Norsk Hydro made manual recovery evidence part of control-plane

Summary

Norsk Hydro's LockerGoga incident made manual production part of the control record because the company publicly distinguished business areas running normally, areas running with heavier manual work, areas temporarily stopped, and supporting functions that lagged behind production.
Hydro's own updates show uneven continuity: Energy and Bauxite & Alumina were described as normal early on, Primary Metal and Rolled Products continued with more manual procedures, while Extruded Solutions suffered the largest production and financial effect.
Public technical accounts identify LockerGoga as disruptive ransomware affecting IT-dependent industrial operations, not as a self-spreading industrial-control worm. That distinction matters because the control lesson is about the industrial dependence on corporate systems, identity, order flow, and restoration.
The company's financial record moved from early estimates to a final 2019 impact estimate of NOK 650 million to NOK 750 million, later insurance recoveries, and an approximately NOK 800 million cost figure on Hydro's incident page. These are company accounting measures, not the full social or customer cost of interruption.
The accountability test is whether manual fallback was a designed, bounded control mode with safe limits, reconciliation, staffing, and public evidence, or whether it was an admirable emergency effort that later governance must convert into repeatable resilience.

Manual fallback became public evidence

Hydro's first public notices on March 19, 2019 did something many companies avoid during cyber incidents: they made operational variation visible. The initial Hydro subject to cyber attack notice said IT systems in most business areas were affected and that the company was switching to manual operations as far as possible. The more detailed same-day update said Hydro had isolated plants and operations, that Norwegian primary plants and remelters were running with more manual operation, and that Extruded Solutions and Rolled Products faced challenges and temporary stops because of lost connection to production systems.

That was not only communications. It was evidence. The company showed that continuity was not binary. Some areas could keep producing. Some could produce but with more labor and friction. Some stopped temporarily. Some supporting processes would lag later even after output returned. Public accountability improved because outsiders could see the operating state by business area rather than receive a vague claim of resilience.

Hydro's March 20 update said most operations were running and meeting customer specifications, but manual activity remained higher than normal and Extruded Solutions still faced production challenges. On March 21, Hydro said Extruded Solutions was operating at roughly 50 percent of normal capacity and that Microsoft and other security partners had arrived. On March 22, it identified payroll, treasury, reporting, billing, and invoicing as functions needing interim solutions.

Those updates matter because control planes are not only machines. In an industrial company, the control plane includes order intake, production scheduling, identity, workstation access, reporting, finance, customer communication, quality records, and the local knowledge that allows a plant to run safely when central systems are down. The ransomware event showed which parts could degrade and which parts became bottlenecks.

Hydro's later incident overview, Cyber attack on Hydro, says the entire global organization was affected, Extruded Solutions had the most significant operational challenges and financial losses, and other business areas produced close to normal with work-intensive workarounds and manual procedures. That phrasing is valuable precisely because it does not romanticize manual work. It acknowledges that manual production carried a cost.

The second-lens accountability issue is control-plane fragility. If manual fallback is treated only as heroism, the company learns the wrong lesson. The right lesson is to ask what made fallback possible, what made it expensive, what limits applied, how errors were prevented, how work was reconciled, how customers were informed, and how long the mode could be sustained. Manual operation is a control when it is designed, rehearsed, and bounded. Otherwise it is emergency labor filling a gap that governance must later close.

The recovery clocks were different

Hydro's chronology is useful because it separates production recovery from information recovery. On March 25, the company said each PC and server was being reviewed, cleaned, and restored under strict guidelines, while encrypted machines would be rebuilt from backups. Extruded Solutions expected about 60 percent overall production. On March 26, three Extruded Solutions units were producing at 70 to 80 percent while Building Systems was almost at a standstill. Hydro also gave a preliminary NOK 300 million to NOK 350 million estimate for the first full week.

The following updates show partial recovery by unit. March 27 said Building Systems had restarted at around 20 percent average capacity. March 28 put Building Systems at 40 to 50 percent and other Extruded Solutions units at 80 to 85 percent. April 5 said production was near normal in most areas, but reporting, billing, and invoicing remained delayed. April 12 said normal or near-normal production was being sustained by extraordinary effort across 35,000 employees, while full IT recovery remained complex across several thousand servers and operations in 40 countries.

