Nisarga Adhikari, a 19-year-old cybersecurity researcher from India, found himself this week on the US Justice Department's hall of fame after reporting a significant security vulnerability in one of the department's systems.
According to a report in Gulf News, Adhikari said that while researching Justice Department websites, he discovered a critical security flaw in one of the department's law enforcement systems. He submitted his findings through official channels, and after review, the department confirmed the vulnerability was valid. According to Adhikari, the flaw was fixed within about a week.
Following his report, his name appeared on the Justice Department's Vulnerability Disclosure Program hall of fame page, which recognizes security researchers who identify problems in government systems and report them responsibly. Adhikari noted he received no payment for the discovery.
US military system also in his sights
This is not the first time the young researcher has reported a security issue in an American government system. According to him, he also identified a vulnerability related to a system belonging to the US Defense Department or the US military, reported it to the appropriate authorities, and the flaw was confirmed as valid. As of the time of the report, work on fixing that vulnerability was still ongoing. He also received a letter of thanks through the HackerOne platform, which many organizations use to receive security reports from researchers.
The technical details of the vulnerabilities were not published, and the exact systems affected were not disclosed, apparently to prevent their exploitation by malicious actors.
The breach that made him a household name in India
Adhikari had already gained publicity earlier this year after exposing vulnerabilities in the On-Screen Marking system of the CBSE, India's Central Board of Secondary Education, which is used for handling exam data and grades.
According to him, he reported the problems to CERT-In, India's national Computer Emergency Response Team for cyber incidents, back in February, and only in May published information about the findings. The affair raised questions about how sensitive information related to the examination system is stored and secured.
The exposure also helped advance his professional career. Adhikari subsequently joined the C3iHub at IIT Kanpur, a center specializing in cybersecurity fields, where he works in open-source intelligence, OSINT, and threat intelligence.
"Ranking is not ability"
Beyond his work in cybersecurity, Adhikari has also drawn attention for criticism he voiced about India's education system. According to him, excessive reliance on grades, rankings and exams can lead to missing young people with exceptional practical technological abilities.
He clarified that he is not opposed to the existence of exams themselves, but in his view, achievements in exams do not necessarily indicate the ability to build a computer system, understand it, or defend it against attacks.
