A program that traveled
Around 1971, a program called Creeper began moving between computers on a research network. It is among the best-known early examples of a program that travels from one machine to another, and it is often listed as a forerunner of computer viruses and worms. The phrase “forerunner” is deliberate. Creeper was an experiment, and under the usual definitions it was not a virus.
Background: a network of research machines
At the time, the United States defense research agency funded a network, ARPANET, linking a small number of universities and research firms. By the early 1970s it linked only a small number of sites, many with large computers from the same manufacturer. Several used the PDP-10 and an operating system called TENEX, which had been developed by the Cambridge, Massachusetts firm Bolt, Beranek and Newman (BBN), the company that also built the network’s Interface Message Processors.
The idea of one program moving to another computer to continue running was new and interesting to the engineers. It could be a way to balance workloads, or to follow a user across the network.
Who wrote it and what it did
Creeper is usually credited to Bob Thomas, an engineer at BBN, who wrote it as a demonstration of this idea. The program started on one machine, displayed a message, then tried to find another machine on the network, moved there, and carried on.
The message it printed has become famous: “I’M THE CREEPER: CATCH ME IF YOU CAN.” It was there to be seen, as an obvious signal that something unusual had happened. No reliable accounts describe the program as destructive.
Moving, not copying
A frequent point of confusion is whether Creeper copied itself. In the version usually described, it moved: it started to run on the new machine and then deleted itself from the old one, so only a single copy existed at any time. Some later accounts say that a modified version left copies behind and could multiply, and sources are not fully consistent. Since the original records are thin, it is safest to say that Creeper demonstrated mobile code, and that whether it ever replicated depends on which version is meant.
It also did not infect other programs. A virus, in the sense that became standard in the 1980s, attaches to a host program or file. Creeper was a standalone program, closer to what is now called a worm, and even that label is loose.
Reaper
A second program, usually called Reaper, was written to deal with it. Reaper traveled through the network in the same way, looked for Creeper and deleted it. It is commonly credited to Ray Tomlinson, the engineer who is also known for adding the at sign to network email addresses, though the attribution is often stated more firmly than the surviving records can support.
Reaper is therefore frequently described as the first antivirus program. That description has some force: it was a self-moving program designed to find and remove another. But it also shows how different early conditions were. A small group of engineers, who all knew each other, could solve the problem with a custom tool.
Why people cite it
Creeper matters for several reasons. It showed that a networked computer could run code that had arrived from elsewhere, which is the capability that all later worms depend on. It showed that such behavior might be hard to stop, because the creator had to write another program to catch it. And it took place in a community whose members were trusted and few, so the lesson that networks needed controls on who could run what was not yet obvious.
It also illustrates why historians avoid awarding the title “first computer virus.” Creeper came before the term “virus” was used in a technical sense, before personal computers, and before any program was thought of as an attack. The Xerox worm experiments of the early 1980s, Elk Cloner in 1982 and Brain in 1986 each add a new feature to the story.
What we do and do not know
Much of what is repeated about Creeper comes from later recollections by people who worked at BBN, and from short histories written decades later. The year is usually given as 1971 or early 1972, the author is generally named as Bob Thomas, and the message is consistently reported. Details such as the exact machines, the number of sites reached and the exact nature of Reaper are less secure. The original program does not exist as a widely available artifact, though people have written recreations.
Legacy
By the standards of later outbreaks, Creeper was tiny and harmless. Its main significance lies in being a very early example of a pattern: a technical demonstration that reveals a risk, followed by a defensive tool. The Morris worm in 1988, which affected thousands of machines on the network that grew from this one, showed how much the setting had changed since a small number of trusted sites.