The Pen Drive, the Power Cut and the Password
You are a data-entry and front-desk trainee at a Common Service Centre in a district town in Maharashtra. The centre processes Aadhaar-linked subsidy forms and scholarship applications. There is one shared Windows PC, one printer, a UPS giving six minutes of backup, and a 4 Mbps broadband line that drops during rain. At 11:20 a.m. a customer's pen drive is inserted to copy a scanned certificate; a folder named 'scholarship' on it contains a file called 'form.pdf.exe'. At 11:35 a.m. the power fails for 20 seconds; the PC restarts and the day's 63-entry worksheet - last saved at 9:50 a.m. - opens, but the most recent entries look blank. Four customers are waiting, and a fifth wants to know whether his son's form has been sent. The centre owner is out and has told you his email password is 'the shop name plus 123'.
1. Put your actions for the next 15 minutes in order and justify the sequence.
Read the worked answer
- Stop touching the pen drive. Do not open the file. Use Safely Remove Hardware, take the drive out and set it aside in a labelled envelope.
- Protect the day's work. Do not press Save. Use Save As to create a new copy with the date and time in the file name, so the 9:50 a.m. version is not overwritten. Then count how many of the 63 entries are actually present.
- Give the four waiting customers a time, not a story - 'the system restarted, I need ten minutes' - and take their tokens in order.
- Check the UPS and the printer queue before entering anything new. A second dip mid-entry is the bigger risk today; a UPS with old batteries is a plan to lose the data twice.
- Log the time and the pen drive owner's name, and ring the owner.
Why this order: containment before recovery, recovery before service, service before reporting. The file on the pen drive is the only risk in the room that cannot be undone, and the queue only gets longer - it does not get worse.
2. Judge the pen drive file and the owner's password practice. What do you do about each today?
Read the worked answer
The file: 'form.pdf.exe' is not a PDF. The true extension is .exe, and the doubled name is a standard trick to make a program look like a document. Opening it on a shared machine holding other people's Aadhaar and scholarship data is the single worst action available to you today. Actions: do not open it; keep the drive aside; inform the owner; scan the PC with the installed antivirus; look in the Downloads and Temp folders for anything new; copy nothing from that drive. If the centre has IT support, hand the drive to them in the envelope.
The password: 'shop name plus 123' is guessable in seconds by anyone who has seen the board outside the shop, and it protects the email account that resets every other account. You cannot change the owner's password on your own authority, but you can raise it with him in writing the same day, ask him to turn on two-step verification, and stop using his account - work from a named login of your own.
Why record it: if a data breach follows, 'nobody told me' is not a defence for the person sitting at the keyboard.
3. The fifth customer asks whether his son's form has been sent. How do you verify and answer without exposing other people's data?
Read the worked answer
Do not read out or turn the screen towards him. Ask for the applicant's full name, date of birth, and the acknowledgement or reference number printed on the receipt he was given. Search by reference number, not by name - names repeat constantly.
Answer only what he asked: 'the form was submitted on the 3rd and is at the verification stage'. Status, not contents. Do not read out an address, a mobile number or a bank detail to somebody standing at the counter.
If he has no receipt and cannot give a reference, say the centre cannot trace it from a name alone and ask him to bring the receipt. Do not scroll through other people's records in front of him to 'have a look'.
Also today: turn the monitor away from the counter and enter the enquiry in the register.
The reason for this discipline is not politeness. Aadhaar-linked and scholarship records are personal data, and the person who is careless in front of a queue of five is the person who ends up explaining a complaint - with no record showing what was actually disclosed.