Robert Tappan Morris

Robert Tappan Morris was born on November 8, 1965, the son of Robert Morris, a Bell Labs computer scientist who had helped design the Multics and Unix operating systems and who later served as chief scientist of the National Security Agency's National Computer Security Center. The younger Morris earned a bachelor's degree from Harvard University. In 1988 he was a first-year PhD student in computer science at Cornell University.

In November 1988, Morris released a self-replicating program onto the early Internet, exploiting known vulnerabilities in sendmail, the fingerd daemon, and weak rsh/rexec authentication to spread between machines running BSD-derived Unix. He released the program from an MIT computer rather than Cornell's network, reportedly to obscure its origin. Morris had built in a check meant to keep the worm from infecting a machine already infected, but a bug in that logic caused it to reinfect systems repeatedly, which drove uncontrolled, exponential replication. Within about a day the program had spread to an estimated ten percent of the roughly 60,000 machines then connected to the Internet, disabling systems at universities, NASA, and military research sites.

Prosecution

Morris was indicted in 1989 and, in 1990, became the first person convicted under the Computer Fraud and Abuse Act of 1986. He was sentenced to three years of probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. His appeal to the U.S. Court of Appeals for the Second Circuit was rejected in United States v. Morris (1991), which held that the government needed only to show he intentionally accessed computers without authorization, not that he intended to cause the resulting damage — a ruling that prompted Congress to further clarify the law's intent requirements in 1996.

Later career

Morris went on to earn a PhD from Harvard University in 1999, with a dissertation on scalable TCP congestion control. In 1995 he co-founded Viaweb with Paul Graham, one of the first web-based applications for building online stores; Yahoo! acquired the company in 1998 for roughly $49 million and relaunched it as Yahoo! Store. In 2005 Morris joined Graham, Jessica Livingston, and Trevor Blackwell in co-founding the startup accelerator Y Combinator.

MIT and legacy

Morris joined the MIT faculty in the Department of Electrical Engineering and Computer Science, where he received tenure in 2006 and continues to serve as a professor working on computer systems and networking. He received the SIGOPS Mark Weiser Award in 2010, was elected an ACM Fellow in 2014, and was elected to the National Academy of Engineering in 2019. His career trajectory — from the defendant in the case that defined the CFAA to a tenured professor at one of the world's leading computer science departments — is frequently cited as emblematic of how the hacker and academic communities intertwined in the decades following the Morris Worm.

Timeline

• 1965-11-08Born in the United States, son of Bell Labs/NSA computer scientist Robert Morris.
• 1988As a Cornell graduate student, releases a self-replicating program (the Morris Worm) from MIT; a bug causes it to spread uncontrollably.
• 1990-12Sentenced to three years probation, 400 hours community service, and a $10,050 fine as the first person convicted under the Computer Fraud and Abuse Act.
• 1995Co-founds Viaweb with Paul Graham.
• 1998Yahoo! acquires Viaweb for about $49 million; relaunched as Yahoo! Store.
• 1999Earns a PhD from Harvard University.
• 2005Co-founds the startup accelerator Y Combinator.
• 2006Receives tenure as a professor in MIT's Department of Electrical Engineering and Computer Science.
• 2019Elected to the National Academy of Engineering.