On November 2, 1988, a programme written by Robert Tappan Morris, a graduate student at Cornell, was released on the internet and copied itself from one machine to another faster than the network could carry it, and within hours several thousand computers at universities and research centres had slowed or stopped. Estimates of the number range from two thousand to six thousand, and at the time the network had only about sixty thousand machines linked to it, most of them at universities and government laboratories. The code was small. The damage was wide. Nothing was meant to be destroyed.
The worm used three known flaws and a list of common passwords to get in, and it copied itself to each machine it reached, and a mistake in the design made it copy itself again and again on the same machine, so a single host was soon running many copies and had no room to work. The design was faulty. Administrators disconnected their machines from the network and worked for days to clear it, and some sites were cut off for a week or more.
Morris said he had wanted to measure how large the network was, and the case went to court, and in 1990 he was convicted of a felony under the Computer Fraud and Abuse Act and fined, and given three years of probation and community service. The case was the first of its kind. It also led to the creation of the first computer emergency response team, which was set up at Carnegie Mellon within weeks so that a similar event could be handled with better information.
The event turned network security from a subject for specialists into a matter of public policy, and it showed that a small piece of code and a single mistake could reach across the world in a day. Later worms used the same method with far more damage. The internet of 1988 was a research network of a few thousand hosts, and the lesson stuck.