Catch ’Em Young

IIT Kanpur’s made a smart move by hiring Nisarga

Nisarga Adhikary, the 19-year-old who became a household name last month, after exposing flaws in CBSE’s on-screen marking system, has made it to IIT Kanpur. Not as a student, but as an employee. He’ll work as open-source intelligence and threat intelligence engineer, for which he’s already demonstrated capability. That’s a very smart move by IIT. By not letting Nisarga’s age and brief CV – he passed Class 12 this year – stand in the way, it’s shown a startup’s agility. And since Nisarga himself doesn’t set store by degrees – “You don’t need a degree to be an engineer” – employer and employee are on the same page.

Doubters might wonder whether 19 isn’t too young for a full-time job in a critical role. They only have to look at David Dworken, now a security engineer at Anthropic, who became famous as an 18-year-old, back in 2016. David participated in Pentagon’s Bug Bounty programme while appearing for his high school exams, and revealed some vulnerabilities in its public websites. There’s also Marcus Hutchins, who found a ‘kill switch’ for WannaCry ransomware that spread to over 100 countries in 2017, and cost $4bn-$8bn globally. Marcus had a dark past. As a teen, he had built malware named Kronos and UPAS Kit, for which he was arrested in US. But his ethical turn as a ‘white hat’ saved the world a lot of trouble.

So, IIT Kanpur’s confidence in Nisarga is well-founded. And Indian institutions should tap such young talent more often. In fact, Pentagon-style bounty programmes can save them the kind of embarrassment CBSE went through. They’re also cheap. Where a US Dept of Defence contractor charged $5mn over three years, and found only 10 vulnerabilities, bug hunters like David revealed more than 130 in days, for a total bounty payment of $75,000.