Robert Tappan Morris: Life After the Internet Worm
On the evening of November 2, 1988, a 23-year-old graduate student logged into a computer at MIT and let loose a program he'd written in Ithaca, New York. By morning, machines from Berkeley to Boston were grinding to a halt.
The program stole nothing and deleted nothing. It was built to spread quietly and leave no mark, and a single number buried in its code turned it into the first worm to cripple the internet.
The student was Robert Tappan Morris, the son of the government's top computer-security scientist. What came next, a federal courtroom, a borrowed name, a $49 million deal and a chair at MIT, is one of the strangest second acts in computing.
Robert Tappan Morris at a Glance
- Morris was born in 1965 and raised near Morristown, New Jersey, on a Colonial estate where the lawn was trimmed by a flock of sheep. His father, Robert Morris Sr., spent 26 years at Bell Labs working on Unix before becoming chief scientist of the NSA's computer-security center.
- He graduated from Harvard in 1988 and entered Cornell's computer science PhD program that fall. He'd been there two months when he wrote the worm.
- On November 2, 1988, he released it from an MIT computer to hide its Cornell origin. It broke into machines four ways: a sendmail bug, a finger-daemon bug, trusted-host logins and password guessing.
- A one-in-seven reinfection rule, meant to defeat fake "already infected" replies, made the worm copy itself far more often than planned. By Cornell's estimate it hit about 6,000 computers, and cleanup cost sites anywhere from $200 to more than $53,000 each.
- A Cornell commission called the worm "a juvenile act that ignored the clear potential consequences" and suspended him.
- In January 1990 a jury in Syracuse convicted him under the 1986 Computer Fraud and Abuse Act. He got three years' probation, 400 hours of community service and a $10,050 fine. The Second Circuit upheld the conviction on March 7, 1991.
- In 1995 he co-founded Viaweb with Paul Graham, listed on the company's site under a pseudonym. Yahoo bought it in June 1998 for about $49 million in stock and renamed it Yahoo Store.
- He earned a Harvard PhD in 1999, joined the MIT faculty the same year, won tenure in 2006, put up $50,000 to help start Y Combinator in 2005 and was elected to the National Academy of Engineering in 2019.
The Life of Robert Tappan Morris
A Lawn Mowed by Sheep
Robert Tappan Morris grew up in a house where computer security was dinner-table talk. His father, Robert Morris Sr., joined Bell Labs in 1960 and spent 26 years there, helping build Unix and designing the scheme that scrambled its passwords.
In 1986 the elder Morris left for the National Security Agency, where he became chief scientist of its National Computer Security Center. The family lived near Morristown, New Jersey, on a modest Colonial estate where, as the Los Angeles Times reported, the lawn was trimmed by sheep.
Paul Graham, who'd become his closest friend at Harvard, remembered a household that "really knew how to live," minus junk food, pop music and television. Morris went to the Peck School and then Delbarton, a Benedictine boys' school whose headmaster summed him up as "bright, gifted, talented, but other than that, pretty ordinary."
Harvard and the Aiken Lab
At Harvard, Morris found his crowd at the Aiken Computation Laboratory, the building where the university's hackers lived. He was good enough at Unix that friends assumed he was headed for his father's field.
He finished his A.B. in 1988 and chose Cornell for his PhD. The appeals court that later reviewed his case put it plainly: through his Harvard work and "various jobs he had acquired significant computer experience and expertise."
What he hadn't acquired was a sense of how fast a clever idea could get away from him.
Two Months at Cornell
Morris arrived in Ithaca in the fall of 1988 and was given an account on the computer science department's machines. Within weeks he was writing a program designed to copy itself from computer to computer across the internet, which then connected roughly 60,000 machines at universities, labs and military sites.
- Cliff Stoll's true story of tracing a tiny billing discrepancy at Berkeley to a KGB-funded hacker, told like a thriller. The first great hacker-hunting book, still unmatched.
The worm had four ways in. It used a bug in sendmail, the program that moved email between computers, and a bug in the finger daemon, which let users look up who was logged in elsewhere.
It also rode the "trusted hosts" feature, which let a user on one machine log into another without a password. And it guessed passwords, trying combinations in rapid sequence until one worked.
Each new victim was asked whether it was already infected. To stop administrators from faking a "yes," Morris told the worm to copy itself anyway every seventh time it heard that answer. It was supposed to be a safety valve, and it became the whole problem.
The Night of November 2
Morris released the worm on the evening of November 2, 1988, from a computer at MIT, chosen, the court record says, "to disguise the fact that the worm came from Morris at Cornell."
