This longread is about how, in 1971, a harmless experiment by engineer Bob Thomas turned into a specter haunting the first computer networks—and sparked a war that still isn’t over.
🔥 December 1971. In the silence of Bolt, Beranek and Newman’s (BBN) labs—a company at the very origins of ARPANET, the precursor to today’s internet—something went wrong. On the screens of DEC PDP-10 mainframes, connected by the thin threads of early network cables, mysterious messages began appearing: «I'M THE CREEPER : CATCH ME IF YOU CAN!». No one had launched this program. No one had given it a command. It just… moved. On its own. From one computer to another, like a ghost seeping through walls. BBN’s engineers, used to total control over their machines, were facing something fundamentally new: code that didn’t obey humans. Code that lived a life of its own.
💀 The paradox was that Creeper wasn’t a virus in the modern sense. It didn’t steal data, didn’t break systems, didn’t demand ransom. It just existed—as the first example in history of a self-replicating network organism. Its creator, Bob Thomas, didn’t even suspect his experiment would become a point of no return. Until that moment, computers had been isolated giants, and ARPANET was just a tool for data exchange. But Creeper proved: if code can move, it can reproduce. And if it can reproduce—who knows what it’ll do next?
🧠 Picture a digital parasite that doesn’t kill its host but won’t let it rest. Creeper was written in assembly for the TENEX operating system, running on DEC PDP-10 mainframes—machines the size of refrigerators, costing millions of dollars and consuming so much electricity they needed dedicated air conditioners. Back then, programmers worked with punch cards, and "network traffic" was measured in bytes per second—laughably little by today’s standards. Yet even under those conditions, Creeper managed to find vulnerabilities.
🔍 Its mechanics were simple but brilliant. The program used FTP (File Transfer Protocol) to copy itself to remote machines. And it didn’t just move—it left a trail: on every infected computer, that same message appeared, like graffiti on the walls of a digital city. Ray Tomlinson, Thomas’s colleague, later refined Creeper, turning it from a drifter into a true parasite: the new version didn’t just move—it reproduced, creating copies of itself on new machines. Thus was born the first computer worm in history—a program capable of self-replication without human intervention. The metaphor that comes to mind is a fire in a library, where books suddenly gain the ability to rewrite themselves and leap onto neighboring shelves.
📊 But the most terrifying thing about Creeper was its scale. In 1971, ARPANET had just 28 machines running TENEX. That’s how many computers Creeper could theoretically infect. For comparison: today, there are over 15 billion connected devices in the world. If Creeper appeared now, it could infect the entire planet in minutes. Though back in 1971, no one was thinking on that scale. BBN’s engineers simply watched as their creation slipped out of control—and wondered: what now?
🛑 When Creeper started spreading, BBN’s engineers found themselves trapped by their own experiment. The program didn’t cause harm, but its presence was unbearable—like a mosquito buzzing in a room where you’re trying to sleep. Manually deleting it from every computer was pointless: as long as the network existed, Creeper could return. Something fundamentally new was needed. And that "new" was Ray Tomlinson—the very man who had refined Creeper, turning it into a self-replicating monster. Now, he had to create a weapon against his own creation.
💉 And so "Reaper" was born—the first antivirus in history. But calling it an "antivirus" in the modern sense would be a mistake. Reaper didn’t scan files, didn’t check signatures, didn’t update databases. It was a predator, created for one purpose: to find and destroy Creeper. Its mechanics mirrored those of its prey: Reaper moved through the network just like Creeper, but instead of leaving messages, it hunted for signs of infection and erased them. This was the first cyberwar in history—a battle between two programs in the dark corridors of ARPANET, where there was no sound, no light, only endless streams of zeros and ones.
🔥 But the most astonishing thing about this story is its symbolism. Creeper and Reaper weren’t enemies. They were two sides of the same coin: the first step toward realizing that the digital world could be dangerous. Before 1971, no one thought about network security. Computers were tools, not ecosystems. But after Creeper, everything changed. Engineers understood: if code can move, it can attack. If it can reproduce, it can destroy. And if someone created Creeper, someone else would inevitably create something worse.
📡 The consequences of Creeper and Reaper ran deeper than anyone could have imagined. First, the story inspired A. K. Dewdney, a columnist for Scientific American, to create the game Core War—a simulation of program battles in computer memory. The game became a cult favorite among hackers and programmers, and its ideas laid the foundation for modern combat viruses and cyberweapons. Second, Creeper proved that mobile code wasn’t science fiction—it was reality. Today, we take JavaScript, Python scripts, and even Word macros for granted. But in 1971, the idea that a program could move between machines was revolutionary.
🛡️ Third, Creeper was the first warning that security isn’t optional—it’s a necessity. Today, the cybersecurity industry is worth hundreds of billions of dollars, but its roots trace back to that moment when BBN’s engineers first saw the message «I'M THE CREEPER : CATCH ME IF YOU CAN!» on their screens. Without Creeper, there would be no antiviruses, no firewalls, no sandboxes for analyzing malware. There would be no Morris Worm—the first truly destructive worm that hit the internet in 1988 and led to the creation of CERT (Computer Emergency Response Team). There would be no modern cyberwars, where states attack each other with digital viruses.
🔮 Today, Creeper seems like a relic of the past—a harmless program that couldn’t theoretically cause any harm. But its legacy lives on in every virus, every worm, every exploit that has ever attacked computer networks. In 2023, global losses from cybercrime exceeded $8 trillion—a sum comparable to the GDP of the world’s largest economies. And every time hackers launch a new virus, they’re retracing the path blazed by Bob Thomas and Ray Tomlinson back in 1971.
🤖 But there’s another side to the coin. Creeper and Reaper aren’t just a story about fear and threats. They’re also a story about creativity and innovation. Because it’s thanks to experiments like Creeper that we have cloud computing, distributed systems, and the Internet of Things today. Without mobile code, there would be no Bitcoin, no blockchain, no artificial intelligence trained on data from the web. Creeper reminds us that technology is a double-edged sword. It can be a weapon, but it can also be a cure. It all depends on whose hands it ends up in. And perhaps that’s why Creeper’s message still rings so true today: «CATCH ME IF YOU CAN». Because the race between virus creators and those who hunt them will never end.