These are separate clocks. Production capacity, value creation, order handling, billing, payroll, reporting, trusted endpoint restoration, server rebuild, and customer communication do not recover at the same rate. A plant may produce while finance is delayed. A product line may resume while order complexity remains restricted. A server may be rebuilt while a manual transaction backlog still needs reconciliation. Treating recovery as one status hides the real control problem.

NIST's SP 800-34 Rev. 1 contingency planning guide provides a general vocabulary for recovery time, recovery point, alternate processing, manual procedures, and testing. NIST's SP 800-82 Rev. 3 guide to operational technology security describes how industrial operations depend on both OT and supporting IT. These are not incident findings about Hydro. They are useful because Hydro's public chronology shows why industrial recovery must be measured across multiple service layers.

Control-plane accountability should therefore require recovery metrics by function. How long until a plant can produce safely? How long until it can meet customer specification? How long until order intake is normal? How long until billing and invoicing are reliable? How long until reporting is trusted? How long until all rebuilt systems are independently checked? Hydro's public updates made those questions visible. Many companies publish less, which can make their resilience harder to evaluate.

LockerGoga showed IT dependence, not direct OT takeover

The technical framing matters. Calling Hydro's event an industrial cyberattack is fair in the sense that industrial operations were disrupted. It would be misleading to imply that public evidence shows malware directly manipulating physical controllers. The Center for Internet Security's LockerGoga primer described LockerGoga as ransomware that affected business and production networks and could force downtime, while noting that it did not target industrial control systems as such. Dragos's IT ransomware in ICS environments made a similar point: IT ransomware can disrupt industrial operations through dependencies even without being purpose-built OT malware.

Dragos later revisited LockerGoga in Spyware, Stealer, Locker, Wiper, describing interactive intrusions, coordinated encryption, disruptive features, and uncertainty about motive. That analysis supports careful language. The event was disruptive. The public record does not justify a simple claim that physical process controllers were maliciously operated or that one employee action alone caused the event.

Microsoft's feature, Hackers hit Norsk Hydro with ransomware, published with Hydro cooperation, reported that the attack path began months earlier through an infected email from a trusted customer and described the company's transparent response, refusal to pay, paper warnings, manual procedures, and recovery work. This is a valuable entity account. It is not a complete forensic report with every timestamp and privilege step. Responsible analysis should attribute it accordingly.

The broader law-enforcement context reinforces the interactive-campaign model. Eurojust announced 12 targeted for involvement in ransomware attacks against critical infrastructure, including activity associated with LockerGoga and MegaCortex. The Department of Justice later announced a ransomware administrator charged in relation to LockerGoga, MegaCortex, and Nefilim attacks. These public records identify criminal-accountability action at campaign level. They do not supply a plant-by-plant Hydro forensic map.

The control lesson is that industrial operations depend on systems outside the control-room boundary. Order systems, file shares, user workstations, identity services, engineering information, customer communication, quality records, and finance functions can all become operationally significant. If ransomware makes those unavailable, plants may be physically capable but administratively constrained. Manual fallback then becomes the bridge between physical capability and accountable operation.

This is why segmentation should be understood broadly. It is not only separating OT from IT. It is deciding which business functions can fail without stopping safe production, which cannot, which can be replaced manually, and which need independent recovery. Hydro's business-area variation suggests that some local capability survived. The governance task after the incident is to turn that variation into design knowledge.

Transparency shifted the burden of proof

Hydro's public communication became part of the control evidence. The company did not publish every technical detail, and no company should release information that would harm recovery or investigations. But it did publish frequent operational states, capacity estimates, affected functions, insurance information, and later financial impact. That changed the burden of proof. Instead of asking the public to accept a generic "we are resilient" statement, Hydro allowed external observers to see recovery moving through specific stages.

The Q1 2019 report reflected the cyberattack's early financial effect. The Q2 2019 report updated the financial picture. The 2019 annual report gave a final estimate of NOK 650 million to NOK 750 million in financial impact, with insurance compensation recognized in that year. The 2020 annual report recognized additional insurance compensation. Hydro's incident page uses an approximately NOK 800 million cost figure.

These figures should be read carefully. They are company accounting measures, not a total welfare calculation. They do not count every customer delay, supplier disruption, worker stress, insurer cost, public-investigation expense, or market reaction. They also do not prove that all future controls are sufficient. They do show that the company was willing to put financial boundaries around the incident and later describe insurance recovery.

