WASHINGTON (05/08/2000) - The "I Love You" virus - also known by the names "Love Bug," "Joke" and "Mother's Day" - may linger in government agencies and Congress long after it has been deleted from most systems: It has triggered a new round of calls in Congress for tougher computer crime laws.
Meanwhile, some federal agencies will examine how the virus, distributed around the world late last week, was handled.
The virus turned up in e-mail at every government agency, including Congress, forcing shutdowns of e-mail systems and causing general business disruptions late last week.
"I would say this is the worst (virus intrusion) we have ever seen," said an information technology worker at the Library of Congress.
The U.S. Department of Veterans Affairs, for instance, was "pretty widely hit" by the virus, which forced a shutdown of e-mail systems, said one IT worker.
But turning off the e-mail system Thursday also cut off the chief means for warning employees about the danger.
"We learned some lessons in our incident response. One is, you can't always rely on e-mail to communicate with people," the IT worker said. Telephones and fax lines were used as backup methods to contact employees.
An overall assessment of the amount of damage the virus caused federal systems was not yet available, said one White House spokesman today.
But some agencies reported minimal impact. At the U.S. Department of Commerce, other than some interruptions of e-mail service, the virus affected only 500 of 40,000 end users in varying degrees, said CIO Roger Baker. "It didn't bring us down," he said.
"The human systems reacted pretty well to this one - people saw it early, reacted to it early and took some fairly substantial actions to keep it from spreading," said Baker. Those actions included cutting off attachments from e-mail.
The department's security staff will be reviewing what happened to see what can be done to minimize future attacks, Baker said.
The software in use also influenced the severity of the attack. The Senate, which uses Lotus Development Corp.'s cc:Mail, had fewer problems then the U.S.
House of Representatives, which uses Microsoft messaging, according to one IT worker. A House IT worker said Friday that "we're too involved with (the virus)" to talk about it. The virus targeted users of Microsoft Corp.'s Outlook messaging software.
The U.S. Department of Defense, in a statement Friday, said the virus had infiltrated a classified e-mail system, where it "contaminated less than 1%" of that network. The DOD said it was investigating how that virus infiltrated its systems.
The virus also prompted calls for computer crime legislation, although it's possible that this virus may have originated in the Philippines.
Sen. Patrick Leahy (Democrat-Vermont) has offered a bill, the Internet Security Act of 2000, that would make it easier for law enforcers to trace transmissions over telephone wires. Current law requires police to get trace orders in every jurisdiction; this bill would eliminate the need to get orders in different jurisdictions - a provision that one congressional aide in Leahy's office said would make it easier to locate attacks, even those coming from outside the U.S.
And U.S. Senators Charles Schumer (Democrat-New York) and Orrin Hatch (Republican-Utah) renewed calls for tougher computer crime penalties.
Legislation they introduced three weeks ago, S. 2448, would make it illegal to forge or alter a header to avoid identifying the sender. The bill also includes provisions intended to improve the ability of federal, state and local agencies to prosecute computer criminals.
But Mark Gembecki, president of information security firm WarRoom Research Inc. in Annapolis, Maryland, questioned the effectiveness of such proposed new laws.
"The issue is enforcement; that's the big thing," said Gembecki. And the main problem is the unwillingness of many private companies to seek law enforcement help to prosecute cybercrimes. Many companies are reluctant to seek prosecution because it draws attention to their own security problems.
"If you can't even address that, why are you bothering to pass another law?
You're adding one more thing out there that is not going to be enforced," said Gembecki.