A Cornell graduate student's program slips onto the Internet from a computer at MIT
In 1988 the Internet had about 60,000 computers, many of them running Berkeley Unix. At roughly 8:30 p.m. Eastern on November 2, Robert Tappan Morris, a 23-year-old Cornell computer science graduate student, launched a self-copying program from a machine at the Massachusetts Institute of Technology, chosen so the trail would not lead back to Cornell. The worm got in through holes in sendmail, finger, rexec and rsh, and through weak passwords. Within hours, an estimated 6,000 computers were affected.
The Morris worm made national news, and Morris became the first person convicted of a felony under the Computer Fraud and Abuse Act of 1986. Carnegie Mellon University's emergency response center for network incidents, grew out of the scramble that followed the worm.
QWhat did Harvard student Paul Graham write to Morris before the worm was launched?
Clifford Stoll later recorded a rumor that Morris had worked with a friend or two in Harvard's computing department. As evidence, he pointed to mail from Harvard student Paul Graham that asked Morris for "Any news on the brilliant project." Stoll presented it as hearsay, not proof of a conspiracy, and the case that followed centered on Morris alone. Still, the line shows how casual the project looked to people close to it: a clever experiment passed around among students, with nobody yet picturing a network full of stalled machines. The word "brilliant" in that message has kept its irony ever since.
QWho was Robert Tappan Morris's father, and what did he do for a living?
His father, also named Robert Morris, was a cryptographer at the National Security Agency. That made the worm's author the son of one of the country's best-known computer security specialists, which gave the story an extra edge when the news broke. The younger Morris had grown up around the subject he exposed. Press coverage of the worm often returned to that detail.
QHow much did Morris end up paying, and who sentenced him?
Federal judge Howard Munson sentenced Morris on May 4, 1990. The terms were three years of probation, 400 hours of community service, a $10,000 fine, and the costs of court and probation. In practice the fine came to $10,050 plus supervision costs, for a total of $13,326, which is about $31,500 in 2025 dollars. There was no prison time. For a program that took thousands of machines offline and whose damage was estimated at up to $10,000,000, There was no prison time.
