High severityOpen
Strong public attribution vs no conviction
Public reporting strongly centers Onel de Guzman, but the legal record did not produce the kind of conviction that would fully settle authorship in court.
ILOVEYOU Virus
New releasePublished May 23, 2026Updated May 23, 2026
Theories
Compare the major theories, supporting claims, disputed points, and unresolved questions in this case.
Theory Comparison
A quick read on how the major theories differ before reviewing the full evidence and claims below.
SupportedModerate confidence
Onel de Guzman authored and released the worm
- Strongest evidence
- Investigators and reporters focused on a rejected AMA Computer College thesis proposal involving password capture or credential access, treating it as an important link in the attribution narrative around Onel de Guzman.
- Open question
- How much of the public attribution record would have survived a fully litigated criminal case?
Jump to details →
HistoricalModerate confidence
Password theft and free internet access drove the original design
- Strongest evidence
- The worm attempted to retrieve or enable theft of internet-access credentials, a key reason later reporting gave for the design and a central piece of the motive narrative around Onel de Guzman.
- Open question
- Was the destructive file-overwrite behavior an intended payload or a consequence of a broader malicious toolkit?
Jump to details →
ContestedLow confidence
An early multi-suspect probe narrowed into an Onel-centered attribution narrative
- Strongest evidence
- Investigators and reporters focused on a rejected AMA Computer College thesis proposal involving password capture or credential access, treating it as an important link in the attribution narrative around Onel de Guzman.
- Open question
- How much stronger was the case against Onel than against the other early suspects?
Jump to details →
HistoricalModerate confidenceShow detailsHide detailsPassword theft and free internet access drove the original design
A widely repeated motive theory is that the worm was designed to collect credentials for internet access because connectivity costs were out of reach, with global destructive consequences flowing from a tool built around theft and propagation rather than a narrowly targeted sabotage plan.
HistoricalModerate confidence
Show detailsHide detailsPassword theft and free internet access drove the original design
A widely repeated motive theory is that the worm was designed to collect credentials for internet access because connectivity costs were out of reach, with global destructive consequences flowing from a tool built around theft and propagation rather than a narrowly targeted sabotage plan.
People
Onel de Guzman
Evidence
The worm attempted to retrieve or enable theft of internet-access credentials, a key reason later reporting gave for the design and a central piece of the motive narrative around Onel de Guzman.
Beyond self-propagation, the worm overwrote user files and altered system behavior, turning a password-theft design into a globally destructive incident.
Timeline links
ILOVEYOU begins global spread via Outlook email
Onel de Guzman emerges as the central public suspect
Sources
Love Bug investigation wrapping up in Philippines
'ILOVEYOU': How a student's email virus exploited human nature
'ILOVEYOU': How the Infamous Computer Worm Wreaked Havoc
CERT Advisory CA-2000-04: Love Letter Worm (2000 CERT Advisories compilation, pp. 14–21)
Key claims
SupportsForensic
The subject line and disguised attachment made social engineering central to the worm's success.SupportsForensic
Outlook address-book automation is what turned ILOVEYOU from a malicious attachment into a global outbreak within hours.SupportsMotive
The password-stealing or credential-access component is central to the public explanation for why the worm was written in the first place.WeakensOther
The worm's file overwriting and worldwide disruption far exceeded any narrow rationale about getting online for free.Open questions
- Was the destructive file-overwrite behavior an intended payload or a consequence of a broader malicious toolkit?
- How much of the motive story comes from later retrospective narration rather than contemporaneous evidence?
ContestedLow confidenceShow detailsHide detailsAn early multi-suspect probe narrowed into an Onel-centered attribution narrative
The initial investigation touched multiple students and associates, but later public memory and reporting concentrated heavily on Onel de Guzman. That shift may reflect stronger evidence against him, the needs of storytelling, or both.
ContestedLow confidence
Show detailsHide detailsAn early multi-suspect probe narrowed into an Onel-centered attribution narrative
The initial investigation touched multiple students and associates, but later public memory and reporting concentrated heavily on Onel de Guzman. That shift may reflect stronger evidence against him, the needs of storytelling, or both.
People
Onel de Guzman
Reonel Ramones
Evidence
Investigators and reporters focused on a rejected AMA Computer College thesis proposal involving password capture or credential access, treating it as an important link in the attribution narrative around Onel de Guzman.
Contemporaneous reporting and later legal materials show that the Philippines lacked a cleanly applicable cybercrime statute for the conduct at the time, a core reason the case did not end in a straightforward conviction.
Timeline links
Philippine NBI targets local programmers
Arrest of Reonel Ramones in Manila
Onel de Guzman emerges as the central public suspect
Sources
Ten Filipino students targeted in 'Love Bug' virus probe
Philippine investigators question suspects in Love Bug case
Charges Dropped in 'Love Bug' Virus Case
'ILOVEYOU': How a student's email virus exploited human nature
Key claims
SupportsInvestigative
The early Philippine probe covered multiple students and associates, not just one person from the beginning.SupportsTimeline
As the story matured, Onel de Guzman remained the central public name associated with authorship, while other early suspects faded from the main narrative.SupportsCourt
A lack of clearly applicable computer-crime law in the Philippines prevented a clean criminal adjudication of the case at the time of the outbreak.Open questions
- How much stronger was the case against Onel than against the other early suspects?
- Did the absence of a final conviction distort how later histories simplified the attribution story?
Disputed Points
These are points where claims, evidence, or investigative conclusions are in tension.
Medium severityOpen
Credential-theft motive vs global destructive impact
The access-theft motive helps explain the worm's origin story, but it does not neatly fit the scale of system damage and worldwide operational disruption that followed.
Medium severityOpen
Early multi-suspect probe vs later singular public memory
The investigation initially touched several people, yet later history compresses the case into an almost single-name attribution story.