Sojan James

[iShowCybersecurity @ishowcybersec]

😭

[Sojan James @sojan_james]

@Sirf786Hai Just a reminder that a loose connection is much more dangerous than a short circuit.The case for using Rust for Automotive software https://t.co/fh3GWyCsgI

[mas.to / @kingslyj]

Dear Journalists,

This is how badly you have failed the future of this country.

Bunch of teenagers are dealing 1-2-3 blows to expose CBSE HQ's incompetence and lies.

DON'T YOU DARE KILL THIS STORY OVER THE WEEKEND.

THIS NEEDS TO BE COVERED EVERY DAY UNTIL RESULTS ARE OUT.

[Sojan James @sojan_james]

@sidhant_sarthak Thank you for doing the work our Media is supposed to be doing! @ndtv @IndiaToday

[Sarthak Sidhant @sidhant_sarthak]

CBSE has systematically rewritten its rulebook to favor Coempt Eduteck.

check out the blog.

[Malay Krishna @Malay4Product]

This is an unbelievable piece of work by Sarthak and something that requires amplification.

Let me explain what he found, in simple terms.

Sarthak is a Class 12 student from the 2025-26 batch, one of the 17 lakh students whose answer sheets went through CBSE's new On-Screen Marking system.

He spent days reading through CBSE's evaluation tenders, scraped all 576 tenders CBSE has issued, and tracked how the rules changed across three versions of the same tender.

The core finding is that the company that won the contract to scan and grade 17 lakh students' answer sheets is Coempt Eduteck.

Coempt used to be called Globarena Technologies. Globarena was the company behind the 2019 Telangana intermediate exam disaster, where software failures led to 3.8 lakh students getting wrong or missing marks, and 23 students died by suicide.

A government committee found systemic failure and negligence. Six months later, Globarena rebranded to Coempt Eduteck.

So a company with that track record won a contract to handle 17 lakh CBSE students. Sarthak's investigation is about how the rules were rewritten to let that happen.

The tender was issued three times.

> First tender, February 2025. It existed, then disappeared from the public GeM portal. Sarthak scraped all 576 CBSE tenders and this one was missing from the archive entirely.

> Second tender, May 2025. Four companies applied including TCS and Coempt. All four failed the technical evaluation. Cancelled.

> Third tender, August 2025. Coempt won. Between the second and third tender, a series of rule changes happened, and every single one made it easier for Coempt to qualify.

Here is what changed, one by one.

01. The old rules disqualified any company with a history of abandoning work, failing to complete contracts, or financial weakness. The new rules deleted this clause entirely. Coempt's Telangana history stopped being a barrier.

02. The old rules disqualified any company that was "blacklisted earlier." The new rules changed this to "currently blacklisted." Because Globarena rebranded after Telangana, removing the word "earlier" effectively erased their past.

03. The rules required Rs 50 crore average turnover over three years. Coempt's exact average came to Rs 50.86 crore. They cleared the bar by less than 1%. Earlier, a smaller company had asked CBSE to lower the bar to Rs 30 crore for fairer competition. CBSE refused. So the bar was kept high enough to block small players, but sat exactly low enough for Coempt to scrape through.

04. Software maturity is measured on the CMMI scale, 1 to 5. The old rules required Level 5. The new rules dropped it to Level 3. Coempt is a Level 3 company.

05. The cooling-off period for engaging retired CBSE officials was cut from two years to one. This makes it easier to use recently retired insiders to influence the process.

06. The old rules required experience with large projects of at least 5 lakh students each. The new rules removed the student count and counted cumulative answer-book volume across small projects instead. Coempt has many small fragmented university contracts. This helped Coempt and hurt TCS.

07. The old rules required bidders to own their own data centre and disaster recovery centre on Indian soil. The new rules allowed third-party MeitY-empanelled cloud hosting. Coempt runs on AWS and Azure. This helped Coempt and hurt TCS, which owns its own data centres. It also means student data is no longer on sovereign, Indian infrastructure.

08. The old rules required the bidder to own or control the complete source code of its software. The new rules deleted this. Coempt's platform runs on Microsoft's proprietary IIS, which they don't own.

09. A last-minute corrigendum, issued right before bid submission, removed CBSE's own power to blacklist the firm if its software failed catastrophically. So even a Telangana-scale failure couldn't get Coempt banned from future government tenders.

10. The penalty structure shifted from punishing mistakes to punishing delays. The old rules fined the vendor for wrong scanning, merged pages, and unscanned books. The new rules dropped those and instead levied Rs 50,000 per day for delays. This incentivises rushed scanning over accurate scanning.

11. The old rules had a hard accuracy threshold, error rate not to exceed 0.5%. The new rules removed this number entirely.

12. The old rules specified proper book and robotics scanners. The new rules just say "sufficient scanners." The definition was vague enough that, as Sarthak notes, the scanning could be done with a phone on a stand.

13. On the security side, the contract required a VAPT (vulnerability and penetration test) certified by CERT-In before go-live, and a restricted beta phase before launch. The system clearly wasn't restricted, because the other researcher, Nisarga, was able to access it and find vulnerabilities four days before go-live. So the mandatory security audit appears to have been bypassed.

These are more than a dozen rule changes, all between the failed tender and the winning tender, all pushing in the same direction, all benefiting the one company with the worst track record in the field.

