The Worm and the Accelerator: Robert Morris and Y Combinator
Zusammenfassung
Robert Tappan Morris released the Morris Worm on November 2, 1988 — the first major worm to propagate across the internet, infecting approximately 6,000 computers (10% of all internet-connected machines at the time). He was the first person convicted under the US Computer Fraud and Abuse Act. He served no prison time, paid a $10,050 fine, and did 400 hours of community service. He went on to complete a PhD at Harvard, become a professor at MIT’s CSAIL, and co-found Y Combinator — the most influential startup accelerator in Silicon Valley history, which has funded Dropbox, Airbnb, Stripe, Reddit, and hundreds of others.
The Worm
Morris was a graduate student at Cornell when he released the worm. He later said his intent was to measure the size of the internet — to count how many connected machines existed — not to cause damage. The worm exploited three vulnerabilities: a buffer overflow in sendmail, a debugging feature in fingerd, and a weakness in the rsh/rexec remote execution protocols.
The worm spread by exploiting these vulnerabilities, installing itself on new machines, and then continuing to spread. A programming error caused it to reinstall itself repeatedly on machines it had already infected, consuming resources until the machines became unusable. This was not intentional; the error was Morris’s failure to properly implement the check that was supposed to prevent multiple installations on the same host.
The cleanup cost was estimated at $100,000–$10 million across affected institutions. The CERT/CC (Computer Emergency Response Team / Coordination Center) was founded at Carnegie Mellon in the worm’s immediate aftermath — the first national computer security response organization.
The Trial
Morris was convicted under 18 U.S.C. § 1030, the Computer Fraud and Abuse Act, in January 1990. The case was the first CFAA prosecution. He was sentenced to three years of probation, 400 hours of community service, and fined $10,050. His defense argued that the worm was not designed to cause damage; the prosecution argued that causing damage was not a required element of the offense.
His father, Robert Morris Sr., was the chief scientist of the NSA and had independently developed a list of UNIX security vulnerabilities. The parallel between father (finding vulnerabilities for security purposes) and son (exploiting them, however unintentionally) was noted widely.
Y Combinator
After completing a Harvard PhD in computer science, Morris joined MIT as a faculty member at CSAIL. In 2005, he co-founded Y Combinator with Paul Graham, Jessica Livingston, and Trevor Blackwell. The firm invested small amounts ($12,000–$20,000 per company initially) in startups selected through twice-yearly application cycles and a three-month intensive program.
Y Combinator companies have included: Dropbox, Airbnb, Stripe, Reddit, Twitch, DoorDash, Instacart, Coinbase, OpenAI (as a nonprofit), and thousands of others. Total combined valuation of YC alumni exceeds $600 billion. The accelerator model YC pioneered — small checks, intensive mentorship, network effects from a cohort structure — has been replicated worldwide.
The trajectory from CFAA conviction to co-founder of the most influential startup organization in technology history is unusual. The History of Hacking traces how the culture that produced the Morris Worm also produced many of the people who built the modern internet.