I don't have a reference, but I suspect that what you are thinking of is that CSNet shutdown very early, preventing the innoculation message (sent by Morris via his friend from the OSF which was a CSnet customer) from getting out for 3 days. The worm was <probably> released from MIT, and Morris <probably> went across the street to the OSF to see his friend from his undergraduate days at Harvard about the problem. They composed and sent out a message describing the worm, its accidental escape, what it exploited, and how to stop it. But CSnet had already shutdown and the message stayed in queue at the OSF for 3 days. Much of the panic was due to the lack of communications about the nature of what was going on. This was made worse by sites shutting down. Morris' message didn't get out for 3 days. By then, Spafford and others had decompiled and analyzed the program, figured out by themselves how to stop it, and were making fun of it. And they were pissed. Due to lack of information, they assumed it was hostile. If the innoculation message had gotten out early on, fears of a hostile attack would have been allayed, and people would not have responded as though under hostile attack. So, I suppose CSnet bears some responsibility for the ensuing panic, and Morris' subsequent prosecution. --Dean Around 03:50 PM 11/21/1999 -0800, rumor has it that Sean Donelan said:

...

and what's more fun, when they come back up on jan 3 or whatever, they will have whatever y2k problems then.

I recall after the Morris worm hit the Internet, reading a report sites which unplugged their ARPANET connection were down longer than sites which remain connected and got repair information over the net.

Does anyone else remember that, and knows a citation for the report (or news story) I'm recalling?

Thanks.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean@av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++