Ransom on Tuesday

The first sign was a file Marco could not open. It was three in the afternoon on a Tuesday, the quiet hour when the light in his edit room goes flat and gold through the frosted glass of the front window. He had been away from his desk for twenty minutes making coffee. He came back and clicked on a bin of audio takes and the bin refused. A small dialogue window said the file was damaged. He closed it and tried the bin next to it. That one was damaged too. He opened a Finder window and saw that every file in his project folder had the same new extension appended to it. Four letters he did not recognise. His reels. His cuts. His sound roll. His notes. The text file he kept his edit log in.

The desktop of the Mac Studio had a new file on it that he was certain he had not put there. It was called, in plain English, README_RESTORE.txt. He opened it. It was short and businesslike. It gave him an address to send a cryptocurrency payment to. It gave him seventy-two hours. It said that after seventy-two hours the key would be deleted and the files would be gone. It did not threaten him beyond that. It did not need to.

He sat for another minute. He picked up his phone and called the director, not to tell him yet, but to confirm something. The festival had sent them the upload deadline three weeks earlier. It was nine days away. He hung up. He did not tell the director.

Marco is thirty-four. He cut his first feature when he was twenty-six, an observational documentary about a market in the north-east of Brazil that ended up on the festival circuit for about eighteen months. He has cut three features and roughly fifty shorter pieces since then. He works out of a one-room studio on the second floor of a converted warehouse in Vila Madalena, above a bakery he is on first-name terms with. He edits almost exclusively by himself. He shares the building with a colourist and a foley artist, and the three of them handle most of the Portuguese-language independent work that moves through the neighbourhood.

The short film he was cutting in April was not like the other work. It was a forty-minute piece, almost an hour if you counted the titles the director wanted, shot in the backlands of Bahia the previous summer. The director was a friend of a friend and a first-time filmmaker, and the budget was the kind of budget that is mostly favours. Marco had taken the job at a rate he would not have taken from anyone else, because he had been on the set for three days early in the shoot and had watched a performance from the lead actor that he had not been able to stop thinking about. He had told the director, on the drive back to the airport, that he wanted to cut it. The director had not believed him at first.

He had been cutting for fourteen weeks. The rough assembly was four hours. The first cut was ninety minutes. By the Tuesday of the attack he had the film at forty-six minutes and was two passes from picture lock. The festival they were aiming for — a small one, not the kind that makes careers, but the right one for this film — had accepted the submission on the strength of a three-minute clip he had cut in February. The full upload was due on the Friday of the following week.

The media pool for the film was a little over eight terabytes. This included the camera original files, the sound rolls, the music stems the composer had sent in two batches, the graded reels from a pass the colourist had done in March, and about six hundred gigabytes of project state — timelines, auto-saves, backups, render caches, colour node graphs, sound-design sessions. Everything on the Mac Studio was encrypted. Everything on the external drive he kept on the desk beside him was encrypted. The ransomware had reached through and done the external drive too.

What it had not done was reach the offsite copy. Marco had been running macup against the Mac Studio since the start of the project. He had set it up in January, when he was still at the assembly stage, because his insurance agent — a methodical woman who had handled his studio renter’s policy since 2019 — had asked him on a phone call whether the footage he was working on was insured, and he had not known how to answer. He had set up an offsite backup that afternoon. The whole media pool plus the project folder. Snapshots every hour while the machine was awake. He had done it, paid for it, and forgotten about it.

If he lost fourteen weeks of work, the financial cost was survivable. He had been paid part of his fee on signing and would be paid another part on delivery; the delivery date would simply move. What he could not replace was the momentum. The film had a shape now that it had not had in January. The shape lived in his head and in the timeline and nowhere else. The rough cuts were not just backups of the final cut. They were the map of how he had got there. If the timeline went, the map went, and the map had taken four months to make.

The festival deadline was the smaller problem. Missing the festival was a setback, not a wound. The wound would be the four months.

The recovery

He did not pay. He did not, in fact, spend very long thinking about paying. He closed the README_RESTORE.txt. He unplugged the external drive, which was already encrypted and therefore could not be made worse. He shut the Mac Studio down. He called a security consultant he had met at a birthday party the previous year, a man who worked for a São Paulo insurance firm doing breach response for small businesses. The consultant came over that evening.

They did not attempt to clean the machine. The consultant, a careful person who had seen this twice that month already, recommended a full wipe and a restore from a clean snapshot. Marco agreed. They erased the internal drive. They reinstalled the operating system from a USB key the consultant had brought with him. They did not reconnect the external drive. They signed into Marco’s macup account on the fresh install. The consultant asked him for the recovery passphrase. Marco had it in a physical notebook in a drawer in his apartment, which was across town. He drove home and got it. He came back at about ten o’clock and typed it in.

The most recent clean snapshot — the one from Sunday afternoon, forty-eight hours before the attack — was there. He had done about six hours of work on the Monday that would have to be redone. It was the smallest loss he could imagine taking.

The restore ran through the night and most of the next day. Eight terabytes is a lot to pull down over residential fibre, and Marco did not rush it. He went home, slept, came back in the morning, made coffee, watched the progress bar for a while, and then went for a walk in the Praça Benedito Calixto market. He bought a book at a second-hand stall. He came back. It was still running. He ate lunch. It finished at about four in the afternoon on the Wednesday.

He opened Resolve. The project opened. The timeline opened. The clips relinked. He watched the first ten minutes of the cut from the top to see whether anything was subtly wrong, the way you watch a child who has fallen down to see whether they will cry. Nothing was wrong. The cut was intact. He spent the rest of Wednesday afternoon redoing the six hours of Monday work, which took him about four hours because he remembered most of what he had done. He did not tell the director any of this. He finished the second picture-lock pass on the Friday. He delivered the upload to the festival on the following Friday, a day before the deadline.

There is a detail Marco learned after the fact, and which he did not learn from macup. His insurance consultant produced a postmortem for him about ten days later, a short document the consultant wrote for all of his breach clients, and one of the paragraphs in it contained something Marco had not known. The attacker, during the window they had been inside the Mac Studio, had attempted to reach into Marco’s offsite backup and erase it. They had used Marco’s own credentials, which they had harvested from a saved session in his browser. They had authenticated successfully. They had sent the delete command. The delete command had been refused.

The explanation in the consultant’s postmortem was a short paragraph of the kind Marco usually skims. He read it twice. The offsite copy was held under a retention policy that, once set, could not be shortened by anyone — not by an attacker with Marco’s credentials, not by Marco himself, not by the people who ran the service. For the length of the retention window, the snapshots were fixed. The attacker had discovered this by trying.

Marco does not often think about the infrastructure of his own work. He is an editor. He thinks about rhythm and pace and the space between two images. But he did, reading the postmortem in the bakery downstairs with a coffee, think about it for a while. The attacker had reached for the film. The film had been out of reach.

He cut the next version of the rough for the director the following Monday. They took a note from the sound designer. They moved a scene. He did not mention the week of the attack. The director heard about it two months later, at a bar, from the insurance consultant, who was there by coincidence. The director asked Marco about it afterwards. Marco told him the story the way you tell a story about a flat tyre on the way to somewhere you got to anyway.

The festival took the film. It screened in November. Marco sat in the back row with the director and the lead actor and watched people watch it. The performance he had seen on the set in Bahia was there in the edit. It had not gone anywhere.