Morris Worm Hits Internet: Cybersecurity Crisis Begins

A 23-year-old Cornell graduate student released 99 lines of code onto the internet on November 2, 1988, and within hours roughly 6,000 computers, about ten percent of the entire network, had ground to a halt. Robert Tappan Morris did not intend to cause damage. The program was designed to spread quietly across Unix systems, exploiting known vulnerabilities in sendmail, fingerd, and rsh. A critical programming error caused it to reinfect machines already compromised, consuming processor cycles until systems became unusable. The Morris Worm spread through ARPANET, the military-academic precursor to the modern internet, at a speed that stunned the small community of network administrators who managed it. Most systems relied on trust rather than authentication, and many administrators used default or easily guessed passwords. The worm exploited this culture of openness ruthlessly. System administrators at MIT, Berkeley, and Purdue worked through the night to analyze the worm's code and develop patches. The decentralized nature of the network made coordinated response nearly impossible, and the worm's traffic clogged the very communication channels administrators needed to share solutions. Some institutions disconnected entirely to protect their systems. Morris was the first person convicted under the Computer Fraud and Abuse Act of 1986. He received three years of probation, 400 hours of community service, and a $10,050 fine. His father, Robert Morris Sr., was chief scientist at the National Security Agency's National Computer Security Center, a coincidence that generated considerable media attention. The worm's legacy far exceeded its immediate damage. DARPA established the Computer Emergency Response Team (CERT) at Carnegie Mellon as a direct response, creating the first formal framework for coordinating cybersecurity incidents. Morris later became a successful venture capitalist and MIT professor.