The Ghost Cursors of Meerut: Inside the 2017 UP Police Sub-Inspector Online Hacking Scandal, the KVM Hardware Bypass, and the Retest of Half a Million Khaki Aspirants

By The Newsroom Investigation Bureau

Published: August 14, 2017 (Updated & Archival Record: INC-2017-UP-LUCKNOW-050)

*

Inside a dimly lit computer laboratory at an engineering college on the outskirts of Meerut in western Uttar Pradesh, on the afternoon of Monday, July 24, 2017, an invigilator walked slowly down an aisle of humming desktop terminals. On the screen of Terminal No. 47, a candidate sat upright in his plastic chair. The screen displayed the official examination interface of the Uttar Pradesh Police Recruitment and Promotion Board (UPPRPB) for the recruitment of Sub-Inspectors of Police (Daroga).

The candidate's right hand rested lightly on the optical mouse. His eyes moved back and forth across a complex question on the Indian Penal Code.

To the invigilator, and to the closed-circuit television (CCTV) cameras mounted on the ceiling, the scene was entirely mundane—a focused young man working through an objective aptitude test.

Yet if the invigilator had leaned closer and looked at the candidate’s fingers, he would have noticed something chilling: the candidate was not clicking. His fingers were completely still.

On the screen, however, the cursor was flying across the interface with lightning speed. It hovered over Option (C), highlighted the bubble, clicked "Save & Next," navigated through a difficult numerical reasoning puzzle, solved a problem on blood relations, and submitted another correct answer—all in less than six seconds.

The cursor was being piloted by a "ghost."

Two hundred meters away, down a flight of concrete stairs in a windowless basement store-room beneath the college library, two young men with postgraduate degrees in computer science sat before high-resolution monitors. Using a secondary network cable concealed beneath the floor tiles and a hardware Keyboard-Video-Mouse (KVM) splitter, they had mirrored Terminal No. 47. They were reading the questions in real-time, solving them with calculators, and clicking the answers on behalf of the candidate upstairs.

For that silent digital remote service, the candidate’s family had agreed to pay ₹10 lakh in cash.

Within twenty-four hours, the illusion of computerized perfection was shattered. Tactical cyber squads from the Uttar Pradesh Police Special Task Force (UP STF) raided testing centers across Meerut and Agra, catching solver gangs red-handed in live operation.

On Tuesday morning, July 25, Director General of Police (DGP) Sulkhan Singh held an emergency press conference in Lucknow, announcing the immediate, statewide cancellation of the ongoing examination for more than 5,40,000 candidates.

It was the first massive collapse of an online Computer-Based Test (CBT) in the history of Uttar Pradesh—a scandal that proved that when state testing migrates from paper to silicon, corruption does not disappear; it simply upgrades its code.

---

I. The Khaki Dream and the Silicon Promise

In Uttar Pradesh, the post of Sub-Inspector of Police (Civil Police)—colloquially revered as the Daroga—is one of the most powerful executive positions in northern India. A Daroga commands police outposts (chowkis), supervises criminal investigations, registers FIRs, exercises preventive detention powers, and wields immense authority across village and town communities.

In 2016, the Akhilesh Yadav government and subsequently the newly elected Yogi Adityanath administration initiated the recruitment of 3,307 Sub-Inspectors and Platoon Commanders. More than 5,40,000 young graduates across 75 districts applied.

For decades, UP police recruitments had been plagued by allegations of question paper leaks from government presses, mass copying in rural schools, and physical answer sheet manipulation.

Determined to break with this tainted past, the UPPRPB—chaired by senior police commanders—heralded a technological revolution: The Complete Shift to Online Computer-Based Testing (CBT).

The rationale was seductive:

• No physical paper question booklets would ever be printed.
• Questions would be stored in encrypted servers and decrypted on candidate screens seconds before the test began.
• Safe Exam Browsers would lock down candidate terminals, preventing internet browsing, external software execution, or USB device access.
• Candidates would be monitored by biometric thumbprint scanners and high-definition CCTV surveillance.

To execute this massive technological operation across 120+ computer centers, the Board awarded a multi-crore contract to Aptech Limited, a veteran national computer training and testing corporation.

The examination was scheduled as a multi-day testing marathon from July 17 to July 31, 2017, conducting two two-hour shifts daily.

