'Love Bug' Virus Suspect Arrested

Monday, May 8th 2000, 12:00 am

By: News On 6

MANILA, Philippines (AP) â€” Philippine police arrested on Monday a bank employee who along with his girlfriend is suspected of links to the ``ILOVEYOU'' computer virus that has overwhelmed networks around the world.

But relatives of the man, Reomel Ramones, said they believe the real culprit may be a third person who lived in the couple's apartment â€” the girlfriend's unemployed sister, who recently graduated from a computer school that a U.S. security firm has linked to the ``Love Bug'' virus.

Investigators raided the apartment in Pandacan, a lower-middle-class Manila neighborhood, and seized computer diskettes, wires, telephones and other computer accessories, officials said.

Two FBI agents accompanied the investigators in the apartment raid, officials said. Several FBI agents are in the Philippines cooperating in the search for the virus programmer.

No one was home at the time of the raid, but Ramones later returned and was arrested by agents from the National Bureau of Investigation. His girlfriend was contacted by investigators and promised to appear at NBI headquarters.

Local radio reports said Ramones denied any involvement with the virus. An investigator said Ramones had ``opted to remain silent.''

The virus has caused a flood of e-mails with the subject line ``ILOVEYOU'' to course through computer systems in more than 20 countries since it appeared last week. When opened, the virus can destroy graphics and other saved files. Several variations appeared soon after â€” one masquerading as an e-mail joke, another as a receipt for a Mother's Day gift.

No charges were immediately filed against Ramones, said NBI chief Federico Opinion. By law, charges must be filed within 36 hours.

Philippine investigators looking into the virus have had to cope with a lack of laws tailored to high-tech computer crimes. Opinion said they currently plan to use a law against improper use of commerce ``access devices'' such as credit cards, account numbers and passwords to charge the virus creators. The law carries a maximum penalty of twice the amount obtained by fraud plus up to 20 years in prison.

``This is a new type of crime and the law applicable is not clear,'' Opinion said. ``That's why we are searching for the right law to be used to prosecute them.''

He said investigators were led to the apartment because of ``confidential information given to us by confidential informants.''

Although Ramones works in the computer department of a bank, he is an accounting graduate and his specialty is computer hardware, not software, his relatives said. They said the computer in the apartment was almost always locked in the room of the third resident, the 23-year-old sister of Ramones' girlfriend. The sister recently graduated in computer engineering from the Philippines' AMA Computer College.

For several days, information culled from various Philippine Internet service providers has indicated that the virus programmer was a 23-year-old living in Pandacan who claimed to be male. Ramones is said to be in his mid-30s.

A U.S. computer security company, ICSA.net, said comparisons of the ``ILOVEYOU'' virus with a password-stealing program written earlier indicate the author was a student at AMA Computer College.

Michelle Navarro, the school's dean of students, said she was unaware of any student having created a computer virus.

In a statement, the school said it will ``never condone any act which will result in the improper use of information technology to the detriment of society.'' It said school authorities have been directed to cooperate with investigators.

In Japan, meanwhile, tens of thousands of people returned to work Monday from a weeklong holiday to find the virus that has swept around the world waiting in their computers. Government officials and antivirus software companies issued emergency warnings to computer users not to open suspicious-looking files in their e-mails.

When the rest of the world was panicking over the virus, Japan was virtually unaffected because most companies and government offices were closed for the ``golden week'' holidays that began April 29. As of early Monday, the number of infected files in Japan reached 73,000, according to Akitsu Hirasawa, a spokeswoman for Trend Micro Inc., a leading Tokyo-based antivirus software firm.

â€”â€”â€”

On the Net:

National Infrastructure Protection Center at http://www.nipc.gov/

CERT Coordination Center at http://www.cert.org

Anti-virus companies, including Trend Micro at http://www.trendmicro.com; Symantec at http://www.symantec.com; Network Associates at http://www.nai.com