Preface

Friday evening, shortly after six o’clock. Somewhere, in an ordinary organisation, an alert is raised: files are becoming unreadable one after the other, a ransom note appears on the screens, and there is nothing left to restore from the backups. The managing director has just been notified. The security team consists of four people; two have already left for the weekend. They’ll have to hold out until Monday, perhaps Tuesday, with no reinforcements.

The timing is no coincidence. Cybercriminals have long since learnt to choose their window of opportunity: Friday evenings, the eve of bank holidays – times when defence teams are reduced to a bare minimum and senior managers are on holiday or with their families. They strike when the organisation will need two or three days just to put together a fully-fledged crisis team. Two or three days during which they, for their part, will continue to ramp up the pressure.

You may well have experienced the consequences of one such Friday evening without realising it. A supermarket till that suddenly refuses all cards. A ticket office closed ‘for technical reasons’. A hospital procedure postponed, a train brought to a standstill, a petrol station running out of fuel. What’s at stake on evenings like these isn’t computers: it’s that part of your life which, without you ever giving it a thought, runs through other people’s machines.

This book was born out of those moments, and all those that preceded them. In analysing them, one conviction has become clear: the history of cybersecurity is far less a story of technology than a story of human beings. People who invent, who hijack, who make mistakes, who betray, who fix things. And who, often, remain much the same from one century to the next.

The curiosity that drove the teenagers at the Bell switchboard in 1878 to overload the telephone lines just to hear the network crack is exactly the same curiosity that drove a Cornell student in 1988 who simply wanted to count the number of machines connected to the internet. It is also the same curiosity that led a group of teenagers in London to take down Uber and Microsoft with just a telephone and a great deal of nerve. Nothing in this long chain of events is down to cold genius. It is all too human: the urge to see what lies behind the door, the pride of having succeeded, sometimes the desire to be somebody, and often the wish to make easy money.

Twenty-five moments when something shifted – sometimes with a bang, sometimes in a silence that almost no one noticed at the time. Together they tell the story of how, over forty years, we have gone from a network of researchers who trusted one another to a permanent battlefield where the war never stops, where it will never be officially declared, where it will never be won.

I have chosen narrative over overarching analysis. I wanted readers to be able to enter these chapters as one might enter a novel: by getting to know the characters, by following the passage of time, by understanding why, that evening, Yves Bigot was pacing up and down the corridors of TV5Monde, or why, that morning, a Maersk engineer watched the screen go blank and wondered if he was dreaming. The facts are documented and verified; the sources are cited. But the emotion, the exhaustion, the disbelief, the anger – all of this matters just as much as the indicators of compromise.

Because after all these years, I have come to be certain of one thing: our defences are improving, as are the attackers, and yet battles are almost never decided on purely technical grounds. A properly configured firewall does not stop a tired employee from clicking on a malicious link. The weak link is not a flaw; it is a feature. We are fallible because we are human, and we will always be fallible as long as we remain so.

As for states, they are not neutral guardians of cyberspace; they are among its foremost offensive actors. Stuxnet, EternalBlue, Yahoo, the Snowden revelations: there is, in this story, a fundamental hypocrisy that it would be dishonest to gloss over. How can we explain to a teenager that unauthorised access is a crime when the major powers have, under the guise of ‘intelligence’, built up arsenals whose very existence undermines the security of billions of users? We cannot demand integrity from citizens when the intelligence services themselves are the leading buyers on the black market for vulnerabilities.

This human weakness, which states are already exploiting, has now been automated by machines. At the end of 2025, Anthropic published details of an espionage campaign in which an artificial intelligence had, for the first time, independently carried out more than 90 per cent of an attack chain. Human operators were no longer experts; they were project managers. The weapon had taken the initiative. It will be understood that this shifts the perspective somewhat, and that the final chapter is not quite the last.

You don’t need to be an engineer to read this book. You don’t need to know what a buffer overflow or a VBS macro is to understand what Robert Morris set in motion one November evening, or why four operators at a Ukrainian power station watched, helplessly, as their mouse cursors moved of their own accord across the screen while half a region was plunged into darkness. Technical concepts are explained when necessary; they are left out when they aren’t. What matters isn’t the mechanics of the code, but what that code says about us.