However, the state testing board and the private vendor harbored a catastrophic administrative vulnerability: The Commercial Infrastructure Deficit.

---

II. The Subcontracting Trap: The Private Engineering Labs

Neither the UP government nor Aptech owned hundreds of thousands of computer terminals across the state. To accommodate 5.4 lakh candidates, Aptech was forced to lease computer laboratories from private engineering colleges, polytechnics, and commercial computer coaching institutes across urban hubs like Meerut, Agra, Bareilly, Kanpur, and Lucknow.

Many of these private colleges—particularly in the volatile, highly commercialized educational belt of western Uttar Pradesh—were struggling with declining student enrollments and severe financial stress.

Their management viewed leasing their computer infrastructure for government examinations not as a public duty, but as an opportunity for immense illicit monetization.

Worse, Aptech deployed minimal technical audit personnel. A single outsourced "Center Supervisor" was often responsible for auditing 300 to 500 candidate terminals.

For the regional examination syndicates—led by tech-savvy operators like Neeraj Kumar (alias Pandit), Sanjay Malik, and Vikas Malik—the private engineering college laboratories were sitting ducks.

---

III. The Architecture of the Cyber Hack: Bypassing the Safe Browser

How does a solver gang seize control of a computer terminal running locked-down testing software without triggering immediate automated security alarms?

The syndicate utilized a combination of physical hardware exploits and network routing tricks:

#### 1. The Dual-LAN Card Exploit

Aptech’s testing software operated on a dedicated local server inside the college. The software was programmed to terminate immediately if it detected third-party software (such as TeamViewer, AnyDesk, or remote desktop tools) running in the background.

To circumvent this, the syndicate physically opened the desktop CPU cabinets days before the examination began:

• Technicians installed a secondary Local Area Network (LAN) network interface card (NIC) inside the motherboard.
• The primary LAN card was connected to the official, audited testing network.
• The secondary LAN card was connected via a hidden, unmonitored Ethernet cable that ran beneath false floorboards or out through air conditioning ducts to an adjacent building or basement room.

#### 2. The Hardware KVM Splitter

In centers where network monitoring was slightly stricter, the gang bypassed software entirely by using Hardware KVM (Keyboard-Video-Mouse) splitters:

• The VGA/HDMI video output from the candidate’s computer was split into two signals: one signal went to the candidate’s monitor; the duplicate signal ran via long shielded cables to a bank of monitors in the hidden solver room.
• Simultaneously, a second USB mouse and keyboard located in the solver room were spliced into the candidate's machine using hardware adapters.
• Because the signal was manipulated at the hardware level outside the operating system, the testing software detected zero unauthorized background programs.

#### 3. The Solver Room Operation

In the secret room—often located in a college basement, a rented private room across the boundary wall, or even an air-conditioned delivery van parked outside—hired subject scholars sat before mirrored screens.

The candidate inside the hall had only one job: Act naturally.

Candidates were warned: Keep your hand on the mouse. Move it slightly so the optical sensor sees movement. Look at the screen. Do not laugh. Do not look around.

Outside in the secret room, the solvers read the questions, calculated the answers, and took over the mouse controls, clicking the correct options at an organic, human-like cadence of 45 to 60 seconds per question to avoid triggering statistical anomaly flags on the central server.

The syndicate charged ₹8 lakh to ₹12 lakh per candidate. Dozens of candidates were handled simultaneously in each shift across compromised centers.

---

IV. The Electronic Web: The UP STF Interception

The scheme operated undetected during the first week of testing, from July 17 to July 23. Dozens of paying candidates completed their tests, their server audit logs recording flawless scores between 320 and 360 out of 400.

The conspiracy collapsed because of electronic intelligence gathered by the Uttar Pradesh Police Special Task Force (UP STF).

Under the command of Inspector General of Police (IG) Amitabh Yash and Senior Superintendent of Police (SSP) Abhishek Singh, the STF’s cyber wing had placed several known education mafia brokers under lawful telephone interception following whispers in the coaching hubs of Meerut and Mukherjee Nagar.

On Sunday, July 23, wiretaps captured urgent conversations detailing "live system hacking" at specific test centers:

"The secondary lines are active at the college in Kankerkhera. Send the roll numbers for tomorrow's morning shift. Solvers are ready in the basement."

SSP Abhishek Singh immediately mobilized tactical cyber squads.

