Worm Suspect Arrested

[William Knowles <wk () C4I ORG>]

http://www.wired.com/news/technology/0,1282,36187,00.html

Wired News Report
6:00 a.m. May. 8, 2000 PDT

MANILA -- The ground-floor flat in a lower middle-class Manila
neighborhood where the "Love Bug" was said to originate is an unlikely
setting for the birth of the most virulent virus ever to hit the
world's computers.

More than two dozen plainclothes officers from the Philippine National
Bureau of Investigation thoroughly searched the dilapidated two-room
flat Monday after receiving search warrants, and arrested Reomel
Ramones, a 27-year-old man living there.

They were also seeking his live-in 23-year-old girlfriend, Irene de
Guzman, who was at work at the time. The couple were named in two
separate search warrants for the same address.

The woman being sought by Philippine authorities is expected to
surrender on Monday, officials said.

"She will be coming," NBI chief Federico Opinion told reporters. He
said she had sent a message through legal counsel that she would turn
herself in either later Monday or on Tuesday.

Scores of cameramen and reporters descended on the 40-year-old Bagong
Barangay housing project as news spread that NBI officers were on the
way there. After a 3-1/2 hour search, NBI officers left with Ramones
in handcuffs.

Gil Alnas, chairman of the local residents council, said the NBI
officers took away 17 items including a telephone, telephone wiring,
and computer magazines -- but no computer.

"There was no computer in the house," Alnas told reporters.

The search warrants, issued by a Manila judge, said there was reason
to believe that equipment in the house -- including possibly computers
and peripheral equipment, telephones, and other hardware -- had been
used in violation of the Access Devices Regulation Act.

Opinion said agents obtained the search warrants after three days of
fruitless efforts to seize evidence that might point to the source of
the virus which penetrated computers last week, including those of the
Pentagon.

It was quickly traced back to the Philippines and on Saturday the NBI
began surveillance of the premises from where the virus was suspected
to have been spread.

But authorities were unable to obtain a search warrant until Monday
because under Filipino law, hacking is not a crime.

The Access Devices Act governs the use of codes, account numbers, and
passwords giving access to different types of devices. The law
provides for a maximum punishment of 20 years in jail for violators.

Opinion said investigators had taken away some computer diskettes, but
would not comment further. He said the seized material was being
analyzed.

Neighbors said the suspect couple was quiet, unassuming, and kept
pretty much to themselves.

"She was nice," said one woman. "She would smile at me when passing,
but I hardly ever talked to her. I didn't know the man either. But I
don't think they were married."

Another neighbor said de Guzman could often be seen in the area going
down to buy bread from a bakery on the crowded main street. "She is a
quiet, pretty woman," he said.

Alnar, from the residents' council, said the flat was owned by de
Guzman's father, but that he had left Manila some years ago. "Since
then Irene has been living here with this man," he said.

The search and the arrest provided several hours of entertainment in
the neighborhood. Residents left their homes to peer at the camera
crews and the NBI officers, one of whom had an ill-concealed revolver
thrust into his waistband.

A group of teenage boys hurriedly abandoned their impromptu basketball
game to jeer at the officers.


*-------------------------------------------------*
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions             http://www.c4i.org
*-------------------------------------------------*

ISN is sponsored by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".