Insurance recovery is not resilience proof. It can transfer some cost after the event. It cannot restore lost production time, customer trust, or employee effort. An insurance payment may indicate that coverage was in place and claims were recognized. It does not prove that manual fallback, segmentation, backups, or detection were adequate. Conversely, the existence of cost does not prove poor governance. Destructive ransomware can impose cost even on prepared companies. The accountability value lies in how cost categories reveal weak and strong controls.

Transparency also supported public-sector confidence. Norwegian authorities, police, security partners, customers, employees, and investors all needed enough information to understand whether the company was safe, whether production continued, and whether financial reporting remained reliable. Norway's National Security Authority guidance on security measures against ransomware and other malware attacks and national police reporting such as Cybercrime 2024 show the broader public context in which ransomware is treated as a national resilience issue.

The lesson is not that every company must publish daily updates in the same format. It is that accountability improves when public communication maps to operational reality. Hydro's statements separated safety, production, business areas, supporting functions, cost, and restoration. That separation made the response more verifiable.

Manual operation must be safe, bounded, and reconcilable

Manual operation in an industrial setting is not a slogan. It has safety limits, staffing requirements, knowledge dependencies, quality controls, authorization rules, and reconciliation burdens. The public praise for Hydro's manual recovery is deserved only if it leads to those stricter questions.

First, manual production needs safe operating envelopes. Which lines can run without central scheduling? Which products require digital quality checks? Which materials require extra verification? Which customers can receive orders under manual paperwork? Which transactions are stopped because the risk of error is too high? A manual mode that does not define stop conditions can create new operational risk while solving an availability problem.

Second, manual production needs people who know older or alternate procedures. Microsoft's account of former employees and local knowledge returning to help is encouraging. It also reveals fragility: if knowledge exists only in people's memory, retirements, outsourcing, and process automation can erode it. A designed fallback preserves knowledge in training, exercises, printed or independently accessible procedures, and clear authority lines.

Third, manual work needs reconciliation. Every order taken, product made, shipment released, invoice delayed, payroll exception, and quality action during the outage must later be tied back to trusted systems. If reconciliation is not designed, the company may preserve output while accumulating errors, disputes, or audit problems. Hydro's notices about reporting, billing, invoicing, payroll, treasury, and first-quarter reporting delays show that supporting functions continued to matter after production improved.

Fourth, manual fallback needs customer transparency. Customers can tolerate some delay better than uncertainty. They need to know whether orders are accepted, which products are constrained, whether quality is maintained, whether delivery dates changed, and how communications should be verified. Hydro's public updates supplied high-level confidence. Individual customers likely needed more specific channels.

Government ransomware guidance reinforces these points. CISA's StopRansomware guide, the UK government's CRI guidance during ransomware incidents, and the UK policy statement on responding to ransom attacks all emphasize preparation, response, evidence, and recovery. They do not judge Hydro's specific decisions. They support the principle that manual and recovery modes must be part of planned governance, not improvised at the edge of exhaustion.

Manual operation also changes labor accountability. The extra effort from thousands of employees was part of recovery. That effort has a human cost, including fatigue, stress, overtime, and error risk. A mature resilience plan treats labor capacity as a control limit. If manual mode requires exceptional effort for weeks, leaders must know when to slow production, rotate staff, add checks, and communicate constraints.

Customers and suppliers carried part of the control-plane risk

Hydro's public cost figures describe the company's recognized impact. Customers and suppliers experienced the event differently. A customer waiting for extruded aluminum may face its own production delay. A supplier may face altered orders or payment timing. A small business in the chain may not have the cash buffer to absorb uncertainty. The control-plane fragility of a large industrial firm can therefore become continuity risk for smaller organizations.

ENISA's Cybersecurity guide for SMEs is general guidance, but it helps frame downstream resilience. Smaller firms often depend on larger partners' digital processes while having less leverage to demand evidence. When a large customer or supplier moves to manual mode, the SME may need alternate ordering, delivery, verification, or payment routes that were never tested.

The public-sector dimension is similar. Hydro's operations are commercial, but industrial continuity intersects with employment, regional economies, safety oversight, market disclosure, and national cyber resilience. ENISA's broader warning that public administration is increasingly targeted by DDoS attacks is not about Hydro, but it reflects the European reality that public and private continuity are intertwined. Industrial incidents are rarely private in consequence.

