Philippine investigators detain man in 'Love Bug' virus case

[William Knowles <wk () C4I ORG>]

http://www.techserver.com/noframes/story/0,2294,500201686-500278757-501482191-0,00.html

By OLIVER TEVES, Associated Press

MANILA, Philippines (May 8, 2000 7:09 a.m. EDT
http://www.nandotimes.com) - Philippine investigators on Monday raided
the apartment of a suspect believed to be linked to the "ILOVEYOU"
computer virus, officials said, and found computer magazines,
diskettes and other equipment.

The investigators, who had a search warrant, cordoned off the street
around the apartment in Manila's Pandacan district. They said they
could not comment further until the search was complete.

The man and woman who owned the apartment were out at the time of the
raid, but the man later returned and denied any involvement with the
virus, local radio reports said. He was taken in for questioning,
officials said. Two other people also lived in the apartment,
neighbors said.

For several days, information culled from various Philippine Internet
service providers has indicated that the virus programmer was a
23-year-old male living in Pandacan.

However, National Bureau of Investigation officers said earlier Monday
that the suspect was the woman living in the apartment that was
raided. Police were searching for her.

Gil Alnas, the elected leader of the neighborhood, said the
investigators took away a box with 17 items, including computer
magazines, telephones, diskettes, wires and cassette tapes.

Philippine investigators have had to cope with a lack of laws tailored
to computer crimes. "We have no law on this, so we are looking for a
law" that can be used, said Federico Opinion, chief of the National
Bureau of Investigation.

A U.S. computer security company, ICSA.net, said comparisons of the
"ILOVEYOU" virus with a password-stealing program written earlier
indicate the author is a student at AMA Computer College in the
Philippines.

Michelle Navarro, the school's dean of students, said it has more than
10,000 computer programming students nationwide, 3,000 of them at its
main campus in Quezon City in metropolitan Manila.

She said she was unaware of any student having created a computer
virus or being involved in any computer-related offense.

In a statement, the school said it will "never condone any act which
will result in the improper use of information technology to the
detriment of society." It said school authorities have been directed
to cooperate with investigators in "pinning down the culprit as well
as his or her allies, if any."

The school is owned by the family of Amable Aguiluz V, who headed the
government's Y2K preparedness commission last year.

The virus has caused a flood of e-mails with the subject line
"ILOVEYOU" to course through computer systems in more than 20
countries, overwhelming computer networks.

Several variations appeared soon after, one masquerading as an e-mail
joke, another as a receipt for a Mother's Day gift.

When opened, the virus can destroy graphics and other saved files.

On Saturday, U.S. Federal Bureau of Investigation agents obtained logs
of messages sent by people victimized by the virus to its creator.

Jose Carlotta, chief operating officer at Access Net, one of several
Philippine Internet service providers believed to have been used by
the programmer, said he gave six to seven pages of e-mail logs to FBI
agents.

Carlotta said most of the 5,000 messages contained in two e-mail
addresses in the Access Net server were from irate victims, but some
included praise for the programmer's skill.

The messages passed through a U.S. e-mail address, which then
forwarded them to the two Access Net e-mail accounts used by the virus
creator, Carlotta said.

Meanwhile, tens of thousands of Japanese returned to work Monday from
their weeklong holiday to find the "Love Bug" virus that has swept
around the world since last week waiting in their computers.

Government officials and antivirus software companies issued emergency
warnings to computer users not to open suspicious-looking files in
their e-mails.

As of early Monday, the number of infected files reached 73,000, most
found earlier in the day, according to Akitsu Hirasawa, a spokeswoman
for Trend Micro Inc., a leading Tokyo-based antivirus software firm.

When the rest of the world was panicking over the virus, Japan was
virtually unaffected because most companies and government offices
were closed for the "golden week" holidays that began April 29.

"We are concerned that the infection might spread further, since today
is the first working day after the holiday week," Hirasawa said. "Our
customer support center is already flooded with calls regarding the
virus."


*-------------------------------------------------*
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions             http://www.c4i.org
*-------------------------------------------------*

ISN is sponsored by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".