The security holes Nisarga found last week now have an explanation. The system was built by a vendor that was specifically allowed to skip the security certification, the source code ownership, the data sovereignty, and the quality thresholds the original rules demanded.

Following things need to happen immediately;

1. An immediate CAG audit of the tender process.
2. A parliamentary debate on the topic.
3. An independent investigation into
> Why the first tender vanished?
> Why the disqualification clauses were deleted?
> Why the turnover bar was held exactly where it was?
> Why the security level was dropped?
> Why the blacklisting power was removed at the last moment?

Sarthak, this is genuinely exceptional investigative work. Far better than most journalists with full resources ever manage. Take a bow. :)

[Cdr Abhilash Tomy KC, NM @abhilashtomy]

I think the right word here is credibility.

Why the Air Force has to get involved for paper distribution.

Why IIT has to get involved for investigations.

Why the army has to rebuild a collapsed bridge.

Because these institutions lend credibility.

Rest all are incredible.

[Uday Bhanu Chib @UdayBhanuIYC]

वाक़ई मेरा देश बदल रहा है।

प्रधानमंत्री लाखों रुपए ख़र्च करके कैबिनेट की बैठक बुलाकर मंत्रियों को हाइड्रेटेड रहने की सलाह दे रहे हैं। देश का मीडिया इसे ब्रेकिंग न्यूज़ समझकर चीख चीख कर बता रहा है। 22 लाख NEET के छात्रों को नहीं पता कि कहां जाएं, किस चौखट पर सर पटकें। CBSE के 18 लाख छात्रों को नहीं पता कि इस ज़्यादा पानी पीने की सलाह का क्या करें उनका आँखों का पानी सूख चुका है।

दरी बिछाऊ सांसद-विधायक इन्हीं बच्चों के घरवालों से वोट लेकर इन्हीं बच्चों की ज़िंदगी बर्बाद होते देख रहे हैं और यशस्वी जी के कुशल नेतृत्व में गद्गद हुए जा रहे हैं। ग़ज़ब तमाशा चल रहा है मेरे देश में।

शर्म मगर इनको नहीं आती।

[Sojan James @sojan_james]

@schickling added some documentation https://t.co/7rRrKUPYrU . Would love some ideas on how to take this forward especially wrt drawing the diagrams

[Sojan James @sojan_james]

@schickling Recently published a project as an attempt to try and solve a similar issue. LLMs are quite fantastic at drawing svgs now. https://t.co/iBfQMmbZEy

[Deedy @deedydas]

@cbseindia29 @EduMinOfIndia @dpradhanbjp @sanjayjavin @airnewsalerts @AkashvaniAIR @DDNewslive @PIB_India @PTI_News @PIB_Edu This is painfully embarrassing.

You just asked ChatGPT to “generate an image to show we’re secure?” Do you think everyone is stupid?

[Sojan James @sojan_james]

@schickling Just tried it on some smaller personal projects. Really cool to see the LLM running the validator and fixing issues

[nisarga @ni5arga]

CBSE just deleted this tweet 😭

[Sojan James @sojan_james]

@IndianExpress Incompetence is not a glitch!

[Sojan James @sojan_james]

@cbseindia29 It is better to remain silent and be thought a fool than to speak and remove all doubt.

[Sojan James @sojan_james]

@ni5arga @Squeal Comedy gold!

[nisarga @ni5arga]

hi, I'm the researcher behind the OSM report:

1. If this was test data – how I was able to log in with prod user data completely? I have a screen recording of it and proof of CERT-In acknowledging it.

2. cbse1/cbse2/cbse3/cbse4.onmark.co.in had the same vulnerabilities

i have visual proof of accessing non-test prod data on that URL

[Sayema @_sayema]

Wow! CBSE marking portal is this hackable! What is all this? A joke? Playing with young adults’s future like this. Shame on the system.

[Sandeep Manudhane @sandeep_PT]

How India is failing its young
- - -
CBSE's on-screen-marking (OSM) system is used to check all 12th class marksheets. It is an online system, that must be made 100% secure, and that's CERT-In's job.

Now, a 19 year old Nisarga (@ni5arga) found many security gaps in that OSM portal, and alerted CERT-in. Nothing happened for a long time (during which the portal was open to abuse). Then some corrections. Then site was down!

What kind of security flaws existed? You'll be shocked.

Flaw 1 - Log in as any examiner using a master password leaked in the frontend.
Flaw 2 - Bypass OTP entirely, because validation happens in the browser.
Flaw 3 - Reach any internal page without authenticating at all.
Flaw 4 - Reset any examiner's password without knowing their current one.
Flaw 5 - Act as any user across the API thanks to systemic IDOR, and in doing so edit marks, change examiner details, and tamper with the evaluation process.

It doesn't take a genius to realize the scale of fraud that may potentially have already happened silently at various levels. Imagine the total breakdown of standards and responsibility. And core reason? Zero accountability, Zero punishment, Zero firings, Zero fear, and Full drama.

Now imagine the situation of many other such services.

Enjoy Amrut Kaal.

Read his post -
https://t.co/BNBoo8xidX

[mas.to / @kingslyj]

Ex-@iitmadras Prof. S. SADAGOPAN is a director in the company responsible for CBSE "glitch" that current @iitmadras director Prof. V KAMAKOTI is going to "probe".

Since they have known each other for decades, THERE IS ZERO CONFLICT OF INTEREST.

Absolutely nothing to see here.