How did a Cornell graduate student’s 99-line bootstrap program in November 1988 infect roughly 6,000 machines — about 10 per cent of the early internet — and force universities to invent the first computer emergency response team?

Twelve days later, the Defense Advanced Research Projects Agency stood up the first computer emergency response team at Carnegie Mellon. It was rsh and rexec, the remote-shell utilities that trusted any machine listed in a user’s .rhosts file or in /etc/hosts.equiv. On 8 November, more than seventy-five researchers and administrators gathered for a post-mortem hosted by the National Computer Security Center, the National Security Agency division whose chief scientist was Robert Morris Sr, the author’s father. Six days after the release, Scherlis and Stephen Squires sent a confidential memo to the agency’s director proposing a round-the-clock National Computer Infection Action Team, a focal point for prevention, coordination and awareness. The Morris worm is usually introduced as the first internet worm, which is true and slightly beside the point.