Washington’s Bar Exam Ran on Wi-Fi and Somehow That Was Not Even the Worst Part

A licensing system built on stress, money, and a wireless network that folded on contact.

Let’s start with what it takes to sit for the bar exam, because the people who built this system seem to have forgotten.

You finish law school. Three years. You borrow a sum of money that would make a cardiologist uncomfortable and a bankruptcy attorney optimistic. You graduate. You do not celebrate, because you cannot celebrate, because the thing that determines whether you actually get to be a lawyer is still ahead of you. You sign up for a commercial bar prep course that costs around two thousand dollars and dedicate the next eight to ten weeks of your life to studying forty hours a week, which is a full-time job that pays nothing and offers no benefits except anxiety. You stop seeing your friends. You stop sleeping properly. You eat at your desk. You learn the Rule Against Perpetuities for the fourth time in your life and understand it for zero of those times. You take practice exams until the questions follow you into your dreams.

Then you pay roughly $780 in registration fees. Then you pay another $149 in “technology fees.” Then you book a flight, or you drive five hours round trip, or in one candidate’s case you fly from Tokyo.

You book a hotel. You pack your laptop. You arrive at the testing center the morning of the exam with everything you have invested in your legal career compressed into the next nine hours.

This is the state you are in when you walk into the Yakima Convention Center on the morning of July 28, 2026, to take the first-ever administration of the NextGen Uniform Bar Examination.

You are not in good shape. But you are ready.

The whole thing ran on Wi-Fi

Here is what you do not know: the entire exam runs on Wi-Fi.

Not a hardwired network. Not an air-gapped local system. Not USB drives handed out at the door. Wi-Fi. The same technology that fails you at the airport Starbucks when three people try to check email at the same time. The NCBE’s plan, which it spent eight years and an undisclosed number of millions of dollars developing, requires 645 candidates to simultaneously connect their personal laptops to the convention center’s wireless network, authenticate through a single sign-on system using room-specific passwords, and stream three hours of encrypted exam content to their devices in real time.

The backup plan, in case the Wi-Fi fails? According to NCBE officials in earlier interviews: fire up some hot spots.

That is not a backup plan. That is a wish.

And to anyone with even a passing familiarity with network security, the entire architecture is not just fragile. It is indefensible.

Let’s talk about what Wi-Fi actually is, because the people who designed this exam apparently did not. A wireless network broadcasts radio signals in the 2.4 and 5 GHz frequency bands. Every device on the network sends and receives data in small units called packets. Those packets travel through the air. They are, by definition, accessible to anyone within range who has the right equipment and the right intent.

Start with packet sniffing. Anyone connected to the same Wi-Fi network, or within range of it, can use freely available software to intercept and capture data packets as they travel between devices and the access point. The exam data itself is almost certainly encrypted in transit via TLS. But encryption does not make a shared Wi-Fi network safe. An attacker on the same network can still observe traffic patterns, identify which servers candidates are connecting to, harvest metadata, and in some configurations exploit weaknesses in WPA2 pre-shared key authentication, where every user shares the same network password, to attempt decryption of other users’ sessions. The network key in this case was a room-specific password handed to 645 strangers. That is not a security model. That is a group chat.

Then there are man-in-the-middle attacks, where an attacker positions themselves between the candidate’s device and the access point and intercepts or modifies data in transit. Then there are evil twin attacks, where someone sets up a rogue access point with the same network name as the legitimate one, and candidates unknowingly connect to it, handing over their credentials and their traffic to an attacker.

One gadget could wreck it

But the simplest and most elegant way to destroy this exam does not require any of that sophistication. It requires a Flipper Zero.

A Flipper Zero is a pocket-sized, open-source device that retails for about $170. You can buy one on the internet. It fits in your pocket. With an ESP32 Wi-Fi development board attached, it can execute a deauthentication attack, which works by sending spoofed management frames to the wireless access point, instructing every connected device to disconnect from the network. The devices try to reconnect. The Flipper sends more deauth frames. The devices disconnect again. As long as the attack is running, no one on that network can maintain a stable connection.

One person. One device that costs less than a bar prep book. One button press. Six hundred and forty-five candidates lose their connection simultaneously.

And no one in the room can figure out why, because deauthentication attacks are nearly invisible to anyone who is not actively monitoring for them. It looks exactly like the Wi-Fi just stopped working. Which, on July 28, 2026, is exactly what happened.

I am not suggesting that a deauthentication attack is what took down the Yakima Convention Center’s network. The venue itself described the failure as a “catastrophic equipment failure.” The NCBE called it “localized on-site network issues.” The point is that it does not matter. Whether the Wi-Fi failed because of a hardware malfunction or because a bored teenager in the parking lot pressed a button on a device he bought off Amazon, the result is the same: 645 candidates cannot take the exam. The entire system collapses because it was built on a technology that can be defeated by a $170 gadget, a YouTube tutorial, and ten minutes of free time.

