November 2, 2026: Trust Was the Only Lock

On the evening of November 2, 1988, Robert Tappan Morris, a 23-year-old computer science graduate student at Cornell University, released a self-copying program onto the early internet.

He sent it from a computer at MIT so nobody would trace it back to Cornell. The program, later known as the Morris worm, got in through weaknesses that a network built on trust among universities, research labs, and government contractors had never bothered to close. Those included a debugging feature in the sendmail email program, machines that accepted logins from computers they recognized, and passwords that were easy to guess.

Morris's motive is still told two ways. The federal appeals court that heard his case said the goal was to show how weak the network's security was, while accounts credited to Morris describe an attempt to gauge the network's size. Either way, one design choice turned it into a crisis. To keep administrators from blocking it, Morris told the worm to reinfect a machine one time in seven even when a copy was already running. Copies piled up until computers on both coasts slowed to a crawl or stopped. Teams at Berkeley, MIT, and Purdue worked around the clock to take it apart, while DARPA scientists William Scherlis and Stephen Squires coordinated a national response with no playbook.

The fallout changed how organizations think about their networks. That same month, DARPA had Carnegie Mellon University set up the Computer Emergency Response Team, the model for hundreds of response teams around the world. Morris became the first person indicted under the Computer Fraud and Abuse Act of 1986, was convicted in 1990, and was sentenced to probation, community service, and a $10,050 fine. He later co-founded Viaweb and Y Combinator and became a professor at MIT.

Written and hosted by Ron Trucks. Research and editing by Rodney Russ. Sound design by Angela Cahoy. Music by Cody Martin and Soundstripe.

Visit us at www.bsnsDailyPodcasts.com