## Facts

- Robert Tappan Morris, a first-year Cornell computer science Ph.D. student, had an authorized account on Cornell’s computer systems.
- In November 1988, Morris released a self-replicating program (the “Morris worm”) onto a national computer network from a computer at MIT to reduce the likelihood the program would be traced to him.
- The worm exploited vulnerabilities in common network services (including Sendmail and the finger program), used trusted-host features, and attempted password guessing to obtain entry into other computers.
- The worm replicated more aggressively than Morris expected, causing many networked computers at universities, research institutions, and military-related sites to slow down, crash, or become unusable.
- Organizations incurred costs to remove the worm and restore systems, ranging from hundreds of dollars to tens of thousands of dollars per installation.
- A jury in the Northern District of New York convicted Morris under 18 U.S.C. § 1030(a)(5)(A) (1988) for intentionally accessing a federal interest computer without authorization and causing damage or preventing authorized use resulting in at least $1,000 in loss.
- The district court sentenced Morris to probation, community service, a fine, and restitution.

## Issues

1. Whether 18 U.S.C. § 1030(a)(5)(A) required proof that the defendant intended the resulting damage or denial of authorized use, or only that he intentionally accessed the computer without authorization.
2. Whether the evidence was sufficient to show Morris accessed computers “without authorization,” rather than merely “exceed[ing] authorized access.”
3. Whether the jury required a special instruction defining “authorization” for purposes of § 1030(a)(5)(A).

## Decision

- The Second Circuit affirmed the conviction.
- The court held that “intentionally” in § 1030(a)(5)(A) modified the act of access, not the resulting damage, denial of use, or loss.
- The court held the evidence supported a finding that Morris accessed computers “without authorization,” including computers for which he had no permission at all.
- The court found no reversible error in declining to give a special jury definition of “authorization,” concluding the term was sufficiently ordinary for the jury to apply on the facts presented.

## Legal Principles

- Under 18 U.S.C. § 1030(a)(5)(A) (1988), the government need only prove the defendant intentionally accessed a federal interest computer without authorization; it need not prove the defendant intended the ensuing impairment, damage, or loss.
- “Without authorization” is satisfied where a defendant intentionally uses exploitation techniques to penetrate other computers or functions for which permission was not granted, even if the defendant has legitimate credentials for some related system.
- Authorization to use one computer system for legitimate purposes does not, by itself, confer permission to deploy code designed to infiltrate and impair other networked systems.
- A trial court may treat “authorization” as a term of common usage not requiring a specialized instruction when the statutory application is clear from the evidence.

## Conclusion

The Second Circuit sustained Morris’s CFAA conviction, construing § 1030(a)(5)(A) to require intent as to unauthorized access only and concluding that releasing a worm that exploited vulnerabilities to enter and disrupt other computers constituted access “without authorization,” notwithstanding Morris’s authorized Cornell account.


United States v. Morris, 928 F.2d 504 (2d Cir. 1991)