I may edit this later as I really think that this is a bit of a word salad, but enjoy a text version of a presentation I gave at BSides Vancouver 2026 on June 1, 2026.

I’ll start off with this: my current career choice is all thanks to this man, Clifford Stoll.

In 1986, he found himself at the centre of an espionage story when a US$0.75 discrepancy in used computer time unravelled a hacking ring involving Soviet and East German spies. A computer at the Lawrence Berkeley National Laboratory where he was then employed was being used to break into the computers of labs elsewhere in the United States.

A mere rounding error by today’s standards when you consider how much an AWS EC2 instance costs per hour, but it all calumniated in a nearly-year-long escapade involving the American military and intelligence agencies.

I was given a copy of his book, The Cuckoo’s Egg as a parting gift when I moved back to British Columbia. At some point earlier in the year, I made mention that I wanted to read the book and a friend of mine saw to it that I didn’t leave without a copy.

Little did she know that this would have a huge impact on my life, but also introduce a burning question that would remain unresolved until I started to look into it late last year.

Before I continue any further: read this book. If you are at all interested in digital forensics, this is what got my mind interested in the whole field and became my job for a number of years.

Anyway,the burning question stemmed from this passage midway through the story:

“The real problem is in German law,” Steve [of the US Navy Research Lab] said. “I don’t think they recognize hacking as a crime.”

“You’re kidding, of course.”

“No,” he said, “a lot of countries have outdated laws. In Canada, a hacker that broke into a computer was convicted of stealing electricity, rather than trespassing. He was prosecuted only because the connection had used a microwatt of power from the computer.”

Our first computer crime story was electricity theft?

To be honest, for years, this is how I believed things were. It made perfect sense since a computer is really just pushing data around using electricity. Numbers go up and down using electricity. Statements that are true or false are made using electricity. Electricity theft even at a microwatt is still theft of some kind.

Now that it is almost two decades since I finished reading Clifford’s book, I am a lot more wise to the law. Last year in a conversation, I almost found myself parroting the statement from the book, but something made me hesitate.

Was it really “electricity theft”? What was this court case? Why did Cliff write it that way?

Finding the case

It took me a few months of it sitting in my head to finally go ask about it on social media. Within an hour, someone had gotten back to me: it was 1980’s Supreme Court of Canada’s decision on R. v. McLaughlin.

Now you can read into that decision and get an answer immediately to what Cliff was on about, skipping this potentially long ramble of mine. However, this brought up an even more important question: how did it land in the Supreme Court? There was also a second question stemming from reading the decision: was Cliff correct at all?

For Americans unfamiliar with the rest of the world

For those who are not in Canada, the United Kingdom, or other places in the Commonwealth, the R in R. v. McLaughlin stood for then regina or “queen”, but would be today, rex as in “king”.

It’s used in legal contexts to imply it is in service of the Crown and if you flip a Canadian or British coin, you’ll see D G Regina if it shows Queen Elizabeth II or Queen Victoria or D G Rex if it shows King Charles III or King George XVI for example. The D G part stands for Dei Gratia or “Grace of God”.

Back on topic: the court decision outlines a lot, but what it does not elaborate much on is what did this man do to get this far in the court system? I simply had to know.

The University of Alberta

Universities across the world rapidly saw the adoption of computers post-Second World War. The first computer built in Canada was at the University of Toronto, dubbed the UTEC. Other universities would follow suit and each new computer would be a big deal.

The University of Alberta, located in the province’s capital city, Edmonton was established in 1906 when the first provincial premier, Alexander Cameron Rutherford promised that with the capital being where it lies today and to appease the residents of Calgary, it would be south of the North Saskatchewan River.

So it was decided that it would be established in Strathcona, Alberta, which was south of the river, but was completely visible from the grounds of the legislature. Six years later, Strathcona would be absorbed into the City of Edmonton

Much of the school’s academia and research were focused on agriculture, medicine, law, and for a time, had a role in the province’s Eugenics Board.

In 1957, the university received its first computer: an LGP-30. Three years later in 1960, computer programming courses were offered by an employee, Bill Adams who would have overseen the introduction of that machine. Four years after, the university removed computing from its mathematics faculty and established an independent Department of Computing Science.

