The Name Game: Groking the Love Bug

by McIntyre

Every few months the computer security community is thrust into the public spotlight with a huge scandal that has every world media outlet scrambling through the Net for the exclusive. Most recently we've seen such frenzies with the defacing of the New York Times Web site, the Melissa virus, the massive DDoS attacks, and now with the virus affectionately known as "The Love Bug."

In the case of the "love bug" the media has been reporting on the investigation which has included information about 27 year old Reonel Ramones, his common-law wife/live-in girlfriend (Maria) Irene de Guzman and her sister. However in these reports there are several cases where Ramones name is spelled completely wrong, his ages are contradicted, de Guzman's age is all over the place....and oh yes, the media seems to be concentrating on Guzman's sister but completely neglects the fact that she has a brother who spends quite a bit of time at the apartment himself. I've included my research in a list at the bottom of this article.

Other frightening facts have included potentially bogus damage estimates from several hundred thousand dollars to $2B, $5B and even $8B in damage. How can you determine such figures so fast? Who's making the final decision on what can be included as damage caused by this virus and, most importantly, are the companies putting these statistics out non-biased 3rd parties or are they affiliated with the antivirus companies making money of the sale of their products and the increase in their stock price due to the frenzy?

I've read a few media reports that can't seem to decide whether or not Guzman spoke with the National Bureau of Investigation. Some outlets are reporting she turned herself in, other reports are claiming she failed to show up and quote an investigator as preparing to issue a subpoena. Yet others claim that she was arrested aling with Ramones.

Personally, I find this kind of reporting ridiculous. If you're going to get anything right, at least get the information about the person correct. I've had my fair share of journalism training and interaction with the media. I know that with the advent of online news deadlines have gone to hell. Everyone wants the news now.....so screw accuracy. I've seen many reporters print incorrect information in an article leaving it there even after it was pointed out to them because they can always go back and update the story once they have more information. But what about the readers who are clueless as to what the truth is and have already read the article as-is? How about those who read the story and think it must be true because a prominent media outlet printed it? Many readers won't make it past one media outlet let alone the several that I looked at and they won't necessarily read the same article twice to see if it was updated. Once source is good enough for them because after all, it's all the same story. Right?

After speaking with several reporters I will concede that this problem of factual integrity cannot fall solely on the heads of the journalists reporting the story, but that the National Bureau of Investigation is partly to blame. According to one reporter, an investigator who phonetically spelled Ramones first name even after verification claimed it was Leonel even though it was eventually determined to be Reonel. Another member of the media said the investigation of this case is horrid with the police willing to verify anything without supporting proof or documentation and making educated guesses instead. Did I mention that the NBI has never handled a computer crime case like this and the lead investigator doesn't have a computer in his office?

Despite the inaccurate information coming from investigators, this is not a reason for reporters to slack off. It should be a strong reason to have multiple sources and to verify information with more than one involved party including friends, relatives, and co-workers. I challenge you to point out such egregious mistakes. If you find an error in a computer security article that you think corrected, e-mail the reporter. If you're worried about being blown off, copy the journalist's editor for good measure. But better yet, make sure you send a note to errata@attrition.org and perhaps your errata will get posted. Reporters and editors need to know about their mistakes lest they repeat them. If they know their public is watching and reading with a critical eye, perhaps this will cause a modicum of improvement in fact checking.