The Morris Worm: The Night the Internet Got Sick
On November 2, 1988, a graduate student's experiment spread across the internet and led to the first felony conviction under a new computer crime law.
By the InterStalgia history desk · November 14, 2026
In 1988 the internet was still a network of universities, labs and government sites, the kind of place where people left their doors unlocked because they knew their neighbors. On the evening of November 2, that changed.
8:30 p.m.
Robert Tappan Morris was a graduate student at Cornell University. That night he released a self-copying program onto the internet. It spread from one computer to the next, targeting VAX computers and Sun-3 workstations running Berkeley Unix, the operating system much of the research world used. A friend later said Morris wrote it simply to see whether it could be done. He launched it from the Massachusetts Institute of Technology rather than Cornell, so it wouldn't be traced straight back to him.
It wasn't built to destroy files. The problem was that it copied itself much more aggressively than intended. Infected machines got slower and slower until they were useless, and system administrators spent days cleaning it up. Clifford Stoll, author of The Cuckoo's Egg, pointed out how lucky everyone was that the internet ran on a mix of systems. If every machine had run Berkeley Unix, he said, the worm could have taken down all fifty thousand of them.
How many?
The number you'll usually see is about 6,000 infected Unix machines. Even that figure is fuzzy. Paul Graham, then a Harvard student who knew Morris, later said he was there when that statistic was cooked up: someone guessed there were about 60,000 computers on the internet and that the worm might have hit ten percent of them.
The first conviction
Morris was tried under the Computer Fraud and Abuse Act of 1986, and his case became the first felony conviction under that law. After appeals, he was sentenced to three years' probation, 400 hours of community service and a fine, plus the costs of his supervision. One more detail made the story stranger: his father, also named Robert Morris, was a cryptographer at the National Security Agency.
What changed
The Morris worm was the internet's first big security wake-up call, and it made national news at a time when most Americans had never used the internet. A floppy disk holding its source code is now kept at the Computer History Museum. The bigger change was cultural. After November 1988, nobody running a computer on the internet could assume that everyone else on it meant well.