The accountable control for customer and supplier risk is not full disclosure of sensitive technical detail. It is practical continuity information. Which plants are constrained? Which products are delayed? Which ordering channels are valid? Which manual confirmations are authoritative? Which invoices will be delayed? Which emergency contacts should customers use? Which commitments are firm and which are estimates? Hydro's public statements answered some of these at a high level; the company likely handled others directly with customers.

For future incidents, industrial firms should pre-design external fallback channels. Customer support, supplier communication, investor updates, regulator notice, and employee guidance should not depend entirely on the same corporate environment affected by ransomware. They should have verified contact lists, alternate publishing channels, and authority rules. The point is not to tell the world everything. It is to keep stakeholders from making blind decisions.

Control-plane accountability also includes security automation. Automation can find affected endpoints, enforce isolation, validate backups, and accelerate restoration. But automation can fail when the identity and endpoint layers are unavailable. Manual fallback and automation are not opposites. They are complementary controls. Hydro's incident shows that automation must be recoverable, and manual mode must be ready when automation is not.

Insurance and later reporting did not close the control question

Hydro's financial reports and insurance recoveries are important because they make cost visible. They do not close the control question. A company can recover money and still have unresolved resilience gaps. It can suffer large cost despite reasonable controls. The accounting record is one piece of accountability, not the final verdict.

The final 2019 estimate of NOK 650 million to NOK 750 million, the insurance compensation recognized in 2019, and the further recognition in 2020 show cost allocation after the event. Hydro's incident overview's approximately NOK 800 million figure helps the public remember scale. But none of these figures identifies which controls shortened recovery, which controls failed, which workarounds became permanent improvements, or whether later exercises prove a shorter recovery path.

The best evidence after such an event would include functional tests. Can Extruded Solutions operate in manual mode at defined capacity for a defined duration? Can Building Systems avoid near-standstill under a similar loss? Can payroll, treasury, reporting, billing, and invoicing operate through alternate channels? Can every plant isolate without losing safety communication? Can restored systems be rebuilt from known-good backups within a measured time? Can public updates be issued without the ordinary corporate network?

Hydro's later 2025 integrated annual report reflects a company that continues to report on risk and operations years after the incident. A later annual report is not proof that the 2019 weaknesses are fully solved. It is part of the continuing public record in which investors and stakeholders can ask whether cyber resilience remains tied to operational continuity.

The responsible conclusion is balanced. Hydro's response stands out for transparency, refusal to pay, use of backups, public capacity updates, and employee effort. It also demonstrates how fragile industrial control planes can be when corporate IT, orders, reporting, finance, and production support systems fail together. Praising the response should increase, not reduce, pressure to make the manual capability repeatable.

Plant-level metrics make resilience auditable

Hydro's public updates were valuable because they gave rough capacity states by business area and, later, by parts of Extruded Solutions. The next level of accountability is plant-level metrics. A company does not need to publish every internal number to the public, but it should maintain enough internal detail to show which degraded modes worked, which did not, and why. Without plant-level evidence, manual recovery can become a story rather than a control.

Useful metrics start with activation. How long did it take each plant to recognize the incident, isolate from affected systems, move to manual procedures, and confirm safe operating status? How many employees knew the fallback process without central digital instructions? Which printed or locally stored procedures were used? Which vendors, customers, and local authorities were contacted? These facts show whether manual mode was designed or discovered under pressure.

The second category is capacity. Hydro publicly reported percentages for Extruded Solutions and Building Systems during recovery. Internally, a stronger record would identify the constraints behind those percentages: unavailable order systems, missing production data, limited customer confirmations, manual quality checks, staffing limits, or equipment-specific dependencies. A plant operating at 50 percent because it lacks order visibility has a different repair path from a plant operating at 50 percent because a production-control system is unavailable.

The third category is quality and safety. Manual production that preserves volume but increases defects or safety risk is not resilience. Metrics should record nonconforming output, near misses, manual overrides, extra inspections, rejected orders, and deferred work. Hydro reported no resulting safety incident in its early communications, which is an important boundary. The broader governance question is how safety assurance was maintained while systems were isolated and procedures changed.

