Encryption, burn keys and AI-generated question sets could make India’s biggest exam scandal architecturally impossible
Every few months, India relives the same headline: an exam cancelled, lakhs of candidates told to wait, an investigation that eventually traces the breach to a strongroom clerk, a transport vehicle, or a printing-press insider. That pattern reached its most dramatic culmination yet this July, when 37 days of youth-led protests at Delhi’s Jantar Mantar over the NEET-UG paper leak forced the resignation of Union Education Minister Dharmendra Pradhan, and extracted from the government a formal commitment to consider a sweeping new law, in place of the 2024 anti-leak Act, with stiffer penalties and independent oversight.
It was a rare political victory for the country’s aspirants but a resignation and a promised law, on their own, only reset the clock until the next scandal. A new strategy paper, The Last Leak, prepared for the Ministry of Education, NTA, UPSC, SSC and state boards, argues that India has been treating a structural flaw as a disciplinary one and that no amount of vigilance can secure a system that requires dozens of human hands to physically touch a paper before a single candidate reads it.
The diagnosis is blunt: India’s examination architecture was built for a paper-and-post era, and it still behaves like one. A question paper is drafted by committee, printed at a secure press, sealed, driven or flown across states, stored in a strongroom, and finally handed out at thousands of centres. At every one of those junctures drafting, printing, packing, transport, storage, distribution the paper exists in a form a human being can read, photograph or smuggle out. The Public Examinations (Prevention of Unfair Means) Act, 2024 criminalised leaks and impersonation with real teeth, and a High-Level Committee has since pushed for tighter procedure. But punishment after the fact, the paper argues, protects no candidate who has already lost a fair shot. The only durable fix is to remove the vulnerability itself.
Its proposed answer is a shift from guarding objects to guarding data. Instead of a single, fixed paper moving through a physical chain of custody, the system would generate encrypted, blueprint-equivalent question sets potentially unique to every candidate or small cluster of candidates that exist in readable form only for the minutes before the exam begins. A stolen envelope today is a catastrophic breach. An intercepted encrypted file, without its one-time “burn key,” would be meaningless noise.
The architecture rests on seven interlocking layers. An AI-assisted “question bank factory” generates large volumes of exam items against a human-approved blueprint, screened for duplication, ambiguity and bias before any human expert signs off. An automated assembly engine then builds thousands potentially millions of distinct but provably equivalent papers from that bank, so a leaked paper predicts nothing about what any other candidate will see. Delivery runs on public-key encryption and hardware security modules, with dual-control release ensuring no single official can ever unlock a paper alone. Examination centres would run in locked-down “kiosk mode,” with biometric verification and live anomaly detection. Evaluation would be machine-graded for objective answers and AI-assisted, rubric-based and human-audited for subjective ones. Binding it all together is a zero-trust governance model in which content authority, security authority and operations authority are structurally separated, so no single actor holds end-to-end control over a live exam.
Crucially, the paper doesn’t ask India to build anything unproven. Generative AI item authoring, PKI encryption, hardware security modules, biometric authentication and OCR-based scoring are already deployed individually across Indian government and industry this is a proposal to integrate them into one purpose-built pipeline, phased over five years from a pilot on high-visibility central exams to full national deployment, backed by a proposed National Examination Technology Authority with statutory teeth to certify, audit and blacklist.
Beneath the engineering sits a sharper argument. The paper poses an uncomfortable question to policymakers themselves: would you willingly be treated by a doctor, or fly with a pilot, or trust a bridge designed by someone selected through a process the public no longer believes is fair? If the honest answer is no, then a leak-prone examination system isn’t a minor administrative embarrassment, it’s a standing risk to public safety and institutional competence. And it carries a fiscal argument too: every cancelled exam compounds direct costs, litigation, lost preparation time and eroded public trust costs that dwarf the one-time investment needed to build shared, reusable infrastructure across every central and state examining body.
India built Aadhaar, UPI and DigiLocker inside a single decade and exported that model to the world. The examination system arguably the single most consequential gatekeeper of opportunity for its youth has yet to receive the same ambition. The technology exists. The legal foundation, via the 2024 Act, already exists. What remains, the paper insists, is not capability but will: the decision to treat exam integrity as an engineering problem to be solved in advance, rather than a scandal to be managed after the fact.
About The Author
