The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage is an English-language nonfiction book by Clifford Stoll, published by Doubleday in 1989. The 326-page print volume was issued in the United States. Its ISBN is 0-385-24946-2 and its OCLC number is 43977527. Stoll, an astronomer by training, presents the case as a first-person investigation.

In 1986, Stoll managed computers at Lawrence Berkeley National Laboratory in California. A supervisor assigned him a 75-cent accounting discrepancy. The charge represented nine seconds of computer use by an unauthorized account. Stoll connected the intrusion to a flaw in movemail, a function in the original GNU Emacs, which had allowed the attacker to gain superuser access.

During one long weekend, Stoll connected about fifty terminals and teleprinters to the laboratory's fifty incoming telephone lines. Much of the equipment came from coworkers who were away. When the intruder called, Stoll identified the line and traced it through the Tymnet routing service to a call center at MITRE in McLean, Virginia. Paul Murray and Lloyd Bellknap helped him work with the telephone lines.

Stoll later returned most of the equipment but kept one teleprinter on the line. It recorded the attacker's activity. The connection ran at 1200 baud through a telephone modem. The intruder sought access to military installations and searched for references to nuclear weapons or SDI, the Strategic Defense Initiative. He copied password files for dictionary attacks and planted Trojan horses to collect credentials. Default passwords remained in use at several protected sites. At times, a military system accepted the account guest without a password.

The investigation became one of the earliest well-documented computer break-ins. Stoll kept a daily log and contacted the FBI, CIA, NSA and the United States Air Force Office of Special Investigations. Agencies initially disagreed about jurisdiction and were reluctant to exchange information. The FBI showed little interest because no large sum of money or classified host was involved.

The log showed that the intruder knew VAX/VMS and AT&T Unix. His activity usually appeared around midday Pacific time. Stoll reasoned that an attacker with a day job or classes would probably use cheaper nighttime calls, so he looked farther east. With assistance from Tymnet and government investigators, he traced the route through a satellite connection to West Germany. Deutsche Bundespost, which controlled the country's telephone system, linked the calls to a university in Bremen and then to a home in Hanover.

To draw the attacker out, Stoll created a fake LBNL department backed by an invented SDI contract. He populated an account called SDInet with large files of bureaucratic technical language. The account appeared to belong to a fictional secretary named Barbara Sherwin. The attacker focused on the bait, which helped investigators locate him.

The intruder was Markus Hess. According to the account, he had spent years selling the results of his break-ins to the KGB, the Soviet Union's civilian intelligence service. A Hungarian agent later contacted the fictitious SDInet by mail, apparently to verify information that could only have come through Hess. Stoll travelled to West Germany to testify at Hess's trial. He also extended the cuckoo's egg metaphor from bird brood parasitism to malware.

The case later appeared in the WGBH NOVA episode The KGB, the Computer, and Me, broadcast on PBS stations on October 3, 1990. Yorkshire Television produced another documentary, Spycatcher. A sequence from chapter 48 became the math puzzle known as the Cuckoo's Egg, the Morris number sequence or the look-and-say sequence. In summer 2000, the name described a file-sharing attack on Napster and similar networks that replaced legitimate song files with white noise or sound effects. Cory Doctorow also referred to the case in his short story The Things that Make Me Weak and Strange Get Engineered Away.