"It's not just the cheating; it's the theft. There's a big business out there where someone can log in and capture information with a digital camera or some other way, then you put it out on the Internet and sell the content to other folks. There's a huge business."

For example, a test-taker might spend $29 buying questions for an information technology certification program test online, memorize the answers and pass the test.

"The worst that I've seen is in the IT certification world, these 'brain dump' sites. It takes not two weeks for the entire text of the test to be available at these brain dump sites for purchase. ... Testing companies spend hundreds of thousands of dollars developing tests, and when it goes out and within a week it's freely available, all that money is wasted," Foster said.

"These kinds of threats are relatively new and sometimes they are not prepared to handle them. What they've been doing for decades has worked, and these are new issues for them."

While acknowledging that pinpointing the extent of cheating is elusive, Foster pegs the figure at between 5 percent and 30 percent of people being tested. "And programs that are more lax with security would have more problems," he added.

The solutions

So, what's a test program to do? Many have called upon Caveon for help, and the company offers three basic services.

One is the Caveon Security Audit, a 250-point evaluation of a testing program's security practices and policies to check for strengths and weaknesses. Another is the Caveon Web Patrol, monitoring the Internet for the sale, barter or other disclosure of test information.

"If you went out on eBay now and searched for actual test questions, you'll probably see several offerings," Foster said.

Sure enough, last week's auction-site bounty included a guide for an aircraft pilot certification test and questions and answers to tests for a commercial driver's license and real estate exams from several states.

The third service is Caveon Data Forensics, statistical analyses of test results to check for patterns that indicate cheating. The company's statistical models dictate how results should look, and the actual results are compared to the models. The analyses can detect possible cheating, test theft, a person taking a test on behalf of someone else, collusion or other shenanigans. Plain old guessing is taken into account in the models.

"If, say, 1,000 people take a test, we get their results — how did they answer every question and how long did it take them. Then we crunch all those raw data and we look for patterns of irregularity in the data," Foster said.