Radsoft
 About | Buy | News | Products | Rants | Search | Security
Home » News » Roundups » ILOVEYOU

The Facts

Updated May 9, 2000 2:30 AM UTC
This is mostly straight from the Philippines and yes it's all highly contradictory. So have fun.

  • His name is Rommel Lamore and he's 27 years old.
  • His name is Reomel Ramones and he's 35 years old.
  • Whoever he is, he works at Equitable Bank in some capacity.
  • According to the Washington Post, it is almost impossible to get any details on this person. Despite this, the Post already knows he is 'reclusive'.
  • The other two suspects 'invited for questioning' are Irene de Guzman and her sister Jocelyn.
  • It's a 'gritty' neighborhood they live in - a series of three storey buildings with 'peeling yellow paint and fluorescent lighting' in a 40 year old housing project next to a 'fetid' canal - and that makes them suspect right there. However the testimony of the neighbors is highly reliable.
  • They have a fenced-in patio strewn with scrap wood and corrugated iron sheeting and a small garden with a dozen potted plants.
  • The NBI zeroed in on them because SkyInet's caller ID identified them when they uploaded WIN-BUGSFIX.exe to those four addresses.
  • The NBI zeroed in on them because 'Spyder' (the header of the worm, remember) was found in IRC channel logs and could be traced to an account used at that address.
  • Lamore/Ramones and de Guzman were both sitting and hacking away with their computer when the NBI arrived, obviously starting the spread of new worms.
  • The NBI were already there when Lamore/Ramones arrived alone.
  • When they arrived at the messy apartment in the gritty house next to the fetid canal, the NBI found cut computer cables and a computer conspicuous in its absence, this despite the suspects either being at work at the time and 'dumbfounded' to see them there when they returned, or actually caught in the act of hacking away on a machine that everyone agrees was not there.
  • Ramones/Lamores ran when he saw the police and was caught in the neighborhood. The American ambassador was on the scene.
  • According to the neighbors, Ramones/Lamores and the de Guzmans have four very mean dogs who bark a lot and bite people. Ramones/Lamores has lived at that address for two years. Irene de Guzman has lived there with her sister Jocelyn for six years. They all work from very early (7 AM) to very late (7 PM) and the neighbors have never been let inside the apartment, but are always met at the front door. Even the mailman cannot get in (would he want to?) but has to slip the mail under the front door, say the neighbors. Despite this, the neighbors - and now the Washington Post - all know the apartment is a mess - a 'pig sty'.
  • Irene de Guzman was not there when the NBI arrived, but was later picked up in town.
  • Irene de Guzman was not there when the NBI arrived, but later turned herself in to NBI Director Federico Opinion. Her sister Jocelyn did the same.
  • From her photos, Irene is a very elegant lady who wouldn't really want to live in a dump. She works at a bank with other elegant ladies and they all belong to the same health club. Irene says her mother is her great inspiration, and has a picture of her at the Geo website with her mother's email address underneath. American lowlifes are already starting to post typically American lowlife things to Irene's guest book.
  • Jocelyn de Guzman just finished her degree at AMA College.
  • They did have a computer, registered in Irene's name, but it was used mostly by Jocelyn, who kept it locked in her own room, where the other two did not have access. Despite this, Irene managed to build her 'Manila Girl' website at Geocities.
  • Their address is 171 Building 7, Bliss Housing, Zamora St., Pandacan, Manila and they all deny the allegations. They have not been arrested, but only 'invited' for questioning (the handcuffs must have been the perk that enticed them).
  • The seizure of their goods allows the NBI to detain them.
  • The incident has terrified them all (highly believable).
  • The Philippines don't have a law against cracking - they had to use the 1998 Access Device Act which outlaws online scams, and needed almost 48 hours to find a law they could use to get a search warrant.
  • Manila Trial Court Executive Judge Rebecca Salvador issued the search warrant for Bldg. 7, Apt. 170, Bagong Barangay Housing Project, P. Zamora St., Pandacan, Manila (compare with above, both addresses from the same Philippines news source), for violation of RA 8484, the Access Devices Regulation Act of 1998, the only law they could get them on.
  • Other people are suspected - two students, 25 and 22 years old, at the AMA Computer College. One of these is likely Jocelyn.
  • The NBI had been casing the apartment since Friday.
  • Someone in that house used the nickname 'Spyder' in an IRC channel. But at least six others did too. TSCM says the feds just grabbed the first 'Spyder' they found, and that the 'Spider' (note different spelling) who helped spread the worm is actually the webmaster of a Philippine hackers website (true). The feds contend they can link their phone number to the spread of the virus but Fredrik Björck and TSCM wonder how.
  • Fredrik Björck still insists they have the wrong man. So does TSCM. Fredrik says Michael in Australia used Lamores/Ramones and the de Guzmans to spread the worm.
  • 'The person the FBI and the Philippine authorities have identified in Manila was, at some stage or other, in contact with Michael,' says Fredrik.
  • Atkinson agrees but says Michael is not in Australia.

About | Buy | News | Products | Rants | Search | Security
Copyright © Radsoft. All rights reserved.