The Ghost on the Screen: Inside the SSC Cyber Scam and the CGO Complex Siege

### By Newsroom Editorial Desk
*Published June 15, 2019 (Archived in the National Examination Integrity Repository)* | Archival Incident INC-2018-NAT-SSC-010

---

On the chilly afternoon of February 21, 2018, a candidate sitting in an examination cubicle on the outskirts of Delhi watched his computer cursor begin to move across the screen on its own.

The candidate was not touching the plastic mouse. His fingers rested flat on the laminate table. Yet, before his eyes, complex multiple-choice questions on coordinate geometry and quantitative aptitude were being highlighted, radio buttons were clicking into place with mechanical precision, and the progress bar of solved answers was turning steadily green. In the minimized tray at the bottom right corner of the Windows interface, barely noticeable to anyone unfamiliar with network utilities, the faint blue-and-white arrow icon of a remote-access program—TeamViewer—was quietly blinking.

Hundreds of miles away, in a residential apartment in western Uttar Pradesh, an anonymous math wizard was staring at a duplicated live display of that very terminal, effortlessly cracking questions while toggling between a spreadsheet of paying clients and an encrypted chat window.

For a decade, the transition from physical paper-and-pen examinations to Computer-Based Tests (CBT) had been heralded by Indian education bureaucrats as the ultimate silver bullet against academic fraud. Digital testing, governments argued, would eradicate printing press leaks, eliminate corrupt bank custodians, and render transit truck hijackings obsolete. Algorithms would randomize questions; encrypted servers would release data packets minutes before login; biometric scanners would prevent impersonators.

What the technocrats had failed to foresee was that corruption would simply adapt. The paper leak had not vanished; it had evolved into a ghost in the machine.

---

1. The Screenshots That Broke the Dam

Between February 17 and February 22, 2018, approximately 1,89,843 candidates who had cleared Tier-I of the Staff Selection Commission Combined Graduate Level (SSC CGL 2017) examination arrived at testing labs across India.

For ordinary Indian youth, the SSC CGL is the gateway to permanent middle-class dignity. It recruits the backbone of the central government bureaucracy: Inspectors of Central Excise and GST, Income Tax Inspectors, Examiners in Customs, Sub-Inspectors in the Central Bureau of Investigation (CBI), and Assistant Section Officers in the Prime Minister’s Office and external ministries. Competition was ferociously unforgiving: over 30 lakh candidates had originally registered for Tier-I to compete for fewer than 8,000 vacant posts.

By February 21, the integrity of Tier-II disintegrated online.

Screenshots showing active test consoles of Paper-I (Quantitative Abilities) began surfacing on private Telegram groups, Facebook pages of coaching teachers, and WhatsApp forums. The images were not fuzzy photos taken from a camera smuggled into an exam hall. They were high-resolution, full-screen desktop captures. Visible in the screenshots were the official watermarks of the private testing vendor, Sify Technologies Ltd., alongside running client windows of commercial remote desktop applications: TeamViewer, Ammyy Admin, and AnyDesk.

Accompanying the screenshots were photographs of handwritten answer keys with question serial numbers that matched the live exam paper set verbatim.

When coaching instructors and student activists noticed that shift-1 Paper-I had been delayed by more than two hours at several centres due to purported "technical server glitches," suspicions hardened into certainty. The delayed starts were not accidental server lags; they were deliberate time buffers engineered by complicit lab administrators to allow external remote connections to be established and stabilized.

---

2. The Official Stonewall

When whistleblowers confronted the Staff Selection Commission, the response was immediate institutional denial.

The SSC headquarters, housed in Block 12 of the vast Central Government Offices (CGO) Complex on Lodhi Road in South Delhi, dismissed the viral images as malicious rumors fabricated by disgruntled candidates and unscrupulous coaching institutes seeking cheap publicity. SSC Chairman Ashim Khurana issued an official statement attributing the disruptions on February 21 to localized technical snags, firmly asserting that the commission’s digital architecture was secure and that no paper leak had occurred.

For hundreds of thousands of aspirants who had spent three, four, or five years living in squalid single rooms in Mukherjee Nagar, Jia Sarai, and Laxmi Nagar, subsisting on cheap dal and water, reading Kiran and RS Aggarwal textbooks sixteen hours a day, the commission's dismissive arrogance felt like a slap in the face.

Every aspirant knew someone who had been approached by exam brokers offering a guaranteed selection in CGL for ₹10 lakh to ₹15 lakh. For years, the whisper had circulated that seats were being sold through "remote lab access." Now, the incontrovertible photographic evidence was on their phone screens, and the government was telling them not to believe their own eyes.

