Criminal case filed against company, owner for 'deleting' MPSC exam data

[Erica Absetz <erica () riskbasedsecurity com>]

http://timesofindia.indiatimes.com/city/mumbai/criminal-case-filed-against-company-owner-for-deleting-mpsc-exam-data/articleshow/20995786.cms

MUMBAI: A day after the Maharashtra Public Service Commission(MPSC)
filed a complaint alleging conspiracy to postpone the state civil
services examination and defame the commission with the loss of data
of 3.22 lakh candidates from the MPSC server in April, the cyber crime
investigating cell, on Tuesday, registered a first information report
against Vast India Pvt Ltd (VIPL) and its owner, VivekChandel, for
criminal breach of trust and violation of the Information Technology
Act.

"We have registered a criminal case against VIPL and Chandel. On
Tuesday, our officials visited the Malad office of VIPL to secure more
information. We will soon summon him to record his statement," Niket
Kaushik, additional commissioner of police (crime), told TOI.

In a nine-page complaint, the MPSC alleged it was a conspiracy to
postpone the state civil services examination. "A few days ago, we
were told that the data of 3.22 lakh candidates, who were to appear
for the examination, was lost due to a computer virus. However, when
we conducted our internal probe, we found that there was a conspiracy
to postpone the exam and that there was no virus and the information
given to MPSC was misleading," a senior MPSC official said.

The official alleged that there was blatant violation of the agreement
between MPSC and VIPL. As per the agreement, it was the responsibility
of VIPL to maintain a disaster recovery site, so that in the event of
a snag, data was not lost.

The official added that as VIPL failed to take adequate precautions,
MPSC had no option but to postpone the examination.

"It was an embarrassing situation for the MPSC.

Despite no fault of the MPSC, it had to postpone the examination. The
entire episode had an adverse impact on the credibility of the MPSC,"
the official added.

According to a senior official, an offence under section 409 (criminal
breach of trust) of the IPC and sections 43 (penalty and compensation
for damage to the computers and computer system) and 66 (if any
person, dishonestly or fraudulently damages the computer or the
computer system he shall be punishable with imprisonment for a term
which may extend up to three years or fine up to Rs 5 lakh or both) of
the Information Technology Act, was lodged.Exam drama

The MPSC was scheduled to conduct a preliminary exam for the state
civil services on April 7 at 935 centres in 35 districts for 265
vacancies for grade I and II officers. When some applicants couldn't
get their hall tickets by March 28, they inquired with the commission,
only to find that all their data was missing. The government later
postponed the exam to May 18.

Initially, the data loss was blamed on a possible computer virus. But
a high-level internal probe by MPSC and the state information
technology (IT) department has concluded that there was a criminal
breach of trust by Andheri firm Vast India Pvt Ltd, which was
entrusted the task of online registration

for the exam was entrusted to VIPL. The MPSC had entered into an
agreement with VIPL to develop a software, an application service
provider and an online application system. In the event of a crisis,
it was the VIPL's responsibility to brief MPSC on the situation and
solutions.
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss-discuss

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges.