A fascinating feature in Sunday’s New York Times tells the story of Conficker. The giant botnet could have wreaked havoc on the internet, but didn’t. We now have some idea why.

Conficker’s botnet was easily capable of launching any of the above — and far worse. At its height, when it consisted of at least 10 million individual IP addresses, there were few computer networks in the world secure enough to withstand an attack from it. And yet it was used only once, to spread a relatively minor strain of “scareware” intended to frighten unsuspecting users into downloading fake antivirus software. That attack was surprisingly pedestrian, like taking a Formula One racecar for a slow ride around the block. Surely something bigger was coming. But it never did. Why? Who created Conficker, and why bother if they were not going to use it?