On the night of February 26, 2018, student leaders and popular YouTube coaching educators issued a call: if the commission refused to listen to their digital petitions, they would bring their bodies to its doorstep.

---

3. The Siege of the CGO Complex

At dawn on Tuesday, February 27, 2018, the first wave of approximately 2,000 candidates gathered outside the iron gates of Block 12 at the CGO Complex. They did not block public highways or destroy public property. They sat on the cold concrete pavement, unrolled plastic tarpaulins, and declared an indefinite, peaceful sit-in.

Within forty-eight hours, the gathering exploded into a national phenomenon.

Trains arriving at Old Delhi and New Delhi railway stations brought thousands of young men and women from Bihar, Uttar Pradesh, Rajasthan, Haryana, Madhya Pradesh, and Punjab. The crowd outside the CGO Complex swelled to more than 5,000. In the freezing late-February Delhi nights, students huddled together under thin blankets on the footpath, warming their hands over small tea stalls, chanting slogans, and singing the immortal verses of Ramdhari Singh Dinkar’s poetry: “Singhasan khaali karo ki janta aati hai” (Vacate the throne, for the people arrive).

Unlike traditional political protests led by party flags, the CGO Complex agitation was entirely youth-driven, self-funded, and digital-first. Protesters organized community kitchens (langars), distributed water bottles, and maintained volunteer sanitation squads to keep the government complex clean. When night fell, thousands of students raised their smartphones into the air, creating a sea of white LED torches that illuminated the brutalist facade of the SSC headquarters.

On Twitter and Facebook, the hashtag #SSCScam trended at number one in India and broke into global top charts for days. Protesters held press conferences on the pavement, projecting the leaked screenshots onto white sheets and explaining the forensic proof of IP addresses, TeamViewer session IDs, and registry traces to national television anchors.

Prominent social activists and political leaders from across the spectrum—including Anna Hazare, Arvind Kejriwal, and opposition parliamentarians—visited the pavement to express solidarity. But the students made it clear: they wanted no political appropriation. Their demand was singularly specific: an independent probe by the Central Bureau of Investigation (CBI) into the SSC and its testing vendor Sify Technologies, and an immediate systemic reform of recruitment testing.

---

4. The Government Blinks

Inside Block 12, the pressure became unbearable.

For seven continuous days, the functioning of one of the central government’s key administrative nodes remained paralyzed by the singing, resolute crowd outside. SSC Chairman Ashim Khurana agreed to meet a multi-member student delegation on March 1 and March 3, but the meetings ended in deadlock when the commission offered only an internal inquiry committee. The students flatly rejected an internal probe: "The accused cannot investigate themselves," their representatives declared to roaring applause outside.

On the morning of Monday, March 5, 2018—the seventh day of the open-air siege—a delegation of students was ushered into the residence of Union Home Minister Rajnath Singh. The representatives presented a comprehensive digital dossier: screenshots with embedded timestamps, witness affidavits from exam invigilators, and audio recordings of brokers negotiating ₹15-lakh rates for remote-access lab seats.

Rajnath Singh reviewed the dossier and conceded. Stepping before the television cameras outside his residence, the Home Minister announced that the Central Government had accepted the students’ demands in full and was officially recommending a comprehensive CBI inquiry into the entire SSC CGL Tier-II 2017 examination.

Outside the CGO Complex, an enormous roar erupted. After eight days and nights on the frozen street, the young aspirants wept, embraced one another, and waved the tricolor. The siege was formally suspended, but the battle had only shifted from the streets to the courtrooms.

---

5. The Anatomy of a Cyber-Syndicate: How Sify Was Breached

On March 8, 2018, the CBI registered a Preliminary Enquiry (PE0032018A0002). Within eleven weeks, the agency uncovered sufficient criminal evidence to register a formal Regular Case (RC0032018A0005) on May 22, 2018, under Section 120B (Criminal Conspiracy) and Section 420 (Cheating) of the Indian Penal Code, alongside Section 66D of the Information Technology Act.

The CBI chargesheet and subsequent arrests blew the lid off a sophisticated technological conspiracy that bridged private testing vendors, local cyber-café operators, and inter-state cheating cartels.

The primary vulnerability lay in the architecture of the testing vendor, Sify Technologies Ltd., which had been contracted by the SSC to administer computer-based tests across the country. To conduct exams for nearly two lakh candidates simultaneously, Sify had sub-contracted hundreds of local private computer laboratories, engineering college computer centers, and private IT institutes in Tier-2 and Tier-3 cities.

