On the evening of November 2, 1988, Robert Tappan Morris — a graduate student at Cornell University — released a program onto what was then called the ARPANET. He would later claim the intent was to demonstrate the vulnerabilities inherent to large networked systems. Within hours, thousands of computers across universities, military installations, and research labs were crawling to a halt.
The Morris Worm, as it became known, exploited three distinct vulnerabilities: a debug backdoor in the sendmail program, a buffer overflow in the fingerd daemon, and a flaw in the rsh/rexec system that allowed trusted host relationships to be leveraged. The worm did not need all three paths — it used whichever one worked, and it tried them all.
What made the worm devastating was not malice but mathematics. The program was designed to check whether a copy of itself was already running on a target machine. But Morris included a mechanism to occasionally ignore this check — one in seven times, a new copy would be spawned anyway, intended to defeat attempts by administrators to fool the worm. This seemingly minor design decision caused the worm to replicate far faster than intended, consuming all available processing resources on infected machines.
Estimates suggest between 6,000 and 9,000 machines were affected — a significant fraction of the then-internet. The cleanup took days. NASA, MIT, Berkeley, Stanford, and military contractors all reported systems offline. The financial cost, in 1988 dollars, was estimated between $100,000 and $10,000,000, depending on how cleanup labor was calculated.
Morris was prosecuted under the Computer Fraud and Abuse Act of 1986 — the first such prosecution under that statute. He was convicted, fined $10,050, sentenced to three years probation, and required to perform 400 hours of community service. He did not serve prison time. He went on to co-found Y Combinator and become a professor at MIT.
The incident prompted DARPA to fund the creation of CERT/CC — the Computer Emergency Response Team Coordination Center — at Carnegie Mellon University. It was the first formal incident response organization for the internet, and its model has been replicated worldwide.
The Morris Worm is often taught as a cautionary tale about unintended consequences in complex systems. But it is also a foundational lesson in the sociology of security: the ARPANET's designers had built a network of trusted institutions communicating with trusted institutions. The idea that someone inside that circle might release something harmful was simply not part of the threat model.
The incident also established one immutable truth about internet security: systems connected to a network should probably be secured. This was, at the time, a genuinely controversial position.