Cybersec Canon Ep 10. The Cuckoo’s Egg - Chapters 42-47. The Trace is Completed, but no Arrest Yet
They get to know the hacker's phone number, but are not able to make an arrest because of a lack of evidence of classified information being stolen. Cliff argues that just snooping around is a crime.
“A computer system isn’t private like a house,” Laurie responded. “Lots of people use it for many purposes. Just because this guy doesn’t have official permission to use it doesn’t necessarily mean he has no legitimate purpose in being there.” “It’s damned well exactly like a house. You don’t want someone poking around in your diary, and you sure as hell don’t want them messing with your data. Breaking into these systems is trespassing without permission. It’s wrong no matter what your purpose is.”
Stoll, Clifford. CUCKOO’S EGG (Chapter 46). Kindle Edition.
Notes
Chapter 42
Cliff tells Martha that he needs to sleep in the office again, and he might be able to catch the hacker this time. She says he already told her this so many times in the past. This time, the hacker logs in and, instead of going through SDINET files, he goes to many other places. Finally breaks into Fort Buckner Army Communications Center. Cliff finds it strange that the time was showing Sunday, though it was only Saturday. He realizes that Fort Bucker is in Japan. Meanwhile, the German Bundespost completes the manual trace and finally finds the exact phone number and location. Cliff, Martha and Claudia celebrate.
Chapter 43
The hacker returns the next day (Sunday) and goes through a bunch of computers across the network, including some Air Force computers in Germany. He breaches the Navy Coastal Systems Center in Florida using a default backdoor password for the Ingres database. Cliff wonders why the hacker copies the password file with all the encrypted passwords. He has done it many times in the past. Cliff talks to Mike Gibbons from the FBI, who tells him that once the US legal attache gives the papers, the German authorities will be able to arrest the hacker.
Chapter 44
Another week goes by, and an arrest has not been made. German authorities are ready to capture the hacker. But they haven’t yet received FBI paperwork from the US legal attache. The hacker breaks into the BBN (Bolt, Beranak and Neumann) computer in Cambridge, MA. They were the ones who built Milnet. So breaking into this computer gave the hacker more range to explore many more computers on the network.
Chapter 45
Cliff is called to a meeting with all the agencies that he’s been working with - FBI, NSA, CIA and DOE. He meets Mike Gibbons from the FBI, Jim Christy from the CIA and Zeke Hanson from the NSA and is happy to put faces to the voices. The discussion goes poorly. The FBI’s stance is that they cannot extradite the hacker since there is not much evidence. 75 cents loss and accessing unclassified information is not a serious crime. Cliff gets to meet Bob Morris, chief scientist at CSC. Bob takes him to Harry Daniels, who is the Assistant Director of the NSA. Daniels is impressed by Cliff’s work. He says this is the first documented case of a network security breach of this magnitude.
Chapter 46
Cliff returns to Berkeley. Martha’s best friend, Laurie, visits. Laurie has some strong opinions about the military and thinks the hacker might be a peace activist. Cliff gets upset by this and tries to explain that the issue is about invasion of privacy and espionage. Later, Cliff gets to know that the FBI has officially closed the case. Cliff finds out that the hacker has broken into Petvax computer, which is used for medical work. Steve White from Tymnet is in town, and he plans to come for dinner. Cliff gets drenched in rain and tries to microwave his shoes to dry, and the rubber melts.
Chapter 47
Cliff gets to know that the hacker uses ‘dictionary attack’ to find out the passwords when the hacker uses an account of a scientist who was giving a lecture in the same building. The password happens to be ‘Messaiah’, a word in the dictionary. This is the reason the hacker was copying over encrypted passwords. He contacts Bob Morris, who says that the NSA has known about the issue for some time. But their main focus is to build an algorithm that can’t be decrypted.
Thoughts
The early vision of the Internet was for it to be a digital world that was vast, free, a shared library or a public park. But that faded away very easily when people discovered that important things could be done online, similar to the physical world. Once money gets involved, values go out of the window, and then laws and regulations are needed to bring back some values. But still, the original free world remains permanently out of reach.
I guess this pattern is similar to how human societies have changed over time. When people didn’t have anything valuable in their homes, they left their doors open or probably didn’t have doors (similar to not having passwords to accounts in the past). But as societies started becoming affluent or when disparity grew, people started having valuables at home that had to be locked up. But they also had laws and police to keep them safe.
Same with the Internet. People have their entire lives on their machines and cloud accounts. Data about people - their family, friends, spending habits, search history, health records, etc. are goldmines for companies wanting to profit. So there has to be some reasonable expectation of feeling safe to interact online. Our digital spaces are extensions of our homes, not public streets. There must be a distinction between what we share publicly and what is not. Just as we use laws and regulations to protect our homes as society becomes more complex, we need digital rules to protect privacy online. When someone breaks into our home, the violation isn’t just about what they take; it’s about the fact that they were there. It is a breach of a boundary. So, digital trespassing is wrong no matter what the purpose is.
The good thing is that there have been many privacy laws in the past decade or so, and things are looking better for the average person, at least in developed countries.