Online examinations can generate large amounts of digital information. Universities may review login records, IP addresses, timestamps, platform activity, submission times and other technical data when investigating suspected academic misconduct.
These records can be useful, but technical information does not always explain by itself what a student actually did. A fast submission, changing IP address or unusual login pattern may justify further investigation without automatically proving cheating.
Students facing a serious online-examination allegation can review the university misconduct support available through Aldwych Legal. Aldwych Legal is a Central London-based legal consultancy supporting students and other clients across the UK with academic misconduct, disciplinary and appeal matters.
Identify the Allegation
The first question should be what misconduct the university actually says occurred.
An online examination case might concern:
- unauthorised collaboration;
- access to questions in advance;
- prohibited communication;
- use of another person;
- contract cheating;
- use of restricted resources; or
- suspicious account activity.
For providers in England and Wales, Office of the Independent Adjudicator for Higher Education guidance says students should understand the allegation and have a fair opportunity to respond to the supporting evidence.
A general statement that “suspicious technical activity was identified” may not be enough. Students should understand what conduct is alleged and how the digital information is said to support that conclusion.
Request the Evidence
Students should ask to see the evidence being relied upon before preparing a formal response.
Relevant material may include:
- login records;
- IP-address information;
- examination timestamps;
- platform logs;
- communication records;
- proctoring reports; and
- technical analysis.
Students should check whether the university has provided the raw information, a summary prepared by staff or both.
If a technical conclusion has been made, it is useful to understand who interpreted the data and what they believe it demonstrates.
Data Needs Context
Digital records can look precise, but the conclusion drawn from them may still require interpretation.
For example, several IP addresses appearing during an examination may indicate changing network connections. The significance depends on the circumstances and other available evidence.
Likewise, a very short completion time may appear unusual but can have different explanations. A student may have prepared permitted material in advance or worked quickly because of the format of the assessment.
Technical evidence should therefore be considered together with the examination rules, the student’s explanation and any other relevant records.
IP Address Evidence
IP-address evidence deserves particular care.
A university may argue that unusual IP activity suggests access by another person or use of multiple devices. The student should ask exactly what the data establishes and what inference is being made from it.
Aldwych Legal’s online examination misconduct case study describes a dispute in which multiple IP addresses were interpreted as evidence of third-party interference during online examinations. According to the published case, the student explained that a mobile hotspot and changing network connections caused the IP changes, and technical evidence was used during the appeal.
Another student’s circumstances may be completely different, so that case should not be treated as predicting an outcome. Its relevance is that changing network information can require technical explanation rather than assumption.
OIA Casework
Independent OIA casework also shows why technical evidence must be understood properly.
In one case involving suspected contract cheating in an open-book examination, the disciplinary panel received confusing and misleading information about IP addresses used to post a question online, access an answer and upload examination responses.
The OIA found the complaint Partly Justified because it could not be confident that the panel’s conclusion was fair when important technical evidence was unclear and some evidence had not been put properly to the student.
The case demonstrates that even where digital records raise legitimate concerns, decision-makers should understand what the evidence actually proves.
Fast Completion Times
Completion time can also trigger an investigation.
OIA casework has considered an online assessment completed in less than four minutes. Other students who completed the assessment quickly had admitted receiving advance information about the questions through a WhatsApp group.
The student under investigation gave a different explanation: academic staff had allowed students to prepare draft material and paste text into answer boxes, and the student said they had prepared answers to likely questions beforehand.
The OIA found the complaint justified after identifying problems with how that explanation and the overall process had been handled.
This does not mean rapid completion can never support a misconduct concern. It means timing should be considered alongside the assessment design and other evidence.
Preserve Digital Records
Students should retain their own evidence as soon as an investigation begins.
Useful records may include:
- emails reporting technical difficulties;
- screenshots taken during the examination;
- messages sent to university staff;
- permitted notes or drafts;
- examination instructions;
- device records; and
- evidence of network problems.
A short chronology may also help show when the student logged in, whether any connection problem occurred and when the assessment was submitted.
Original evidence should be preserved rather than altered after the allegation has been raised.
Separate Facts and Inferences
A useful response distinguishes between what the technical evidence directly shows and what the university is inferring from it.
For example:
Fact: the account connected from multiple IP addresses.
Inference: multiple people must therefore have accessed the account.
Those are not necessarily the same statement.
The student should address the inference directly and provide any genuine explanation or evidence available.
The same approach can be used with completion times, device activity, login locations and other digital records.
Burden of Proof
The burden of establishing academic misconduct remains with the higher-education provider.
OIA guidance says the provider must establish that the student did what they are accused of doing; the student should not simply be required to disprove the allegation.
Students can still strengthen their response by providing supporting evidence. The fact that the burden rests with the university does not mean the student should ignore material that can explain an unusual technical pattern.
A clear account supported by original records can help the panel understand the evidence in context.
Prepare for the Hearing
Before an investigative meeting or disciplinary hearing, students should review the examination rules and technical evidence carefully.
They should be prepared to explain:
- how they connected to the examination;
- what device or network they used;
- whether any technical problem occurred;
- what resources were permitted;
- whether they communicated with anyone; and
- how the assessment was completed.
If a technical question is unclear, students should not invent an explanation. They can ask for clarification or state when they do not understand a particular technical point.
If new evidence appears for the first time during the hearing, the student should make clear that they have not previously had an opportunity to review it.
Check the Decision
The written outcome should explain more than that the technical evidence was “suspicious”.
Students should be able to understand what information the panel accepted, what inference it drew and why the student’s explanation was rejected.
Where the decision depends heavily on technical material, clear reasoning becomes particularly important.
Students should ask:
- Was the data described accurately?
- Was the student’s explanation considered?
- Was contradictory evidence addressed?
- Did the panel rely on information not previously disclosed?
- Does the decision explain why misconduct was established?
These questions can help identify whether there may be a genuine appeal issue.
Appeal Issues
Where an adverse decision involves disputed technical evidence, an appeal should focus on the permitted grounds in the university’s regulations.
Possible concerns may include procedural irregularity, misunderstanding of important evidence, relevant new material or an unreasonable conclusion.
Aldwych Legal’s university disciplinary appeal case study provides another example involving disputed IP-address evidence, procedural fairness, mitigation and an appeal against a serious university misconduct decision.
Aldwych Legal supports students with university disciplinary and appeal matters, but another case study cannot determine a new appeal and no professional adviser can guarantee a particular outcome.
Keep a Record
Students should keep copies of:
- the allegation notice;
- technical evidence;
- their written explanation;
- correspondence with university staff;
- hearing documents;
- the written decision; and
- appeal material.
An organised record can become particularly useful where the dispute concerns when evidence was disclosed or how a technical issue was explained during the investigation.
Conclusion
Technical evidence can be important in an online examination investigation, but the raw data and the conclusion drawn from it should not automatically be treated as the same thing.
IP addresses, timestamps, completion times and digital logs may raise legitimate questions. Their significance depends on context, the assessment rules and the wider evidence.
Students should request the relevant records, preserve their own technical evidence and respond to the specific inference the university is making.
Aldwych Legal provides education-law support in university misconduct and appeal matters across the UK. However, the central issue in any technical-evidence case remains whether the university has interpreted reliable evidence properly and given the student a fair opportunity to explain what happened.