Time sharing and its strife

During all of this time, computers were rapidly evolving but were still expensive. Such machines were reported to be as much as C$240,000 (or C$2,000,000 today) and would only be replaced on a multi-year basis. The university did not have the funds to own a computer outright and were regularly renting machines from IBM with them acquiring an IBM System 360 in 1967.

While computer science students may be studying with the aide of these computers, other departments also wanted to be able to use them. A computer can do mathematics so much faster than a human ever could (sorry, Frank Herbert) and so time on the machine was allocated based on need.

Through time sharing, users could be given a time bank per day. Studying computer science? You’d get four hours per day for access. Studying soil movement via geotechnics? Four hours per week. Majoring in English? Probably not.

These restrictions ultimately led to a lot of strife amongst students and faculty and would become the origin of many early computer hacking stories.

If you look up Allan Scherr on Wikipedia, you will read that he is a Grace Murray Hopper Award winner in 1975. This prize is named in honour of Grace Hopper, a woman you should read about separate from this entry as her story is so, so much more than what I can write in a paragraph.

His contributions to computing science has its origins in modern artificial intelligence research and furthered IBM’s work in the computer industry. His recognition is warranted and deserved.

What is missing from his Wikipedia entry is that he likely is the first person to have committed what we would today refer as computer crime.

In the IEEE’s Computer Society’s Fiftieth Anniversary Commemorative Overview, Allan shares a story about him stealing passwords while as a student at MIT.

This worked well until the spring of 1962. What happened was that someone on the CTSS staff (I think Bob Daley) came to me and said that the space my measurement programs used was needed and, since I was done measuring, they were going to remove my programs from the operating system. At the same time, my privileges to modify the operating system were revoked.

[…]

I finally found a way to do it. All of the passwords for the system were stored in a file called UACCNT.SECRET under user M1416. There was a way to request files to be printed offline by submitting a punched card with the account number and file name. Late one Friday night, I submitted a request to print the password files and very early Saturday morning went to the file cabinet where printouts were placed and took the listing out of the M1416 folder. I could then continue my larceny of machine time.

Time theft on computers was often done out of necessity, but it would later become part of what we’re about to get into here with this legal case.

A new computer

I am aware that this is not a 470. Enjoy a nice ad copy though!

In 1975, the university purchased an Amdahl 470 V/6 computer, the first Amdahl computer in Canada with a serial of P5 implying it was the fifth computer ever built.

If you remember earlier, they had previously been using an IBM System/360. The Amdahl 470 itself was built to be plug and code compatible with the System 360 series. This interoperability meant a person who learnt on IBM could learn on Amdahl.

This machine cost the university C$9 million (C$50 million today) and could support 5,000 users. To help support the expense of the machine, the school split the machine up so 3,500 students and faculty could have access to it, divvied up like I had mentioned before, but the other 1,500 could be shared with local businesses and governments.

Access to the machine was initially set at C$1,440 per hour (C$7,400 today) only because of them sticking to a calculation with the old System 360.

Until the end of this fiscal year, computer time rates will be calculated by multiplying the rates on the old IBM 360/67 by eight since the Amdahl does eight times the work in the same amount of time. This means that the computer time will cost about $1440 per hour.

A student with four hours per day for a whole month would have to cost something approaching C$172,000 if my math is to be believed.

The largest Amazon EC2 instance I have used at work worked out to C$3,500 a month just to put this all into perspective.

With budgets being budgets at any university, time was allocated like before. The Amdahl machine was known for having been used in playing chess in its first year–a popular computer science activity then and even now, but it was about to become the centre of Canada’s first significant computer crime cases.

The only account is hard to follow

I’m relying on Fighting Computer Crime by Donn B. Parker (ISBN 0-684-17796-X) to compile this timeline as there really is no other reliable background story that isn’t full of contradictions.

To add to this, the author replaces the names with pseudonyms, but thanks to him including details about the Supreme Court hearing, we can work it all back.

Name in book	Name in real life
“Lingen”	Arnold Astels
“Osbourne”	Michael McLaughlin
“Devon”	Bruce Christensen

Additionally, he refers to Bruce Christensen as a high school student, but according to the January 9th, 1979 University of Alberta Folio newsletter, he was a former student of of the university.

In the same newsletter, it is revealed that the third person involved is Arnold Astels, a third-year electrical engineering student. However, Parker refers to him as a part-time employee of the university who is still in high school.

