ILOVEYOU — The Love Letter Worm That Circled the World in a Day

ILOVEYOU (also called the Love Letter worm or the Love Bug) was a Windows worm that spread from Asia on 4 May 2000 and within a day had choked email systems around the world. It arrived as a message with the subject line "ILOVEYOU" and an attachment named LOVE-LETTER-FOR-YOU.TXT.VBS; opened, it mailed itself to everyone in the victim's Microsoft Outlook address books. The suspect was Onel de Guzman, a student at a computer college in Manila, the Philippines. The Philippines had no law against what he was accused of, and charges brought under another law were dropped. He admitted writing it twenty years later.

What it did

The CERT Coordination Center (CERT/CC) at Carnegie Mellon University issued advisory CA-2000-04 on 4 May. It described the worm as a malicious VBScript program that ran on Windows systems with Windows Scripting Host enabled.

People who received the worm by email, the advisory warned, would most likely recognise the sender; it urged users not to run code received by email, whoever sent it, without first-hand knowledge of its origin. Because files were overwritten rather than deleted, it said, recovery was difficult and might be impossible.

Around the world in a day

The US General Accounting Office (GAO) reconstructed the day in testimony to Congress on 18 May. The first reports came from Asia on 4 May, and the worm spread with unprecedented speed through Asia and Europe while the US slept: when it was 3 p.m. in Hong Kong it was 9 a.m. in western Europe, and the impact was becoming evident.

By the evening of 8 May, the CERT/CC advisory said, it had reports from more than 650 sites indicating more than 500,000 individual systems affected.

GAO gave two reasons it outran Melissa, the previous year's mass-mailing virus: it arrived on a weekday rather than a weekend, and it mailed every address in the book, not just the first 50 as Melissa had. By 10 May the Veterans Health Administration had received 7,000,000 ILOVEYOU messages, against 750,000 during Melissa. The Department of Health and Human Services received about 3 million, and its department-wide email was not fully restored until 9 May.

Who was hit, and the cost

According to GAO, large companies such as AT&T, TWA and Ford, media outlets such as the Washington Post, Dow Jones and ABC News, state governments, school systems and credit unions took their networks offline for hours. Abroad, the International Monetary Fund, the British Parliament and Belgium's banking system were among those affected.

Federal warnings came late. Of the 20 agencies GAO interviewed, only two first heard about the worm from FedCIRC; twelve heard from their own users. Seven were spared widespread infection, largely because they used email software other than Outlook.

On damage, GAO said initial estimates ranged from $100 million to over $10 billion and that the bottom line was still uncertain.

Japan: saved by a holiday

The worm reached Japan during Golden Week. The Information-technology Promotion Agency (IPA) reported in June that it had received 900 virus reports for May, a monthly record, 346 of them for VBS/LOVELETTER, also a record for a single virus in one month. Actual infections were limited to nine cases and 19 PCs. IPA's explanation was that the story broke as big news while companies were closed, so users handled email carefully when they returned and administrators had dealt with it during the holiday.

No conviction

The trail led to Manila. According to Infosecurity Magazine and the BBC, the passwords the worm stole were being sent to an email address registered to an apartment in Manila, and the occupant's brother was Onel de Guzman, a student at AMA Computer College. At a press conference organised by his lawyer on 11 May, asked whether he might have released the virus accidentally, de Guzman said: "It is possible."

Computerworld, citing the Associated Press, said the charges were dropped for lack of evidence and because the counts filed by the National Bureau of Investigation were not specifically about computer hacking. The new e-commerce law could not be applied retroactively.

A confession twenty years on

The British journalist Geoff White tracked de Guzman down to a phone-repair stall at the back of a Manila shopping mall. In the BBC article published in May 2020, de Guzman admitted creating the worm and said his aim had been to steal dial-up passwords so he could use the internet without paying. He said he first sent it only to Philippine victims he met in chat rooms, then in spring 2000 added the feature that mailed it to every Outlook contact and gave it a subject line with worldwide appeal. "I didn't expect it would get to the US and Europe. I was surprised," he said. He denied that his fellow student Michael Buen, sometimes cited as co-author, had any part in it.

This is his own account; in 2000 he had never admitted it.

What it left behind

GAO's testimony concluded by urging agencies to teach users that email attachments are not always what they seem, to sound an alarm when large numbers of identical messages arrive at once, and to keep alternative ways to communicate when email is down.

Twelve years after the Morris worm crossed the network on its own in 1988, ILOVEYOU travelled on email and human curiosity. What came after is on the cybersecurity timeline, including WannaCry in 2017.