Every few months, India relives the same headline in a different city: a trunk of question papers goes missing, a gang of “solvers” is arrested, a Minister announces a re-test. Then the story fades until the next exam cycle brings it back.

The latest instalment came this month, when the National Testing Agency (NTA) invited applications to replace the 600 subject-matter experts, translators and reviewers it removed after the NEET-UG 2024 paper leak, some of whom were allegedly linked to the leak.

It is tempting to read this as a story about a few dishonest individuals. However, it is more honest to read it as a story about a process that gave a handful of people too much unsupervised access. An exam is not one event; it is a relay of custodians, including writers, moderators, printers, transporters, centre staff, evaluators, and every handover is a place the chain can break.

Where the paper is born

The most sensitive phase of any exam is also the least visible: the creation of questions. Experts, moderators, and translators all know something no candidate should know before exam day, which makes them targets for bribery or coercion if their identity or assignment becomes known.

Central Bureau of Investigation’s (CBI) chargesheets show how this phase was compromised in NEET-UG 2024. On the morning of May 5, trunks of the question paper reached Oasis School in Hazaribagh, Jharkhand, and were stored in a control room. The school’s principal, who doubled as the NTA’s local city coordinator and vice-principal, allegedly let in an individual, a civil engineering graduate of NIT Jamshedpur with no official role, who pried the trunks open with tools and photographed the paper. It was solved that same morning by seven MBBS students from AIIMS Patna, RIMS Ranchi, and a Bharatpur medical college, and circulated to candidates who had paid for it. The theft succeeded not because encryption failed, but because one locally appointed individual held two roles – centre custodian and control-room gatekeeper – with no one checking the other.

Before the gates open, and after them

Hall tickets, biometric checks, seat allocation, and the choice of centres and vendors are all decided by people, long before a candidate sits down. Outsourcing an entire exam, including registration, printing, and conduct, to a single private agency concentrates power with little independent oversight, as Uttar Pradesh discovered in February 2024, when it cancelled its Police Constable recruitment exam for roughly 48 lakh candidates competing for over 60,000 posts after the paper leaked before the test began. It blacklisted the vendor, removed the recruitment board’s chairperson, and eventually held a staggered, multi-shift re-test to cut the incentive to leak.

Exam-day security, namely through CCTV, jammers, frisking, Aadhaar checks, and AI-assisted proctoring catches only the crudest forms of cheating, like a smuggled phone or an impersonator. It cannot catch a paper that was never transmitted electronically but walked out in a trunk.

The phase that follows this, such as evaluation, score normalisation across shifts, merit lists, the “challenge window” for disputed answer keys gets even less scrutiny, even though it decides who is actually selected.

The Madhya Pradesh Vyapam scam remains the starkest warning, as admit cards were altered so paid impersonators could sit exams for real candidates, seating was rigged for mass copying, and OMR sheets were left deliberately blank to be filled later to match marks a broker had sold. A State audit found nearly three times as many OMR sheets printed as candidates existed; over 3,000 people were eventually arrested, and a trail of unexplained deaths among the accused led the Supreme Court to hand the case to the CBI. The key lesson being the gap between “exam conducted” and “result declared” is as exploitable as the hall itself.

Building the fix: a chain, not a checkpoint

The reflex after each leak is to bolt on a safeguard at the last point of failure, including more CCTV cameras, a blacklist, and a jammer. What repeated scandals demand instead is an architecture where no single person, institution, or technology controls more than one link, targeting the exact failure that made Hazaribagh possible. One finished paper, known to a small circle, sitting in one place for hours.

The first fix is double-blind content creation. Routing question-writing through independent third-party agencies so the exam authority never learns which individual wrote a given question, and the expert never learns which exam or date it is for – precisely the traceability the NTA now lacks with 600 known experts to replace. Spreading commissioning across several agencies means no single expert ever holds a complete, exam-ready paper that could be leaked or coerced out of them.

The second is a blockchain-secured vault. Instead of finalising and guarding one paper for weeks, validated questions would sit in a repository stocked at several times the volume any exam needs, with the actual paper assembled only at a late, automated stage using parameters like subject and difficulty, adding unpredictability, even to insiders.

Recording every deposit, access, and selection on a permissioned, tamper-evident ledger would let authorities prove who touched the vault and when, and catch interference in real time rather than in a chargesheet months later.

AI’s role should be to validate questions for duplication, difficulty, and syllabus alignment before they enter the vault, flagging metadata anomalies, and surfacing unusual evaluation or normalisation patterns for human review, not issuing final verdicts. Vyapam’s blank OMR sheets are a reminder that automated checks matter most exactly where human discretion is least supervised: after the exam, not only during it.

None of this works as a gadget bolted onto an unchanged process. It requires (i) segregating agencies for content, printing, centre administration and evaluation so no one holds both the vault and its keys, (ii) two-person verification for sensitive actions and (iii) rehearsed, not merely filed, contingency plans. The Public Examinations (Prevention of Unfair Means) Act, 2024, adds legal teeth, up to ten years’ imprisonment and crore-rupee fines for errant providers, and a four-year ban from conducting exams.

Every examination authority, from the NTA to State commissions, should be able to say exactly who could access the vault, the centre list, and the answer key at each stage, and who independently verified that they did not misuse them. Until that question has a confident answer, the next leak is not a matter of if, but where.

(Venkatraman Umakant is Senior Vice President and Chief Business Officer at Meta-i Technologies and HireMee, units of Vee Technologies. Meta-i Technologies has worked with government universities, colleges, PSUs, and government bodies across India, handling sensitive examination processes. Views are personal)