One night in 1988, a college student’s prank broke the internet

On the evening of November 2, 1988, in a quiet computer lab at MIT, a student completely screwed up. Robert Tappan Morris, a 23-year-old computer science student at Cornell University, had written 99 lines of code and launched the program on ARPANET, the Internet’s first foundation. Unbeknownst to him, he had just released one of the internet’s first self-replicating and self-spreading worms – “the Morris Worm” – and it would change the way we viewed the internet forever.

But why would a nerdy college kid unleash this beast? Even after 30 years, a criminal trial and countless retellings of its history, it remains unclear.

Morris claimed it was a harmless feat to gauge the size of the internet. However, the fact that he published the worm from MIT, and not from his own college at Cornell University, often raises questions among critics of Morris.

“Speculation has centered on motivations as diverse as revenge, sheer intellectual curiosity, and a desire to impress someone,” according to the official 1989 Cornell University incident report.

Regardless of the motive, Morris made a serious mistake. In its relatively simple programming, it made the worm far too fast, too aggressive, and too obvious.

The program snuck onto computers asking if there was already a copy of the program running. If the computer answered “no”, the worm would copy itself to the computer. Morris wanted to avoid infecting the same machine multiple times, so the program could slither onto multiple computers before attracting unwanted attention. If a computer answered “yes” to the question, the worm would simply duplicate itself and install another copy every 7 times.

However, things soon escalated. The program spread faster than Morris had expected, and its “1 in 7 guarantee” proved ineffective. Computers around the world were rapidly installing hundreds and hundreds of copies in an endless loop, eventually overwhelming them with masses of unnecessary processing.

By the morning of November 3, about 10% of computers connected to the Internet worldwide were down. Computers at MIT were the first and hardest hit, but the worm quickly spread across the United States, with reports reaching as far as Europe and Australia.

Needless to say, even at a time when there were only 60,000 computers, it cost a lot of money. Damage estimates vary wildly, but numbers have started at $100,000 and go into the tens of millions.

Word quickly spread that it was the work of Russian hackers – after all, the Cold War was still on. Newspapers and cable news channels picked up the story, not least because Morris’ father was a senior official in the National Security Agency’s (NSA) computer security arm.

After the panic and confusion subsided, Morris was arrested and charged under the Computer Fraud and Abuse Act. He pleaded “not guilty” – but the jury found otherwise, sentencing him to three years probation, 400 hours of community service and a $10,050 fine.

In 1990, just after his conviction, the New York Times wrote: “It scared a lot of people who manage computer systems.”

If anything, that’s an understatement. In late November 1988, DARPA had offered funding for the Computer Emergency Response Team in direct response to the Morris worm. From now on, the Internet was no longer seen as a placid network of wires – it was a network of ungoverned alleyways filled with shady people and open doors.

“It was not a simple act of trespass analogous to wandering into someone’s unlocked house without permission but with no intention of causing harm. A more apt analogy would be driving a golf cart a rainy day in most homes in a neighborhood,” the 1989 Cornell Commission report concluded.

As a wrap-up for the start, Morris returned to MIT’s computer technology department to build a career as a renowned professor. Better the devil, you know, I guess.

The original version of this article was published in January 2018.