Answer sharing on timed quizzes: the leak is usually a person, not a bot
The questions from last week's timed quiz are on a sharing site, word for word, in order. The instinct is to hunt for the bot that scraped them. Check the attempt logs first. One real account, taking the full time allowed, can carry out every question it saw, no automation required.
Two different leaks that look identical afterwards
Automated harvesting exists: accounts created to start attempts, extract content, and abandon them, at a pace and volume no candidate matches. Human leaking is quieter. A participant screenshots or transcribes during a genuine attempt, posts the set afterwards, and the log shows a normal session, normal timing, a plausible score. The International Center for Academic Integrity frames this as a conduct problem first, which is why purely technical responses keep missing it.
The distinction decides the remedy. Harvesting responds to gate controls: attempt limits, account history requirements, pace analysis. Human leaking responds to making any single leaked set worth less: larger question banks, randomised selection and order, and per candidate variants, so the posted set helps the next person far less.
Question banks are arithmetic, not bureaucracy
If a quiz draws 20 questions from a bank of 24, every candidate sees nearly the same quiz and one leak compromises the whole instrument. Draw 20 from 200, randomised per candidate with shuffled options, and a leaked set covers a fraction of what the next candidate faces, with the order scrambled. The bank is the control. Everything else is decoration around that ratio.
Banks decay, so treat the ratio as a maintained number. Retire questions that appear on sharing sites, log which items each cohort saw, and add new items at a rate that keeps the bank ahead of the leaks you know about. Turnitin and similar integrity vendors make the same operational point in their guidance: assessment design, varied and refreshed items, carries more weight than surveillance layered on a static quiz.
Timing and attempt data still earn their place
Per question timing separates the cases you do have. A harvester moves at reading speed or faster with no deliberation pattern. A strong candidate is fast on easy items and slow on hard ones. A participant copying questions often shows a distinctive rhythm too: long pauses on ordinary items, consistent with transcription, that vanish on a second attempt, alongside a score jump the first attempt's pace did not predict.
None of that is proof on its own, and it should never be presented to an accused user as proof. It is triage: which attempts to review, which question sets to retire, where the leak most likely sits. The conduct process, with a human reading the whole record, remains the decision maker.
What to tell participants, in advance, in plain words
State the rules before the attempt, in the interface, not in a PDF nobody opens: questions are drawn per candidate from a bank, copying or sharing items ends the attempt and triggers review, and attempts are logged per question. Clarity deters the casual leak, which is most of them, and it makes later enforcement a matter of applying a published rule rather than inventing one mid dispute.
Then make the honest path the easy one. Practice quizzes with real sample questions give anxious participants a legitimate way to prepare, which removes the stated reason many sharing sites exist. Integrity controls work best when they are not the only door in the building.
Keep reading: Second devices in remote exams: designing for the phone you cannot see, Lockdown browsers stop the exam device, and nothing else in the room.
Frequently asked questions
How can I tell if questions were harvested by a bot or leaked by a person?
Harvesting leaves machine patterns: many attempts started and abandoned, extraction pace timing, and accounts with no genuine history. A human leak usually sits inside one normal looking attempt, sometimes with transcription pauses and a second attempt score jump. Timing and attempt logs triage the cases; they do not prove either one alone.
Why does a bigger question bank help so much?
Because it changes what a leak is worth. Drawing 20 questions from 24 means one leaked set is nearly the whole quiz. Drawing 20 from 200, randomised per candidate with shuffled options, means the leaked set covers a small, scrambled fraction of the next attempt. The ratio between bank and quiz length is the control.
Should leaked questions be reused if they were only posted once?
Retire them. Once an item and its answer are public, every future use measures whether the candidate found the post, not whether they know the material. Log which cohorts saw the retired items, replace them, and keep the bank growing faster than the known leaks.
Do participants need to be told attempts are logged per question?
Yes, in the quiz interface before the attempt starts, along with the rules on copying and sharing and the fact that questions are drawn per candidate. Advance clarity deters casual leaking and makes any later review a matter of applying a stated rule, which is fairer and easier to defend.