What is a honeypot? Cyber deception and digital decoys

In August 1986 Clifford Stoll, an astronomer working as a systems administrator at Lawrence Berkeley Laboratory, noticed a 75-cent discrepancy in the computer accounting records. Pulling on that thread, he found an intruder using the lab's network as a stepping stone into US military systems. To keep the intruder online long enough to trace the connection, Stoll and those around him created a batch of fake documents about a supposed Strategic Defense Initiative project. The bait worked. The intruder was Markus Hess, a young man from Hanover who belonged to a group selling information to the KGB.

That digital paper trail is one of the most frequently cited precursors of what we now call a honeypot. This article explains what a honeypot is in cybersecurity, how the idea evolved and where its limits lie — as history and concepts, not as a deployment guide.

What is a honeypot? A one-line definition

A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource.

Lance Spitzner, Honeypots: Tracking Hackers, 2002

Put simply, a honeypot is a decoy: a system, service or piece of data with no legitimate use, so any contact with it is a red flag. It does not protect anything on its own the way a firewall does. Its value is informational — it tells defenders someone is inside, shows how they behave and sometimes wastes their time.

Timeline: from Stoll's bait to cyber deception

1. 1986–1989 — Clifford Stoll tracks Markus Hess, publishes 'Stalking the Wily Hacker' (Communications of the ACM, 1988) and the book The Cuckoo's Egg (1989). Hess is tried in Germany and convicted in 1990.
2. 1991–1992 — Bill Cheswick at AT&T Bell Labs watches an intruder for months inside a controlled environment and describes it in 'An Evening with Berferd' (1992).
3. Late 1990s — Fred Cohen releases the Deception Toolkit, one of the first public tools designed to mislead attackers.
4. 1999 — Lance Spitzner founds The Honeynet Project, which popularises the systematic study of attackers through decoy networks.
5. 2003 — Augusto Paes de Barros coins the term honeytoken on a mailing list: trap data, accounts or documents rather than whole machines.
6. 2010s onwards — the idea matures into cyber deception, and frameworks such as MITRE Engage treat it as a defensive discipline.

Types of honeypot at a glance

The literature classifies decoys by how much they let an intruder do and by what they are for. The table summarises the usual categories without going into configuration.

Research versus production honeypots

A second classic distinction separates research honeypots, built to learn about attackers and their tools, from production honeypots, placed inside an organisation to spot intrusions early. The former feed threat intelligence; the latter act as silent alarms.

What honeypots are good for

• Early detection: since nobody should touch a decoy, alerts carry very few false positives.
• Understanding the adversary: observed tools and behaviour feed threat intelligence and attribution work.
• Attrition: time an attacker spends in a fake environment is time not spent on the real one.
• Proof of a leak: a honeytoken surfacing outside the organisation shows that data has left the building.

When the honeypot is an entire platform

Honeypot logic has scaled up to international policing. In June 2017 Dutch police covertly took over Hansa, one of the largest dark-web markets, and kept running it for about a month while gathering information on vendors and buyers, in coordination with the takedown of AlphaBay, according to Europol.

The most striking case is ANOM. According to the FBI and Europol, from 2019 the FBI, working closely with the Australian Federal Police, covertly developed and ran an encrypted phone company that reached more than 12,000 devices used by over 300 criminal syndicates in more than 100 countries. When results were announced on 8 June 2021, Europol cited around 800 arrests and 27 million messages reviewed. Defence lawyers in several countries have challenged the admissibility of the evidence — a reminder that such operations are also tested in court.

A honeypot is not a honey trap

In traditional espionage, a honey trap means something else: seducing a person to obtain information or blackmail material, a technique associated in the Cold War with services such as the KGB and closely linked to kompromat. The computer honeypot borrows the metaphor of sweet bait, but it targets systems rather than people. The two are easily confused.

Limits, risks and the legal debate

• Being spotted: sophisticated attackers look for signs of an artificial environment and may feed defenders false information.
• Pivot risk: a poorly isolated decoy can be used to attack third parties, with possible liability for whoever runs it.
• Personal data: logs may capture personal information, which in the EU falls under the GDPR.
• Entrapment: the legal concept mainly concerns authorities inducing a crime; Spitzner argued in the early 2000s that a passive decoy rarely fits it, but each jurisdiction differs.

The practical conclusion is modest: a honeypot is an observation and early-warning tool, not a shield. It works best as one layer of a wider defence.