess (handle “Urmel”), a programmer from Hanover. He was not acting out of curiosity: Hess and a small ring of associates were selling the stolen military data to the Soviet KGB for cash and drugs. Figures around $54,000 are cited for Hess’s take; the court in Celle put the KGB’s total payments to the three sellers at DM 90,000. The Soviet side seems to have cared less about nuclear or SDI material than about Digital Equipment software, which it probably passed to East Germany. The material he exfiltrated was, in intelligence terms, mostly low-grade (unclassified or modestly sensitive documents reachable from networked systems) but the principle was unprecedented: a foreign intelligence service was paying hackers to loot computers over a network from the other side of the world.

The ring around Hess was loosely tied to the explosive early hacker scene in West Germany and the orbit of the Chaos Computer Club. It began in 1986 at the “Leitstelle 511,” a regulars’ table of young computer enthusiasts in a Hanover pub, some of whom already dialled into foreign networks with acoustic couplers. In the summer of 1986 the idea arose of selling what they found; the croupier Peter Carl (“Pedro”), in his early thirties the oldest of them, offered it to a KGB officer known as “Sergei” at the Soviet trade mission in East Berlin. Its members also included Dirk Brzezinski (“DOB”), the Berlin teenager Hans Heinrich Hübner (“Pengo”), and the central tragic figure, Karl Koch.

Karl Koch / “Hagbard Celine”

Karl Koch was born July 22, 1965, in Hanover. As a teenager he took his handle, “Hagbard Celine,” from a character in the cult Illuminatus! trilogy (a gift from his father) and absorbed its paranoid mythology of secret societies battling for control of the world through the number 23 and the forces of “Eris,” chaos. He bought his first computer in 1982 and named it “FUCKUP.” Brilliant and politically restless, he was also, by the mid-1980s, deep into hard drugs and a worsening confusion between the conspiracy fiction he loved and the genuine espionage he had drifted into. To Koch, hacking Western military computers and selling to the KGB could feel like a move in the cosmic Illuminatus! game rather than a crime with consequences.

The ring unraveled slowly. Stoll’s trace identified Hess’s telephone in January 1987, but when police searched his Hanover flat on June 23, 1987 he was out and nothing could be proved, and the case was dropped. In the summer of 1988, after a magazine story and an article by Stoll, Koch and Hübner separately came forward to the Office for the Protection of the Constitution and confessed under a West German espionage amnesty provision, which spared them prosecution in exchange for cooperation; only their statements revealed the KGB connection. On March 2, 1989 police arrested Hess, Brzezinski and Carl, and that evening the Tagesschau called it the most serious espionage case since the Guillaume affair.

Two Endings

The two endings of the story could not be more different.

Markus Hess was tried with Carl and Brzezinski in Celle from late January 1990, on charges of espionage rather than hacking, with Stoll among the witnesses. On February 15, 1990 the court sentenced Carl to two years, Hess to 20 months and Brzezinski to 14 months, all suspended, and ordered them to pay DM 10,000, 5,000 and 3,000; it found no demonstrable damage to West Germany. The light punishment reflected both the novelty of the crime and the modest classification of what had actually been stolen.

Karl Koch did not live to see it. On May 23, 1989, he drove a company car out of Hanover and disappeared (the HNF dates his death to May 23 or 24 and places the car between Hanover and Gifhorn). His body was found on June 1, 1989, in a forest near Celle: he had apparently doused himself with gasoline and burned to death, the ground around him scorched. The death was officially ruled suicide, but no note was found, and the timing, a key witness in a Cold War espionage case dying violently just as investigations and the public attention around the KGB hack peaked, has fueled decades of speculation that it was murder. The truth has never been established. Koch was 23, the number that had haunted his Illuminatus!-soaked imagination.

Myth: The KGB hackers stole vital nuclear secrets and gravely damaged US security

The espionage was real and the precedent historic, but the substance of what was stolen is routinely exaggerated. By most assessments, including Stoll’s, the material Hess exfiltrated was largely unclassified or low-sensitivity documents accessible from networked machines; he never cracked genuinely secret weapons data. The case mattered enormously as the first proof that network intrusion could be an instrument of state espionage, not because it handed Moscow anything decisive. See Myths and Misconceptions.

Legacy

The KGB Hack is a hinge in the history of computer security on several axes at once. Technically and operationally, Stoll’s investigation invented much of the playbook of modern incident response, keystroke logging an active intruder, building a honeypot to bait and trace an attacker, and patiently correlating evidence across organizations, and The Cuckoo’s Egg taught it to a wide public in narrative form. Strategically, it was the first documented case of state-sponsored cyber-espionage, the distant ancestor of every later nation-state intrusion campaign, from Moonlight Maze to the APT era. Culturally, through Koch’s death and the 1998 German film 23 dramatizing it, the case became a foundational legend of the European hacker scene and of the Chaos Computer Club’s self-understanding.

Koch and Hess are documented here on the principle of impact, not endorsement: they were paid agents of a hostile intelligence service who treated other people’s systems as merchandise, and the romance that has accreted around Koch’s tragic death should not obscure that. But the history of computing genuinely turns on this episode; it is where the network first became a battlefield between states, and where, thanks to one stubborn astronomer chasing 75 cents, the defenders first learned how to fight back.

📚 Sources