On November 2, 1988, American computer science graduate student Robert Tappan Morris, then studying at Cornell University, released an experimental computer programme that would go down in history as the Morris Worm, one of the earliest major cyberattacks on the internet.
Morris designed the self-replicating programme as an experiment and released it from the Massachusetts Institute of Technology (MIT) to conceal its origins at Cornell.
However, a programming error caused the worm to spread far faster than he had anticipated, infecting thousands of computers and bringing many systems to a standstill.
The disruption affected universities, military installations and medical research facilities across the United States. An estimated 6,000 computers, representing roughly one-tenth of the internet at the time, were affected.
Programmers at institutions including the University of California, Berkeley, MIT and Purdue University worked around the clock to develop solutions and stop the worm from spreading. Some institutions disconnected their computers from the internet as they tried to contain the damage.
Morris was later identified as the author and convicted under the Computer Fraud and Abuse Act. He was sentenced to three years of probation, 400 hours of community service and fined $10,050.
The incident became a landmark moment in computer security, exposing vulnerabilities in internet-connected systems and highlighting the risks posed by self-replicating malicious programmes.
