How a Need for Challenge Seduced Computer Expert

By John Markoff
The New York Times

November 6, 1988

Robert Tappan Morris spent many weeks painstakingly creating the computer ''virus'' that beleaguered many of the nation's computer networks Wednesday night and Thursday.

By all accounts the 23-year-old computer science student intended no harm. But in the end, working with great intensity and little sleep, he made a single programming error that ultimately jammed more than 6,000 computers in what is being called this country's most serious computer ''virus'' attack.

That mistake also brought Robert Morris's life crashing down around him, three friends have told The New York Times. He quickly recognized that things had gone terribly wrong and, they disclosed, he arranged for a friend to send out instructions on eradicating the virus to the same computers plagued by it. But, in another miscue, the instructions were electronically posted in a place where few would see them.

Exploring the Crannies

Then he turned himself in to his father, Robert Morris, a top Government expert on computer security. The elder Mr. Morris said he met with F.B.I. agents yesterday to discuss the matter.

Also yesterday, officials at Cornell University, where the younger Morris is a first-year graduate student in computer science, said they had discovered that his computer files had a list of passwords like those found in the computer virus.

Computer viruses are the computer equivalent of biological viruses, spreading largely on their own from computer to computer. They consume computer processing power and storage space and can sometimes destroy stored information.

The case, with all its bizarre twists, illuminates the cerebral world of a father and son - and indeed a whole modern subculture - obsessed with the intellectual challenge of exploring the innermost crannies of the powerful machines that in the last three decades have come to control much of society.

That a remarkable demonstration of computer vulnerability, with more than 6,000 computers halted or slowed for a day and a half, should be made by the son of a top computer security official is less surprising than it first appears, people who know both father and son say.

Both men are well versed in a field in which a ''game playing'' mentality is essential: To make computers more secure, one must first be able to understand how to break into them. ''It's absolutely imperative - you must do that,'' said M. Douglas McIlroy, a computer scientist at American Telephone and Telegraph's Bell Laboratories under whom both father and son worked at different times. ''You must be able to think of how to subvert them.''

Described as 'Caring'

The first-year Cornell University graduate student was not available for comment yesterday. But those who knew him as a student at Harvard, where he earned an undergraduate degree in computer science, paint a picture of a remarkably bright but private person. They said he at first seemed an ''inept,'' socially awkward person with a passion for computers, but was really a ''caring'' and ''thoughtful'' young man. They said he was not vindictive and was horrified at the consequences of his virus program.

His parents said he had obtained an attorney and was planning to meet shortly with United States Justice Department officials. The department is continuing an inquiry into whether Federal laws were violated.

The senior Mr. Morris, 56, himself a graduate of Harvard, worked for many years at Bell Labs in New Jersey, where he developed a passion for the world of computer security. He helped develop the Unix operating system, which is the standard operating system for technical computing and was the target of his son's virus.

Two years ago, Mr. Morris left Bell Labs and went to work as the chief scientist for the National Computer Security Center, the division of the National Security Agency that focuses on computer security. The agency itself is responsible for gathering electronic intelligence and protecting the nation against electronic spying.

With the move to the National Computer Security Center, he plunged into the ''wilderness of mirrors'' world of the intelligence community with a passion, associates of his said.

''He views his work as an incredibly complex set of abstractions,'' said one computer security specialist who has worked with him frequently in the last two years. ''If you ask him a question he will say: 'What level are you looking at? Are you looking for what's obvious or what's subtle, or what's buried beneath it?' ''

His son became captivated with computers as a teen-ager in New Jersey, those who know the family say.

Those who knew him later at Harvard say he was unchallenged by many normal programming activities, and that may have led to the programming experiment that went awry this week.

''Robert was really brilliant, and so for him simple things like generating a crossword puzzle or graphics program weren't that exciting,'' said Andy Suddugh, assistant systems manager at the Aiken Laboratory at Harvard, where Mr. Morris had a part-time job.

Jumped Up on a Desk

A friend said that when Mr. Morris discovered the flaw that would let him secretly enter Unix computers connected to the Arpanet, a Department of Defense computer research network, he was so excited that he jumped on the friend's desk and paced around on top of it while describing the entry point.

This friend and others said Mr. Morris's original vision was to spread a tiny program widely throughout the United States and the world and have it secretly take up residence in the memory of each computer it entered. The program was supposed to propagate slowly from machine to machine, always hiding in the background to escape detection.

But because the young computer expert chose a single incorrect number, and that number bore directly on the rate of replication, the virus instead sped madly out of control, creating dozens or hundreds of copies on each machine it entered rather than the one copy originally planned.

'He Probably Got Scared'

At Harvard yesterday, Mr. Morris's professors were shocked that he undertook the project.

''What surprises me about this is that it cuts across the grain of Robert's personality,'' said Mark Friedell, the assistant professor of computer science who was the young student's adviser for three years. ''He probably got scared and froze; he could have stopped it. When he saw this thing getting out of hand, he should have got on the horn and called a few people. That is a shame; he could have saved us.'' Harvard's computers linked to Arpanet were among those jammed by the virus.

Mr. Morris learned of his replication error through a monitoring mechanism he had built into his program. Each second, each virus broadcast its location to a computer named Ernie at the University of California at Berkeley.

In trying to alert people to the virus after discovering his error, Mr. Morris had a friend post detailed instructions on how to disable it. The friend said he posted the instructions with an electronic ''discussion group,'' but it was an obscure one. He said he regretted not having chosen a more prominent group.

A Resource Even for Teachers

At Harvard Mr. Morris was viewed by even teachers as the campus's Unix expert, one who could help with intricate technical details. ''He was extremely, extremely quick and was a very valuable resource to us,'' said Harry R. Lewis, a Harvard computer scientist. ''For bugs in systems he could very quickly figure out what to do.''

Both he and Professor Friedell portrayed Mr. Morris as a technical wizard who showed no signs of malicious behavior. Both teachers said that if he had wanted to, he could have designed a program capable of massive damage to the Arpanet.

The computer science community is split about the gravity of what Mr. Morris did. Around the country, computer managers who have spent days battling the program have expressed widespread anger.

''I take this kind of stuff very seriously even if it was accidental,'' said M. Stuart Lynn, Cornell's vice president of information technologies. ''It takes time away from productive work, and we don't think it's funny.''

Other computer security experts argued that the virus was an important and useful demonstration of the potential vulnerability of computers.

'A Folk Hero'

''When all is said and done, this kid is going to come down as a folk hero,'' said Peter Neumann, a computer security expert at SRI International, a research center in Menlo Park, Calif., who has frequently warned that not enough thought is given to security matters.

''On balance,'' he said, ''the net effect of what has happened will be extremely positive - if the computer community responds with significantly increased awareness.''

GRAPHIC: Photos of Robert T. Morris (Harvard University) (pg. 1); Robert Morris, father of Robert T. Morris (NYT/Marty Katz from ABC News) (pg. 30)

Copyright 1988 The New York Times Company