The 18 MB Invitation
The IT club of a government high school in Belagavi has made a 2-minute video invitation for a parent meeting. The file is 18 MB. The club secretary must email it to 35 parents and 4 teachers by 6 p.m. The school's shared email account allows attachments up to 10 MB. The secretary drafts one message and puts all 35 parent addresses in To, the four teachers in Cc, and attaches the video. One parent, who has asked the school not to share her address, is in the To list. The school Wi-Fi disconnects every 15 minutes during the upload. The secretary also receives an email saying 'Your mailbox is full; click here to verify your account' with a link to a login page. The club adviser asks for a plan that respects privacy and still reaches everyone before the deadline.
1. Rewrite the addressing plan: say who should be in To, Cc, and Bcc, and justify each choice for this message. Then explain how to handle the 18 MB video given the 10 MB limit.
Read the worked answer
To should contain the club's own address or the adviser's address, so there is a clear sender and a single visible primary recipient. Cc can hold the four teachers if their addresses are not confidential and they need to see one another; Cc is visible, so it must not contain parents. All 35 parent addresses should go in Bcc. Bcc hides each parent's address from every other parent, protects the parent who asked not to be identified, and reduces reply-all storms. The message body should say 'sent to parents via Bcc' so people understand why their address is not shown.
For the video, an 18 MB attachment cannot be sent on a 10 MB limit. The secretary should upload it to the school's approved cloud drive, set the sharing permission to 'anyone with the link can view' only if school policy allows, or to 'specific people' if it does not, and paste a short link plus a plain-text fallback. The link should be tested in a private browser window. Alternatively, the video can be compressed or exported at a lower resolution to below 10 MB, but that may reduce quality. Given the unstable Wi-Fi, the upload should be done in one session with the laptop connected by cable if possible, and the email should be sent only after the link opens successfully.
2. A parent replies to the message with 'Please remove me from this list', and the reply reaches all 35 parents. Explain the technical reason and describe two concrete changes that would prevent the same reply-all storm next time.
Read the worked answer
The parent was in the To field, so her reply used Reply All, which includes every To and Cc recipient. Because all 35 parents were visible in To, one reply could reach the whole list. The student cannot control whether a parent clicks Reply All, but the student can control the addressing.
First, move all parent addresses to Bcc and put only the club address in To. A Bcc recipient who replies normally replies to the sender, and the other Bcc recipients are not exposed. Second, set a Reply-To address such as the club account and add a line in the footer: 'This is an announcement. Please do not use Reply All; write to club@... for removal.' A school mailing list or group with restricted posting is even better, because it can be configured so only the club can send and replies go to the club. The secretary should also apologise briefly to the list only once, not repeatedly, and remove the parent after confirming the request. These changes protect privacy and reduce unnecessary traffic.
3. The 'mailbox full' email asks the secretary to click a link and log in. Identify two signs that it is phishing, state the safe action, and explain why the school's shared account makes this more dangerous than a personal account.
Read the worked answer
Two signs are the generic, urgent threat that the mailbox is full and the request to log in through a link in the email. A real provider normally asks you to sign in through its own site and does not need your password from a message. The link text may also point to a different domain than the school's mail provider. The safe action is not to click. The secretary should report the message to the teacher or school IT contact, then open the mail service by typing its known address, check the quota in account settings, and delete the message after reporting. If the link was already clicked, the password should be changed immediately from a known device and the incident reported.
The shared account makes this worse because one password may be known to several club members, a single successful phish gives access to all club mail, and the attacker can read parent addresses or send messages in the school's name. The account may also have no second factor. The club should change the password, enable two-factor authentication if available, check sent items and forwarding rules, and move to named accounts for office-bearers so access can be removed when a student leaves.