'Love Bug' hackers fall

Agents of the National Bureau of Investigation (NBI) raided yesterday the Manila apartment of the suspected author of the "ILOVEYOU" computer virus, and detained a young and computer-literate couple.

Riomel Lamores, 27, was picked up from his home at the Bagong Barangay housing project on Zamora street in Pandacan, Manila, and taken to the National Bureau of Investigation office in a private car escorted by a convoy of NBI vehicles.

Lamores, an employee of Equitable Bank's administrative division, stepped out of the car and walked into the NBI office with his hands covering his face. He was accompanied by an NBI agent carrying what appeared to be a computer unit.

Lamores' live-in partner, Irene de Guzman, who was originally tagged by the NBI as the "Love Bug" creator, was later picked up at a bank in Makati City where she works. She was also detained and questioned.

The raid was conducted by 16 members of the NBI's International Police branch and the Anti-Fraud and Computer Crimes Division at around 4 p.m. They were accompanied by three US Embassy representatives, including legal attaché James Nixon.

NBI sources said Lamores had been "invited for questioning."

The raiding team claimed they failed to find any computer unit in the house but found hundreds of computer magazines stacked up in a corner of the apartment.

"It appears they were expecting us so they may have hid the computers. It was obvious that a computer had been previously been set up here because of the cables and cut telephone wires," one agent told The STAR.

Two other people also lived in the apartment, neighbors said.

Earlier, the NBI and the Department of Justice (DOJ) said the suspected Filipino creator of the "love bug" computer virus has yet to be arrested because the country lacks laws that deal with computer crimes.

NBI Director Federico Opinion Jr. admitted it may be difficult to pin a charge on the virus programmer.

"We have no law on this so we are looking for a law. We have to research," Opinion told reporters.

A DOJ source noted the Philippines has no laws on high-tech and cyber crimes similar to those in the US.

"What will the suspect be charged with? The only charge that comes close is that of malicious mischief, which is punishable by imprisonment of a minimum six months," the source said.

The DOJ likewise ruled out the possibility of extradition against the hacker if the attack was launched from a computer in the Philippines.

This is the first time the NBI has investigated a case of computer crime, and observers noted that a lack of experience may have hamstrung its agents.

Opinion said the bureau was trying to persuade a judge to issue a warrant to search the house of the suspect, who is believed to be a woman living in a Manila suburb.

"As of this time, we are collating evidence. We are preparing to apply for a search warrant," he said. "It's not that easy... you have to convince the judge to issue a search warrant."

If the search uncovers evidence of a crime, an arrest will be made, he said.

The case is being handled by the NBI's anti-fraud and computer crimes division led by Nelson Bartolome.

The "love bug," the most virulent computer virus ever created, penetrated millions of computers last week through e-mail. It was quickly traced back to the Philippines.

NBI agents, speaking on condition of anonymity, earlier said the suspect may be a young woman. They also said it was possible the current suspect might not be responsible for the computer attack.

"It was only the suspect's computer that was used to launch the virus. Anybody could have used that computer," one source said.

He pointed out that the person identified was merely the registered owner of the computer used.

The source expressed concern that given the massive international publicity over the case, the suspect could by now have erased all evidence from the computer.

Earlier, information culled from various Philippine Internet service providers (ISPs) said the virus programmer was a 23-year-old male living in Pandacan, Manila.

However, Swedish researcher Fredrik Bjoerck, who helped identify the creator of last year's Melissa virus, said the virus maker is a German exchange student in Australia named Michael, probably in his 20s.

A US computer security company, ICSA.net, said comparisons of the "ILOVEYOU" virus with a password-stealing program written earlier indicate the author is a student at the AMA Computer College in the Philippines.

AMA executive vice president Manuel Abad said AMA will "never condone any act which will result in the improper use of information technology to the detriment of society."

"If the hacker was really our student, I don't think it is something to be proud of," Abad said.

He pointed out that school authorities have been directed to cooperate with investigators in "pinning down the culprit as well as his or her allies, if any."

Michelle Navarro, the computer school's dean of students, said it has more than 10,000 computer programming students nationwide, 3,000 of them at its main campus in Quezon City.

She said she was unaware of any student having created a computer virus or being involved in any computer-related offense.

The school is owned by the family of Amable Aguiluz V, who headed the government's Y2K preparedness commission last year.

On Saturday, FBI agents obtained logs of messages sent by people victimized by the virus to its creator.

Jose Carlotta, chief operating officer at Access Net, one of several Philippine Internet service providers believed to have been used by the programmer, said he gave six to seven pages of e-mail logs to FBI agents.

Carlotta said most of the 5,000 messages contained in two e-mail addresses in the Access Net server were from irate victims, but some included praise for the programmer's skill.

The messages passed through a US e-mail address, isp-admmail.com, which then forwarded them to the two Access Net e-mail accounts used by the virus creator, Carlotta said.

He said the virus both replicates itself and steals usernames and passwords of unsuspecting victims.