The fourth category is reconciliation. Every manual transaction should eventually re-enter trusted systems. Plant-level metrics should show how many orders, shipments, quality records, invoices, and inventory changes were created outside normal workflows; how long reconciliation took; how many discrepancies were found; and which controls caught them. This turns manual work from folklore into audit evidence.

The fifth category is endurance. A manual mode that works for twelve hours may fail after five days because people become tired, inventories diverge, customer inquiries accumulate, and exceptions multiply. Hydro's April 12 update referred to extraordinary effort from 35,000 employees. That statement shows why endurance matters. Human effort can sustain continuity, but it is not infinite. A mature plan sets staffing rotations, escalation thresholds, and criteria for reducing output before fatigue creates unsafe conditions.

Plant-level metrics also help target investment. If one business area remains near normal while another approaches standstill, the difference may reflect process design, local autonomy, system dependency, product complexity, or prior training. The company should not flatten those differences into a single cyber program. It should learn from the plants that degraded well and invest where the control plane was too centralized or brittle.

This kind of evidence would also help customers and insurers. Customers want to know whether a supplier can continue specific product lines under stress. Insurers want to know which controls reduce loss. Regulators and market entities want credible statements. Plant-level metrics provide a disciplined answer without requiring the company to expose sensitive technical detail.

Manual knowledge has to survive automation

Hydro's response highlighted the value of local knowledge and older procedures. That value can decline quietly as industrial firms automate, standardize, outsource, retire experienced staff, and centralize data. A ransomware incident then reveals that the manual knowledge still exists in a few people rather than in the system. That is dangerous because resilience depends on availability of people as well as availability of machines.

Manual knowledge should be treated as an asset. It includes how to read orders without the usual interface, how to verify customer specifications, how to run a line safely with reduced digital support, how to document quality checks, how to approve exceptions, how to contact suppliers, and how to stop work when uncertainty is too high. This knowledge should be captured in procedures that can be reached without the corporate network. It should be practiced often enough that employees trust it.

Automation can make manual knowledge harder to maintain because the ordinary workflow hides complexity. A system may validate fields, check tolerances, route approvals, apply pricing, and update inventory automatically. Workers may not see those steps until the system is gone. Manual fallback must therefore identify which hidden checks need manual substitutes and which cannot safely be substituted. Otherwise employees may continue visible work while invisible controls are absent.

Training should also include role boundaries. In an emergency, people want to help. That instinct is powerful and valuable. It can also create unauthorized workarounds. A manual-mode plan should say who may accept orders, who may release products, who may alter production schedules, who may approve quality exceptions, who may communicate with customers, and who may reconnect systems. Clear authority protects employees by reducing the burden of improvising governance.

The manual knowledge problem extends to suppliers and customers. If a supplier portal is down, procurement teams need alternate ordering rules. If customer-service systems are unavailable, sales teams need verified contact lists and approved language. If invoicing is delayed, finance needs exception procedures. Hydro's public updates about payroll, treasury, reporting, billing, and invoicing show that manual knowledge outside the plant floor mattered too.

For industrial companies, the right balance is not nostalgia for paper. It is deliberate hybridity. Digital systems should do what they do best: scale, automate, validate, optimize, and record. Manual modes should do what they must: preserve safe limited operation when the digital layer is unavailable or untrusted. The two should be designed together. If manual mode is treated as a relic, it will not be ready. If digital mode is treated as optional, the company will lose efficiency and control. Resilience lives in the boundary.

Hydro's case gives the public a rare view of that boundary. The company kept some production moving with manual work while rebuilding digital systems. The evidence should push other industrial firms to ask where their own manual knowledge resides and whether it can be activated without heroic improvisation.

Cost transfer is not the same as control repair

Insurance recoveries are important, but they can create a misleading sense of closure. Hydro's financial reporting shows that insurance compensated part of the cyberattack's financial impact. That helped allocate cost after the event. It did not itself rebuild computers, train workers, restore customer confidence, or prove manual procedures. Cost transfer and control repair are different functions.

An insurer will care about controls because controls affect loss. The company will care about recovery because recovery affects operations. Customers will care about delivery. Employees will care about safe work and manageable effort. Investors will care about financial effect and future exposure. Public authorities will care about resilience and lawful operation. A complete accountability record speaks to all of those audiences. Insurance is one line in that record, not the whole document.

