A Fake Result Website, a Defaced School Page and One Licensed DVD
A higher secondary school in Ernakulam publishes its Plus Two model examination results on its own website. Two days before the result date, a message circulates in a class WhatsApp group: 'Check your result early at kerala-result-verify.xyz - enter roll number, date of birth and pay a ₹50 verification fee by UPI.' Eleven students submit their details. Within an hour a parent's account is debited ₹18,000 in three UPI transfers, and one student finds the password of his e-mail account changed and his contacts receiving messages in his name. On the same day the school's genuine home page is replaced by a political slogan; the web administrator had stored the hosting FTP password as school2010 and had shared it in a staff WhatsApp group six months earlier. Separately, the lab's 30 computers run a commercial office suite installed from a single licensed DVD purchased for the office computer. The principal asks the computer applications teacher for a written note on what has happened and what must change.
1. Classify each of the three incidents, naming the specific offence involved and the provision of the IT Act 2000 (or other law) that applies. Distinguish clearly between the fake website and the defacement.
Read the worked answer
Incident 1 - the fake result site. This is phishing: a deceptive site impersonating the school to harvest credentials and money. Two offences arise. Obtaining and using the students' personal data (roll number, date of birth, e-mail credentials) is identity theft under Section 66C of the IT Act 2000. Inducing payment of ₹50 and then debiting ₹18,000 is cheating by personation using a computer resource under Section 66D. Fraudulent withdrawal through UPI is also cheating and forgery under the IPC (now Bharatiya Nyaya Sanhita), and the e-mail takeover is unauthorised access to a computer resource under Section 66 read with Section 43.
Incident 2 - the defaced home page. This is website defacement, a form of unauthorised access and damage to a computer resource: Section 43 (damage, deletion, alteration) and Section 66 (computer-related offences, punishable with imprisonment up to three years and/or a fine up to ₹5 lakh). It becomes Section 66F (cyber terrorism) only if intent to threaten the unity or security of India is shown - a slogan alone does not automatically meet that bar, and a student should say so rather than overstate.
Distinction. Phishing targets people and their credentials/money through deception; defacement targets a system and its public content through unauthorised access. Different sections, different evidence, different remedies.
Incident 3 - the single licensed DVD. This is copyright infringement, civilly actionable and criminally punishable under Section 63 of the Copyright Act 1957; it is not an IT Act offence. 'For education' is not a licence.
2. Using only the facts given, reconstruct how the defacement was probably carried out and list the controls that would have prevented it, in order of priority.
Read the worked answer
Reconstruction. The FTP account password was school2010 - a dictionary word plus a year, guessable in seconds - and it was broadcast in a WhatsApp group, so it was known to everyone in the group and to anyone who later gained access to a member's phone. Storing that password in a chat, never changing it for at least six months, and using plain FTP with no second factor are together sufficient explanation; no sophisticated attack is required. The investigation should still confirm it rather than assume it, by reading the hosting provider's access logs for the FTP/SFTP login times and source addresses around the incident.
Controls, highest priority first. (1) Rotate every password that was ever shared - hosting, FTP, database, e-mail - to long unique passphrases stored in a password manager, never in chat. (2) Switch off FTP and use SFTP/SSH or the host's control-panel file manager over HTTPS; plain FTP sends the password in clear text. (3) Enable two-factor authentication on the hosting account and on staff e-mail. (4) Least privilege: the teacher who only uploads notices should not hold the account that can change DNS or delete the site. (5) Patch and update the CMS/plugins and remove unused ones, since compromised plugins are the other common route in. (6) Off-site, versioned backups so a defaced site can be restored in minutes rather than rebuilt. (7) A written incident procedure - preserve logs, report to the hosting provider and to cybercrime.gov.in, inform parents honestly.
The examiner's point. Every control here addresses a process failure, not a missing tool. A firewall would not have stopped a password pasted into WhatsApp.
3. The lab technician argues that installing one licensed copy on 30 machines is acceptable because it is 'for education, not for profit'. Evaluate that argument and advise the school, including what it should do about the twelve students' losses.
Read the worked answer
The argument fails. A software licence is a legal permission with conditions; the condition on a single-user or single-machine licence is installation on one machine. The purpose of the use is irrelevant - non-commercial use is not a general defence under the Copyright Act 1957. Installing 30 copies from one DVD is reproduction of a copyrighted work without authorisation, an infringement actionable under Section 63, with the institution (not only the technician) exposed. The school is also the worst possible place to model this: it teaches 60 students per batch that licences are optional.
What the school should do. Audit every machine and record the licence for each installed package. Either buy adequate licences (many publishers offer heavily discounted educational or volume licensing) or migrate to free and open-source equivalents - LibreOffice for the office suite, GIMP for image editing, Scilab or LibreOffice Calc for spreadsheets - which are legally installable on all 30 machines at no cost and are exactly what the syllabus's generic 'word processor/spreadsheet/presentation' outcomes require. Keep the paperwork: invoices and licence keys are the evidence if an audit arrives.
The students' losses. The school cannot recover the ₹18,000 itself; the affected families should report at cybercrime.gov.in or the local cyber cell with screenshots, UPI transaction IDs and the fake URL, and inform the bank immediately - the bank can attempt a chargeback and freeze the beneficiary account. The school's duty is to inform all parents in writing, warn that no fee is ever collected for viewing results, and publish results only through the official domain over HTTPS. Blaming the students publicly would be an ethical failure; the school's messaging invited them to a link.