Who Created the ILOVEYOU Virus? Charged Under a Credit Card Law, Cleared by August

September 6, 2026

The Philippines' Chief State Counsel ruled in May 2000 that the credit-card law did not cover hacking. On 29 June the National Bureau of Investigation charged Onel de Guzman under it anyway.

Everyone remembers the short version: the Love Bug came from Manila, the Philippines had no computer-crime law, and the kid walked. All three parts are true. None of them is the story.

The story is that the first person arrested was not him. That he was formally charged and faced up to twenty years. That the state's own Chief State Counsel had said the charge would fail before it was filed. And that the law which would have fitted, signed while the case was still open, carried a maximum of three years.

Who created the ILOVEYOU virus?

Onel de Guzman, then 23, a dropout from AMA Computer College living in Pandacan, Manila. That was the answer within days in 2000, and it was confirmed by the man himself in 2020, when the journalist Geoff White tracked him to the phone repair shop he now runs in Manila and he admitted to authoring the virus. Twenty years of "alleged" ended at a phone repair shop.

The 2000 identification did not need much detective work. The worm's own source code carried a comment naming a handle, spyder, and a group, GRAMMERSoft Group / Manila,Philippines. GRAMMERSoft, according to the Philippine Star, was a group of students who wrote software for small businesses and, on the side, wrote theses for sale to other computer science students. De Guzman was a member. The worm reached the world on 4 May 2000, the day before AMA's graduation ceremony, and de Guzman was not graduating, because in February the thesis committee had rejected his proposal. Its title was "E-mail Password Sender Trojan". It proposed software to "steal and retrieve Internet accounts of the victim's computer". The dean wrote "This is illegal!" on it. A faculty member added, in the margin: "We do not produce burglars."

By May the burglary tool had a subject line. The mass-mailing shape was not new; Melissa had already used the Outlook address book. What ILOVEYOU did once opened, and why the attachment looked like a text file, is a separate account. This one is about what happened to the person who sent it.

How was it traced to Manila?

Quickly, and by the phone line rather than by the code. The Philippine Star reported on 6 May that the worm had been uploaded to the servers of Sky Internet, a Philippine ISP, as early as 28 April, and had sat there dormant until the Thursday it went out. Information from the ISPs pointed to a 23-year-old male in Pandacan. The Register's account of the same trail: a Manila flat "where a telephone line, traced with caller ID, is thought to have been used to release the worm."

Dial-up left a phone number. The phone number had an address. The address had a door.

Who was actually arrested?

Not de Guzman. On 8 May 2000, four days after the outbreak, NBI agents raided a flat at the Bagong Barangay housing project on Zamora Street, Pandacan, and took away a 27-year-old bank employee. His live-in partner, Irene de Guzman, was picked up later at the Makati bank where she worked; the Philippine Star noted that she had been "originally tagged by the NBI as the 'Love Bug' creator." They found no computer. They found a disk with code resembling the worm's and, by the FBI-assisted count reported on 13 May, 17 diskettes in total.

By 9 May the bank employee was out. The NBI released him "pending further enquiries" because it did not have enough evidence to hold him, and told him to report back on 19 May. He said he had nothing to do with it. The press could not even settle his name: the Philippine Star printed Riomel Lamores, The Register Reonel Ramones, and later accounts Reomel Ramones. The man whose arrest made the wires is, twenty-six years later, still spelled three ways.

Irene de Guzman had a brother. He had just failed to graduate from AMA. Investigators' attention moved to him, and he had not been at the flat when it was searched.

"It is possible"

De Guzman surfaced on 11 May, at a press conference, with a lawyer. Asked whether he might have released the worm by accident, he answered, "It is possible." He would not say whether he had written it. He offered one line of philosophy: "The Internet is educational, and it should be free." His lawyer, Rolando Quimbo, did the rest of the talking. "He is not really aware that the act imputed to him was done by him." And, to the question of why the two students under investigation had not turned themselves in: "No subpoena or warrant of arrest has been issued, so why do they have to give themselves up?"

