Morris Worm Indicted: First Cybercrime Prosecution

A twenty-three-year-old Cornell graduate student released ninety-nine lines of code onto the internet and accidentally shut down roughly ten percent of all connected computers within hours. Robert Tappan Morris launched his self-replicating program on November 2, 1988, intending it as a harmless experiment to measure the size of the internet. A coding error caused it to replicate far faster than designed, overwhelming thousands of machines and creating the first major cybersecurity crisis in network history. Morris was the son of a chief scientist at the National Security Agency, giving the incident an irony that prosecutors did not overlook. His worm exploited three known vulnerabilities in Unix systems: a flaw in the sendmail program, a buffer overflow in the finger daemon, and weak password security. Each compromised machine would attempt to infect every other machine it could reach, and the replication bug meant the same computer could be infected multiple times, each copy consuming more processing power until the machine crashed. System administrators across the country scrambled to respond, often by simply disconnecting their machines from the network. The Defense Advanced Research Projects Agency estimated the damage at between $100,000 and $10 million, depending on how labor costs were calculated. The worm struck universities, military installations, and research labs, demonstrating that the internet's architecture, designed for openness and collaboration, was fundamentally vulnerable to malicious code. A federal grand jury indicted Morris under the Computer Fraud and Abuse Act of 1986, making his the first prosecution under the statute. He was convicted in January 1990 and sentenced to three years of probation, 400 hours of community service, and a $10,050 fine. The judge declined prison time, acknowledging that Morris had not intended the damage. Morris later became a professor of computer science at MIT and co-founded Y Combinator, the startup accelerator that launched Airbnb, Dropbox, and hundreds of other companies.