'Virus' Whiz Kid Morris Was Hacker, Prankster

Robert T. Morris '87-'88, who masterminded the "virus" program that immobilized computers across the country, studied computer security intensely while at Harvard, where he was known as a creative but innocuous prankster, associates said in interviews this weekend.

Termed a "classic hacker," the Dunster House graduate is portrayed by friends as an avid computer buff who spent long hours toying with computers to the exclusion of his studies.

Morris, who was known as "RTM" among his close-knit circle of computer friends, developed a reputation as a friendly practical joker who liked to amuse his colleagues.

"When something went wrong at a work station, people would look at him and he would say, 'No, it wasn't me,'" said Mark J. Nitzberg, a computer graduate student, who knows Morris. "But he's not a criminal."

A typically inventive and nettlesome prank devised by Morris was a program that automatically sent computer users into an adventure game if they made typing errors while trying to enter an electronic mail system, friends said.

The game--dubbed "MIAL" after one of the common spelling errors it exploited--sent the user on a series of adventures from which it was difficult to exit. Morris maintained a file which recorded the moves that players made when they entered the game.

"Some people played it, and some people started cursing at it," said Gregory J. Kuperberg '87, who worked closely with Morris on computer projects while they roomed together in Dunster House.

While many friends declined to label the first-year Cornell graduate student a genius, they said hard work and an incredible enthusiasm for the subject created a potent programming ability. They said, however, that any computer graduate student was capable ofcreating the virus that entered the NationalSecurity Agency's computer system, haltingterminals at many of the premier researchinstitutions in the country and the Pentagon.

Friends said Morris was fascinated by computersecurity and had given several talks on securingsystems similar to the one he broke into.

He had also done considerable work with BellLabs in New Jersey, at the DEC systems researchlab in Palo Alto, Calif., and as recently as lastsummer worked as an assistant in Aiken ComputationLab.

Through his links with Aiken, Morris developeda close circle of friends at Harvard whom hecalled upon when the virus went awry.

Morris, who has remained silent in spite ofheavy national media attention, is a privateperson who would never have run an experiment ifhe thought it would draw attention to him, hisfriends said.

"He's not talking to the press because hedoesn't want to seem like he's taking credit forit or he's proud of it," said Paul Graham, aHarvard graduate student who has worked withMorris. "It was a mistake."

They said he was primarily motivated bycuriosity and never intended any maliciousconsequences to his actions.

"In some sense, it was an experiment, it wastomfoolery," said Kuperberg, now a graduatestudent at the University of California atBerkeley. "If it had worked properly, no one wouldhave noticed it, and he would have seen itprogress and be amused by it."

Morris, now a Cornell graduate student, iscurrently under investigation for his role ininitiating the virus that disabled some 6000computers on Wednesday. Though the virus causedmany computers to become unusable, it never becamea serious threat to any aspect of nationalsecurity, computer experts said.

His friends point out in his defense that withthe kind out access Morris had, he could havedestroyed data at all the research labs linked tohis terminal.

Ironically, Morris' father, Robert Morris Sr.'54 is a nationally known computer expert whospecializes in securing the UNIX system that hisson penetrated.

"Because of his father, he's very familiar withUNIX security, and it's not hard for him to defeatit," said Pella Harbury '88, who was the youngerMorris' roommate.

But, it is common occurrence for people whowork on computer security to learn first how asystem can be cracked.

While an undergraduate, Morris took ComputerScience 148, "Introduction to VLSI Design," anddid a project on UNIX security as part of hiscourse requirements.

Assistant Professor of Electrical EngineeringJames J. Clark, who directed Morris' project inthe spring of 1987, said the effort involveddesigning a more efficient way of encodingpasswords to the UNIX system. These codes aredesigned to prevent unauthorized entry into thecomputer system.

But Clark, who called Morris "a very goodhacker," said he did not believe that the projectwould have helped Morris inject his virus into theUNIX system.

Friends said Morris was the unfortunate victimof a small programming error that made a minorexperiment turn into a national disaster.

"I think Robert just didn't think about it--itwas one of these things where his brain had beenturned off--he just wasn't thinking," saidAssistant Professor of Computer Science MarkFriedell, who advised Morris' thesis and spoke tohim several days before the virus was made public."I can understand the technical miscalculation--itwas something I could have made late at nightmyself."

While Friedell praised Morris' ability, headded that the UNIX system, which Morrispenetrated, was known to have dozens of seriousloopholes which could be used by an experiencedhacker.

"I wouldn't have been surprised if it were anyof the people you work with" at Aiken, saidNitzberg, a mathematics graduate student.

Morris got much of his experience in computersat Bell Labs, where his father worked beforejoining the National Security Agency as aspecialist in computer security. While at Bell,colleagues say, he met Dennis Ritchie, one of theoriginal developers of the UNIX system. Harvardprogrammers learned of the younger Morris throughRitchie who told Harvard contacts to watch for thefreshman.

"He said, 'Keep after this kid, he's brilliant,but he can also get through security holes,'" saidAndrew H. Sudduth '83-'85, a Harvard systemsadministrator and Olympic crew medalist. Accordingto Sudduth, the Bell expert added that Morris "isdeveloping a sense of ethics."

Morris was hired at Harvard's Aiken ComputationLab during his freshman year and continued to workthere until he graduated this spring. Colleaguessaid that Morris was unusually helpful and thatthey went to him for advice in solving difficultproblems. "To do what RTM did for us free wouldhave cost us $100,000 a year," said Graham.

While he was a serious programmer at Aiken,friends and colleagues say Morris' computingfrequently had a lighter side. Morris created aprogram that would write crossword puzzles,friends remembered.

Sudduth yesterday recalled coming into Aikenand finding the lab cluttered with puzzles thecomputer had generated. "He sat down and did it ona whim," Sudduth said.

During long hours at Aiken, Morris also createda program that generates high-quality picturesthat appear on an idle computer screen. Theprogram, which is still in use, periodicallygenerates pictures of Morris and of a professor'scat.

Friends declined to give an account of otherpranks of Morris, although they said none wasmalicious.

But a friend, who asked that his name not beused, said that Morris had made unauthorizedentries into computer systems. Cornell officialsdiscovered in his files unauthorized passwords tothe Stanford and another school's computer system.

Although Morris had a few outside interestsincluding skiing, most of his time was spent atthe computer. As a result, Morris developed fewfriendships beyond his rooming group and Aikenlab, friends said.

Morris' interest in computers also had anadverse impact on his academic work. He was put onacademic probation after his freshman year andtook a year off. "His courses were too regimentedfor him," said Kuperberg. "He tended to lose trackof his coursework."

Friends were uncertain what impact the virusincident would have on Morris' career. Some saidthat because of an outstanding resume, Morriswould have had little trouble finding a goodcomputing job. The exposure he gained by creatingthe virus would only add luster to his reputation,they said.

"Even before this, RTM could have gotten a jobanywhere he wanted. The references are fantastic,"said Graham. Sudduth said the virus might have anadverse effect on his career, adding "he'sdefinitely hurt himself."

But others said that Morris could benefit froma kind of "War Games" mentality that might throwpublic sympathy in his favor. "It's made him anational hero," said Nitzberg. "It's going to gethim the salary of his choice."

Madhavi Sunder contributed to the reportingof this article.