A couple of days ago, I found a name for my unnamed design practice (so far called Pulkit Soni Architects for communication). Black White Grey Design Studio was born. Name had changed, the way of working hadn’t. I have been wanting to put a better working paradigm in place at my office. I wasn’t satisfied with the way in which the work was being done. Given the deadlines and deliverables that a design house have in the pipelines, it rarely allows for a complete overhaul of the way it functions. Catastrophes on the other hand have an uncanny ability to bring about radical changes. In my case too, it was a catastrophe that changed everything and brought on a much needed, albeit painful, clean slate.

Yesterday was an eventful day, my office was under attack, a ransomware (malicious computer virus seeking ransom) spread on my office workstations. All data, all the work of last 4 years was encrypted(locked) by an unknown cyber-terrorist sitting somewhere on the face of the Earth. A pop-up appeared on the desktop, the popup was a ransom note. The only way to decrypt (unlock) the data was to pay the hefty ransom and get a key which may or may not work after all. For someone who isn’t used to keeping backups, it was quite the ordeal. 

Everything was going on like usual and out of the blue this ransomware called Masok was all over my work. Well the attack was probably caused by downloading a unit converter software by one of the staffers from an untrusted source. I say ‘probably’ because there wasn’t a definitive answer and blaming someone wouldn’t make the situation any better. I should have been shattered upon the discovery but I found myself eerily calm. A sort of numbness took over. I tried to analyse the situation. One of the good approaches although of no technical help is to call up the geekiest people you know or can reach out to (friends of friends). This doesn’t help you out of a ransomware attack but it definitely helps you with mental peace. Remember the explanation that Rancho (3 Idiots) gives for saying “Aal izz well” during a stressful situation? The two are somewhat the same. 

Now with all inputs taken, there were only two outcomes:

1. Pay the ransom and face what is there to come.
2. Lose the data and move ahead in life.

Well if data is too important to lose, there is no other way out. Cyber crime division of the police can’t help you. Ethical hackers can’t help you. You have to pay, that is your only hope. Some people may advise you that a payment is not a guarantee of getting back the data, which in theory is true but you have to trust the market instincts for that. Capitalist society does have its benefits, it is more predictable. The point being, no cyber terrorist would kill their own future market by not releasing the key on payment. Once the news is out that keys in such attacks aren’t released even on payment nobody would pay in the future. 

Now keeping that in mind, moving towards payment, check that the key that the hacker/ attacker promises to release is in fact a working one. They always allow a test run. They’d ask to send over a locked file and get back an unlocked version. Don’t act smart by sending the file with crucial information on it. They always are smarter. Send a dummy only. This is no rocket science, they even write the cautionary note with the ransom demand.

After establishing that the key is working, begin negotiating. Negotiate, do not infuriate.Finally, pay up and get done with it.

One important thing to mention here is that some people believe that paying once makes you more susceptible to attacks in the future. Personally, I don’t support this theory as people who are attacked once are more likely to put robust measures in place making it difficult for another breach to happen. 

Moving on to the outcome number two. It is always a difficult choice, to lose your work, to lose a part of yourself to some geeky teenager(mere speculation) who has chosen to make a quick buck out of looting innocent people behind the cover of computer sorcery. 

How does one decide that its okay to lose all the data? To be honest that is a very personal decision and nobody can help you with that. I can tell you what led me to make the decision. I’d break it down into two parts: the significant and the insignificant part. 

I have grown up deeply influence by powerful lines, irrespective of the place they come out from be it movies, poetries, songs, quotes by great people and the one from within. This may sound absolutely bizarre but these were the lines that were in my head when I was numb otherwise. So here is the significant part:

1. “The United States of America does not negotiate with terrorists.” A line most common in many action thrillers including Airforce One, White House among others.
2. “Humko mita sake yeh zamane mein dum nahi, zamana khud hum se hai hum zamane se nahi.” Rajkumaar fandom, of course. And not to mention the fandom is an inheritance, all the more deeper.
3. “Sach hai, vipatti jab aati hai, kayar ko hi dehlati hai, surma nahi vichalit hote.” Rashmirathi, my go to manual on life.
4. “In the fell clutch of circumstance, I have not winced , nor cried aloud. Under the bludgeoning of chance, my head is bloody, but unbowed.” Invictus, well because Invictus.
5. “Koi #$%@^@#% button daba ke mere liye yeh faisla nahi karega ki mujhe kab marna hai.” The amazing dialogue from A Wednesday, you can notice the similarity of the circumstance.

There were a few things that I managed to assimilate before I clicked the button to format the office computers and forever losing the data. So here is the insignificant part of the equation:

1. Completed works are the legacy, not the drawings.
2. A small yet significant portion of the work could be downloaded from the mail. 
3. One of the project was backed up on cloud.
4. Design proposals lost were a good way to start on a clean slate for some of the projects.

And before my mind could regain total sanity or succumb to fear of any kind, I began the process of cleaning up the house. By the evening when my family was informed, the decisions were already made, the panic didn’t find any oxygen to live on. I do not find any solace in nazarbattus or nimbu-mirchi (India’s go to weapon). Things were done and dusted before my mom got into a frenzy. She forced me to reach out to the police and every other resource that she could think of. It was as futile as expected. The great positive from reaching out to those people was the reinforcement that what was done was the best way out. The point here isn’t about being a rationalist and away from superstition, but not letting the panic set foot in your head. 

Over the coming days the team would be rebuilding the office, like the phoenix we would be taking re-birth from our own ashes. Although the internet is full of knowledge in this regard, here are a few measures that we are taking up to fight such attacks in future:

1. Moving the office to cloud servers.
2. Creating a protocol to have external backups weekly.
3. Banning direct download of media or software on the workstations.
4. Prohibiting access of personal email on office computers.
5. Encouraging safe internet access for the staff.
6. Denouncing the use of personal USB storage drives. 
7. Corresponding and communicating on email more than WhatsApp or other social media messengers. 

From what I have learnt in my tryst with Masok, such ransomware are looking for small businesses/ professional practices who are dependant on computers for their work but aren’t tech savvy enough to have the most robust cyber-security protocols in place. 

Masok came, Masok saw, but Masok couldn’t conquer.