This book is written for you, who use this infrastructure every day without giving it a second thought – to make payments, access healthcare, travel and communicate. It is also intended for those who defend it. Of both, it asks just one thing: there is no longer a boundary between the virtual world and the real world. There probably never was one.

Prologue

“An error that cannot be explained is not a mistake. It is a trace.”

2 November 1988 is not the beginning of this story. It is the day the world realised it had lost sight of it. Before that date, the network was not yet an infrastructure; it was an open territory where the virtual had no lasting hold on reality. People moved through it on trust. It took just a few hours that Wednesday to realise that trust, on its own, has never been enough to keep a machine running.

To understand what broke that day, we must go back further than computer networks. We must go back to the first copper networks, the very first ones, those that the Bell Telephone Company began rolling out in 1878, two years after Graham Bell’s patent. The young American monopoly was then facing a crisis that had nothing to do with its cables. The switching centres were manned by teenagers, and these teenagers discovered, before anyone else, that the tool they’d been entrusted with was also a toy. They eavesdropped on private conversations, made fun of subscribers, pulled plugs at random, and jammed lines for the sheer pleasure of seeing the system collapse. Unbeknown to anyone at the time, this was the first denial-of-service attack in history – not the work of software, but the result of a deliberate attempt to bring down a public resource.

Bell’s response was not technical; it was social. The company sacked the boys en masse and replaced them with young women, who were considered at the time to be more docile and more predictable. The first ‘patch’ in the history of cybersecurity did not touch a single cable: it consisted of changing the human behind the machine. The network was neither repaired nor improved. A ‘raw material’ deemed too unstable was simply replaced with another believed to be more malleable.

The actions of the Bell teenagers already illustrate what Heidegger would theorise under the term readiness-to-hand, and which Douglas Thomas would later apply to hacking, once it had become a field of study, in Hacker Culture: as long as a tool works well, it is invisible.

We do not see the telephone; we see the conversation. We do not see the computer; we see the work. The hacker is the one who shatters this transparency. By pushing the system to the point of malfunction, they force society to look at what it relies on. They do not destroy out of hatred for the tool; they put it through its paces to see how it copes under pressure. This impulse – the impulse to open up the machine to see what’s inside – would carry through the following century.

First, it changed medium. In the 1960s, it moved away from copper to venture into the world of radio frequencies. This was the era of ‘phreaking’, a practice that would demonstrate that an industrial empire could hang on a single musical note.

Before John Draper, there was a child. His name was Josef Engressia, later known as Joybubbles. Blind from birth, with perfect pitch, he used to amuse himself from the age of seven by whistling into his parents’ telephone receiver. One day, he happened to whistle a sound which, instead of triggering a response from the exchange, silenced it. The line remained open, the dial tone disappeared, and the charges stopped. The child had discovered, without seeking to, a frequency that spoke to the network in its own language: exactly 2,600 hertz. He spent the following years exploring this secret grammar with the methodical joy of a self-taught explorer who had found, within the labyrinths of the American copper network, a geography that was at last accessible. Attempts were made for a long time to silence him; in the end, he was hired as a consultant.

John Draper revisited Engressia’s discovery in the early 1970s, adding a detail that has since become legendary: he realised that a plastic whistle, given as a free gift in boxes of Cap’n Crunch cereal, also emitted a perfect 2,600 hertz when one of its two holes was plugged. A two-cent toy. A key to an empire. Draper, now nicknamed Captain Crunch, turned the whistle into a rite of passage for a whole generation of curious minds. Among them was a young Steve Wozniak, who was so fascinated by the discovery that it prompted him, along with his friend Steve Jobs, to miniaturise the process into an electronic box: the Blue Box. Jobs would later say that without those few months spent hacking the global telephone network from their garage, Apple would probably never have existed. Two teenagers had learnt, by hijacking frequencies, that one could become the equal of a multinational provided one spoke its language better than it did.

Phreaking was a solitary pursuit. What began in West Berlin in 1981 was something else entirely: a political movement. The Chaos Computer Club was founded that year around a simple – and, for the time, almost audacious – idea: a computer is not just a calculating machine; it is also a battlefield for civil liberties.

