Two Pages on Telegram
You are the assistant in a district security branch. Forty-eight hours before a scheduled movement, a contractual data-entry operator in the same office photographs 14 pages of a schedule marked 'Restricted' on his personal phone and, within the hour, posts two of those pages to a public Telegram channel. A handle on that channel replies almost immediately, asking him to confirm the rail siding code. Your branch head is on leave and unreachable for six hours. You have no power of arrest, no authority to order interception, and no budget of your own. The operator is still at his desk, two metres away. The movement commander must decide within 24 hours whether to reschedule. The office has a written disclosure policy, one gate CCTV camera that overwrites every 72 hours, and a personnel file containing the operator's signed undertaking on handling restricted material.
1. Set out your actions for the next six hours, in order, with the reason for each sequence decision.
Read the worked answer
Order is the whole answer, because two clocks are running: the 72-hour CCTV overwrite and the 24-hour movement decision.
- Preserve before you confront. Screenshot the channel posts with visible timestamps and the channel URL, save the two images, record a SHA-256 hash, and have a second official sign a witness note. Reason: a Telegram post can be deleted in one tap, and the deletion is triggered by the operator realising he is under suspicion.
- Pull the gate CCTV footage now, not tomorrow. Reason: it is the only independent record of who entered with a phone, and it is on a 72-hour cycle.
- Reduce access before seizure. Ask the IT assistant to suspend the operator's folder and login rights, without announcing why. Reason: this stops further exfiltration without warning him.
- Approach the phone as a request, not a seizure. Ask him to hand it over voluntarily, in the presence of a witness, and record the answer. If he refuses, do not wrestle it from him; note the refusal and route the seizure through the police. Reason: you have no power to seize, and an unlawful seizure contaminates the evidence.
- Report upward in writing the same hour to the officer holding charge in the branch head's absence, and inform the district police control room. Reason: 'unreachable for six hours' is not a lawful reason to sit on a suspected breach; a written report protects you and starts the clock on everyone else.
- Brief the commander early, even before the enquiry is complete. Reason: his decision costs money and time, and he needs your input at hour 6, not hour 24.
What you must not do: confront the operator in a closed room before preservation, contact the handle from any official account, or invite the operator to 'explain himself on record' before the phone is secured.
2. Which legal and administrative routes are open to you and which are not? State the boundary explicitly.
Read the worked answer
Open to you
- Departmental action. Suspension and a disciplinary proceeding under the applicable service rules, and a preliminary fact-finding enquiry. This is entirely within the office's competence and should start on day one.
- A written complaint to the police. The suspected conduct - unauthorised communication of a document marked Restricted - falls to be investigated under the Official Secrets Act, 1923, and the misuse of a computer resource under the Information Technology Act, 2000. The investigation is the police's function; your role is to hand over a clean, documented complaint and the preserved material.
- Revocation of access and, if the contract permits, termination of the data-entry engagement under its own terms, executed on the record.
Not open to you
- Interception or monitoring of the operator's accounts or phone. Powers under the IT Act, 2000 for interception and monitoring require a written order from the competent authority designated for that purpose - not a branch assistant, and not a verbal instruction.
- Arrest, detention, or a search of his person, desk or residence. Without authority, any of these converts a clean case into a compromised one and exposes you personally.
- Any engagement with the foreign handle - no replies, no friend requests, no 'testing' with a decoy account. That is an operation, not an enquiry, and it needs authorisation you do not have.
The boundary in one line: you may preserve, report, suspend access and file a complaint; you may not search, seize, intercept or arrest.
3. The commander asks whether to reschedule. Advise him, and state the principle you are applying.
Read the worked answer
Advise: reschedule - shift the movement and change the siding - but do not cancel.
The principle. The question is not 'how damaging is the leak in fact?' but 'has the other side gained a time-and-place advantage that I can deny more cheaply than I can absorb?' Two pages of a Restricted schedule are already an advantage; a request to confirm the siding code tells you the adversary is trying to convert a partial document into an operational picture. You do not need to prove he succeeded before you react, because the cost of reacting is low and the cost of being wrong is not.
Why reschedule rather than cancel. Cancelling signals that the leak was detected, forfeits the training value and the sunk cost, and leaves the compromised route in use for the next serial. A time shift plus a new siding achieves the same denial without the signal.
Why not stall for the enquiry. Waiting for a completed enquiry to decide is a category error: the enquiry establishes who did what; the commander's decision is about whether the plan is still safe. Those are different questions with different clocks.
Add two riders. First, tell only those who must know - a rescheduling instruction circulated widely defeats the purpose. Second, assume the two posted pages are the minimum the adversary holds, not the maximum; any detail on the other 12 pages should be treated as available to him when choosing the new route.