By the time the real assessments had been made, the identity of the author of the worm had been discovered. He was Robert Morris, Jr., a twenty-three-year-old graduate of Harvard University and, at the time of the incident, a postgraduate student at Cornell. Far from being an embittered hacker or an outsider, he was very much the product of an "insider" family. His father Robert Morris, Sr., was the chief scientist at the National Computer Security Center, a nationally recognized expert on computer crime, and a veteran of Bell Laboratories. He was, coincidentally, also one of the three designers of a high-tech game called Core Wars, in which two programs engage in battle in a specially reserved area of the computer's memory. The game, which was written in the early 1960S at Bell, used "killer" programs that were designed to wipe out the defenses of the opponent. The curious similarities between Core Wars and the Internet Worm were often cited in press reports.
Morris received an enormous amount of publicity after his identity became known. His motives have been endlessly reviewed and analysed, especially in a recent book, Cyberpunk, that was partly devoted to the Internet Worm. The consensus was that Morris wrote a program that fulfilled a number of criteria, including the ability to propagate widely, but that he vastly underestimated the speed at which it would spread and infect and then reinfect other machines.
He himself called the worm "a dismal failure" and claimed that it was never intended to slow computers down or cause any of them to crash. His intention, he said, was for the program to make a single copy on each machine and then hide within the network. When he realized, on the night of November 2nd, that his program was crashing computers on the linked networks, he asked a friend, Andrew Sudduth, to post an electronic message with an apology and instructions for killing the program. That was the message sent out at 3:34 A.M., the one overlooked in the general confusion.
Morris was indicted for "intentionally and without authorization" accessing "federal-interest computers," preventing their use and causing a loss of at least $1,000 (that figure being the minimum loss for an indictment). The charge, under a section of the 1986 Computer Fraud and Abuse Act, potentially carries a fine of $250,000 and up to five years in prison.
Morris was tried in January 1990. His defense lawyers said that be had been attempting to "help security" on Internet and that his program had simply gotten out of control. The prosecution argued that "the worm was not merely a mistake; it was a crime against the government of the United States."
On January 22nd a federal jury found Morris guilty, the first conviction under that particular section of the 1986 act. Despite the verdict the judge stated that he believed the sentencing requirements did not apply in Morris's case, saying the circumstances did not exhibit "fraud and deceit." The sentence given was three years' probation, a fine of $10,000, and four hundred hours' community service.
The type of program that Morris had released onto ARPANET, a worm, has been defined as a program that takes up residence in a computer's memory, similar to the way a real worm takes up residence in an apple. Like the biological worm, the electronic one reproduces itself; unlike the real-life worm, however, the offspring of a computer worm will live in another machine and generally remain in communication with its progenitor. Its function is to use up space on the computer system and cause the machine to slow down or crash.
To researchers there is a clear distinction between worms and viruses, which are a separate sort of malicious program that require a "host," a program or file on a disk or diskette that they can attach themselves to. Viruses almost always have a payload as well, which is designed to change, modify, or even attack the system they take residence on. Worms can also usually be destroyed by closing down the network.
The fact that worms can travel independently from one linked machine to another has always intrigued programmers, and there have been many attempts to harness this ability for beneficial purposes. Ironically, one of the first experiments was made on ARPANET. A demonstration program called Creeper was designed to find and print a file on one computer, then move to a second and repeat the task. A later version not only moved through computers performing chores, but could also reproduce, creating perfect clones of itself that would undertake the same chores and replicate again. The problem became obvious: the number of worms would increase exponentially as each generation replicated, creating a seemingly endless number of clones.
