May 11, 2000 - 02:29 AM

Computer Virus Hit 14 Federal Agencies

By Jesse J. Holland

Associated Press Writer

WASHINGTON (AP) - Hiring a "computer czar" to coordinate the government's high-tech crime-fighting efforts and making it a federal crime to create a computer virus can help keep future "Love Bugs" from wreaking havoc, experts told a congressional committee.

Harris Miller, president of Information Technology Association of America, told the House Science technology subcommittee that the government needs to hire a point-person to send out immediate alerts when a destructive virus is going around.

"Not a big office, not a lot of staff ... but someone who does have the authority and the ear of the president in coordinating responses across the government agencies," Miller said.

At least 14 agencies were hit by the Love Bug, including the Social Security Administration, the Energy Department, the CIA, the National Aeronautics and Space Administration, the Immigration and Naturalization Service and the Defense Department, said Keith Rhodes, director of computer and information technology assessment at the General Accounting Office.

Love Bug was the fastest-spreading and most destructive computer virus ever; it caused a flood of e-mails with the subject line "ILOVEYOU" to course through computer systems worldwide. When opened, the virus destroyed graphics and other files and damaged operating programs. Several variations appeared soon after. The virus also installed a password-stealing program, experts said.

"Some DOD (Defense Department) machines required complete software reloads to overcome the extent of the damage," Rhodes said. "The virus-slash-worm spread rapidly through the department, penetrating even some classified systems."

He predicted virus attacks will continue until government agencies suffer major damage and become more serious about defending their computers from hackers.

"It will be worse next time and it will cost more money, but until we bang the knee against the curb we're going to keep going through this," Rhodes said.

Rhodes complained that there were too many government agencies taking too many different security methods when the Love Bug struck. "A single point for getting the information out would be valuable," Rhodes said. "Right now, we've got jillions of people trying to give information."

Peter Tippett, chief technology officer for computer security company ICSA.net of Reston, Va., said a quick coordinated response is key to containing a computer virus. At least 1 million computers had been infected by the Love Bug within five hours after it was launched at 4 a.m. a week ago Thursday, he said.

"It was half over with by 9:30 in the morning," Tippett said. "That means if you learned about it at 10:30, it was too late."

But the federal government, Rhodes said, didn't send out its first Love Bug alert to agencies until after 10 a.m.

Tippett suggested that Congress look at making it illegal to write a computer virus. Making a bomb is illegal but writing about how to make a bomb is not, he noted. "But with a computer virus, the words are the bomb," he said.

Lloyd's of London has estimated the worldwide damage caused by the Love Bug to be over $15 billion, said Rep. Constance Morella, R-Md., chairwoman of the subcommittee.

A preliminary survey of 63 American businesses with 200 or more computers showed that 62 of them had been mailed a copy of the Love Bug virus, a 98 percent rate if it holds for all major American businesses, Tippett said.

He said 41 of those companies were actually infected by the virus after it was opened by an employee.

"Sixty-five percent of American companies, we believe, were infected by the Love Bug on Thursday," he said. ---

On the Net: House Science subcommittee on technology: http://www.house.gov/science/welcome.htm General Accounting Office: http://www.gao.gov Information Technology Association of America: http://www.itaa.org ICSA.net: http://www.ICSA.net

http://ap.tbo.com/ap/breaking/MGIVNUA048C.html

-- Carl Jenkins (Somewherepress@aol.com), May 11, 2000