The Result Portal, the Bulk Download, and the OTP Message
During the annual exam, a Class 12 student, Neha, notices that the school's result page has the address https://results.example.edu/view.php?roll=1023. When she changes 1023 to 1024, the browser shows another student's marks, name, and date of birth. Curious, she writes a small loop, downloads the marks of all 600 students, and posts a screenshot plus a link to the file in the class WhatsApp group “so everyone can check”. The same week she receives a message: “Your scholarship of ₹5,000 is pending; click this link and enter the OTP sent to your phone.” Her friend says both actions are harmless because no money was taken and the school website is public.
1. Assess Neha's download and sharing of all 600 records. Was the access authorised, which legal and ethical principles are involved, and does “no money was taken” matter?
Read the worked answer
Neha was authorised to view her own result after logging in, not to change the roll parameter and read others' records. Changing 1023 to 1024 bypasses the intended access control, so the access is unauthorised even though the page is reachable from a browser. Under the IT Act 2000, unauthorised access and computer-related offences under sections 43 and 66 can apply; personal data such as name, marks, and date of birth raises privacy and confidentiality concerns, and misuse of identity data can engage section 66C. Downloading all 600 records is not a minimal check: it turns a single accidental exposure into a bulk data breach, and sharing the file amplifies the harm. Good intentions and the absence of money loss do not make the access authorised. “Publicly reachable” is not the same as “permission to collect and redistribute”.
2. Set out a responsible-disclosure plan for Neha and the school, including what evidence to keep and what technical fix to recommend.
Read the worked answer
Neha should stop changing roll numbers, avoid downloading further records, and not share the file again; she should ask the group to delete it and remove her own copy where possible. She should preserve minimal evidence, such as the URL, time, and a redacted screenshot, and report the issue privately to the principal or the website administrator. The school should contain the problem by disabling parameter-based access and requiring a server-side check that the logged-in session belongs to the requested roll number. It should preserve web logs, identify affected students, notify them according to school policy, patch the page, and retest. Recommended fixes include authentication and authorisation on every request, unpredictable identifiers as a defence in depth, HTTPS, rate limiting, and input validation. Neha should not demand a reward or publish the data before a fix; coordinated disclosure protects students.
3. Analyse the scholarship message. What should Neha do, and why is entering an OTP dangerous even if the site looks official?
Read the worked answer
The message has the classic signs of phishing: an unexpected scholarship, urgency, a link, and a request for an OTP. An OTP is a second factor used to authorise a login or transaction; anyone who obtains it may be able to complete an action as Neha. Banks and legitimate scholarship portals do not ask for an OTP through a WhatsApp link. She should not click the link or enter any detail, and she should verify the scholarship through the school office or the official portal using a known phone number. If she already entered the OTP, she should contact her bank immediately, block the card or UPI access, change relevant passwords, and report the incident at cybercrime.gov.in or on helpline 1930. She should also warn the class group. “No money has been taken yet” is not reassurance: stolen identity data and credentials can be used later, and the first loss may be the OTP itself.