The great Indian examination heist
Authorities should examine unusual score clusters, identical answer patterns, geographical concentrations and links between candidates—while ensuring that analytics trigger investigation rather than automatic guilt.
- Aug 5, 2026,
- Updated Aug 5, 2026 3:39 PM IST
An examination paper is an unusually valuable object. For a few hours, it can determine admission to a medical college, a government salary, social mobility and, in many families, the return on years of sacrifice. That value creates a market. Around it has grown an illicit supply chain of insiders, middlemen, coaching operators, “solver” gangs and buyers, all exploiting the fact that India’s examination system often combines enormous stakes with surprisingly fragile logistics.
The scale is not anecdotal. An Indian Express investigation documented 41 recruitment-examination leaks across 15 states in five years, disrupting the plans of 1.4 crore applicants competing for just over 1.04 lakh posts. The governments involved cut across party lines. Paper leaks are not an ideological disease; they are an institutional one.
A leak is rarely the work of a lone genius defeating an impregnable system. More often, it is a mundane breach: a printer makes an extra copy; a courier consignment is opened; a strongroom has an unguarded entrance; a school employee photographs a paper; a vendor’s server credentials are compromised; or an official sells access. Once a single image reaches a messaging app, distribution becomes instant, cheap and almost impossible to contain.
A brief history of breached gates
The 1997 IIT Joint Entrance Examination was an early demonstration that even India’s most prestigious admissions system was vulnerable. Shortly before the examination, students attending “special classes” at a Lucknow coaching centre were reportedly given shorthand versions of questions, including seven of the 17 problems that later appeared in the mathematics paper. The IITs cancelled the examination and conducted it again in July, while the CBI opened an investigation. Yet the affair also illustrated a weakness that would recur in later scandals: institutional action against candidates was swift, but legal accountability moved glacially. Nearly three decades later, reports indicated that the criminal trial was still at the stage of examining witnesses—a sobering example of how delayed justice weakens deterrence.
The 2003 Common Admission Test leak was an early warning. The CAT, gateway to the Indian Institutes of Management, was cancelled for the first time in the IIMs’ history after the Central Bureau of Investigation uncovered the breach on the morning of the examination. The test was eventually held again in February 2004. The episode showed that prestige was no substitute for process: even a small, elite examination could be compromised when confidential printing and distribution depended on a limited circle of trusted humans.
In 2011, the All India Engineering Entrance Examination suffered a similar blow. The question paper was leaked in Uttar Pradesh and reportedly offered for ₹6 lakh. The CBSE delayed the test by more than two hours and used a fresh set of questions; more than 12 lakh candidates were affected. The operational response was better than outright cancellation, but the episode revealed a recurring weakness: a national examination could be disrupted by a local breach occurring shortly before the starting time.
By 2018, the smartphone had transformed the economics of leakage. In the CBSE board-examination scandal, handwritten versions of the Class XII Economics and Class X Mathematics papers were circulated on WhatsApp; a printed Economics paper was also photographed at a Delhi school roughly an hour before the examination. A Delhi High Court judgment, drawing on the police investigation, described teachers gaining premature access to the examination hall, photographing the paper on mobile phones and forwarding the images to a tuition teacher. The breach required no sophisticated hacking—only premature access, a camera and lax supervision.
Recruitment examinations have proved even more vulnerable. The Rajasthan Eligibility Examination for Teachers, held in 2021, became engulfed in a leak investigation; the state government cancelled its Level-2 examination in February 2022 and ordered it to be held again. In Uttar Pradesh, the police-constable recruitment examination held in February 2024 was cancelled after the question paper was leaked. About 48 lakh candidates had appeared for approximately 60,000 posts. The arithmetic explains the criminal incentive: when millions compete for a narrow funnel of secure employment, even a tiny fraction willing to pay can finance a substantial cheating network.
The 2024 NEET-UG case exposed the problem at its largest and most politically explosive. The Supreme Court found that a leak had occurred in Hazaribagh and Patna, though it concluded that the evidence did not establish a nationwide systemic breach and declined to order a fresh examination for more than two million candidates. Its judgment nevertheless recorded grave operational failures: unauthorised access through a strongroom’s rear door, the use of private couriers and even e-rickshaws to move papers, weak oversight of invigilators and unclear timelines for sealing answer sheets.
That distinction matters. Not every localised leak justifies cancelling an entire national examination—but every localised leak exposes a system that failed somewhere specific. An authority must be able to determine quickly whether the breach was contained and whether the beneficiaries can be identified. Otherwise, it faces an ugly choice between preserving a possibly contaminated result and punishing millions of innocent candidates with a retest.