However, Michael McLaughlin is also claimed to be a university student in the book, but then like before, the newsletter contradicts this by stating he’s a high school student instead.

Super frustrating for me to figure out here.

In a December 5th, 1978 article in the Edmonton Journal, it refers to them as such:

A computer theft trial — believed to be the first of its kind in Canada — saw three University of Alberta students charged with mischief and theft of computer time on U of A facilities.

I believe that Folio has it wrong on McLaughlin, Parker made changes to the story, and the Edmonton Journal is probably correct.

So for the sake of my sanity and yours, they’re all students of the university. I don’t think that any of them were in high school at the time of the incident considering their ages were 18 to 22.

Everything I am sharing here should be taken with a grain of salt and may only reflect so much in what really occurred.

What I think happened

Let’s go through this mess.

The whiz kids get caught

In Parker’s book, he claims that a professor gave his students in his computer science class an assignment to beat the computer. One of the students in his class submitted an application called Green, which modified the computer and terminal charges.

The Folio newsletter I cited earlier makes reference to this program being developed in the springtime of 1976.

However, sometime around January 1977 or perhaps December 1976, a printout of the application somehow landed in a wastebasket in a terminal room. A part-time employee in the Geology department, Arnold Astels discovered it and realised what it was.

In a Edmonton Journal article after the incident, “MJB Green” code was developed by a graduate student who is now on the university’s payroll.

The student kept the code in his files and a “staff member” asked for copies which were apparently distributed. The unidentified student was never charged and his work was done under the guidance of a professor in a computer sciences course.

I’m going to say that the book is probably incorrect and instead believe that it was just a case of the application being handed over willingly.

Astels, who I believe was the eldest of the three involved, was at the time an electrical engineering student who had been interested in computers since the age of twelve.

I will also add that Astels had the ability to issue key cards, granting access to the Geology building and perhaps elsewhere, but it will be mentioned later that it could have been another person involved.

He was friends with Michael McLaughlin, an 18-year old electrical engineering student. McLaughlin was the first to use Green to circumvent the controls placed on him.

Astels’ shenanigans however did predate the use of Green. He admitted to have been using a Snooper program to access other people’s files.

In then comes in our third person, Bruce Christensen, an 18-year old unemployed former science student, described as a “impulsive mad scientist” type by Parker. He was friends with the other two and was excited at the prospect of getting all sorts of information.

He was described by one of the two as “having a disease” when it came to this discovery. Followed by noting that his programming skills were “haphazard” while theirs were “refined”.

I am uncertain to what language they would have been writing code in, but if a 1976 paper on computer chess is to be believed, then it was possibly a Amdahl variant of Algol. This would line up with Barry J. Mailloux being employed at the university at the time, known for being an authority on the programming language. This is my best guess here as I do not have any technical details on the code being mentioned in the story.

Not long after their mischief began, the director at the computer centre discovered what had been occurring. Discrepancies in the logs led the director to discover the use of Green thousands of times to alter the logs.

All three admitted to their behaviour and summarily their accounts were terminated.

McLaughlin did protest the decision, which led to its reversal on the grounds he needed access for his studies. For the other two, no such reversal was made, but thanks to what I suspect was a combination of the Snooper program and poor hygiene on the part of other students and faculty, they had access to other accounts.

Mischief once again

As time progressed, problems reared their ugly heads again, and by July of that year, the computer centre began to run into problems with its users. Crashes were becoming more frequent going from a weekly occurrence to near daily.

Sometime that same month, the trio plotted to regain a foothold on the computer. However, for some reason, Astels bounced out well before it progressed, a decision which would benefit him later.

The crashes were so bad that at their peak, they had to restart the mainframe three times over the course of two days towards the end of that month. Use of the computer was increasing both legitimately and not.

To determine the fault of the crashes, the centre developed an application called Tracer, which while would consume a tenth of the computing power to keep track of everything, it would give them an edge that they were lacking prior. One of its tasks was to identify the user IDs in use when a crash occurred.

This application would be the trio’s undoing.

Takedown

On August 20th, 1977, the application discovered that the accounts belonging to Syncrude Canada Ltd, a newly-formed company to extract oil in the Athabasca basin, had their usage records destroyed and contents replaced with obscenities.

