One student's worm brought the early internet to its knees

A measurement tool that could not stop measuring

Robert Tappan Morris’s worm was designed to move from one internet-connected computer to another and estimate how large the network was. A worm is a program that spreads between computers on its own, without needing users to copy it manually.

To travel, Morris’s program took advantage of weaknesses in Unix systems, including flaws in network services and easily guessed passwords. Once it reached a machine, it could use that machine to seek out others. The internet in 1988 was far smaller than today’s, but many connected computers were powerful university and research mainframes shared by numerous users.

The safeguard that backfired

Morris tried to keep the worm from repeatedly infecting computers that were already running it. But if the program trusted a machine’s report that it was infected, an administrator could potentially fool it into staying away. Morris therefore made the worm check again sometimes—even when a copy was already present.

That precaution had a dangerous side effect: a computer could acquire multiple copies. As the worm spread, those copies consumed processor time and memory, slowing machines so severely that users could not reliably work on them. The worm did not need to erase files to cause major harm; simply multiplying was enough to clog thousands of mainframes.

A network forced to respond together

The incident exposed how quickly a program could cross institutional boundaries—and how little coordination existed for responding to a network-wide emergency. Administrators traded advice and fixes as they tried to remove the worm and close the routes it had used. The episode helped spur the creation of dedicated computer-security response teams, including CERT/CC, which coordinates responses to internet security incidents.

Morris’s father was a senior computer-security expert at the National Security Agency, but the worm’s damage came from a specific technical failure: a program built to count the network kept making copies until the network’s computers could barely function.