On the evening of November 2, 1988, thirty-eight years ago almost to the day as this is written, a twenty-three-year-old graduate student sat down at a terminal in the MIT Artificial Intelligence Laboratory, in Cambridge, Massachusetts, and released a program he had been writing for weeks. He was not a student at MIT. He was a first-year graduate student at Cornell, and he had traveled, in the network sense, to MIT precisely so that the trail would point at the wrong university. The program was small. Its leading edge was a bootstrap of 99 lines of C, whose only job was to land on a new machine, compile itself, and reach back to fetch the real engine. At 8:30 that night, Robert Tappan Morris let it go, and then he went to wait and see how big the internet was.
That was the point of the thing, and it is the detail that makes the story worth retelling. Morris was not trying to break anything. By his own account, given later under oath, he wanted to measure the internet: to build a program that would quietly copy itself from machine to machine, settle in, and send back a signal, so that someone, for the first time, could actually count the network. In 1988 nobody knew how large the internet was. There was no registry to query and no census to take. The network was a research commons of universities, laboratories, and military sites, run on trust and spare time. If you wanted to know its size, you had to go out and touch every machine on it. So he wrote a program that would.
The program had three doors, and all three of them were standing open.
The first door was sendmail, the program that moved electronic mail between machines. Sendmail shipped with a debug mode intended for its developers, a maintenance hatch that let a remote sender talk to the program as an operator rather than as a correspondent. On machine after machine, in production, on the live network, that hatch had never been welded shut. The worm knocked on it and was let in with something close to administrative courtesy.
The second door was fingerd, a small and friendly service that answered the question "who is logged in on that machine?" It read incoming requests into a fixed-size buffer using a C library routine, gets(), that performed no bounds checking at all: it trusted the sender to be brief. The worm sent a request longer than the buffer, carefully built so that the overflow overwrote the program's own return address and handed control to code the worm supplied. A question about who was home became an invitation to come inside and rearrange the furniture.
The third door was not a bug at all. It was the architecture. Unix machines of the era maintained trust relationships: files named .rhosts and hosts.equiv that declared, in effect, "anyone arriving from that machine, under that name, is one of us, no password required." The worm read those files and walked through the trust, and where trust failed it guessed passwords, working through account names, permutations, and a built-in dictionary of a few hundred likely candidates. On a network built by colleagues, the passwords were often the first thing a colleague would guess, because the network had been designed for people who already knew each other.
None of this was secret knowledge. Every one of these weaknesses was known to the small community that ran the network, the way everyone in a small town knows which doors are unlocked. The worm was, among other things, an audit of that knowledge, performed at machine speed, without asking.
But the worm had a design problem, and Morris knew it. A program that copies itself onto machines will eventually knock on a machine it already occupies. Unchecked, that is how you get two copies, then four, then a machine doing nothing but hosting your census. So Morris built a handshake. Before installing itself, the worm asked the target machine a question: is one of you already running here? If the machine answered yes, the new arrival would, in the normal course of things, politely die. Population control. A census taker who knocks, hears "already counted," and moves on.
Then Morris thought about his colleagues, and he outsmarted himself.
He realized that the moment administrators understood the handshake, they could immunize their machines for free: write a tiny fake program that answered "yes, already infected" to every knock, and the worm would politely die at the door forever, never counted, never present. The census could be defeated by a bluff. So he added an override. One time in seven, the worm would ask the question, hear the answer "yes, already counted," and install itself anyway, on the theory that some fraction of those yeses were lies and the real infections among them were worth catching.
One in seven. About fourteen percent. As a lie detector, it sounds modest. As a replication rate, on machines being knocked on constantly by copies arriving from every direction at once, it was a catastrophe with a short fuse. On a busy, well-connected machine, arrivals came not once but dozens and hundreds of times. Each arrival rolled the dice. Each seventh roll, roughly, installed another full copy of the worm, and every copy consumed processor time, spawned its own attempts to spread, and rolled the dice on its neighbors in turn. The politeness mechanism had become the engine. Machines did not get infected once and report for duty. They accumulated copies the way a drain accumulates hair, until the processor was spending all of its time running the census and none of its time doing anything else. The worm deleted nothing. It stole nothing. It altered no files and carried no payload in the modern sense. It simply asked its one question, over and over, at scale, until ten percent of the internet was too busy answering to do any work.
By the small hours of November 3, the shape of the night was clear at site after site. System administrators arrived to find their machines crawling or frozen, load averages in territory they had never seen, and a process that kept coming back. The response, improvised independently in dozens of places, had a bleak comedy to it: the internet's first responders saved the internet by unplugging it. Sites disconnected their machines from the network entirely. Regional networks cut themselves off from the backbone and from each other to stop recontamination while they cleaned house, and the young internet spent days partitioned into islands, each scrubbing its own machines in isolation. The tool being used to count the network had made the network uncountable, unreachable, in pieces on the floor.
