On the evening of November 2, 1988, in a quiet computer lab at MIT, a student made a big mistake. Robert Tappan Morris, a 23-year-old computer science student at Cornell University, wrote 99 lines of code and released the program on ARPANET, the first foundation of the internet. Unfortunately, he had unwittingly released one of the internet’s first self-replicating, self-replicating worms, the “Morris Worm,” and it would change the way we look at the internet forever.
It is still a mystery why a diligent student did such a thing. Even after 30 years and a criminal investigation and numerous retellings of her story, this mystery remains elusive.
Morris claimed that this is a harmless exploit to measure the size of the internet. However, the fact that he released the worm at MIT, not his own Cornell University college, is often seen as a question mark among critics of Morris. According to Cornell University’s official 1989 report on the incident, “Speculations focused on a variety of motivations, including revenge, pure intellectual curiosity, and the desire to impress someone.”
But for whatever reason, Morris had made a serious mistake. In relatively simple programming, he had made the worm very fast, very aggressive and very obvious.
The program spread to computers asking if there was a copy of the running program. If the computer answered “no”, the worm would copy itself to the computer. Morris also wanted to avoid being copied multiple times to the same machine so that the program could spread to more computers before attracting unwanted attention. If a computer answered “yes” to the question, the worm would simply replicate itself and install another copy every 7 times.
And things are getting out of control
However, things quickly got out of control. The program spread faster than Morris had expected, and the “1 in 7” method proved ineffective. Computers around the world were rapidly spinning hundreds of copies into an endless loop, eventually rendering them inoperable with piles of unnecessary processes.
On the morning of November 3, an estimated 10 percent of the world’s internet-connected computers were down. MIT’s computers took the first and hardest hit, but the worm quickly spread to the United States and is reported to have spread as far as Europe and Australia.
As you can imagine, even at a time when there were only 60,000 computers, this was a huge amount of property damage. Damage estimates vary widely, ranging from $100,000 to tens of millions.
News quickly began to spread that this was the work of Russian hackers; After all, the Cold War was still going on. Newspapers and cable news outlets began to color and spread the story enthusiastically, at least because Morris’ father was a veteran in the computer security arm of the National Security Agency (NSA).
After the panic and confusion cleared, Morris was caught and charged under the Computer Fraud and Abuse Act. He pleaded not guilty, but the jury thought otherwise and sentenced him to three years probation, 400 hours of community service, and a $10,050 fine.
In 1990, just after his sentence, The New York Times wrote: “He frightened a lot of people who run computer systems.”
We can say that this is a big understatement. At the end of November 1988, DARPA had set aside funding for the Computer Emergency Response Team in direct response to Morris Worm. From then on, the internet was no longer seen as a quiet and secure cable network. It was now a web of unmanageable streets filled with suspicious people and open doors.
As the 1989 Cornell Commission report stated, “This was not a simple trespassing like wandering around someone’s unlocked home without permission but with no intent to harm. A more appropriate analogy would be driving a golf cart through most houses in a neighborhood on a rainy day.”
Morris later returned to MIT’s computer technology department to build a career as a renowned professor…
