THE MORRIS WORM▊
A Cornell graduate student — the son of the NSA's chief computer scientist — wrote a program to measure the size of the internet, and a single arithmetic decision turned the census into a catastrophe. On the night of November 2, 1988, the worm slipped through holes in sendmail, fingerd, and trusted-host logins, then re-infected machines faster than it spread, grinding an estimated 6,000 of the internet's ~60,000 computers to a halt. He tried to warn people how to kill it; the network was too clogged to carry the message. Two years later he became the first person convicted of a felony under the Computer Fraud and Abuse Act. Two decades after that he had tenure at MIT and a venture firm that funded half of Silicon Valley.
This memo takes a look back at the helminthiasis (infestation with, or disease caused by parasitic worms) of the Internet that was unleashed the evening of 2 November 1988.
RFC 1135, The Helminthiasis of the Internet, J. Reynolds, IETF, December 1989 — the internet's own postmortem on the worm
- WHO
- Robert Tappan Morris — "RTM," b. Nov 8, 1965; Cornell PhD student in 1988 FACT
- SCENE
- Son of Robert Morris — Bell Labs Unix designer, later chief scientist at the NSA's National Computer Security Center. Released the worm from an MIT machine to mask its Cornell origin
- THE DRAMA
- A self-replicating program with a re-infection bug crashes/clogs an estimated ~6,000 of ~60,000 internet machines; prompts the creation of the CERT Coordination Center (see Timeline)
- RECORD
- Convicted 1990 under 18 U.S.C. § 1030(a)(5)(A) — the first felony conviction under the CFAA (1986); sentenced to 3 years' probation, 400 hours community service, a $10,050 fine. Conviction affirmed by the Second Circuit, Mar 7, 1991 FACT
- STATUS
- TENURED — MIT professor (EECS), Y Combinator co-founder. The statute's first felon became the field's elder statesman
This file is not an accusation; the accusation was the government's, and the government won. It is a record of what happens when a clever experiment escapes the lab and a brand-new statute needs its first felon. The through-line is the distance between the myth — a malicious hacker who tried to take down the internet — and the paperwork, which shows a graduate-student census program, a fourteen-percent arithmetic decision that turned it into a plague, and a defendant who spent the night of the outbreak trying to broadcast the antidote.
the drama timeline
ACT I — THE PROFESSOR'S SON (1965–1988)
A kid raised inside the machine that built Unix goes to Cornell and starts reading other people's code for the seams.
-
1965–87
Bell Labs to Cornell
Robert Tappan Morris is born Nov 8, 1965. His father, Robert Morris, helped design Unix at Bell Labs and later becomes chief scientist at the NSA's National Computer Security Center — the man who literally wrote the book on password security. The son grows up fluent in the systems he will later break, and enrolls as a graduate student in computer science at Cornell.
-
OCT 1988
The census idea
Morris writes a program meant, by his own defense's account, to gauge the size of the internet — to quietly spread from machine to machine and count. To move, it exploits three known weaknesses: a debug hole in the Unix sendmail daemon, a buffer overflow in fingerd, and the transitive trust of rsh logins with no password. The design flaw is not in the spreading. It is in what happens when the worm meets a machine it has already infected.
ACT II — NOVEMBER 2, 1988 (the night it got away)
The worm is released, the re-infection bug fires, and by morning a tenth of the internet is on its knees.
-
NOV 2, 1988
Release — from MIT, not Cornell
Around 8:30 p.m. Morris launches the worm from a machine at MIT — a deliberate choice to obscure that it came from Cornell. To resist being killed by admins who set a fake "already infected" flag, he tells the worm to copy itself anyway 14% of the time regardless of infection status. That single hedge is the bug. Machines get infected over and over, each copy stealing more cycles, until they slow to unusability.
-
NOV 2–3, 1988
~6,000 machines
The worm rips across the young internet overnight. Estimates put it at roughly 6,000 of the ~60,000 machines then connected — universities, research labs, military sites — crashed or clogged into paralysis. There is no destructive payload; the damage is entirely the congestion of a program multiplying out of control. It is the first time the general public learns the internet can be brought down at all.
-
NOV 3, 1988
The antidote nobody could receive
Realizing what he has done, Morris has a colleague send an anonymous message with instructions on how to kill the worm and patch the holes. The internet is so clogged by his own program that the warning arrives too late to matter. The gesture — a defendant trying to broadcast the cure while the disease outruns it — becomes the load-bearing fact of his defense.
ACT III — UNITED STATES v. MORRIS (1989–1991)
A two-year-old statute gets its first felon, and a landmark ruling decides that meaning to cause damage was never required.
-
1989–90
Indicted — the CFAA's first test
Morris is charged under the Computer Fraud and Abuse Act of 1986, specifically 18 U.S.C. § 1030(a)(5)(A): intentionally accessing federal-interest computers without authorization and causing loss over $1,000. A federal jury in the Northern District of New York convicts him — the first felony conviction under the CFAA, the statute that still governs American hacking cases (see the other founding case, Knight Lightning).
-
MAY 1990
Sentenced
Judge Howard Munson sentences Morris in Syracuse to three years' probation, 400 hours of community service, and a $10,050 fine plus the cost of supervision — no prison. Contemporary coverage notes he "remained grim-faced through most of the hearing, then cracked a wide smile and hugged his mother when the sentence was announced."
