AMA thesis writer wanted free surfing on Internet

One of the alleged authors of the most virulent computer virus to date apparently wanted to surf the Internet for free.

In his research paper, Onel de Guzman, an undergraduate of the AMA Computer College, wrote that his software "will be helpful to a lot of people, especially Internet users, to get Windows passwords such as Internet accounts to spend more time on Internet without paying."

De Guzman's thesis was rejected by the college dean, and an adviser said the computer school did not produce "burglars."

"We spend a lot of money to pay (for Internet) accounts for only using (sic) a couple of hours," the suspected hacker wrote. "So this program is the main solution. Use it to steal and retrieve Internet accounts of the victim's computer."

In developing the software, De Guzman said he gathered most of his data from computer books and the Internet itself. To see if his software works, he proposed to give it to Net surfers for free.

The idea was rejected on Feb. 24, with a thesis reviewer at the school noting "This is illegal" and "We do not produce burglars."

"That may have angered him so much so he decided to release his masterpiece to the world," said an agent of the National Bureau of Investigation (NBI).

AMA executive vice president Manuel Abad said De Guzman's software may have been combined with that of Michael Buen's, another AMA student, to make the "ILOVEYOU" virus.

"We are not saying they are the culprits," Abad said. But he characterized the information, which has been shared with investigators, as "potential leads for further confirmation."

De Guzman is now missing but lived in the same apartment as Reonel Ramones, the 27-year-old bank employee who was originally believed to be the creator of the virus.

De Guzman and Buen were members of an underground computer group called GRAMMERSoft, which provided programming to small- and medium-size businesses and also wrote and sold thesis projects to computer students, Abad said.

Buen graduated Friday - one day after the virus jolted businesses and governments around the world, creating disruptions that may cost as much as $10 billion, mostly from lost productivity.

Buen was not at his home when a reporter visited yesterday afternoon, but his mother, Emma Buen, said her son had only an old-model computer that he didn't use for accessing the Internet.

"I know that he has nothing to do with it," she said.

Buen's program, which was accepted as thesis material, was able to create multiple copies of computer files, Abad said.

US FBI agents have made copies of the diskettes and are studying them separately in Manila, said Elfren Meneses Jr., who heads the NBI's Anti-Fraud and Computer Crimes Division.

Cracking the "Love Bug" case has been a daunting task for the police, who lack much high-tech equipment as well as cyber-savvy investigators.

They have also been hindered by a shortage of local laws that can be applied to computer crimes.

Meneses was unable to report any progress yesterday, although he said authorities were doing their best.

"This is an international issue. We don't want other countries to say we are just looking at the problem and not acting," said Meneses.

The NBI's Computer Crimes Division appears anything but high-tech -- a sign outside the office is handmade and attached to the window with plastic tape, while a copy machine sitting atop an old green filing cabinet inside displays a big "out of order" sign.

Meanwhile, the Department of Justice ordered the Bureau of Immigration to impose a travel ban on Ramones.

"The hold departure order is deemed necessary to ensure that Ramones is available at any time for a speedy investigation of the case," Justice Secretary Artemio Tuquero said in a statement.

Ramones, the alleged creator of the "ILOVEYOU" virus, was questioned for several hours before being conditionally released on Tuesday after prosecutors said police did not have enough evidence to hold him.

He was to appear at another hearing at the justice department on May 19.

Carlos Caabay, deputy director for investigation services of the NBI, told Agence France Presse that Ramones had a case to answer for violating the Access Devices Act which carries a maximum jail term of 10 years.

The Act bans the use of devices to break into telecommunications systems but is normally used in detecting credit card fraud.

The computer attack was the biggest of its kind to date, triggering an international search for the perpetrators.

Ramones' 25-year-old common-law wife Irene de Guzman and her sister Jocelyn, 23, have also been questioned over the computer virus. The couple are local bank employees and live in a government tenement housing in Pandacan.

Tuquero said he had created a special panel of prosecutors to handle the preliminary investigation, the first of its kind in the Philippines which has no law specific to cybercrime.

Among the members of this panel are Senior State Prosecutors Archimedes Manabat and Jafar Dimaampao and State Prosecutor Ruben Carretas.

"I have directed the legal staff to carefully study the most applicable penal provisions under our existing statutes so that we may pin down the perpetrator or perpetrators of this assault that recognizes no national boundaries made through the cyberspace," he said.

Tuquero said the justice department was very much aware of the extent and intensity of the damage wrought by the virus.

The justice secretary also said his department was coordinating with Congress to determine if pending measures are sufficient to deter and penalize hackers.

"If not, we may have to draft a proposal for the President to certify as urgent to ensure its early passage by Congress," he said.

Caabay said they were also looking for 10 more people suspected of helping launch the devastating "Love Bug."

He said the 10 other suspects were believed to be from the AMA Computer School in Makati City, where Ramones had also studied.

"The NBI is busy going all over Metro Manila today hunting for 10 possible suspects," Caabay said. "Our people are still working in the field, busy looking for these people."

Experts have expressed doubt that the virus, which came in the form of an innocent love message but once opened burrowed destructively into computer systems, was the work of Ramones.

James Atkinson of the Massachusetts-based Granite Island Group said he believed the main author to be a male who lives in a Manila suburb near Ramones.

Atkinson, a former US intelligence agent whose firm provides technical security and counter-intelligence, said he traced the virus to a 23-year-old named Michael Gulam who may have been assisted by a 15- to 17-year-old female from Tanzania named Ajnabi.

"Both of them have a significant amount of underground activity," he told AFP by telephone in Washington.

Atkinson said he believed Ramones may have been arrested simply because he had in the past used the nickname "Spyder" that appeared in some of the coding in the virus.

Internet providers said the virus was planted last month by a hacker using the names "mailme," "spyder," and "ispyder," who left an awkwardly written message saying "I hate go to school."

Tuquero said Ramones could even be a fall guy.

"I'm not saying Ramones didn't do it. It is still early to say that he is not involved," he said.

Meanwhile, Ramones has hired the services of lawyer JJ Disini, who specializes in cyber law and e-commerce. The lawyer is an alumnus of the UP College of Law and is an advocate for the passage of the E-Commerce Bill in Congress.

Investigators said the crippling "Love Bug" virus could have started as a prank by hackers who did not foresee the consequences.

The NBI said it was investigating a lead pointing to people with links to a local computer school after state prosecutors on Tuesday ordered the release of their first suspect.

The NBI's top investigator in the case, Nelson Bartolome, told reporters the agency was examining 10 encoded names in the virus program which pointed to people with links to the AMA Computer College in Manila.

"They (the suspects) did not know it was criminal, perhaps it was just a prank," Bartolome told reporters. "But it was deliberate on their part, what they did not expect is the damage it would cause." --