The distinction matters because insurance can reimburse some costs while leaving residual harm outside the policy. Lost customer trust, delayed projects, supplier disruption, employee fatigue, and public-response costs may not be fully captured. Even insured costs can be delayed, disputed, capped, or conditioned. A company that treats insurance as the primary resilience mechanism is confusing financing with continuity.

The better use of insurance is as a feedback mechanism. Claims analysis can identify which losses were largest, which controls reduced loss, which exclusions mattered, and which evidence was required. That information should flow back into resilience planning. If lost sales were larger than restoration cost, customer communication and manual order handling may need more investment. If rebuilding endpoints consumed excessive time, endpoint recovery and segmentation may need redesign. If reporting delays created market pressure, finance fallback may need stronger procedures.

Cost transfer also affects accountability to smaller partners. A large company may have a cyber policy and balance-sheet capacity. A small supplier or customer affected by delays may not. The large company's recovery plan should therefore consider downstream cost even when its own insurance works. Practical communication, predictable manual channels, and timely reconciliation can reduce harm for parties that have less financial cushion.

Hydro's public financial transparency made these questions easier to ask. It showed that the event had material cost, that insurance played a role, and that the largest disruption was not evenly distributed across the business. The next accountability step is to connect cost categories to tested controls. A board should be able to ask: which part of the NOK impact would be lower under the current recovery plan, and what evidence supports that answer?

The answer cannot be perfect. Future incidents will differ. But the discipline of connecting cost to controls prevents a severe incident from becoming only a historical anecdote. It converts the accounting record into a resilience agenda.

Public evidence can protect workers too

Hydro's transparency is usually discussed as investor or customer communication, but it also matters for workers. Employees asked to keep operations running manually need clear public and internal signals that safety comes before output, that extraordinary effort is recognized, and that delayed administrative processes are being handled. When leadership explains which units are constrained and which functions are delayed, it reduces the pressure for local teams to pretend that normal capacity has returned before the control plane is ready.

Worker-facing accountability should include fatigue limits, exception escalation, manual authorization rules, and a path for stopping work when evidence is missing. Manual fallback depends on people, and people need governance as much as machines do. A plant that can run manually for a day may not be safe at the same pace for a week. The resilience plan should therefore protect the workforce from becoming the unmeasured backup system.

This worker lens also strengthens public confidence. A company that reports capacity without explaining degraded effort may look healthier than it is. A company that acknowledges extraordinary manual work gives stakeholders a more honest picture of recovery. Hydro's repeated distinction between normal production, near-normal production, and work-intensive workarounds was valuable because it kept that nuance visible.

That nuance is the basis for durable industrial accountability.

Typography note

Typography is the art and technique of arranging type to make written language legible, readable, and visually appealing. It involves selecting typefaces, point sizes, line lengths, line-spacing, and letter-spacing.

Typography originated with the invention of movable type by Johannes Gutenberg in the 15th century.
Key elements include font selection, kerning, tracking, and leading.
Good typography enhances readability and conveys mood or tone in design.

Residual unknowns and the accountable question

The public record does not provide Hydro's full intrusion timeline, every privilege step, every affected system, every plant-level recovery metric, or every customer impact. It does not independently validate every later control. It does not prove how long each manual procedure could run safely or how many errors were created and reconciled. It does not show every insurance-claim detail or every public-authority interaction.

The known facts are still enough to support a strong accountability lesson. Hydro's ransomware event affected the global organization. The company isolated operations, used manual procedures, rebuilt encrypted machines from backups, kept some business areas close to normal, suffered serious disruption in Extruded Solutions, published frequent updates, reported substantial financial impact, and later recognized insurance compensation. The technical record supports a ransomware campaign affecting IT-dependent industrial operations rather than a direct OT takeover.

The accountable question is whether manual recovery became design evidence. If the lesson is only that employees were resourceful, the organization remains dependent on emergency improvisation. If the lesson becomes tested manual capacity, independent recovery, protected communications, function-by-function metrics, and transparent stakeholder updates, then the incident strengthens the control plane. Norsk Hydro's public record matters because it lets that question be asked with evidence rather than mythology.

Typography

Typography originated with the invention of movable type by Johannes Gutenberg in the 15th century.
Key elements include font selection, kerning, tracking, and leading.
Good typography enhances readability and conveys mood or tone in design.