Why the leaks keep happening
The first reason is the single-secret model. Many high-stakes examinations rely on one paper, or a small number of paper sets, prepared well in advance and moved through a long chain. Every additional person, device, room, vehicle and contractor with access enlarges the attack surface. Security is only as strong as the least supervised handover.
Second, the rewards are immense while the probability of swift punishment has historically been low. Investigations often cross districts and states, involve disposable SIM cards, cash payments and layers of intermediaries, and become bogged down in proving who first obtained the paper and which candidates benefited. A 2026 review by The Indian Express of 45 major paper-leak cases over two decades found that only two had resulted in convictions. Arrests generate headlines; trials tend to generate adjournments. Criminal syndicates understand this gap rather better than official committees do.
Third, examination bodies frequently outsource critical functions without retaining equivalent control. Printing, transport, software, biometric verification, centre management and invigilation may be divided among private vendors and local institutions. Outsourcing a task, however, does not outsource accountability.
The Public Examinations (Prevention of Unfair Means) Act enacted in 2024 recognised this by defining offences involving question-paper leakage, collusion, tampering and service providers. As enacted, it provided prison terms and substantial fines for organised examination crime, personal liability for complicit executives and penalties against offending service providers. These are useful provisions. But deterrence depends on credible investigation and conviction, not the decorative severity of statutory language.
Fourth, the demand is structural. A government post may offer long-term security, a predictable salary and social status. A medical or engineering seat may alter a family’s economic trajectory. When one examination carries so much of a young person’s future, it also carries a black-market premium.
Coaching culture intensifies the pressure by turning preparation into a costly, multi-year investment. A cancelled examination is therefore not a minor administrative inconvenience. It can mean additional rent, travel and coaching expenses, lost wages for candidates and parents, and the risk that an applicant will cross an age or attempt limit before the recruitment process is completed.
Finally, institutions often communicate badly. Initial denial, opaque inquiries and delayed decisions create a vacuum filled by rumours, fabricated screenshots and political claims. Authorities face a genuine dilemma: cancelling too quickly can punish millions because of a local breach; waiting too long can deepen public suspicion. The answer is not reflexive cancellation, but credible forensic capacity and transparent thresholds for determining whether tainted candidates can be separated from the rest.
How to shut the market down
First, reduce the value of stealing any single paper. Large examinations should move towards encrypted item banks and late-stage, algorithmically assembled question sets, with several statistically equivalent versions. No individual should be able to view a complete paper days in advance. Decryption keys should be divided among independent custodians and activated shortly before the test at secure regional nodes or examination centres.
Second, impose a verifiable chain of custody. Every packet should have a unique serial number, tamper-evident seals and time-stamped scans at each handover. Strongrooms require controlled entry, uninterrupted camera coverage, intrusion alerts and two-person access rules. Transport routes and personnel should be randomised. E-rickshaws may be excellent urban transport, but they are not a security protocol.
Third, treat vendors as high-risk partners rather than cheap contractors. Contracts should mandate employee background checks, staff rotation, independent cyber audits, access logs, rapid breach reporting and financial liability. Sensitive responsibilities should be divided so that no vendor employee can download, print or reconstruct an entire examination paper alone. A company that cannot establish who accessed what, and when, should not handle a national examination.
Fourth, build permanent examination-integrity units. These should combine cyber forensics, financial investigation, conventional policing and statistical analysis. Authorities should examine unusual score clusters, identical answer patterns, geographical concentrations and links between candidates—while ensuring that analytics trigger investigation rather than automatic guilt. Protected whistleblower channels and rewards for verified information would help investigators reach insiders before a leaked paper is widely sold.
Fifth, publish the incident-response rules in advance. Examination authorities should specify the evidentiary thresholds for a centre-level retest, regional retest or nationwide cancellation. Once a breach is reported, they must preserve electronic and physical evidence immediately, issue verified updates at fixed intervals and explain why a particular remedy has been selected. Candidates forced to take another examination should receive fee waivers and, where practical, assistance with travel.
Finally, make accountability travel upward. Centre superintendents, examination officials and senior managers should face administrative consequences for negligent controls even when criminal intent cannot be proved. Annual independent security audits should be published with anonymised findings, compliance deadlines and details of corrective action. The objective is not to produce another committee report that gathers dust more securely than the question paper.
Paper leaks endure because India has treated them chiefly as episodes of cheating rather than failures of system design. Police action is necessary, and harsh penalties may deter some offenders. But the durable solution is to make the secret harder to access, less valuable when stolen, easier to trace and riskier to sell.
Until that happens, every sealed packet will carry two questions: the ones printed inside, and the one haunting millions of candidates outside—has somebody already seen it?