On the morning of Monday, July 24, STF commandos and cyber forensic investigators executed simultaneous, unannounced raids on suspect testing centers in Meerut (including an engineering college in Kankerkhera) and Agra.

---

V. July 24: The Raid on the Basement

When STF commandos entered the Kankerkhera testing college during a live examination shift, they did not disrupt the main examination hall.

Guided by network cables running out of the main server room, detectives followed a thick black wire running down an exterior drainage pipe into a subterranean storage room beneath the campus cafeteria.

Detectives kicked open the wooden door.

Inside, the scene was indisputable:

• Four young computer operators and solvers were seated before high-resolution LCD monitors displaying live UP Police Sub-Inspector question papers.
• On the monitors, detectives watched candidate names, roll numbers, and live countdown timers ticking away.
• One of the solvers was actively manipulating a mouse, clicking answers on a General Hindi paper for a candidate seated in Hall B on the second floor!

Simultaneous raids in Agra uncovered identical setups, with computer systems connected to remote access networks routing test data to external laptop terminals.

Police seized:

• Multiple desktop CPUs fitted with unauthorized dual-LAN cards and KVM hardware splitters.
• High-speed routers, wireless modems, and hundreds of meters of concealed network cabling.
• Registers containing the names, roll numbers, and admit cards of over 150 candidates.
• Cash, promissory notes, and blank signed bank cheques totaling crores of rupees.

More than twenty individuals—including solver mastermind Neeraj Kumar, college lab owners Sanjay and Vikas Malik, technical coordinators, and Aptech center supervisors who had accepted bribes to turn a blind eye—were placed under arrest.

---

VI. July 25, 2017: The Emergency Statewide Abort

At 8:00 AM on Tuesday, July 25, 2017, Director General of Police Sulkhan Singh held an emergency press briefing at the Police Headquarters in Lucknow.

Flanked by the Chairman of the UPPRPB and senior STF commanders, DGP Sulkhan Singh announced the immediate, total cancellation of the examination:

"The UP Police will never compromise on merit. While the online system was introduced to bring transparency, our Special Task Force has unmasked a sophisticated cyber hacking ring that compromised terminals in several centers. To ensure that not a single tainted candidate enters the police force, the ongoing Sub-Inspector online recruitment examination is hereby cancelled statewide with immediate effect."

The decision affected more than 5,40,000 candidates. Over 1.5 lakh candidates who had already written the exam during the previous seven days saw their attempts annulled.

The cancellation triggered waves of frustration and anger among honest aspirants who had spent months preparing. Demonstrations erupted outside the UPPRPB headquarters in Lucknow, with students demanding strict action against the private testing vendor.

The UPPRPB acted decisively:

1. Blacklisting Vendor Aptech: The Board blacklisted Aptech Limited from conducting future police recruitment examinations in Uttar Pradesh.

2. Comprehensive Cyber Audit: The Board ordered a forensic cyber audit of all 120+ computer testing centers, blacklisting 22 private colleges whose labs had been compromised.

3. Registration of Criminal Cases: FIRs were registered under Sections 420 (Cheating) and 120-B (Criminal Conspiracy) of the IPC, read with Sections 66 and 66-D of the Information Technology Act.

Testing vendor Aptech and several candidate groups approached the Lucknow Bench of the Allahabad High Court challenging the mass cancellation.

In November 2017, the High Court firmly dismissed all petitions, holding that when the technological infrastructure of an examination is breached through systemic hardware manipulation, the state is fully justified in scrapping the entire process to protect the sanctity of law enforcement recruitment.

---

VII. December 2017: The Fortified Retest

Determined to restore the honor of the UP Police, the UPPRPB scheduled a complete re-examination from December 12 to December 23, 2017.

The security architecture deployed for the December retest was fundamentally overhauled:

• Air-Gapped Standalone Networks: Testing centers were strictly prohibited from connecting candidate terminals to external internet lines. Examination data was delivered on encrypted, standalone local servers that were physically sealed by STF cyber experts.
• Physical Port Blocking & BIOS Locks: Every candidate CPU was physically opened and inspected by police cyber teams before the exam. Secondary expansion slots were glued or sealed, USB ports were disabled in the computer BIOS, and cabinet casings were secured with tamper-evident serial-numbered seals.
• Continuous Keystroke and Click Telemetry: Software algorithms continuously audited candidate click patterns in real-time. Any terminal recording an inhuman click velocity (such as answering five questions in ten seconds) automatically locked the screen and triggered an immediate physical inspection.
• STF Technical Observers: Armed police and STF cyber detectives were stationed inside every single server room across all examination centers.

