Man arrested in Love Bug virus; relatives say police have wrong person

MANILA, Philippines - Accompanied by FBI agents, Philippine police raided an apartment in Manila on Monday and arrested a bank employee who along with his girlfriend is suspected of links to the ''ILOVEYOU'' virus that has overwhelmed computer networks around the world.

But relatives of the man, Reomel Ramones, said they believe the real culprit may be a third person who lived in the apartment - the girlfriend's unemployed sister, who recently graduated from a computer school that a U.S. security firm has linked to the ''Love Bug'' virus.

Investigators entered the apartment in Pandacan, a lower-middle-class Manila neighborhood, and seized computer diskettes, wires, telephones and other computer accessories.

No one was home at the time of the raid, but Ramones later returned and was arrested by agents from the country's National Bureau of Investigation. His girlfriend was contacted by investigators and promised to appear at NBI headquarters, NBI chief Federico Opinion said. He did not give her name, and her sister's whereabouts were not immediately known.

Local radio reports said Ramones denied any involvement with the virus. An investigator said Ramones had ''opted to remain silent.''

The virus has caused a flood of e-mails with the subject line ''ILOVEYOU'' to course through computer systems in more than 20 countries since it appeared last week. When opened, the virus can destroy graphics and other saved files. Several variations appeared soon after - one masquerading as an e-mail joke, another as a receipt for a Mother's Day gift. Several FBI agents are in the Philippines cooperating in the search for the virus programmer.

No charges were immediately filed against Ramones, Opinion said. By law, charges must be filed within 36 hours.

Philippine investigators were faced with a difficult task because their country has few laws tailored to high-tech computer crimes. Opinion said they plan to use a law against improper use of commerce ''access devices'' such as credit cards, account numbers and passwords to charge the virus creators. The law carries a maximum penalty of twice the amount obtained by fraud plus up to 20 years in prison.

''This is a new type of crime,'' Opinion said, adding that investigators were led to the apartment by informants.

At a news conference Monday in Washington, Attorney General Janet Reno sidestepped the question of whether those taken into custody in the Philippines were suspected of actually creating the virus.

''They've presently been questioning individuals in connection with the investigation. We continue to pursue all relevant leads,'' she said.

Although Ramones works in the computer department of a bank, he is an accounting graduate and his specialty is computer hardware, not software, his relatives said. They said the computer in the apartment was almost always locked in the room of the third resident, the 23-year-old sister of Ramones' girlfriend. The sister recently graduated in computer engineering from the Philippines' AMA Computer College.

For several days, information culled from various Philippine Internet service providers has indicated that the virus programmer was a 23-year-old living in Pandacan who claimed to be male. Ramones is said to be in his mid-30s.

A U.S. computer security company, ICSA.net, said comparisons of the ''ILOVEYOU'' virus with a password-stealing program written earlier indicate the author was a student at AMA Computer College.

Michelle Navarro, the school's dean of students, said she was unaware of any student having created a computer virus. She said the school has 10,000 computer students.

In a statement, the school said it will ''never condone any act which will result in the improper use of information technology to the detriment of society.''

In Japan, meanwhile, tens of thousands of people returned to work Monday from a weeklong holiday to find the virus that had swept around the world waiting in their computers. Government officials and antivirus software companies issued emergency warnings to computer users not to open suspicious-looking files in their e-mails.

When the rest of the world was struggling to cope with the fast-moving virus last week, Japan was virtually unaffected because most companies and government offices were closed for the ''golden week'' holidays that began April 29.

As of early Monday, the number of infected files in Japan reached 73,000, according to Akitsu Hirasawa, a spokeswoman for Trend Micro Inc., a leading Tokyo-based antivirus software firm.

---

On the Net:

National Infrastructure Protection Center at http://www.nipc.gov/

CERT Coordination Center at http://www.cert.org

Anti-virus companies, including Trend Micro at http://www.trendmicro.com; Symantec at http://www.symantec.com; Network Associates at http://www.nai.com