[copaliscrossing]

What was that case where someone noticed a couple of seconds of computer time that did not jive, and tracked it to a big problem?

Sometimes that is the hardest thing to spoof... Date / Time stamps. Not impossible, just a level more difficult.

[Scrambler Bob]

I found what I was remembering:

Crazy cool true story about an astronomer-turned-sysadmin at Berkeley in the 1980s who decides to track down a 75 cent accounting discrepancy in server usage, and turns into a year-long hunt to track down a sneaky computer spy operating for the KGB. Covers several severe holes in Unix security, but emphasizes that the weakest link in security is almost always from human operators.

https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787