As an aside: when reading one of the newsletters from the university, passwords had a limit of twelve characters. It would have been nice to have more technical information about what I am about to write about here.

Someone then at the centre noticed a file from a user had been destroyed as well, leading them to restore it from a backup only to have it destroyed once again. After repeat attempts, it was then discovered that their own Tracer program was itself being monitored.

The book describes the occurrence here as a game where they went back and forth trying to take control over the computer. My mind can only wander off to that scene in Hackers, where the protagonists were fighting against the evil security director.

But during this time, the word “Tilt”, which I assume was lifted from pinball, kept filling their display. By 4:30 PM, the computer crashed once more, and despite it taking nearly forty minutes to restore the whole system, they managed to salvage a paper printout of everything key to what had been going on.

This user revealed existence of two programs: Q3H3 and SPACE.

SPACE itself was used to scramble or rather obfuscate programs. Q3H3, however, while scrambled itself, would use the aforementioned Snooper application to then monitor any terminal they wanted.

Computer centre managers were brought in to stay late to observe because it sounds like they expected this to continue. They were correct as after staring at a console for nearly an hour, a user ID of DCGA signed in and made use of the SPACE program.

They quickly identified which terminal it belonged to: a hard-wired DEC Writer III located in the Geology department.

Something I must point out right now: this is a Saturday night. Just let that one sink as I am sure everybody involved is pissed off.

Three managers and three university peace officers entered room 273 (or maybe 2-37, as room numbers today do not reach as high as stated in Parker’s book) of the Geology building, a room that was locked with a pass key, and once in, they caught Christensen red-handed.

He had a piece of paper on him with both Q3H3 and DCGA written down, plus a listing of a program that could access the centre’s registration clerk’s ID and password. He also had the Green program readily available too.

Dead to rights in their eyes, he was escorted to a nearby campus police station and subsequently the Edmonton Police Service was called in. He then spilt the beans and admitted to everything he had been doing.

The police then went looking for Astels at his home, but did not find him there. However, they did discover him staying at Christensen’s home and there they found numerous printouts.

Closing in on McLaughlin, he denied everything at first, but then admitted to his involvement in the whole affair. When the police searched his home, they found printouts as well as data tapes.

The crashes did stop and the Alberta Crown opted to have all three were charged under section 287 of the Canadian Criminal Code.

Now it’s a legal mess.

The cost to the university

This is an aside, but I noticed in the newsletter I got some clarification from, there was this tidbit:

[Bruce Christensen had] very large number of computer runs [performed]. Much of the evidence was destroyed, but analysis showed many runs with total charges exceeding $200; the total amount of computed work was probably worth many times that figure.

If you remember earlier, they had a C$1,440/hour (C$7,400 2025) quote for computer time, meaning that their modifications to the ledger made it seem like they only had to be billed just over a tenth of what they actually had done.

I don’t know what else to make of this, but I did want to bring it up instead of leaving it lying on the table.

The struggle with the Criminal Code

If you were to look up section 287 today, you’d end up with something that absolutely does not make sense. I will explain why in a moment, but as it stood in 1977, this is what it then stated:

”s. 273 Every one commits theft who fraudulently or maliciously

(b) uses a telephone or telegraph line or obtains telephone or telegraph service. S.C. 1953-54, C. 51.”

To expand on the charges further, they were charged under s. 273 (b), which how it became theft of telecommunications services. I am intentionally removing (a) because that will become important later.

They were also all charged with mischief.

On December 4th, 1978, a court ruled on the following:

• Astels despite his involvement was acquitted on both charges
• Christensen was convicted on both charges
• McLaughlin was acquitted on mischief, but convicted on telecommunications theft

It is my understanding that in this hearing, McLaughlin and Astels shared the same lawyer, Dan Haag, who argued that a computer was not a telecommunications facility under the Criminal Code so the students had not used any telecommunications facility. The judge, Justice John Hope of the Albertan Court of Queen’s Bench disagreed and gave his ruling.

In the December 8th, 1978 edition of the Edmonton Journal, the following was stated by Bruce’s lawyer:

Lawyer Nick Feehan, representing Bruce Kevin Christensen, 19, said he agrees his client committed mischief.

