The first computer worm to attract wide attention, the Morris worm or Internet worm, quickly infected a great number of computers on the Internet on November 2, 1988. It was written by Robert Tappan Morris when he was a graduate student at Cornell. The worm propagated through a number of bugs in BSD Unix and its derivatives.
"In 1989, Morris was indicted for violating United States Code Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act (CFAA). He was the first person to be indicted under this act. In December 1990, he was sentenced to three years of probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. He appealed, but the motion was rejected the following March. Morris' stated motive during the trial was "to demonstrate the inadequacies of current security measures on computer networks by exploiting the security defects [he] had discovered." He completed his sentence as of 1994" (Wikipedia article on Robert Tappan Morris, accessed 9-2020).
It should be noticed that Morris subsequent had a very distinguished career in academia and the computer industry.