The club made its name in 1984, targeting Btx, the German Federal Post Office’s online system, which the government touted as the future of e-commerce. Two members of the CCC exploited a vulnerability to transfer 134,000 Deutschmarks from a Hamburg savings bank into their own account. They returned the money the following day and called a press conference. The message was not about the money. The message was that the infrastructure on which the state was building the future was held together with sticky tape. It was the first political hack in European history: a breach that sought neither to steal nor to cause harm, but to force a technology to become a subject of public debate.

Forty years on, the CCC still exists. Its members advise political parties, draft expert reports for the German Constitutional Court and sit on official committees. The organisation has evolved from a subversive collective into a moral authority on digital security in a democratic country. It is perhaps the only successful example, on a European scale, of such a transformation: the hacker as guardian, rather than as enemy.

In the United States, trust died differently. It died in Berkeley, in August 1986, in the office of an astronomer who had asked nothing of anyone.

Cliff Stoll was not a computer scientist. He was sorting out the laboratory’s accounts because the job had been passed on to him. When he noticed, on a statement, a discrepancy of seventy-five cents, his first reaction was that of a scientist by training: an error that cannot be explained is not an error. It is a clue. He followed the trail. At the other end of the line was a German hacker named Markus Hess, who was using American university networks as gateways to military bases, and who was selling his haul to the KGB. The network that everyone believed to be impenetrable had just quietly become an extension of the Cold War battlefield.

What Stoll did next has gone down in history. The usual response to an intruder was to cut the line; he did the opposite, and decided to observe. To keep the hacker online long enough to physically trace him through the telephone exchanges of half a dozen countries, he invented the first honeypot: an entire folder of fake documents on the Strategic Defense Initiative, just credible enough to pique the attacker’s curiosity. He recorded everything: every command, every hop, every hour of connection. Without realising it, he was writing the first methodology of digital forensics – the very one taught today in all cybersecurity schools. He had proved that a machine could act as an eyewitness, provided a human taught it how to remember. The full account can be found in The Cuckoo’s Egg, a remarkable book that should still be placed in the hands of anyone starting out in cybersecurity.

While Stoll was learning to read the traces, a young Californian was learning not to leave any. Kevin Mitnick was not the best coder of his generation. He was something far more dangerous: the best liar.

Mitnick had realised that computer security is an illusion, because it ultimately relies on a human link trained to be helpful, polite and respectful of authority. He didn’t hack software; he hacked people. A phone call while posing as a visiting technician, a confident voice, a few details gleaned from an internal directory, and the door would open. He called this ‘pretexting’: the fabrication of an alternative reality credible enough for the person on the other end to willingly give you what months of brute force would not have wrested from them. The desire to help, the fear of being caught out, the need for recognition. In his hands, these universal levers became logical vulnerabilities, just like a weak password. It was no longer a question of cracking a code. It was a question of manipulating someone.

All of this remained confidential. Hackers talked among themselves; the general public was unaware of them; governments did not yet know what to make of this discreet group. What changed the game was not a technical incident, but a film.

In 1983, WarGames was released, in which a teenager, simply on a whim, nearly triggered a nuclear war between the United States and the Soviet Union. President Ronald Reagan watched the film at Camp David one Saturday evening. Legend has it that, a few days later, he asked his advisers whether such a scenario was possible. They replied that it was.

Three years later, the Computer Fraud and Abuse Act came into force. The Act was brief and ambiguous; it criminalised ‘unauthorised’ access to a computer system or ‘exceeding authorisation’, without these concepts being precisely defined. This ambiguity was no drafting oversight. For thirty years, it enabled federal prosecutors to turn trivial breaches of terms of use into crimes punishable by decades in prison. The law did not merely punish theft; it punished curiosity. It made it illegal to seek to understand how a system worked without the owner’s authorisation.

Legal scholars have given a name to the effect of this law: the ‘chilling effect’. By making the exploration of systems legally risky, the state had, without realising it, paralysed the very section of the population that would have been best placed to protect them. The most scrupulous researchers withdrew from the field. The less scrupulous, however, carried on.

In November 1988, at Cornell, a twenty-three-year-old student named Robert Tappan Morris Jr finished fine-tuning a program he had designed, he said, to count the machines connected to the internet. His father worked at the NSA. He did not yet know that he was about to write the first chapter of this book.