Forty Bundles, a 20 MB Portal Limit and a Suspicious Email
You sit in the e-filing and computer section of a district court. A direction has come to upload forty case bundles to the e-filing portal. Each bundle has been scanned on the office scanner at 600 dpi in colour, and the average file size is 28 MB. The portal accepts PDF only, rejects any single upload above 20 MB, and requires each uploaded file to carry the court's digital signature certificate. The office email account caps attachments at 25 MB. There is one 4 GB pen drive in the section and a shared printer-cum-scanner whose maximum is 300 dpi. One bundle is a 400-page record from the 1950s on faded paper, and it has to remain readable for the reviewing Judge.
At 4:40 p.m. an email arrives from "[email protected]" saying the court's DSC expires tonight and asking you to confirm the token PIN and the OTP sent to the section's mobile number to avoid deactivation.
1. Work out the storage and transfer arithmetic, then set out how you would bring each file within the portal limit without destroying legibility.
Read the worked answer
Arithmetic first: 40 × 28 MB = 1,120 MB, about 1.1 GB. The 4 GB pen drive is sufficient for transfer; email is impossible, since 40 files at 28 MB each cannot pass a 25 MB attachment cap, and even one file exceeds it marginally after encoding.
The limit is per file, not per bundle set, so the fix is measured and reversible. Rescan at 300 dpi in grayscale for text pages - this alone typically cuts size by more than half and is well within the 20 MB ceiling - and keep colour only for pages where colour carries meaning (seals, maps, photographs). Split long bundles into logical parts (pleadings, annexures, exhibits) so that each part is under 20 MB and is easier to cite. Use the scanner's PDF output rather than photographing pages or re-compressing the same JPEG repeatedly, which destroys text edges. For the 1950s record, test-read two pages at 300 dpi grayscale before committing: legibility for the Judge outranks a smaller file.
2. A scanned signature image is pasted on each PDF by a colleague and he says the file is now "digitally signed". Is he right, and what should the section actually do?
Read the worked answer
He is not right, and the difference matters legally. Pasting a picture of a signature onto a PDF produces an electronic image; anyone with the file can copy that image onto another document, and nothing in the file shows that the court's authorised signatory approved that particular content.
A digital signature works differently: the signing certificate held on a token, with its private key, produces a cryptographic hash of the document. Any later change to a page breaks the hash and the portal or viewer shows the signature as invalid; the signature also identifies the signatory and carries a validity period. So the section must sign each PDF with the court's DSC token, keep the token and PIN with the designated officer, record the date and time of signing, and verify on the portal that the uploaded file shows a valid signature. The practical check before upload: open the file, confirm the signature panel shows "valid", and confirm the certificate has not expired.
3. How should the 4:40 p.m. email be handled, and what makes that the correct response rather than simple caution?
Read the worked answer
Treat it as a phishing attempt and do not reply. Three signals: the domain is not the court's or the service provider's official domain; the message creates artificial urgency at the close of the working day, when verification is hardest; and it asks for exactly the two things that together allow misuse of the certificate - the token PIN and the OTP. A genuine helpdesk never needs either; it can check certificate status itself from the registration details.
Correct handling: do not click the link, do not enter any credential on the page, preserve the mail as evidence, and report it the same evening to the officer in charge and the section handling IT security. Independently verify the DSC's expiry by opening the certificate on the token rather than by trusting the message. If the certificate really is near expiry, renewal is done through the issuing authority's formal process with written authorisation. Being merely "cautious" would leave the mail unreported; the judgement is that a credential-harvesting attempt against a court's signing certificate is a security incident, not an inconvenience.