The CBI investigation identified that the breach occurred through a four-stage mechanism:

1. The Insider Infiltration: The CBI named ten employees and technical representatives of Sify Technologies in the FIR. These ground-level technicians, responsible for configuring the local server nodes and testing terminals at regional exam centres, conspired with external syndicates.
2. The Software Bypass: Under official security protocols, examination terminals were supposed to run in a "locked kiosk" mode—a restricted operating system environment that disables USB ports, blocks the internet, and prevents any application other than the testing software from executing. Complicit Sify technicians and local lab administrators bypassed this lockdown. They secretly installed third-party remote desktop utilities—TeamViewer, Ammyy Admin, or modified Virtual Network Computing (VNC) software—on specific terminal machines before the examination day.
3. The LAN Bridging: To evade proxy firewalls, lab administrators connected the designated candidate computers to secondary local network cards or smuggled 4G mobile dongles directly into the back of CPU towers hidden beneath wooden desks.
4. The "Ghost" Solvers: On the day of the exam, paying candidates were assigned to these pre-configured terminals. When the exam began, external "solvers"—hired graduate toppers, coaching faculties, and competitive exam veterans stationed in hotel rooms in Delhi, Ghaziabad, and Patna—logged into the terminals remotely. The candidate had only to pretend to read the screen, occasionally resting a hand on the mouse, while the remote operator clicked the correct answers in real time.

In June 2019, the CBI scored a major breakthrough by arresting the prime mastermind of the remote-access syndicate, Akshay Kumar Malik, alongside his key logistics handlers Sandeep Mathur and Dharmendra. Malik’s network had charged candidates between ₹10 lakh and ₹15 lakh each, pocketing crores of rupees by turning official exam centers into puppet terminals.

---

6. The Supreme Court Intervention: "The Entire System is Tainted"

While the CBI tracked the cyber syndicates, the legal fate of nearly two lakh candidates hung in the balance before the Supreme Court of India.

A group of aggrieved aspirants, led by petitioner Shantanu Kumar, approached the apex court in Shantanu Kumar & Ors. v. Union of India & Ors. (Writ Petition (Civil) No. 234 of 2018), praying for the total cancellation of the examination and the establishment of a court-monitored oversight mechanism.

On August 31, 2018, a bench comprising Justices S.A. Bobde and L. Nageswara Rao delivered an explosive order. Relying on the CBI’s initial status report, the bench ordered an immediate, nationwide stay on the declaration of results for both the SSC CGL 2017 and the Combined Higher Secondary Level (CHSL) 2017 examinations.

Justice Bobde’s oral observations in open court sent shockwaves through the central administration:

*"It prima facie appears that the entire SSC CGL 2017 examination and CHSL 2017 were tainted... We cannot permit anyone who took advantage of this leak to get into services. The custodian of the examination itself seems to have leaked it. If the whole system is contaminated, how can we separate the tainted from the untainted?"*

For nine agonizing months, the recruitment of an entire batch of central civil personnel remained completely frozen. Aspirants who had spent years studying and who had written the exam with absolute honesty faced the terrifying prospect of having their performance annulled due to the crimes of a corrupt minority.

Recognizing that the core failure lay in flawed examination technology and vendor monopoly, the Supreme Court took an extraordinary institutional step on October 29, 2018: it proposed the constitution of a high-powered committee of eminent technological experts—including Infosys co-founder Nandan Nilekani and supercomputer pioneer Dr. Vijay Bhatkar—to formulate a permanent technological blueprint for national recruitment examinations.

---

7. The Final Judgment: Pragmatism Over Annulment

As the CBI submitted subsequent confidential status reports in early 2019, the empirical picture grew clearer.

The CBI’s forensic analysis of server logs and terminal IP addresses revealed that while the remote-desktop malpractice was egregious and deeply organized, it was concentrated in a discrete cluster of private testing centres in specific states (primarily Delhi-NCR, western UP, and parts of Rajasthan and Haryana). Across hundreds of other university centres and government colleges, no remote connections had breached the local servers.

On May 9, 2019, the Supreme Court vacated its stay on the declaration of results.

The court balanced two competing principles of constitutional justice. On one hand was the purist demand for absolute institutional purity; on the other was the human reality that nearly two lakh young citizens had spent years of their youth preparing, that two full years had already elapsed since the exam was notified, and that an outright cancellation would destroy the lives of tens of thousands of honest candidates whose careers could not endure another cycle of delays.

