- Two bank employees living in an unglamorous part of Manila are to be charged in connection with the release of the 'Love Letter' virus.
Reports on news services say that one suspect, 27 year-old Reomel Ramones, has been arrested and that that his 23 year-old girlfriend Irene De Guzman is expected to turn herself in to the Philippine National Bureau of Investigation (NBI) soon.
The couple - whose flat did not contain a computer, only disks and accessories - are thought to have devised the virus to steal Internet access passwords. The Washington Post is today quoting a source saying that the suspects didn't "ever expected it to spiral out of control like it did."
Ramones is expected to be charged today with violating a Philippine law called the Access Devices Regulation Act, which forbids using fraudulent information to obtain goods or services. He would thus be charged with using stolen passwords to connect to two Philippine ISPs, but not with actually unleashing the virus, which is not specifically prohibited by Philippine law.
A Reuters story says the flat, owned by de Guzman, has been under surveillance since Saturday. NBI officials said over the weekend they were having trouble finding a judge who understood the issues well enough to grant a search warrant, but were searching the flat when Ramones arrived and was arrested after attempting to flee.
The Access Devices Act provides for a maximum punishment of 20 years in jail for violators.
The NBI said it was also likely that further investigation could lead to more arrests, but would not give details.
The suspects are thought to have been relatively easily traced after connecting to the Manila ISP they used to introduce the virus to the Internet from their own home phone number. Caller-ID was used to trace the source number.
In the midst of news coming out of the Philippines, a Swedish researcher over the weekend said that he has tracked the virus to a German exchange student living in Australia. Fredrik Björck, a researcher at the Computer and Systems Sciences Department run by Stockholm University and the Royal Institute of Technology, said that the virus was launched through an e-mail account at a Philippine ISP.
However, computer security companies have been saying for several days that the virus writer is in the Philippines. One such company, ICSA.net, reportedly has thinks the suspect is a student at AMA Computer College in the Philippines.