Love Bug hunters look to Philippines

The computer virus that swept the globe is now circulating under new names as officials seek its creator.

By Compiled from staff, wire reports

© St. Petersburg Times, published May 6, 2000

WASHINGTON -- Investigators tracking down the author of the world's worst computer virus focused on the Philippines Friday and on two men there who use the computer nickname "Spyder."

"We're relatively certain (the suspect) is, or recently was, a student at a college near Manila. He's 22 now if he's who we think he is. His birthday was April 4, 1977. We don't have a name right now but we're working on it," said David Kennedy, research director at ICSA.net, an Internet security-consulting firm in Reston, Va., that's assisting the FBI and Department of Justice.

A 27-year-old man in the Philippines who also uses the nickname "Spyder" is being looked at, too, Kennedy said.

"Everything now points to the Philippines," Kennedy said. "If the (suspect) isn't in the Philippines, then he's using them as a doormat to clean his feet. I can't rule that out, but if that's the case, we need to see what tracks lead out of the Philippines."

While the probe of the "ILOVEYOU" virus -- popularly known as the Love Bug virus -- moved quickly, a rash of clone, copy and mutant viruses based on the Love Bug model moved even faster. Among those that popped up on Friday were e-mail headers titled "Very Funny," "fwd: Joke," and "Mothers Day Confirmation Order."

The confirmation says that the recipient's credit card has been charged $326.92 for a Mother's Day "diamond special," urging the reader to click on an attachment to print the invoice. Opening the attachments releases the bug. Another variation has a subject line with a Lithuanian phrase that translates as "Let's meet tonight for a cup of coffee."

Anti-virus technicians and software developers struggled to keep pace.

The fast-moving virus already has disrupted tens of millions of computers and caused, by some estimates, as much as $2-billion in business disruption and other damage since it was discovered Thursday.

Friday, many businesses in the Tampa Bay area were still working to repair the damage from the "Love Bug."

"Most of the day is wasted," said Mike Marika, Web master for Nicholas Financial Inc., a Clearwater-based car finance company. The bug destroyed graphic files on Marika's hard drive as well as those on the company Web site, which is linked to his computer. Marika said graphics on the Web site were quickly restored from backup files, but other files that existed only on his computer's hard drive have been lost.

"I'm sifting through all my backups trying to find as much as I can," he said. "And I'm going through and rechecking every PC in the place for viruses, making sure we don't get hit again."

He said the incident is a reminder that any work that has not been backed up is at risk.

"With digital cameras so popular today, this could have wiped out your whole photo collection," he said. The incident also might prompt some companies to consider other computer operating systems such as Linux, which is not susceptible to viruses designed for Windows systems, he said.

Neither FBI nor Justice Department officials would confirm that their investigation is centering on the Philippines. Officials at the Philippine Embassy in Washington said their National Bureau of Investigation is heading the inquiry.

A suspect will be prosecuted in the country in which he or she is found, according to the FBI. Depending on that country's laws, the Justice Department could seek extradition and prosecution under the U.S. Computer Fraud and Abuse Act. The felony offense is punishable by up to five years in prison, a fine of up to $250,000 or damages set at twice the gross loss to victims, said FBI spokesperson Debbie Weierman.

How prosecution proceeds depends on several factors, said Martha Stansell-Gamm, chief of the Justice Department's computer crime and intellectual property section.

"We have to determine whether the activity has been criminalized in that country," she said. Among the influencing factors: "Has it been criminalized in foreign systems? How many victims are there all over the world? Is there an extradition treaty and a history of succeeding with it? Or would it make more sense to support a prosecution where the suspect is."

A mutual legal assistance treaty is in place for joint criminal investigations by the Philippines and the United States, said Marc Zwillinger, a Justice Department trial attorney.

If a suspect is identified and extradition and foreign prosecution don't materialize, Stansell-Gamm said, the United States could still indict the suspect "in wait," hoping the culprit eventually can be arrested either entering the United States or in a country that has a functioning extradition treaty with the United States.

"Every case is different, but we want to make sure justice is done by us or some other government," she said.

© St. Petersburg Times. All rights reserved.