The Morris Worm: The Night the Internet First Fell Over

On the evening of 2 November 1988, the internet was a small and trusting place, perhaps sixty thousand computers run mostly by universities, research labs and the military, connected on the cheerful assumption that everyone online was a colleague. That night, a single program written by a graduate student spread from machine to machine until roughly a tenth of the entire internet had ground to a halt. It was the moment the network lost its innocence, and computer security was born as a serious discipline.

An experiment that escaped

The author was Robert Tappan Morris, a graduate student at Cornell and, in a detail too good to invent, the son of a renowned cryptographer at the National Security Agency. By his own account he did not set out to cause harm. He wanted to measure the size of the internet by writing a program that would quietly copy itself from computer to computer and report back. To cover his tracks, he released it not from Cornell but from a machine at the Massachusetts Institute of Technology.

The bug that turned a probe into a plague

The trouble lay in one design decision. To avoid being deleted, the program was built to sometimes reinstall itself even on a machine that already had a copy. That small safeguard against removal was catastrophic in practice. Computers were infected over and over, each copy consuming a little more processor and memory, until machines slowed to a crawl and then froze entirely under the weight of dozens of copies of the same worm fighting for room. It spread by exploiting weaknesses in common programs of the day and by simply guessing weak passwords, both of which were rife in a world that had never needed to worry.

The clean-up and the reckoning

Administrators across the country spent days disconnecting machines, comparing notes by the few channels still working, and scrubbing the worm out by hand. The estimate that has stuck is around six thousand affected computers, about ten percent of everything then connected. In the aftermath, Morris became the first person convicted under the United States Computer Fraud and Abuse Act of 1986, and was sentenced to three years of probation, four hundred hours of community service and a fine of around ten thousand dollars.

The more lasting consequence was institutional. In direct response to the chaos, the first Computer Emergency Response Team was set up to coordinate against future incidents, the ancestor of the security response teams that every serious network now relies on. An informal, trusting internet suddenly understood that it needed locks, watchmen and a plan.

What it still teaches

The Morris worm endures as a lesson because the vulnerability it exposed was never really technical. It was the danger of a monoculture built on trust, where everyone runs the same software with the same weaknesses, so a single clever exploit can sweep through all of it at once. That shape of fragility keeps returning in new clothes, from the single typo that took down much of the cloud to the way so much of the modern web leans on a handful of networks and data centres. The protocols underneath, which you can still read in our RFC archive, were designed for a friendlier world than the one we got.

There is a gentle coda. Robert Morris was not ruined by the worm. He went on to become a respected professor at MIT and a co-founder of a famous startup incubator. The internet, too, recovered and grew up, a little more guarded and a great deal larger. If you ever want to peer at the machinery behind a site and the network that carries it, our who is hosting this site tool traces it, and the directory shows the providers keeping it all running.

Sources and further reading

• The Morris worm
• United States v. Morris, the first CFAA case