-
MAR 7, 1991
Second Circuit affirms — intent to damage not required
The U.S. Court of Appeals for the Second Circuit affirms the conviction, holding that the government did not have to prove Morris intended to prevent the use of the computers or cause the loss — only that he intended the unauthorized access. It is a foundational CFAA precedent, and it is why "I didn't mean to break it" has never been a defense to the statute since. The same year, the incident prompts DARPA to fund the CERT Coordination Center at Carnegie Mellon — the world's first computer emergency response team.
ACT IV — TENURE (1995–)
The convicted felon becomes a founder, a professor, and the quiet co-author of a generation of startups.
-
1995–98
Viaweb
Morris co-founds Viaweb with Paul Graham — one of the first web-application companies, letting merchants build online stores. In 1998 it sells to Yahoo for about $49 million and becomes Yahoo! Store. The man who accidentally broke the internet has now helped build commerce on it.
-
1999–
MIT professor, Y Combinator co-founder
Morris joins the MIT faculty in 1999, earns tenure in 2006, and becomes a professor in the EECS department. In 2005 he co-founds Y Combinator with Graham, Trevor Blackwell, and Jessica Livingston — the seed fund that will launch thousands of startups. He is later elected an ACM Fellow (2014) and to the National Academy of Engineering (2019). The template the scene keeps hoping for and rarely gets: prodigy, defendant, elder statesman.
both sides, on the record
The prosecution's case: Morris released a self-replicating program onto a network he did not own and had no authorization to touch, and it caused real, documented damage — thousands of machines at universities, labs, and military sites knocked offline, with substantial cleanup and lost-work costs. A jury convicted him and the Second Circuit affirmed. The intrusions were real, the loss was real, and the law was clear enough that his conviction still anchors CFAA doctrine.
Intent to damage was never the point: the appellate court held that the government did not need to prove Morris meant to cause harm — only that he meant to access the computers without authorization. By the letter of the statute he wrote and ran, the outcome was foreseeable and he owned it [2].
There was no malicious payload: the worm did not delete files, steal data, or vandalize anything. The entire catastrophe was congestion — a program multiplying because of a bug in the re-infection logic, not a weapon. Strip the arithmetic error and the "attack" is a census that would have finished quietly [1].
He tried to stop it: on realizing the worm was out of control, Morris had a colleague send anonymous instructions on how to kill it and patch the holes — a message his own program had congested the network too badly to deliver. The record shows a defendant fighting his mistake in real time, not gloating over it [1].
The damage was an accident of scale: no prosecutor argued Morris set out to crash 6,000 machines, and the sentence — probation and community service, no prison — reflects a court that saw recklessness, not malice. The subsequent career is the clearest verdict the community ever rendered: MIT gave him tenure and the industry gave him a venture fund [3].
YOU DECIDE
He wrote it, he released it, and he owns the first felony conviction the CFAA ever produced — that is settled record, affirmed on appeal. But the disaster was a bug, not a bomb: no payload, no theft, just a fourteen-percent hedge that turned a census into a plague, and a graduate student who spent the outbreak trying to broadcast the cure. The state got a landmark precedent that intent to damage was never required. The internet got CERT. And the man the statute made its first felon spent the next thirty years teaching the networks he once broke.
The archive does not deify, and it does not damn on a headline. It keeps the conviction — and the bug report, and the tenure letter.
evidence locker
PRIMARY / REFERENCE
Wikipedia — Morris worm ATTRIBUTED — dated record: the Nov 2, 1988 release from MIT, the sendmail/fingerd/rsh exploits, the 14% re-infection bug, the ~6,000-of-~60,000 estimate, the anonymous kill-instruction message, and the founding of CERT/CC.
en.wikipedia.org/wiki/Morris_worm Wikipedia — United States v. Morris (1991) ATTRIBUTED — the first CFAA felony conviction under 18 U.S.C. § 1030(a)(5)(A); the Second Circuit's Mar 7, 1991 affirmance holding intent to cause damage need not be proven.
en.wikipedia.org/wiki/United_States_v._Morris_(1991) Wikipedia — Robert Tappan Morris ATTRIBUTED — birth, his father's NSA role, and the redemption arc: Viaweb (sold to Yahoo, ~$49M), MIT tenure (EECS), and co-founding Y Combinator in 2005.
en.wikipedia.org/wiki/Robert_Tappan_Morris RFC 1135 — The Helminthiasis of the Internet FACT — the IETF's own contemporaneous postmortem (J. Reynolds, Dec 1989), dating the outbreak to the evening of 2 November 1988.
rfc-editor.org/rfc/rfc1135.html
CONTEXT & CROSS-LINKS
Computer Underground Digest 1.07 (May 5, 1990) ATTRIBUTED — period coverage: the Chicago Tribune sentencing report ("COMPUTER TAMPERER FINED"), reprinted in the era's underground newsletter.
textfiles.com/magazines/CUD/cud0107.txt troll.fan — Timeline CROSS-LINK — the worm in the wider chronology of the scene and the law that grew up around it.
troll.fan/timeline.html
The standard. Robert Tappan Morris is a public figure; the conviction, sentence, and appellate affirmance are matters of public record and are stated as fact. The exculpatory center — no malicious payload, a bug in the re-infection logic, and his attempt to broadcast a kill message — is sourced and given at full strength, as is the redemption (MIT, Y Combinator). No motive beyond the record is asserted. If a line here couldn't survive scrutiny, it wouldn't be on the page.