He underestimated how often a machine would be asked the question. The one-in-seven rule meant computers were infected again and again, each copy eating memory and processor time, until the machines slowed to a crawl or crashed. A Berkeley researcher sent out a message that began, "We are currently under attack."
Morris saw it happening and panicked. He phoned Paul Graham at Harvard, and in the small hours another friend, Andy Sudduth, posted an anonymous message with instructions for stopping the worm. It opened with the words "I'm sorry."
The apology took about two days to arrive. Sudduth had routed it through a relay to hide its origin, and the relay was buried under the email backlog the worm itself had caused.
The Hunt and the Headlines
Within days the New York Times had Morris's name, and the FBI was in Ithaca. The internet of 1988 was small enough that everyone knew everyone, and the story was irresistible: the NSA's own security chief, undone by his son.
Reactions split by age. At the Aiken lab, hand-drawn posters appeared reading "RTM Lives: The Fall Tour." Cornell's computer science director, Dean Krafft, called the worm "stupid and thoughtless."
Cornell appointed a commission, which reported in April 1989 that Morris had worked alone and that the worm wasn't a heroic demonstration of weak security but "a juvenile act that ignored the clear potential consequences." The university suspended him for a year.
- Scott Shapiro tells five landmark hacks in depth, including the Mirai botnet and the Minecraft feud that built it. The clearest account of how Paras Jha's code took down the internet.
United States v. Morris
Congress had passed the Computer Fraud and Abuse Act in 1986, and Morris became its most famous test. In January 1990 he stood trial before a jury in Syracuse, testifying that the worm had simply gone out of control.
The jury convicted him. In May 1990, Judge Howard Munson rejected a prison term, although federal guidelines pointed to 15 to 21 months, and sentenced Morris to three years of probation, 400 hours of community service, a $10,050 fine and the costs of his supervision.
His lawyers appealed, arguing that the law required proof he intended damage, not just intended access. On March 7, 1991, the Second Circuit disagreed and affirmed, the first appeals-court reading of the statute and a precedent prosecutors have leaned on ever since.
Even the government softened over time. Mark Rasch, who prosecuted the case, told the Washington Post in 2013 that he'd support a pardon.
A Pseudonym and a $49 Million Exit
Morris went back to Harvard for his doctorate, and in 1995 he and Paul Graham started Viaweb, software that let merchants build online stores through a web browser, something nobody had done before.
Morris was so allergic to publicity after the worm that he refused to put his name on the company's website. Graham negotiated a compromise: his bio could appear, under the name John McArtyem.
- Katie Hafner and John Markoff, the reporter who put Morris's name in the New York Times in 1988, devote a third of this classic to the worm: the Aiken lab, the night it got loose and the trial in Syracuse. The other two parts follow Kevin Mitnick and Germany's Chaos Computer Club.
On June 8, 1998, Yahoo announced it was buying Viaweb for about $49 million in stock, roughly 455,000 shares. The product became Yahoo Store, and the pseudonymous co-founder became a very quiet millionaire.
Professor Morris
He completed his Harvard PhD in 1999 and joined the MIT faculty the same year, working on networking and operating systems. MIT granted him tenure in October 2006.
His research produced some of the field's most cited systems work, and in 2019 the National Academy of Engineering elected him a member for contributions to programmable network routers, wireless mesh networks and networked computer systems.
He also kept backing Graham's ideas. When Graham, Jessica Livingston and Trevor Blackwell started Y Combinator on March 11, 2005, Morris put in $50,000 of the first $200,000, making him a co-founder of the accelerator that later funded Airbnb, Stripe and Dropbox.
Graham has written that Morris has "a very unusual quality: he's never wrong," because he never says anything he isn't fairly sure of. By Graham's count, the one exception came as an undergraduate, when Morris declared that little desktop computers would never be suitable for real hacking.
Robert Tappan Morris: The Experiment That Got Away
Morris's worm did more than crash a few thousand computers. It created the Computer Emergency Response Team at Carnegie Mellon, put a federal statute to its first real test and taught a generation of administrators that a network of trusting machines is a network waiting to fall.
Its author never gave interviews about it and never needed to. He let the work speak: a company that defined online retail, a lab that shaped how networks are built, and a seed fund that reshaped Silicon Valley.
The man who once brought down the internet now teaches people how to keep it running. He still doesn't say much, and by Graham's reckoning, he's still right.
What Is a Computer Worm?
Cliff Stoll: The 75-Cent Clue Behind The Cuckoo's Egg
QUOTE:
"Amateurs hack systems, professionals hack people."