WHEN you are hacked, settle who is responsible before you do anything else. That is true for a person, household, business, agency or the country. Choose who leads, protect the evidence or artifacts and set the terms on which anyone can help you. Hackers count on confusion. In the panic, people click, pay or wipe the very records that could help catch the attacker.
I use four steps simultaneously, rather than one after another. Throughout this, you keep control of the decisions, access, data, spending and final say on whether the work is done.
Step 1: Get help and save the artifacts. Choose one person to lead and use a device you trust to ask for help. Bring in an examiner — someone who checks devices and data — to help you stop the break-in and save the records.
Artifacts are the records left on your devices and accounts: messages, photos, logs. A log records actions on a system. Artifacts can serve as evidence, so leave them as they are, and write down dates, times, names and every action taken.
Contact the bank, phone company or app firm through channels you have verified. Then report to the National Bureau of Investigation’s Cybercrime Division under the Department of Justice (DOJ) or to the Philippine National Police’s Anti-Cybercrime Group. The DOJ Office of Cybercrime acts on complaints, orders companies to preserve data and helps agencies work across borders. Get a complaint number and the investigator’s contact details. At work, ask your privacy officer who must be notified, and by when.
Step 2: Agree on the work and data access. In a crisis, people hand the keys to anyone who sounds capable. Don’t. Confirm every helper’s identity, role and skills in their company or agency. Put the work, price, access and reports in writing, and have a lawyer explain your rights and duties.
Create or review a data-sharing agreement between parties that decides how the data is used. Name who may receive it, the purpose, legal basis and data covered. Set rules for storage, sharing, return and deletion. A vendor working only on your instructions needs a data-processing agreement instead.
Create or review a service level agreement. Set times for replies, starting work and updates, plus recovery goals, acceptance checks, costs and remedies for delay. Check what your existing vendors and platforms already cover: support hours, log access and your right to export data.
Give each helper an account limited to their task, with an end date and a record of their actions. Require your approval before anyone expands the work or brings in another company. Keep your passwords and sign-in codes in your own hands.
Step 3: The “Philippine Digital Forensics Manual” by Dexter “Drexx” Laggui is now available. It’s a book. Use it as your guide to finding, collecting, saving, checking and presenting evidence under Philippine law. Read it while the response continues, and ask your examiner how it applies to your case.
Then use it to check the work you receive. Expect a list of the devices and files collected, and a record of who held each item and when it changed hands. That is the chain of custody. Get a receipt for every device you hand over, showing its name, serial number, condition and recipient.
Ask how copies were checked against their source. Insist on a report that keeps facts apart from conclusions: facts show what was found, conclusions explain what it may mean. Read the manual alongside the laws and court rules now in force.
Step 4: Check the fix and take back control. Have the team tell you what they found, what they fixed and what still needs work.
Change your passwords from a device you trust, end the attacker’s access and turn on a second sign-in check. Have the team verify your backups, which are copies kept for recovery, before restoring files. Test your accounts, files and services before you accept the work. Recovery depends on the damage, your backups and your providers.
Keep the report and evidence. End the helpers’ access the day their work ends, and confirm in writing how they will return, keep or delete your data. Track repairs, money recovered and the investigation separately, each with an owner and a date. Then update your contacts, backups and response plan.
Being hacked is not a verdict on your carefulness. It happens to banks, agencies and families alike. What separates a bad week from a lasting loss is who was in charge, what was saved and what was agreed in writing. Decide those three things first, and you stay in control of your own recovery.
Mary Rose Magsaysay is a Harvard Kennedy School alumna, former undersecretary of the Department of Energy and former deputy executive director of the Cybercrime Investigation and Coordinating Center.
P1nai.com/marymagsaysay
