On November 2, 1988, LLNL computer scientist Russell Brand noticed a sudden spike on his VAX computer from his home in Berkeley. The load increased by one thousand times within mere seconds. Tracing the problem, Russell Brand discovered unusual files and processes on his machine. Believing a worm had breached his system, Brand contacted fellow students at UC Berkeley’s Experimental Computing Facility. They confirmed an ongoing attack across the internet.
The internet was under twenty years old then. It consisted of slightly over five hundred autonomous unclassified networks connecting approximately sixty thousand computers. Two massive networks dominated the American landscape. The National Science Foundation and the Department of Defense sponsored them.
DARPA established ARPANET in the late 1960s as a prototype unclassified network. On January 1, 1983, TCP/IP protocols were installed on ARPANET, officially birthing the internet. Five years prior to ARPANET, Livermore computer scientists created a local classified time-sharing network called Octopus. By 1974, Octopus simultaneously connected over a thousand remote terminals and printers. Livermore’s pioneering hardware and software later modeled NSFNET. NSFNET served as the primary backbone for explosive internet growth in the nineties.
Cornell Graduate Unleashes the Program
Robert Morris Jr., a Cornell computer science graduate student, created the experimental self-replicating program. That evening, he hacked into an MIT computer from his Cornell terminal and released the worm. The program targeted specific UNIX versions and spread rapidly by exploiting known security flaws.
Morris quickly realized his program was far too successful. The worm replicated and reinfected machines much faster than anticipated. Seeking a solution, Morris consulted a Harvard friend. They sent an anonymous message containing instructions on how to kill the worm. Unfortunately, the network bogged down, and the instructions arrived too late.
Within hours, the worm hit an estimated six thousand connected computers. Vital military, government, and university functions slowed to a crawl. The incident shattered the widespread complacency and familiarity among early internet users. Public awareness of computer system vulnerabilities did not yet exist.
Lawrence Livermore National Laboratory Responds
LLNL computer security manager Chuck Cole learned of the intruder from Russell Brand. Discovering that UNIX systems were most vulnerable, Cole severed connections between the Lab’s unclassified computers and the internet.
UC Berkeley students quickly developed a computer patch. LLNL’s Computer and Communications Security Group modified it for Lab systems. Because of early knowledge and coordination with Berkeley, LLNL became a national focal point for assistance. Organizations nationwide relied on the experience Livermore gained during the night.
Thanks to a quick response from employees like Brand and Doug Mansur, damage was limited to six infected Lab computers. None of those systems crashed. Livermore restored Open Labnet connections within a day and reconnected to the internet on Friday. Other organizations remained disconnected for up to a week. The worm caused millions of dollars in damages by creating widespread havoc.
Legal Consequences and Cybersecurity Evolution
In the aftermath, Robert Morris became the first person convicted under the 1986 Computer Fraud and Abuse Act. Courts spared him prison time, issuing fines, probation, and community service instead. Morris later became an MIT professor and co-founded Viaweb, which Yahoo acquired for nearly fifty million dollars.
Acting on lessons learned, the Department of Energy established the Computer Incident Advisory Capability on February 1, 1989. Livermore hosted this center due to its demonstrated leadership during the attack. CIAC responded to security incidents across the DOE on a twenty-four-hour basis. This capability eventually evolved into the modern DOE Joint Cybersecurity Coordination Center.
Today, LLNL applies cutting-edge science and technology to defend the nation from sophisticated cyber threats. The Lab’s programs protect critical civilian infrastructure and national security against advanced adversaries.
