The Screenshot, the Laptop and the Committee Member
On Tuesday, a Class XI girl shows her class teacher a screenshot of Instagram direct messages that threaten to circulate an edited photo unless she sends money. The sending account has no profile photo and a generic username. The principal asks the school's IT teacher to log in to the school-issued laptop of a boy in the same class and 'check his Instagram and delete anything nasty', because the boy's father is on the school management committee and 'we don't want police'. The school's corridor CCTV, which covers the door of the computer room, overwrites after seven days. The girl's phone is her own; the screenshot is the only copy she has shared. School rules say devices can be inspected for 'disciplinary purposes', but no written procedure exists. The IT teacher has admin rights on all school laptops and has previously reset students' passwords.
1. Should the IT teacher carry out the principal's instruction? Identify the legal, forensic and ethical problems and state what he should do instead.
Read the worked answer
No. The instruction creates four problems:
- Legal: logging into another student's account and deleting messages is unauthorised access and destruction of evidence. It may attract provisions of the IT Act, 2000, and it bypasses the lawful investigation process. A broad school rule about 'disciplinary purposes' does not authorise a criminal investigation.
- Forensic: deleting 'anything nasty' destroys the very material a court or police cyber cell would need. The account may also be accessed from other devices, so the laptop is only one source.
- Ethical and safeguarding: the boy is a minor; his privacy and his parents' rights matter, and the father's position on the committee creates a conflict of interest. The girl needs protection from escalation, not a quiet internal deal.
- Procedural: the IT teacher has no written authority, no consent, and no chain-of-custody procedure.
Instead: preserve the screenshot and CCTV immediately, escalate to the designated child protection or safeguarding officer, inform the parents of both students as required by school policy, and report to the police cybercrime portal. The IT teacher may preserve school-owned device logs and the laptop itself, but should not log into personal accounts or delete content.
2. Describe how to preserve the screenshot and the CCTV footage so they are usable later, including two hash-related steps.
Read the worked answer
Screenshot: do not crop, annotate or re-save it. If possible, export the original conversation from the girl's phone, record the account handle, the URL, the device time and the time zone, and copy the file to write-once media. Note who made the copy and when.
CCTV: export the relevant clip before the seven-day overwrite. Record the camera ID, the system clock time and any known clock drift between the DVR and real time. Preserve the exported file in its original format rather than screen-recording the monitor.
Two hash steps: calculate a SHA-256 hash of each file immediately after export, and calculate it again after transfer to the evidence store. Record both values in a chain-of-custody log, together with the tool used, the handler's name, and the date and time. If the two hashes match, the copy is shown to be unchanged in transit; any later mismatch shows tampering.
Store the evidence in a sealed folder or account that the IT teacher does not use for routine work, and hand it to the investigating officer with a signed log.
3. The principal says 'handle it internally to protect the school's reputation.' Give two reasons this is wrong and describe the lawful path in two sentences.
Read the worked answer
Reason 1: the conduct described is extortion and a threat to circulate an edited image, which is a cognisable matter. Internal handling does not make it disappear; it delays protection for the girl and may allow the offender to escalate or target others.
Reason 2: internal handling destroys evidence and creates institutional liability. Deleting messages or 'counselling' the suspect without preserving records can amount to destruction of evidence, and the school may be seen to have protected a committee member's son. Reputation is damaged more by a cover-up than by a timely report.
Lawful path: preserve the screenshot and CCTV with hashes, inform the parents and the safeguarding officer, and report to the police cybercrime portal or the local cyber cell, cooperating with the investigation while providing counselling and privacy protection for both minors. Do not name the girl publicly or allow the IT teacher to conduct a private search of the boy's account.