The court directed that the SSC could proceed with declaring the final merit list and making appointments, provided that any candidate specifically identified in the CBI's chargesheet or forensic audit would be summarily disqualified and prosecuted.

In November 2019—twenty-one months after the first screenshot flickered across social media—the final SSC CGL 2017 merit list was officially published.

---

8. The Legacy of the CGO Complex

The SSC CGL 2017 scam and the 15-day CGO Complex siege forever altered the landscape of Indian public examinations.

It punctured the dangerous technocratic delusion that computer-based testing is inherently immune to corruption. It demonstrated that when examination management is outsourced to private vendors with layers of unvetted sub-contractors, digital testing merely substitutes the physical thief with the network hacker.

The agitation compelled the Staff Selection Commission to introduce far-reaching systemic overhauls:

• The Transition to TCS iON: Sify Technologies was progressively phased out from major national recruitment contracts, with the Tata Consultancy Services (TCS iON) infrastructure brought in to enforce stricter hardware-level sandbox security.
• Network Isolation: Mandating air-gapped local networks with complete physical severance of external internet gateways, disabling all remote-desktop communication protocols.
• Digital Audit Trails: Implementation of automated keystroke and mouse-click trajectory logging to detect suspicious bursts of automated activity.

Above all, the CGO Complex protest remains a monument to student resilience. In an era when public dissent is frequently marginalized, five thousand young job-seekers stood peacefully on the Delhi pavement for fifteen freezing nights, clutching printouts of code and screenshots, and forced the highest offices of the Indian republic to look into the digital abyss.

---

9. Chronological Case Timeline

---

10. Sources & Further Reading

1. Thousands of SSC aspirants protest at CGO Complex

Publication: The Hindu

Date: February 28, 2018

Direct URL: https://www.thehindu.com/news/cities/Delhi/thousands-of-ssc-aspirants-protest-at-cgo-complex/article22879555.ece

1. Why thousands of job-seekers are protesting outside the Staff Selection Commission office in Delhi

Publication: Scroll.in

Date: March 2, 2018

Direct URL: https://scroll.in/article/870634/why-thousands-of-job-seekers-are-protesting-outside-the-staff-selection-commission-office-in-delhi

1. SSC protests: Rajnath Singh agrees to CBI probe, students relieved

Publication: The Indian Express

Date: March 5, 2018

Direct URL: https://indianexpress.com/article/india/ssc-protests-rajnath-singh-agrees-to-cbi-probe-students-relieved-5087342/

1. CBI registers PE into SSC exam paper leak

Publication: Hindustan Times

Date: March 8, 2018

Direct URL: https://www.hindustantimes.com/india-news/cbi-registers-pe-into-ssc-exam-paper-leak/story-8yZ4c4x.html

1. CBI files FIR against 17 including 10 Sify employees in SSC leak

Publication: The Times of India

Date: May 23, 2018

Direct URL: https://timesofindia.indiatimes.com/india/cbi-files-fir-against-17-including-10-sify-employees-in-ssc-leak/articleshow/64295328.cms

1. SC stays declaration of SSC CGL 2017 results, says exam seems tainted

Publication: The Hindu

Date: August 31, 2018

Direct URL: https://www.thehindu.com/news/national/sc-stays-declaration-of-ssc-cgl-2017-results/article24831610.ece

1. SC moots panel of Nandan Nilekani, computer scientist to overhaul SSC

Publication: The Indian Express

Date: October 30, 2018

Direct URL: https://indianexpress.com/article/india/sc-moots-panel-of-nandan-nilekani-computer-scientist-to-overhaul-ssc-5423851/

1. SC vacates stay on SSC CGL 2017 results

Publication: Hindustan Times

Date: May 9, 2019

Direct URL: https://www.hindustantimes.com/india-news/sc-vacates-stay-on-ssc-cgl-2017-results/story-7V8x.html

1. SSC leak: CBI arrests mastermind Akshay Kumar Malik

Publication: Business Standard

Date: June 3, 2019

Direct URL: https://www.business-standard.com/article/pti-stories/ssc-leak-cbi-arrests-mastermind-akshay-kumar-malik-119060300958_1.html

1. Supreme Court of India Record of Proceedings in Shantanu Kumar & Ors. v. Union of India

Forum: Supreme Court of India, Tilak Marg, New Delhi

Case Identifier: Writ Petition (Civil) No. 234 of 2018

Direct URL: https://indiankanoon.org/doc/171549429/