After the Indian parliament passed a strict law against examination material leaks, which mandates up to ten years in prison for violators, a student from Dubai who discovered weaknesses in the country's exam portals stated that a single legislative act is insufficient.
Calls for Enhanced Protection
He appealed to the government, demanding the implementation of more robust cybersecurity measures and regular vulnerability testing to prevent future breaches. Rilen Anil, a 12th-grade student at the private school JSS, noted that the examination portals contain highly confidential information about students and must be protected by strong security measures.
In June, he drew public attention by discovering serious security issues in two of India's most sensitive examination systems within just a few hours. The young cybersecurity enthusiast emphasized that his work goes beyond technical fixes—it concerns protecting the future of millions of students whose lives depend on these crucial exams.
Recommendations for System Testing
He recommended conducting regular vulnerability assessments and penetration testing (VAPT) on all examination portals, especially before major examination periods and after significant system updates. Anil expressed deep regret over the human consequences of exam-related problems, as they can determine a student's fate. He concluded that cybersecurity is not just about protecting systems and data, but also about protecting people who rely on these systems.
The NEET Scandal
Rilen's discovery came amid a wave of controversy engulfing India's education system. In May, a major leak of the NEET exam sample occurred, which was taken by over 2.2 million candidates, with the leak containing about 120 matching questions. This scandal triggered weeks of student-led protests, and activists from the Cockroach Janta Party demanded accountability for those responsible. According to activists, more than 20 people died by suicide due to the exam scandal this year.
Discontent eventually forced Education Minister Dharmendra Pradhan to resign on July 25, after which senior politician Pralad Joshi took over the post. On Wednesday, the Lok Sabha of India passed the anti-leak law, which introduces stricter penalties, including up to 10 years in prison and fines up to 10 crore rupees (approximately 3 million dirhams) for individuals and organizations involved in organized leaks.
Responsible Disclosure
The teenager, a member of the globally ranked cybersecurity team Capture The Flag g4mra, first reported his findings to the Indian Computer Emergency Response Team (CERT-In) before making them public. Authorities responded promptly. Rilen expressed satisfaction that the authorities adopted his findings and were able to resolve the issues before an attacker could discover them, noting that responsible disclosure can have a real impact on protecting thousands of students.
He received personal thanks from NTA officials. IIT Roorkee, which manages the JEE portal, publicly acknowledged the issue and stated that it had been 'immediately rectified.' Rilen stressed that vulnerabilities 'should be reported responsibly, thoroughly, and without creating unnecessary panic.' The Dubai student, who has been interested in computer systems since the 8th grade and started learning Python at the age of seven, hopes to build a career in cybersecurity. He currently works as a junior cybersecurity engineer at the IIT Kanpur C3iHub technology innovation center.
