Page 027

Undergound. Go to Table of Contents.

   Perhaps the seemingly random file-erasing trick was a portent of

   things to come--just a small taste of what might happen at a

   particular time, such as midnight. Perhaps an unusual keystroke by an

   unwitting computer user on those systems which seemed only mildly

   affected could trigger something in the worm. One keystroke might

   begin an irreversible chain of commands to erase everything on that



   The NASA SPAN computer team were in a race with the worm. Each minute

   they spent trying to figure out what it did, the worm was pushing

   forward, ever deeper into NASA's computer network. Every hour NASA

   spent developing a cure, the worm spent searching, probing, breaking

   and entering. A day's delay in getting the cure out to all the systems

   could mean dozens of new worm invasions doing God knows what in

   vulnerable computers. The SPAN team had to dissect this thing

   completely, and they had to do it fast.


   Some computer network managers were badly shaken. The SPAN office

   received a call from NASA's Jet Propulsion Laboratories in California,

   an important NASA centre with 6500 employees and close ties to

   California Institute of Technology (Caltech).


   JPL was pulling itself off the network.


   This worm was too much of a risk. The only safe option was to isolate

   their computers. There would be no SPAN DEC-based communications with

   the rest of NASA until the crisis was under control. This made things

   harder for the SPAN team; getting a worm exterminating program out to

   JPL, like other sites which had cut their connection to SPAN, was

   going to be that much tougher. Everything had to be done over the



   Worse, JPL was one of five routing centres for NASA's SPAN computer

   network. It was like the centre of a wheel, with a dozen spokes

   branching off--each leading to another SPAN site. All these places,

   known as tailsites, depended on the lab site for their connections

   into SPAN. When JPL pulled itself off the network, the tailsites went

   down too.


   It was a serious problem for the people in the SPAN office back in

   Virginia. To Ron Tencati, head of security for NASA SPAN, taking a

   routing centre off-line was a major issue. But his hands were tied.

   The SPAN office exercised central authority over the wide area

   network, but it couldn't dictate how individual field centres dealt

   with the worm. That was each centre's own decision. The SPAN team

   could only give them advice and rush to develop a way to poison the



   The SPAN office called John McMahon again, this time with a more

   urgent request. Would he come over to help handle the crisis?


   The SPAN centre was only 800 metres away from McMahon's office. His

   boss, Jerome Bennett, the DECNET protocol manager, gave the nod.

   McMahon would be on loan until the crisis was under control.


   When he got to Building 26, home of the NASA SPAN project office,

   McMahon became part of a core NASA crisis team including Todd Butler,

   Ron Tencati and Pat Sisson. Other key NASA people jumped in when

   needed, such as Dave Peters and Dave Stern. Jim Green, the head of the

   National Space Science Data Center at Goddard and the absolute boss of