But he compared Christensen to Galieo Galilei (the man who was condemned for saving the earth revoled around the sun) and predicted “some day he could easily be one of the top scientists in Canada “

The convictions on Christensen and dismissal of Astels would remain, but this was not going to be the case for McLaughlin.

Appeal to the King’s Court

Up until this point, I’ve had to rely on third-party accounts, newsletters with questionable information, and newspaper articles that contradict everything. This appeal, however, filed by Dan Haag for Michael McLaughlin is fortunately available without much effort.

It’s here we learn about the struggle the Crown and the courts face when discussing computer crime. Here’s the surface-level comment out of the way:

Through these phone facilities the computer can be accessed by single telephone means. He described the terminals as being a ‘Deck Writer’ types, and expanded by comparing them to typewriters. These Deck Writers record the dialogue between the operator and the computer on the computer sheets, which we have heard designated as ‘hard copy’. He described C.R.T., cathode ray tube terminal, as printing on a screen on the terminal itself. He described a ‘buffer’ as being part of the facility and used as the computer memory in one sense.

“Deck Writer” should be “DEC Writer”, but as an aside, you have to explain every single item to the court. What leads up to this part of the statement from the University’s Director of Computer Services, Dr. Dale Bent is more interesting:

Dr. Bent referred to the ‘central processing unit’ as one part, and that there was some two dozen major units connected by electrical cable and that the computer was also connected to telecommunication facilities, and that there was at the time in question over 300 terminals for the unit, that some of the terminals were in the General Service Building wired directly to this Amdahl computer, and there were electromagnetic connections. He said that outside there was connection by telephone, that is, telephone cable and coaxial cables, there was a dial up connection by phone through the facilities of Edmonton Telephones, Alberta Government Telephones, and the Trans Canada Telephones System.

For those unfamiliar, Edmonton Telephones and Alberta Government Telephones are now TELUS and Trans Canada Telephones System is what became the backbone of Rogers’ national mobile phone network. In this statement, the argument is being made that since the terminals connect to the computer no differently than the modems used from off-campus, it constituted a telecommunications facility.

On November 11th, 1979, the court ruled on the appeal, allowing it and setting aside the conviction.

From: Mr. Justice McClung

It seems to me that the appellant’s argument ignores the very purpose for which the computer proper and its access lines - the facility - were constructed. It was designed as a general purpose time sharing service for the various academic programs at the University and to permit access to the computer from inside as well as outside the University. This could only be done by telecommunication and the appellant, obviously, was aware of it. His asportation of the data provided by the central processing system was made possible by the very telecommunication that he now denounces as ancillary to it. The evidence persuades me that the facility intercepted by the accused was a computer designed to electronically receive and furnish information with speed and convenience to a wide but selective audience of recipients. The electronic transmission of the information was not incidental to its function - it was integral of it.

And from Mr. Justice Morrow:

Turning back to the offence charged I am unable to read “telecommunication facility” along with the statutory definition of “telecommunication” as having application to the unit or device with all its various components under consideration in the present case. The whole accent here is on computing or calculation with the relay or communication aspect as only incidental. It seems to me it would be an improper extrusion of the language to hold that such a device constituted a telecommunication facility.

Reaction from the Crown prosecutors was swift: they wanted further clarity. Within that same month, they submitted an appeal to the Supreme Court of Canada.

The final say

This is where we end up with the landmark case, R. v. McLaughlin and where I suspect led to some thinking that this was a case about electricity theft. A decision by the court was reached on July 18th, 1980.

I’m going to skip right to the outcome: McLaughlin won on the Crown’s appeal, so let’s reveal 287 as a whole:

287.(1) Every one commits theft who fraudulently, maliciously, or without colour of right, (a) abstracts, consumes or uses electricity or gas or causes it to be wasted or diverted; or (b) uses any telecommunication facility or obtains any telecommunication service.

Section 287(a) and not (b) mentions electricity theft (or gas), but that is not what McLaughlin was charged with. However, Chief Justice Laskin brings this topic up:

Section 287 has a history which began in simpler times when electricity alone was the protected resource, as expressed in the Electric Lighting Act, 1882 (Imp.), c. 56, s. 23, making it an offence maliciously or fraudulently to, inter alia, abstract or use any electricity. This provision was adopted in Canada by The Electric Light Inspection Act, 1894 (Can.), c. 39, s. 10, and was carried into s. 351 of the Criminal Code, R.S.C. 1906, c. 146.