Over 5.4 lakh candidates appeared for the December retest. The examination concluded smoothly, without a single breach, leak, or technical hack. The results were tabulated transparently, allowing thousands of deserving, honest young men and women from humble agrarian families to don the two stars of a Sub-Inspector.

---

VIII. Institutional Legacy: The Limits of the Machine

The 2017 UP Police Sub-Inspector online hacking scandal was a profound watershed in the history of Indian examination administration. It destroyed the naive bureaucratic myth that simply replacing paper with computers automatically eliminates corruption.

The scandal established crucial lessons that transformed computer-based testing nationwide:

1. The Vulnerability of Outsourced Infrastructure: Testing agencies learned that leasing unvetted private college computer laboratories is a recipe for disaster. Today, premier testing organizations (such as TCS iON) mandate dedicated, company-owned or rigorously audited testing centers with industrial-grade physical security.

2. Hardware-Level Security Audits: Software firewalls are useless if physical hardware (dual-LAN cards or KVM splitters) can be inserted into the back of a machine. Testing standards now mandate sealed, unibody thin-client terminals with zero internal expansion slots.

3. Algorithmic Behavioral Monitoring: Modern CBT systems routinely employ artificial intelligence to track mouse cursor movements, keystroke dynamics, and response times to detect remote control or proxy hacking in real time.

For the 5.4 lakh candidates who endured the emotional rollercoaster of July and December 2017, the ghost cursors of Meerut remain an unforgettable chapter.

It proved that in the unending arms race between integrity and criminal syndicates, the true shield of merit is not merely the silicon of a computer chip, but the unwavering vigilance of law enforcement and the courage of an administration willing to scrap a compromised test to defend the honor of the uniform.

---

Chronological Case Timeline

---

Sources & Further Reading

1. Uttar Pradesh Police Recruitment and Promotion Board (UPPRPB) — Official Notification on the Immediate Cancellation of the Online Computer-Based Written Examination for Sub-Inspector (Civil Police) & Platoon Commander Recruitment 2016, Lucknow, July 25, 2017. https://uppbpb.gov.in

2. Uttar Pradesh Police Special Task Force (UP STF) — Press Note and FIR Records in Case Crime No. 248/2017 (PS Kankerkhera, Meerut) and Case Crime No. 342/2017 (Agra), under IPC 420, 120-B and Sections 66, 66-D Information Technology Act, July 25, 2017. https://uppolice.gov.in

3. High Court of Judicature at Allahabad (Lucknow Bench) — Orders in Service Single No. 17820 of 2017 (Amit Kumar & Ors vs State of UP & Ors), upholding the state government's decision to scrap the hacked online CBT, November 2017. https://allahabadhighcourt.in

4. The Times of India — UP Cancels SI Online Recruitment Exam After STF Busts Hacking Ring: Solvers Operated Mice from Outside Test Halls, Pathikrit Chakraborty, July 26, 2017. https://timesofindia.indiatimes.com/city/lucknow/up-cancels-sub-inspector-recruitment-exam-after-stf-busts-hi-tech-cheating-racket/articleshow/59765214.cms

5. The Indian Express — Hacking Racket Busted in UP Police Online Exam: Dual LAN Cards and KVM Switches Used to Bypass Safe Browser, Manish Sahu, July 26, 2017. https://indianexpress.com/article/cities/lucknow/up-police-si-online-exam-cancelled-after-stf-busts-cheating-racket-in-meerut-4767214/

6. The Hindu — Online Exam for UP Sub-Inspectors Scrapped Over Cyber Fraud: DGP Sulkhan Singh Promises Rigorous Retest, Omar Rashid, July 26, 2017. https://www.thehindu.com/news/national/other-states/up-scraps-si-exam-after-paper-leak/article19363012.ece

7. Hindustan Times — Behind the UP Police CBT Hack: How Private Computer Labs in Meerut Leased Servers to Hacking Masters, Pankaj Shah, July 28, 2017. https://www.hindustantimes.com/lucknow/up-police-si-exam-hack-inside-the-remote-desktop-racket/story-384912.html