Greetings and good luck with your startups! We recently had an unfortunate incident happen to us at Zaakpay. At startups, we are attuned to not having a heart attack and dealing with the situation at hand. So we did deal with it!

Why am I writing this publicly?

I quit PayPal, Silicon Valley and my entire professional + personal network when I moved back to India in Oct 2008. I started working with Drishtee, Noida in the rural products space. 10 months later I joined 2020social.com, 7 months later I joined MobiKwik.com in Feb 2010.  Therefore, I have been part of the startup ecosystem in India since the last 2 years. Just in these 2 years, I have seen far too many shocking *rogue employee* incidents happen to us and our friends at startups. Enough is enough; I want a cleaner startup ecosystem in India therefore I am speaking up.

See Facebook snapshot: my friend Rajat Garg founder of socialappshq.com a successful Facebook Apps startup found 2 of his employees stealing his code. There are all kinds of people in the world – some are capable of wrongdoing, theft, murder, rape, etc. without any provocation. The “Chalta Hai” attitude is what makes people think they can get away with anything. Yes we have a slow legal system and a slower cyber crime police force in India, but that does not mean we let offender after offender get away it. We definitely do not want the employee who screwed us to screw any other company. There are some who think that we are doing this for PR, some who think this is our (Zaakpay’s) shortcoming and therefore we should not talk about in public. We have not done anything wrong; why should we be scared of speaking up?

So what happened?

We hired Subhro Kar in Dec 2011 as Senior Engineer at Zaakpay.com; prior to Zaakpay he worked at Ixigo.com in Gurgaon. His key duties at Zaakpay were setting up and managing the PCIDSS secure servers, system and database administration, and creating automated processes. He worked for about a month in our Delhi office post which he had to go Kolkata to deal with some family issues. Interestingly, enough he never came back and continued to work remotely. Subhro reduced his output towards Zaakpay in the last two months. We constantly questioned him but he never improved his performance or said that he was leaving. To say the least we were not happy with him but were keeping him till we found a great person to replace him. On March 15, he put in his resignation with 30 days notice, which was accepted. I was happy I would not have to fire him and that he wanted to go on his own. The same week he went on an unscheduled 8 day long vacation and it was decided the resignation terms would be decided upon his return. He returned and continued to work and said we will discuss in person. Early April, he visited the office in Delhi for a day since he was visiting Delhi for some personal work. Subhro, myself and Bipin (my partner at Zaakpay) had a 1.5 hour meeting. We told him things were not working out; he had similar things to say. We asked him did he have any last date in mind or any new job to join – he said ‘No’. So we all agreed in the meeting that he would continue on till we found a new person or he found a new job – whichever came first. Note everyone was courteous and on good talking terms with each other.

A very interesting point to note is that Bipin asked Subhro specifically are you moving abroad or have an offer coming up since there was a tweet to that effect he had read. Very convincingly Subhro said no I am not going anywhere; I was inquiring for a friend since he was unable to get a response from Vodafone.

So this was the status quo in which Subhro Kar was working at Zaakpay. We all knew he was doing his last days here and now working at even lower levels than before. But since we are a resource strapped startup we were living with it. This was our first mistake. We should have ensured he was out of the company as soon as possible even at the cost of adding more operational burden on the Tech team. We should have also not believed him when he said he was still looking for a job.

Getting to the climax:

Since 4th May we had an email thread ongoing where Bipin, and I were questioning Subhro on why so many of his tasks were pending. After all he was being paid a salary so at least we expected 30-50% output. Last we heard from him was via an email on May 7th early morning making excuses for his incomplete tasks. At 10:30 am IST on Tuesday 8th May, Sudarshan Purohit (Architect at Zaakpay) called us to inform that he was unable to log in to the production server via SSH. Within a few minutes, we realized that Bipin the only other person who had access to the production servers was also unable to use SSH credentials to login. A point to note here is that as per the PCIDSS setup Subhro was the only superuser with root access to our 3 servers. Two other people in the company had access to the production servers that too in a limited fashion via SSH from our monitoring server.

Thus, we figured out that Subhro (the system administrator) had deliberately removed Bipin and Sudarshan’s access and thereby the Zaakpay team’s access to the Zaakpay production servers (the servers by the way were running and processing payments for our customers). This came as a RUDE SHOCK to us. We still do not know why Subhro did this. Its easy enough to write an email saying that I have found a new job and I need to leave ASAP and this is my last date. Isn’t it? Unless he really just wanted to cause us pain.

I immediately called our hosting company SingleHop and went about the business of gaining control of our servers. This was easy to do since the account is associated with my credit card. First I got them to remove Subhro’s email and phone no from the account and have only my contact information on the account. Second I got the SingleHop account password changed. Then I asked them to change the root passwords on all the servers. One of the servers was done within 10 mins. On the other two servers there was a password being requested before the servers could be rebooted. None of the passwords on file worked. SingleHop had to get a datacenter technician to do the changes at the psychical servers. After almost 6 hours of downtime and firefighting we re-gained access back to our servers and Zaakpay was back up. There were many other passwords to change for the email server, various tools and services we used – if something like this happens to you please make a list of all such things first and then go about changing them. By evening, while upset we all relaxed at a small party at the office to celebrate an employee’s birthday.

We sent a termination email to Subhro at 2:17 pm IST on May 8th 2012. On 9th May 9am IST, I found out from Linkedin that Subhro Kar had started work at Facebook in Ireland. Check his Linkedin

Subhro Kar cut off the entire company’s SSH access to the production servers and literally took off to Ireland without any communication, last date or handover. It is clearly very bad on part of an employee to start a new job without telling his current employer. To add to that, cutting off our access to our servers and holding us and our customers hostage like this – is totally uncalled for, unprofessional and illegal. Collectively, we at Zaakpay have never come across such a rogue employee in our entire lives! And yes, we are taking legal action.

Lessons Learnt:

• Be very careful of who you hire as a system administrator and give superuser /root accesses
• Fire non-performing employees as soon as possible; do not give anyone more than 3 chances to prove themselves
• Do not tolerate shit from any employee whether via email or phonecall or in person
• Spend more time in hiring and reference checks; 1 good employee is better than 5 average/rogue/poor employees
• Proactively look for and judge candidates based on their trustworthiness, personal character and credibility and not just based on their key functional skills

My first concern as a CEO is providing excellent services to our new and existing customers. My second priority is growing the business topline and creating a solid product roadmap. My third priority is building a strong and reliable team. With this incident behind me, I can assure our customers, employees, investors, partners that I am going to spend 5X more time on hiring and onboarding employees to ensure they fit the fabric of “Zaakpay” and when required fire unreliable and non-performing employees to maintain the  fabric.

Finally for those users who were trying to use our site on May 8th, sorry guys we were down due to the saga explained above.

————————————————————————————————————————————–

Oh BTW who is Subhro Kar? Please read this before you think about ever hiring him.

Subhro Kar on Linkedin
Subhro Kar on Twitter
Subhro Kar on vworker
Subhro Kar on Pinterest
Subhro Kar on Facebook
Subhro Kar on 500px

We understand that the card application is fairly long which is why we save it at all steps so you can come back later to complete it. We hope you will submit your card application ASAP. We are open to constructive criticism as comments to this blog post or via email to contact@zaakpay.com.