The counterattack, when it came, came from the same culture that had built the vulnerable network in the first place. Teams at Berkeley, at MIT, at Purdue, working through the night on mailing lists that were themselves buckling because sendmail was one of the casualties, disassembled the worm in parallel. Within about a day, the Berkeley group had a decompiled, commented copy of the thing, and the fixes were almost insultingly small: patch the fingerd buffer, turn off sendmail's debug mode, change the passwords. Morris, watching from Ithaca as the scale of it became undeniable, tried to get an apology and instructions out through a friend at Harvard, posted anonymously. The message was delayed for hours in the congestion his own program had created, a return note stuck in a traffic jam of the author's own manufacture. By the time it circulated, the people it was addressed to had already solved the problem without it.
The accounting, such as it was, took longer than the worm did. The General Accounting Office, reporting to Congress the following June, recorded the figure that has attached itself to the incident ever since: press accounts put the toll at about 6,000 computers infected, on an internet of more than 60,000 machines. About one computer in ten, on the entire network, had been knocked over by a graduate student's measurement project. The GAO's estimate of the damage ran from $100,000 to $10,000,000, a range so wide it amounts to the government shrugging in print, and the shrug was honest: nobody had ever had to price a night like that before, because a night like that had never happened before.
The legal system had the same problem. The Computer Fraud and Abuse Act was two years old and had never produced a conviction; the conduct it described had been drafted for a world of break-ins and theft, and here was a defendant who had broken in everywhere and stolen nothing. Morris was indicted in 1989, tried in Syracuse, and convicted by a jury in January 1990, the first person ever convicted under the Act. The argument that he had not intended the damage ran through the whole case and into the appeal, and the appeals court, upholding the conviction in March 1991, settled the point that mattered: the statute punished the unauthorized access and the reckless release, whatever the motive had been. The sentence, handed down in May 1990, was three years of probation, 400 hours of community service, and a fine of $10,050, plus the costs of his supervision. No prison. The court, in effect, priced the difference between malice and carelessness, and carelessness, at internet scale, turned out to be worth a felony record and a decade-defining precedent.
There is one more detail, and it is the best one. The post-mortem meeting on November 8, where the community gathered to work out what had happened and what to build so it would not happen again, was hosted by the National Computer Security Center. The chief scientist of the National Computer Security Center, the NSA's public-facing security arm, one of the foremost authorities on Unix password security alive, was Robert Morris Sr. The father sat in the institutional response to the son. Nobody in that room needed a lecture about how security knowledge and security practice are different things. They were living in the gap.
What they built is the part of the story that outlasted the felony. Within days of the worm, DARPA directed Carnegie Mellon's Software Engineering Institute to stand up a permanent coordination center for exactly the function whose absence had made the night of November 2 so chaotic: a place to call. The CERT Coordination Center, created that November, had no authority to command anyone. It could receive reports, verify them, recruit the right experts, work with vendors, and publish advice that sites were free to evaluate. A switchboard for distributed competence. It worked so well that the model replicated worldwide, and nearly four decades later the institution Morris's census accidentally founded is still answering the phone. The internet's first emergency created the internet's first emergency service, which is not a coincidence. It is the pattern. Institutions are what incidents leave behind when a community decides the incident was tuition.
Morris himself finished the sentence, earned a doctorate at Harvard, co-founded a startup that Yahoo bought, helped start Y Combinator, and became a tenured professor at MIT, the same institution whose terminal he had borrowed for the launch. The internet, for its part, kept the lessons in the form of defaults: debug modes off in production, bounds checks on buffers, trust treated as a liability rather than a convenience, rate limits and replication brakes designed as safety systems rather than performance tuning. Every engineer who has ever put a cap on a retry loop, a ceiling on a fan-out, a circuit breaker on a self-propagating job, is paying a small royalty to November 2, 1988, whether they know the date or not.
Because that is the real lesson, and it is not "do not write worms." The lesson is that a rate limiter is a safety system, in the same sense that a pressure relief valve is a safety system: it is the part that decides whether a mistake stays a mistake or becomes an event. Morris got almost everything else right. He built the handshake. He thought about adversarial responses. He tried, sincerely, to build a polite program. What he shipped was a system whose only throttle was a probability he had picked by feel, one in seven, chosen to defeat a bluff, never tested against the load it would meet on a busy machine at the center of the network. There was no staging internet to test it on. There was only the internet, and so the test ran there, at full scale, on the first try, in production. Every experiment on a live network is a production deploy. Every self-replicating anything inherits the blast radius of the whole network, not the intentions of its author. A claim about what your program will do is not a fact until the program has landed, and the landing is the only audit that counts.
He wanted to know how big the internet was, and the honest answer turned out to be: exactly big enough to notice.
Sources, for the record: the U.S. General Accounting Office report "Computer Security: Virus Highlights Need for Improved Internet Management" (GAO/IMTEC-89-57, June 1989) records the internet's size at more than 60,000 computers, the press estimate of about 6,000 infected, and the damage range of $100,000 to $10,000,000. Eugene Spafford's "The Internet Worm Program: An Analysis" (Purdue University, 1988) is the contemporary technical reconstruction of the worm's three infection vectors and its one-in-seven reinfection behavior. United States v. Morris, 928 F.2d 504 (2d Cir. 1991) is the appellate record of the first conviction under the Computer Fraud and Abuse Act and the sentence of three years' probation, 400 hours of community service, and a $10,050 fine. The CERT Coordination Center's creation at Carnegie Mellon in November 1988, at DARPA's direction in response to the incident, is documented in the Software Engineering Institute's own history of the center.