Delhi University’s dean of examinations has dismissed a massive privacy breach on the varsity website brought to light by students, calling it “a fuss over nothing”.
On Thursday, a day before the university was to release its revised exam date sheet, students from the Campus Law Centre (CLC) found that the issuance of their online admit card had made their private details easily accessible online. This is the first time admit cards have been issued online, because of the coronavirus pandemic that has closed down educational institutions and many other offices.
Vivek Prasad, a final year LLB student at CLC, said he woke up to messages on various student WhatsApp groups, where the university notice with a link to download the admit card had been shared.
But when he went online to download his card, Prasad realised the process didn’t require any specific OTP or password, just the college code.
“With the college code, I could access the admit cards of all my batchmates (at the Campus Law Centre), all 800 of them,” he told HuffPost India.
Others had the same experience.
“In the morning when I proceeded to download my admit card, I found it odd to see my address on it,” said Somya Pant, who found herself having a similar conversation about the privacy breach on a WhatsApp group with friends.
Prasad estimates that 2,500 students across the Campus Law Centre, Law Centre 1 and Law Centre 2 may have been affected. HuffPost India could not independently confirm this number.
Prasad’s classmate Ribhav Pande said that since information is often disseminated through the class representatives on various WhatsApp groups, the ‘college code’ which was common to the whole college was widely shared.
Once accessed, the admit card reveals a student’s home address, phone number and email ID, among other details.
The Delhi-based Software Freedom Law Centre (SFLC) said the breach left thousands of university students exposed and that they would raise the issue to the Ministry of Human Resource and Development.
“Any harasser or stalker can gain access to their personal information and misuse it. To enhance privacy, DU may consider introducing the option of one-step or two-step verification i.e. OTPs on mobiles or emails and different passwords for students. It is also a possibility that this data could be put on sale on dark web and may be misused,” a spokesperson for SFLC told HuffPost India over email.
HuffPost India accessed the portal and found that anybody could download a student’s admit card which has their personal details using their name, roll number and the college code.
Both Pant and Prasad pointed out that the roll numbers and names of students could easily be found from the marksheet of the latest semester, which was publicly available on the DU website.
This was in contrast to the admit card portal for the post-graduate students of the university, which required an additional admit card key.
Several students told HuffPost India that their immediate fear was how the public availability of their personal details made them vulnerable.
“This level of easy access can lead a potential stalker to find out addresses and phone numbers of any student they would like to, tamper with their subjects and other examination related details, or depending on what mechanism is to be used for the highly controversial Online Book Exam to be held, might even lead to concerns regarding the answer scripts to be uploaded,” said Pant, who pointed out that female students were particularly open to harassment.
As students tweeted online and wrote to the university, the portal had blocked issuance of admit cards by Thursday evening and said it was in the process of setting up an OTP system.
However, in his commentsto theHindustan Times, Vinay Gupta, dean of examinations, did not see the privacy breach as a vital concern and seemed to rely on the “moral responsibility” of individuals. “We cannot distribute the admit card in person this year, given the circumstances, and we had to switch to the online mode. We do not expect our students to search for the roll numbers of other students and pull out their personal details. Students should have a moral responsibility to not indulge in something like that, considering the prevailing situation. Some students are trying to create a fuss over nothing,”
Gupta later told HT that the administration has fixed the issue for law students. “No other college student should face any such issue since their details are not available online,” he said.
Rajib Ray, president of the Delhi University Teachers’ Association, said this was the first time online cards have been issued as these are usually printed and given to students in person.
“This year is a special year. They are trying to do many things and failing at it,” he told HuffPost India.
Ray said the university needed to take immediate action and hoped no harm had been done already.
He said this was likely the first such incident at the university because it’s the first time the admit card has been issued online.
HT reported that the NSUI and a group of DU teachers, who are also members of the Indian National Teachers’ Congress, had raised the issue with vice-chancellor Yogesh Tyagi on Thursday. The Hindu reported that NSUI had called for exams to be cancelled, citing the breach as the latest in a series of missteps by the university.
Exam woes pile on
The final year students at DU have already had a rollercoaster month in June as they waited for the university to provide details on when, how and where their exams would be held.
Students felt trapped in a limbo after a UGC panel last month recommended scrapping of exams, which several universities have differing stands on.
Delhi University had last week postponed the exams, which were scheduled to begin from July 1, by ten days. This resulted in recalling of the exam date sheet, with a fresh one to be issued on Friday, July 3.
Students’ and teachers’ unions have also been petitioning the university to cancel the open books exams. DUTA had on June 28 called the University’s decision to postpone July exams thoughtless and irresponsible. The association called the open book exam process “highly discriminatory towards those who have not had equal access” and said it would “put undue strain on students and households in these difficult times”.
Prasad told HuffPost India that the online exams have been a cause for concern because students had not been able to access study material. “I was fortunate to get a physical copy, but many other classmates have had to refer to it on their phones.”
Pande said Thursday’s privacy breach only highlighted how much the university had mismanaged the exam process.
“It’s an open book exam without adequate access to ‘books’. The Case Materials our college provides are only available online (they don’t give it even if you go to the campus), and that’s all the material you have unless you are lucky to have and afford online delivering of books,” he said.
The Delhi High Court this week slammed DU for “withholding material information” on postponement of the exams and issued notices to the university and its dean of exams. The court said it was of the opinion that contempt proceedings ought to be initiated against the university for ‘misleading’ the court.