The second student was Michael Buen, also 23, a close friend who had graduated on 5 May with a thesis on self-duplicating programs. Whether Buen was even in GRAMMERSoft depended on which day you read the Philippine Star: a member on 12 May, "reportedly not a member" on 13 May. A second virus turned up on a floppy from the flat and investigators suspected him of writing it. He denied any involvement. When the NBI eventually filed charges, it declined to file any against Buen because it "found no evidence against him." The two-students version of this story was closed by the investigators themselves, in June 2000.

Why was nobody prosecuted for ILOVEYOU?

The usual answer is that there was no law. There was no law. But watch the sequence, because it is stranger than an absence.

Officials were, in the Star's words, "looking for a law" from the first week. What the NBI found was a 1998 statute on the fraudulent use of credit cards, account numbers and passwords, carrying up to twenty years. By 18 May the Chief State Counsel, Elmer Bautista, had ruled that it did not reach. "Nowhere in the law is 'computer hacking'... and the effects thereof dealt with," he wrote. A hacker's intention "is not to defraud," so hacking "cannot be considered covered." The NBI accepted the ruling without objection.

On 14 June 2000 President Joseph Estrada signed Republic Act 8792, the Electronic Commerce Act. Section 33(a) makes hacking and cracking a crime, "including the introduction of computer viruses and the like," with a minimum fine of one hundred thousand pesos and "mandatory imprisonment of six (6) months to three (3) years." That is the law that fits ILOVEYOU. It arrived forty-one days after ILOVEYOU, and it does not run backwards.

Then, on 29 June, the NBI charged de Guzman anyway: theft, and violation of the Access Device law, the same credit-card statute Bautista had already ruled out. Elfren Meneses Jr., chief of the NBI's Anti-Fraud and Computer Crimes Division, said the bureau had four witnesses. The penalties on paper were six to twenty years for the access-device count and three to six for theft, with fines from ten thousand pesos up to twice the damage. The Voice of America put it as a maximum of twenty years.

On 21 August 2000 Chief State Prosecutor Jovencito Zuno signed the resolution dismissing every count. The Department of Justice said the charges "either did not apply to computer hacking, or there was insufficient evidence to back them up": the credit-card law does not apply to hacking, which is what Bautista had said in May, and investigators had not presented adequate evidence for theft. The new law, the Department confirmed, could not be applied retroactively. Meneses' summary of the legal position, the day the case collapsed, was less confident than his charge sheet had been: "Those are the only laws that our legal department has identified as being applicable. That's the best we have."

There was one more door, and it was also shut. The Philippines had an extradition treaty with the United States, but it applied only to conduct that was a crime in both countries. In the Philippines, in May 2000, this was not one. An outbreak which the GAO told Congress had produced reports involving more than 420,000 internet hosts by six o'clock on its first evening, and had reached at least fourteen US federal agencies, ended with every charge dismissed. The Archive's account of who was arrested for WannaCry ends with three men charged and none in custody. This one ends with the charges themselves gone, and the file open from 29 June to 21 August.

What he said, twenty years later

When Geoff White found him, at the phone repair shop, for the book Crime Dot Com, de Guzman admitted writing it and said he regretted it. The motive he gave was the one on the rejected thesis: he wanted internet access and did not want to pay for it, so he took the passwords of people who had. White's own assessment, to WHYY in 2025: "I genuinely don't think he understood the kind of mayhem he was gonna cause."

The mayhem has a famous price tag, and it is worth knowing where the tag came from. The figure the GAO gave Congress in May 2000 was a range, "from $100 million to over $10 billion globally," which is a spread of two orders of magnitude and an admission that nobody had measured anything. The $10 billion that gets quoted is the top of that range, without the bottom.

He was charged with theft. The thing he was actually trying to steal was dial-up time.

The charge carried twenty years. The law that fit carried three. He served neither.

Written and fact-checked by a practicing senior security engineer. Published under UNHACKED, which is accountable for it. How the Archive is written.

EXHIBIT 0003 — ILOVEYOU

EXHIBIT 0003 is the attachment, not the court file. The filename, exactly as it was, both extensions intact.

Most people who see it will remember that some kid in Manila got away with it. A smaller number will know he was charged under a credit-card law, and that the ruling against that charge was already on file when it was brought.

That's the whole idea.

View the ILOVEYOU shirt — EXHIBIT 0003

Back to blog

Item added to your cart