CBSE ‘hack’, IIT gig and US recognition: Nisarga Adhikary’s incredible year at 19 - The Indian Express

Tuesday, September 22. It was almost an hour past midnight. Nisarga Adhikary was sitting in the Starbucks café at IIT Kanpur. An email notification flashed across his screen. It was a message from the US Department of Justice, acknowledging his work in finding and reporting a security flaw within their systems.

“I was having my second cup of coffee when I received the email,” he recalls.

Nisarga Adhikary is only 19 years old. On paper, this recognition stood as one of the most prestigious accolades he could have ever imagined. Yet, surprisingly, he remained unfazed, showing no trace of excitement.

“I love to break stuff,” Nisarga says. “Hacking things is a part of me trying to understand how things work.”

The security flaw was not something he had been assigned to find. There was no college project or professional brief behind it. He was simply trying to understand how the system worked.

Still, the recognition was the latest turn in a remarkable five months for this 19-year-old. In February, he first drew public attention for identifying alleged security flaws in the Central Board of Secondary Education’s digital examination system and has since landed a job at IIT Kanpur’s cybersecurity hub.

Nisarga is from Siliguri, West Bengal. His parents, both IAS officers, wanted him to take the Joint Entrance Examination (JEE) and he was preparing through a FIITJEE South Delhi programme.

Then, his work began attracting attention. His parents were worried, Nisarga says, before they gradually became more accepting of it.

Earlier this year, Nisarga began examining publicly accessible parts of CBSE’s On-Screen Marking (OSM) system, the digital platform used to evaluate scanned answer sheets.

He claims he found several weaknesses in the system. One, its One-Time Password (OTP) checks could be “bypassed”, allowing an unauthorised user to access examiner accounts without receiving an actual code.

Two, “poorly configured” storage on Amazon Web Services (AWS) allegedly gave him access to about 1.8 million scanned answer sheets.

Nisarga also demonstrated the account-takeover risk by accessing the account of a physics teacher on the live CBSE system. Asked about the ethics of accessing a real person’s account, he says he’d blurred the teacher’s details and used the access only to demonstrate the vulnerability.

He reported his findings to the Indian Computer Emergency Response Team (CERT-In), the government agency that coordinates responses to cybersecurity incidents, in February.

By May, he had published a detailed account of what he had found. He had also come on television to describe and explain his findings.

His revelations quickly attracted attention as students, teachers, and parents were already raising concerns about glitches, evaluation inconsistencies, and operational problems linked to the OSM rollout.

The board initially denied that its OSM portal had been compromised, but later acknowledged that cybersecurity issues had been flagged in the public domain.

Subsequently, on May 31, CBSE stated that it had been “closely monitoring the vulnerabilities in the OnMark portal” and that a team of cybersecurity professionals drawn from “various arms of the government as well as the IITs” had been deployed over the last few days to fortify the system.

Nisarga’s findings soon became part of a wider political debate. Leader of Opposition Rahul Gandhi was among those who publicly praised him for raising questions about the CBSE system.

Nisarga also participated in protests organised by the Cockroach Janta Party (CJP) over the NEET-UG paper leak and posted a photograph with CJP convenor Abhijeet Dipke.

He says he was invited to meet Rahul Gandhi alongside Sarthak Sidhant, who had separately flagged alleged irregularities in CBSE’s tendering process, but chose not to go.

Sarthak, an 18-year-old student from Jharkhand, had known Nisarga before they became publicly associated with the CBSE controversy. He says they met around three years ago on Reddit and credits Nisarga with “supporting him during CBSE times.”

Kshitij Kapoor, a software engineer at AI research lab Nous Research, says he has known Nisarga since he was 14.

He met him through Capture The Flag (CTF), competitive cybersecurity exercises where players find hidden text strings called “flags” inside vulnerable systems or programmes.

“He’s always had a knack for poking holes in systems. The curiosity hasn’t changed much but the scale definitely has,’’ Kshitij says. “I was happy to see him get recognition. Having known him since so early on, it felt very personal to me in a way”.

Nisarga describes himself as “a nerd all his life”. He says he spends almost all his waking hours glued to a screen, claiming that he has no non-technical friends.

Outside cybersecurity, he reads young-adult fiction, like The Fault in Our Stars. He is also a big fan of Japanese animation such as Tokyo Ghoul. He reads books about activism and says he is interested in activism for the rights of neurodivergent people, queer rights and internet freedom.

His views on technology and society are shaped, he says, by what he calls “neoliberal technocratic biases”. He describes himself as “socially very left and economically right”.

He looks up to the likes of Sam Altman and Mark Zuckerberg, the heads of the artificial intelligence company OpenAI and technology company Meta, respectively, for their drive to build things.

Around the same time, Nisarga’s views on technology and government brought him to the attention of IIT Kanpur Director Manindra Agrawal.

When the Centre moved to restrict Telegram before the NEET-UG re-exam, Nisarga criticised the decision, arguing that authorities had failed to prevent paper leaks while trying to restrict a messaging platform that could still be accessed through proxies.

IIT Kanpur director Manindra Agrawal responded to his comments, saying he would need to sit Nisarga down and explain.

He had already reached out to the teenager earlier, and the interaction eventually led to Nisarga joining C3iHub, IIT Kanpur’s cybersecurity-focused technology innovation hub, as an Open-Source Intelligence (OSINT) and Threat Intelligence Engineer. His job involves identifying and understanding potential security threats.

Nisarga, however, remains sceptical of an educational system that measures people through examinations and credentials alone. “You can have a PhD and still produce low quality research and do worse than your peers with no degree. It depends on talent and curiosity,” he says.

For now, he is settling into life at IIT Kanpur. He says the transition has not been difficult, although he describes Kanpur as “a bit bad” compared with places he has lived before.

Eventually, he wants to work across technology, defence and artificial intelligence and may eventually return to formal education, possibly in the US or another country.

For someone whose curiosity began with figuring out how computer systems work, the question now is what he will choose to explore next.

But when that email from the US Department of Justice arrived, Nisarga did not see it as a defining moment for him.

“I was unamused. It was like any other normal Hall of Fame mention for me,” he says.

“I think I work a lot and put all my time into research because that’s the only coping mechanism I have.”

Why is he unmoved by this latest recognition?

“Alex Karp, CEO of Palantir once said that one cannot have a great social life at age 20 and achieve extraordinary career success at the same time,’’ he says. “It might sound toxic but he’s kind of right, I feel”.