On This Day: November 2, 1988 — The Morris Worm Crashes the Internet

Morris released the program, a self-replicating piece of code written to crawl from machine to machine across the ARPANET, at around 8:30 PM on November 2, 1988. He launched it from a terminal at MIT rather than his own university, hoping to make it harder to trace back to Cornell. Whether that was clever misdirection or the first clue that he knew the thing was riskier than he was letting on, nobody’s fully settled on — but it’s the detail that turns this from an accident into a story.

A Program Built to Count, Not Destroy

Morris’s stated goal was modest: estimate the size of the internet by writing a program that could hop from one connected UNIX machine to the next, quietly checking in without doing any damage. To make sure it could actually spread, he built in exploits for known weaknesses — a bug in the Unix sendmail program, a flaw in the fingerd network service, and weak passwords on accounts across the network. None of that was new or secret; researchers knew about these holes. What Morris added was a program that could use all three to jump machines on its own, unsupervised, at computer speed.

The fatal flaw was in how the program decided whether a machine was already infected. Morris worried that system administrators would write a fake “yes, I’m infected” response to trick the worm into leaving their machines alone, so he designed it to sometimes re-infect a system anyway, just to be safe. The math on that decision was catastrophic: instead of one copy per machine, computers ended up running the program dozens or hundreds of times simultaneously, each copy eating memory and processing power until the machine ground to a halt under its own weight.

Upson Hall, Cornell’s computer science building, where Morris was a first-year graduate student when he wrote the program that would crash a tenth of the internet.

8:30 PM at MIT, and the Network Started Dying

Once the program hit the network, it moved faster than anyone in 1988 had planned for. Universities, military research sites, and corporate labs running UNIX machines on ARPANET started seeing systems slow to a crawl and then stop responding entirely. Administrators at Berkeley, MIT, Stanford, and NASA were pulling machines offline or physically disconnecting network cables by the middle of the night, with no idea yet what they were fighting or whether it would keep spreading if they reconnected.

What made it worse was that the obvious tool for coordinating a response — email — was one of the things getting clogged by the program itself. Some sites cut their network connections entirely rather than risk infection, which also cut them off from the mailing lists where a fix was being worked out. For a brief, strange window, the fastest way to spread word about a piece of self-replicating code loose on the internet was the same slow phone and fax network the internet was supposed to be replacing.

A Panicked Phone Call at 2:30 AM

By the early hours of November 3, Morris understood what he’d done. According to later court testimony, he called a friend at Harvard around 2:30 AM, panicked, and asked him to post an anonymous message to Usenet apologizing for the outbreak and explaining how to stop it — essentially, patch the three holes the program exploited and the infections would stop spreading. The message barely helped. The network congestion the program had already caused was so severe in places that the fix instructions couldn’t reliably get through to the people who needed them.

It took teams at Berkeley and MIT roughly two days of reverse-engineering the program’s code, independently and in a rush, before a real fix circulated widely enough to bring the network back under control. The estimated cleanup and downtime cost ran into the millions of dollars — the government’s own figure at trial was $10 million at the low end — a number that seems almost quaint next to modern breach costs but was enormous for an internet that, in 1988, connected maybe 60,000 machines total.

Network outages serious enough to make national television news in 1988 — most Americans had never heard the word “internet” before this story explained it to them.

The First Felony Conviction for a Computer Crime

Congress had passed the Computer Fraud and Abuse Act two years earlier, in 1986, mostly aimed at hacking into government and financial systems. Morris became its first felony conviction. In 1990, a jury found him guilty, and he was sentenced to three years of probation, 400 hours of community service, and a $10,050 fine — no prison time, a sentencing outcome his defense argued fit a reckless mistake rather than malicious intent, and one prosecutors argued was far too light for the damage done.

The case became the template for how computer crime would get prosecuted for the next three decades, and the worm itself became the reason the internet grew a security industry at all. CERT, the first computer emergency response team, was founded at Carnegie Mellon within weeks of the outbreak specifically to coordinate responses to incidents like this one. Patch management, coordinated vulnerability disclosure, and the entire discipline of incident response all trace a line back to the scramble that started on the night of November 2, 1988.

MIT’s campus in Cambridge — the network Morris used to launch the program, and, decades later, the university that gave him tenure.

From Defendant to Tenured Professor

Morris didn’t disappear after the conviction. He co-founded a startup called Viaweb with Paul Graham in the mid-1990s, sold it to Yahoo in 1998, and used the proceeds to help start Y Combinator, the startup accelerator that would go on to fund companies like Airbnb, Dropbox, and Stripe. At the same time, he built an academic career at MIT, becoming an associate professor and eventually earning tenure there in 2006 — at the same institution whose network he’d accidentally brought down eighteen years earlier.

That arc is the part of the story that keeps it interesting almost forty years later: the first person convicted under America’s new computer crime law went on to help build the industry that law was meant to protect, and to teach at the university most associated with the night everything broke. The worm that was supposed to just count computers ended up proving, the hard way, how fragile a trusting, wide-open network really was — a lesson the internet has had to relearn, in bigger and more expensive ways, more or less every year since.

Sources

• Morris worm — Wikipedia — timeline, technical overview, and casualty figures.
• The Morris Worm: 30 Years Since First Major Attack on the Internet — FBI — law enforcement retrospective on the case and its legacy.
• The Morris Worm — Cornell Alumni Magazine — background on Morris’s time at Cornell and faculty reaction.
• In 1988, One Rogue Worm Shut Down 10 Percent of the Internet — Atlas Obscura — narrative account of the outbreak and response.
• On This Day in 1988: The Morris Worm — Tom’s Hardware — technical retrospective and cybersecurity industry legacy.