(Views are personal; Prof Bodhibarata Nag (Retired) was Professor of Operations Management at IIM Calcutta, and Prof Ranjan Pal is Researcher at Massachusetts Institute of Technology)
An examination paper is an unusually valuable object. For a few hours, it can determine admission to a medical college, a government salary, social mobility and, in many families, the return on years of sacrifice. That value creates a market. Around it has grown an illicit supply chain of insiders, middlemen, coaching operators, “solver” gangs and buyers, all exploiting the fact that India’s examination system often combines enormous stakes with surprisingly fragile logistics.
The scale is not anecdotal. An Indian Express investigation documented 41 recruitment-examination leaks across 15 states in five years, disrupting the plans of 1.4 crore applicants competing for just over 1.04 lakh posts. The governments involved cut across party lines. Paper leaks are not an ideological disease; they are an institutional one.
A leak is rarely the work of a lone genius defeating an impregnable system. More often, it is a mundane breach: a printer makes an extra copy; a courier consignment is opened; a strongroom has an unguarded entrance; a school employee photographs a paper; a vendor’s server credentials are compromised; or an official sells access. Once a single image reaches a messaging app, distribution becomes instant, cheap and almost impossible to contain.
A brief history of breached gates
The 1997 IIT Joint Entrance Examination was an early demonstration that even India’s most prestigious admissions system was vulnerable. Shortly before the examination, students attending “special classes” at a Lucknow coaching centre were reportedly given shorthand versions of questions, including seven of the 17 problems that later appeared in the mathematics paper. The IITs cancelled the examination and conducted it again in July, while the CBI opened an investigation. Yet the affair also illustrated a weakness that would recur in later scandals: institutional action against candidates was swift, but legal accountability moved glacially. Nearly three decades later, reports indicated that the criminal trial was still at the stage of examining witnesses—a sobering example of how delayed justice weakens deterrence.
The 2003 Common Admission Test leak was an early warning. The CAT, gateway to the Indian Institutes of Management, was cancelled for the first time in the IIMs’ history after the Central Bureau of Investigation uncovered the breach on the morning of the examination. The test was eventually held again in February 2004. The episode showed that prestige was no substitute for process: even a small, elite examination could be compromised when confidential printing and distribution depended on a limited circle of trusted humans.
In 2011, the All India Engineering Entrance Examination suffered a similar blow. The question paper was leaked in Uttar Pradesh and reportedly offered for ₹6 lakh. The CBSE delayed the test by more than two hours and used a fresh set of questions; more than 12 lakh candidates were affected. The operational response was better than outright cancellation, but the episode revealed a recurring weakness: a national examination could be disrupted by a local breach occurring shortly before the starting time.
By 2018, the smartphone had transformed the economics of leakage. In the CBSE board-examination scandal, handwritten versions of the Class XII Economics and Class X Mathematics papers were circulated on WhatsApp; a printed Economics paper was also photographed at a Delhi school roughly an hour before the examination. A Delhi High Court judgment, drawing on the police investigation, described teachers gaining premature access to the examination hall, photographing the paper on mobile phones and forwarding the images to a tuition teacher. The breach required no sophisticated hacking—only premature access, a camera and lax supervision.
Recruitment examinations have proved even more vulnerable. The Rajasthan Eligibility Examination for Teachers, held in 2021, became engulfed in a leak investigation; the state government cancelled its Level-2 examination in February 2022 and ordered it to be held again. In Uttar Pradesh, the police-constable recruitment examination held in February 2024 was cancelled after the question paper was leaked. About 48 lakh candidates had appeared for approximately 60,000 posts. The arithmetic explains the criminal incentive: when millions compete for a narrow funnel of secure employment, even a tiny fraction willing to pay can finance a substantial cheating network.
The 2024 NEET-UG case exposed the problem at its largest and most politically explosive. The Supreme Court found that a leak had occurred in Hazaribagh and Patna, though it concluded that the evidence did not establish a nationwide systemic breach and declined to order a fresh examination for more than two million candidates. Its judgment nevertheless recorded grave operational failures: unauthorised access through a strongroom’s rear door, the use of private couriers and even e-rickshaws to move papers, weak oversight of invigilators and unclear timelines for sealing answer sheets.
That distinction matters. Not every localised leak justifies cancelling an entire national examination—but every localised leak exposes a system that failed somewhere specific. An authority must be able to determine quickly whether the breach was contained and whether the beneficiaries can be identified. Otherwise, it faces an ugly choice between preserving a possibly contaminated result and punishing millions of innocent candidates with a retest.
Why the leaks keep happening
The first reason is the single-secret model. Many high-stakes examinations rely on one paper, or a small number of paper sets, prepared well in advance and moved through a long chain. Every additional person, device, room, vehicle and contractor with access enlarges the attack surface. Security is only as strong as the least supervised handover.
