The ILOVEYOU Worm of 2000: Why a Love Letter Went Global in Hours

On 4 May 2000, as the working day began across Asia and Europe, millions of people received an email with a simple subject line: ILOVEYOU. The message said that the attachment was a love letter. It was not. Within hours, the worm had reached businesses, governments and media organisations in dozens of countries. It remains one of the most widely reported malware outbreaks in history.

The attachment

The email carried a file called LOVE-LETTER-FOR-YOU.TXT.vbs. The real file type was .vbs, a Visual Basic Script, but at that time Windows hid the extensions of known file types by default. So most users saw only LOVE-LETTER-FOR-YOU.TXT, which looked like a harmless text file. Opening it ran the script.

This was a deliberate trick. It exploited a user-interface choice made for convenience, the hiding of file extensions, and turned it into a way to disguise an executable as plain text.

What the worm did

1. It sent copies of itself to every contact in the victim's Outlook address book, not only the first few.
2. It overwrote many files on the computer, such as pictures and music files, with copies of itself, and altered others.
3. It tried to download a program that was designed to steal passwords.
4. It changed settings so that it would run again when the computer restarted.

The combination of full-address-book mailing and a subject line that played on curiosity and affection made it spread faster than Melissa had a year earlier. Large organisations, including news outlets and governments, shut down their email. Reports at the time said that the parliaments of the United Kingdom and other countries closed down their mail systems for a time.

The cost

Estimates of the damage were large, with commonly quoted figures in the range of billions of dollars worldwide. Those numbers combine lost working time, cleanup effort and replaced data, and are inherently imprecise. A safer statement is that the worm infected an enormous number of machines in a very short time and caused a great deal of lost work and lost files.

Why it spread so quickly

Timing mattered. The first wave struck in Asia, where the working day starts early, and as each time zone arrived at the office, a new batch of users opened their inboxes. Many of them received the message from someone they knew, since the worm used real address books. The word love in the subject line worked on curiosity.

Variants appeared within hours and days. Other authors modified the script with new subject lines and attachment names, which made it harder for filters keyed to the original text to catch everything. This was an early look at a pattern that continues today: a successful technique is copied and adapted almost immediately.

Tracing the source

Investigators traced the origin to the Philippines. Authorities there identified Onel de Guzman, a computer student in Manila, as a suspect. He was reported to have written a thesis proposal on a related idea, a program for obtaining internet access passwords, which his college had rejected. He said in interviews that he had not expected the program to spread across the world, and that he did not intend harm, though accounts vary on the details.

The problem for prosecutors was that the Philippines had no law against what he was accused of. The country's laws of the time had not been written with computer crime in mind. Charges of theft and fraud were considered, but they did not fit well, and the case was dropped in August 2000.

A law written in a hurry

The incident exposed the gap. In June 2000, the Philippines enacted its Electronic Commerce Act, which, among other things, made hacking and the introduction of viruses punishable. It was not retroactive, so it could not be used against the author of ILOVEYOU. But it put a legal framework in place, and the episode is a clear example of how a single event can drive legislation across a country.

Microsoft and other vendors changed their products. Outlook began blocking certain dangerous attachment types by default, and later versions made it harder for scripts to send mail automatically. Email filters started to reject script attachments at the gateway. These defaults still protect users, which is a reminder of how much safety depends on default settings that most people never look at.

The lesson for site owners today

ILOVEYOU worked because of three things: an emotional hook, a disguised file type and software that trusted the user to make safe choices. All three still exist. Phishing messages today use invoices, delivery notices and password alerts as hooks. Disguised file types still appear as double extensions. And even now, many people have the permissions to run something harmful with a single click.

• Show file extensions on your own computers.
• Do not run attachments you did not expect, whatever the subject says.
• Use separate, limited accounts for everyday work instead of an administrator account.
• Filter mail on the server, so that dangerous attachments do not reach staff at all.

For a wider baseline of measures, see the security page.

Where to go from here

Server-side filtering is part of a good mail setup. Look at our business email plans, and see our security page for the broader checklist. If you have questions about securing your mail, our team can help in 17 languages.