And I think it is this statement in the judgement that got some folks, including Stoll or the person he was speaking with in the book.

Which is where we were left with: the ask was to Parliament to solve this as the courts cannot.

Other cases

In that newsletter from much earlier, there’s also this quote:

There have been convictions under this section in similar circumstances as a result of guilty pleas. Instances have occurred at Simon Fraser University, University of Toronto, and University of Waterloo.

Here’s the thing: searching for “287” and any of these universities or just the word “computer” nets nothing in CanLii. If someone knows what this is all about, please let me know! It’s entirely possible that these cases may have not been digitised or I am using the wrong section.

Honestly, after reading through law just on this whole matter for this whole piece, I think my brain is not going to get any of this straight.

Media Reaction

Being that this was 1980, news about the story did not make its way to the general public until the morning after. For a case of its importance, it found itself reported many pages deep mixed in with ads from supermarkets and department stores.

Per the Victoria Times Columnist via the Canadian Press, they referred to McLaughlin as a “whiz kid” and summed up the case as follows:

Taken too literally, the law could be applied to using a “simple Xerox machine” to send images from one point to another.

Although today I would consider a photocopier a communication device, the average Xerox machine then likely made mere duplications of paper for the vast majority of offices. Fax machines were likely a separate device.

The July 19th, 1980 edition of The Globe and Mail spelt this out:

There is no doubt the campus computer was used without authority, Judge Estey said, but the law simply didn’t embrace the computer.

Closing

I have two loose ends here, so let’s cover them.

Asking Cliff Stoll himself

The magic of the Internet is you can contact people directly. Cliff maintains a website that sells Klein Bottles, which are really cool and you can just check the place out for yourself.

Hi Cliff!

I love your Klein Bottles and had a chance to see one owned by a friend who lives in the Bay Area. However, admittedly, I am emailing you about your book, The Cuckoo’s Egg. There’s a passage in the book that has bothered me for twenty years and I am going to bring it up in a conference talk (should it be accepted).

If you do not mind, it’s this:

“The real problem is in German law,” Steve [of the US Navy Research Lab] said. “I don’t think they recognize hacking as a crime.”

“You’re kidding, of course.”

“No,” he said, “a lot of countries have outdated laws. In Canada, a hacker that broke into a computer was convicted of stealing electricity, rather than trespassing. He was prosecuted only because the connection had used a microwatt of power from the computer.”

Assuming that this is a real conversation, what did Steve mean here? I went looking for this particular case and could not find it in our country’s legal history. I did however find a Supreme Court of Canada case (R. v. McLaughlin) which did cite the origins of the law that would have been applied to early computer crime cases with it originating in electricity and heating fuel theft.

Was this what he meant?

In any event, no worries if you do not know. I want to say that this book is wonderful and I recommend reading it because it’s genuinely a fun and entertaining story. It had an influence on my career choices in life even though I do wish I went down the astronomer route I had originally planned.

Thanks in advance! Cariad

I had emailed him in the morning and by mid-afternoon that same day, he replied:

Hi Cariad,

Thanks for your kind note - I appreciate your interest in both my Klein bottles and m’old book.

Needless to say, after 40 years, I don’t remember that conversation. However, it was in the early days, just a few years after they discovered mud, and not quite invented the wheel. There were lots of rumors about legalities, and I ididn’t chase any of the cases down.

I do remember postings to the old Usenet, talking about whether “theft of service” and “theft of electricity” applied to theft of computer time. But I didn’t do my homework and chase them down to see if the rumors were founded in caselaw. (remember – no google then. I had to bike over to the law library to look this stuff up.

Not sure if this helps, but it’s about all I know!

Warm wishes, -Cliff (still living in the same ol’ place in north Oakland, California – a 15 minute bike ride south of the Berkeley campus.)

I am so happy he got me quickly. It’s understandable with it being over four decades since everything happening that he’d have forgotten, so his response was understandable. Nonetheless, it was super appreciated that he’d take a response.

The status of the three men

I did not reach out to any of these men, but at least for Arnold and Bruce, they have remained out of the public spotlight.

However, Michael may have unfortunately since passed away. I found an individual matching everything I know about him having died of cancer in late 2020.

They have all led fairly private lives since.