United States v. Morris (1991)

United States v. Morris
Court	United States Court of Appeals for the Second Circuit
Full case name	'United States v. Morris
Argued	December 4 1990
Decided	March 7 1991
Citation(s)	928 F.2d 504
Holding
The Government does not need to prove that the defendant intentionally prevented use of federal interest computers, thereby causing loss. Furthermore, Morris acted "without authorization" according to section (a)(5)(A). The decision is therefore affirmed.
Court membership
Judge(s) sitting	Jon Newman, Ralph Winter, T.F. Daly
Case opinions
Majority	Jon O. Newman
Laws applied
18 U.S.C. § 1030(a)(5)(A)

United States v. Morris was an appeal of the conviction of Robert Tappan Morris for creating and releasing the Morris worm, one of the first Internet-based worms. This case resulted in the first conviction under the Computer Fraud and Abuse Act. In the process, the dispute clarified much of the language used in the law, which had been heavily revised in a number of updates passed in the years after its initial drafting. Also clarified was the concept of "unauthorized access," which is central in the United States' computer security laws. The decision was the first by a U.S. court to refer to "the Internet", which it described simply as "a national computer network."

Robert Tappan Morris was a Cornell student, who began work in 1988 on an early Internet worm. He had been given explicit access to a Cornell computer account upon entering the school, and used this access to develop his worm. Morris released the worm from MIT, in an attempt to disguise its source. The worm spread through four mechanisms:

The worm was designed so that it would not spread to computers that it had already infected. To prevent computers from defending against this by pretending to have the worm, however, it would still infect an already infected computer one out of seven times. The worm was also designed so that it would be erased when an infected computer was shut down, thus preventing multiple infections from becoming problematic. Morris' underestimation of the rate of reinfection causing this safeguard to be ineffective, and "tens of thousands" of computers were rendered catatonic by repeated infections. It was estimated that between $200 and $53,000 was required per infected facility to clean up after the worm.

Morris was found guilty by the United States District Court for the Northern District of New York of violating 18 U.S.C. 1030(a)(5)(A), sentenced to three years of probation, 400 hours of community service, a fine of $10,050, and the cost of his supervision.

Legal discourse took place on three main issues: whether Morris had to have intended to cause damage, whether Morris really had gained unauthorized access, and whether the District Court had properly informed the jury of the subtleties of the case.

...
Wikipedia