FOLLOW THE FAILURE
How a fault became an incident.
A condensed sequence, not a minute-by-minute reconstruction.
- 01THE TRIGGER
Worm spreads between systems
- 02THE FAILURE SPREADS
Computing and communication are overloaded
- 03THE CONSEQUENCE
Institutions isolate and recover systems
- 04THE AFTERMATHRead the recovery and its limits ↓
Computing and communication are overloaded
A response channel that depends on the affected network may fail when it is needed most. Coordination needs its own continuity plan.
Editorial interpretation of the failure pattern.01 / THE INCIDENT
What happened
On November 2, 1988, the Morris Worm began spreading through Internet-connected Unix computers. The FBI estimates roughly 6,000 computers were affected within 24 hours. Universities and research institutions faced severe slowdowns even though the worm did not destroy their files.
Evidence: FBI · Historical case account ↗02 / THE FAILURE CHAIN
Why it happened
The worm could propagate without attaching to a host program. Multiple weaknesses in network services gave it routes between machines. As copies spread, computing capacity and communication suffered. A system can become unusable through resource exhaustion even when stored data remains intact.
How would your responders share findings if your normal messaging stopped working?
03 / THE AFTERMATH
Recovery—and its limits
Administrators investigated the program, removed it, and in some cases disconnected systems or rebuilt them. Guidance was harder to distribute through the impaired network. The episode helped prompt the creation of a dedicated computer emergency response team, making coordination part of the lasting response.
TWO THINGS FAILED TOGETHER
The incident also carried the message.
Capacity disappeared.
Spreading copies slowed systems. Keeping files intact did not keep services usable.
Coordination slowed too.
Email delays made the impaired network a poor channel for urgent recovery guidance.
The FBI’s figure of approximately 6,000 affected computers is an estimate, not a complete device census. This exhibit does not reproduce worm code.
04 / TAKE IT WITH YOU
Where could the chain break?
Safeguards to investigate—not a claim that one change would certainly have prevented this incident.
Go to the source.
A condensed editorial account. The lessons are our interpretation, not quotations. Consult the primary source for the full technical record.
FBI · Historical case account ↗