Second, the rewards are immense while the probability of swift punishment has historically been low. Investigations often cross districts and states, involve disposable SIM cards, cash payments and layers of intermediaries, and become bogged down in proving who first obtained the paper and which candidates benefited. A 2026 review by The Indian Express of 45 major paper-leak cases over two decades found that only two had resulted in convictions. Arrests generate headlines; trials tend to generate adjournments. Criminal syndicates understand this gap rather better than official committees do.
Third, examination bodies frequently outsource critical functions without retaining equivalent control. Printing, transport, software, biometric verification, centre management and invigilation may be divided among private vendors and local institutions. Outsourcing a task, however, does not outsource accountability.
The Public Examinations (Prevention of Unfair Means) Act enacted in 2024 recognised this by defining offences involving question-paper leakage, collusion, tampering and service providers. As enacted, it provided prison terms and substantial fines for organised examination crime, personal liability for complicit executives and penalties against offending service providers. These are useful provisions. But deterrence depends on credible investigation and conviction, not the decorative severity of statutory language.
Fourth, the demand is structural. A government post may offer long-term security, a predictable salary and social status. A medical or engineering seat may alter a family’s economic trajectory. When one examination carries so much of a young person’s future, it also carries a black-market premium.
Coaching culture intensifies the pressure by turning preparation into a costly, multi-year investment. A cancelled examination is therefore not a minor administrative inconvenience. It can mean additional rent, travel and coaching expenses, lost wages for candidates and parents, and the risk that an applicant will cross an age or attempt limit before the recruitment process is completed.
Finally, institutions often communicate badly. Initial denial, opaque inquiries and delayed decisions create a vacuum filled by rumours, fabricated screenshots and political claims. Authorities face a genuine dilemma: cancelling too quickly can punish millions because of a local breach; waiting too long can deepen public suspicion. The answer is not reflexive cancellation, but credible forensic capacity and transparent thresholds for determining whether tainted candidates can be separated from the rest.
How to shut the market down
First, reduce the value of stealing any single paper. Large examinations should move towards encrypted item banks and late-stage, algorithmically assembled question sets, with several statistically equivalent versions. No individual should be able to view a complete paper days in advance. Decryption keys should be divided among independent custodians and activated shortly before the test at secure regional nodes or examination centres.
Second, impose a verifiable chain of custody. Every packet should have a unique serial number, tamper-evident seals and time-stamped scans at each handover. Strongrooms require controlled entry, uninterrupted camera coverage, intrusion alerts and two-person access rules. Transport routes and personnel should be randomised. E-rickshaws may be excellent urban transport, but they are not a security protocol.
Third, treat vendors as high-risk partners rather than cheap contractors. Contracts should mandate employee background checks, staff rotation, independent cyber audits, access logs, rapid breach reporting and financial liability. Sensitive responsibilities should be divided so that no vendor employee can download, print or reconstruct an entire examination paper alone. A company that cannot establish who accessed what, and when, should not handle a national examination.
Fourth, build permanent examination-integrity units. These should combine cyber forensics, financial investigation, conventional policing and statistical analysis. Authorities should examine unusual score clusters, identical answer patterns, geographical concentrations and links between candidates—while ensuring that analytics trigger investigation rather than automatic guilt. Protected whistleblower channels and rewards for verified information would help investigators reach insiders before a leaked paper is widely sold.
Fifth, publish the incident-response rules in advance. Examination authorities should specify the evidentiary thresholds for a centre-level retest, regional retest or nationwide cancellation. Once a breach is reported, they must preserve electronic and physical evidence immediately, issue verified updates at fixed intervals and explain why a particular remedy has been selected. Candidates forced to take another examination should receive fee waivers and, where practical, assistance with travel.
Finally, make accountability travel upward. Centre superintendents, examination officials and senior managers should face administrative consequences for negligent controls even when criminal intent cannot be proved. Annual independent security audits should be published with anonymised findings, compliance deadlines and details of corrective action. The objective is not to produce another committee report that gathers dust more securely than the question paper.
Paper leaks endure because India has treated them chiefly as episodes of cheating rather than failures of system design. Police action is necessary, and harsh penalties may deter some offenders. But the durable solution is to make the secret harder to access, less valuable when stolen, easier to trace and riskier to sell.
Until that happens, every sealed packet will carry two questions: the ones printed inside, and the one haunting millions of candidates outside—has somebody already seen it?
(Views are personal; Prof Bodhibarata Nag (Retired) was Professor of Operations Management at IIM Calcutta, and Prof Ranjan Pal is Researcher at Massachusetts Institute of Technology)