This is the platform that 47 states plan to adopt by 2028.

The rollout was chaos

Here is what happened that morning. The exam was scheduled to start at 8:30 a.m. Candidates began reporting connectivity problems almost immediately. On-site tech support warned exam administrators that testing might not be possible. Candidates sat and waited. By 11:30 a.m., proctors announced they would try starting the exam in waves, letting the lucky few who had managed to stay connected begin while the remaining two-thirds tried again in fifteen minutes.

Then lunch came. The internet did not fix itself over lunch. After lunch, administrators tried again. The NCBE app crashed or failed to load for most candidates. Then the head proctor’s internet went out. People were crying. People were throwing up. And keep in mind, even without a single technical glitch, the bar exam is already Dante’s Inferno in business casual. It is the most stressful day in a young lawyer’s professional life under normal conditions. These were not normal conditions. These were 645 people watching their careers buffer like a broken YouTube video while the proctors shrugged and rebooted the router.

No one ever started the exam. Not a single candidate answered a single question.

Late Tuesday afternoon, the WSBA told candidates they could take a refund or come back in February. Then they sent everyone home with word that testing would resume the next day and continue through Thursday, at which point candidates began scrambling to extend hotel reservations in a town a long drive from Seattle. Then the WSBA changed its mind and canceled the entire July administration, citing insufficient confidence that the technology issues could be resolved.

The NCBE then released a statement calling the inaugural administration of the NextGen bar exam “a historic milestone in legal licensure” and noting that its platform “performed as designed.” This is technically accurate in the way that saying “the parachute performed as designed” is technically accurate when the problem was that nobody could get it out of the backpack.

Washington’s own bar licensure task force had recommended waiting until 2027 to adopt the NextGen exam, specifically to allow time to work out issues with its administration. The Washington Supreme Court overruled the recommendation and chose 2026. The task force turned out to be right, which is the kind of vindication that tastes like nothing when 645 people are stranded in Yakima with ruined flights and maxed-out credit cards.

The bill landed on candidates

The costs are not abstract. One candidate, a Mukilteo resident who had accepted a position as a public defender, spent ten weeks studying, paid roughly $2,000 for bar prep, $780 in registration, $149 in technology fees, $870 for three nights in a hotel, and over $300 in gas for the five-hour round trip. Another candidate, a Notre Dame Law School graduate, spent about $1,000 in flights and hotels traveling from North Carolina. His job is contingent on passing the bar. Another candidate flew from Tokyo. He took time off work, rented a car, and booked a hotel. He said none of the three options offered by the WSBA are financially viable for him.

The three options were: take a makeup exam tentatively scheduled for September 1 and 2 in Tacoma, transfer to the February 2027 administration, or withdraw and receive a refund of WSBA fees. Every one of those options bills the candidate for a failure the candidate did not cause. And the dean of Seattle University School of Law pointed out an additional problem: 30 to 40 candidates with testing accommodations had already completed their exams using the same questions. Recycling those questions five weeks later, he said, “presents disqualifying exam integrity problems.” So the makeup exam may not even be a fair exam.

Every one of those options bills the candidate for a failure the candidate did not cause.

By Wednesday afternoon, the deans of all three Washington law schools had sent letters to the state Supreme Court asking for diploma privilege, the same remedy the court granted in 2020 when the pandemic made in-person testing impossible. In 2020, graduates of accredited law schools were admitted to the bar without sitting for the exam. The sky did not fall. The profession survived. Clients were represented. The legal system continued to function exactly as it had before.

Here is the point

Here is what I keep coming back to.

There is a person who flew from Tokyo to take this exam. He studied for weeks. He took time off work. He flew halfway around the world. He rented a car and drove to Yakima, a town he had probably never heard of before the WSBA told him it was where his career would begin. He checked into a hotel. He set his alarm. He walked into the convention center. He sat down. He opened his laptop.

And the Wi-Fi did not work.

Not because of some unprecedented, unforeseeable catastrophe. Because 645 people tried to log on to a wireless network at the same time in a convention center in a rural city two hours southeast of Seattle, and nobody involved in eight years of planning and development thought to ask whether the building could handle it. Or whether someone with a pocket-sized device could shut the whole thing down from the parking lot. Or whether, perhaps, a high-stakes licensing examination that determines whether human beings are permitted to practice law should not be built on the same infrastructure that sometimes cannot reliably stream Netflix in a hotel room.

We ask candidates to demonstrate minimum competence. Maybe we should ask the same of the people who design the test.

These 645 candidates did everything right. They studied. They paid. They showed up. They were ready. The system failed them, completely and preventably, and then handed them the bill. Diploma privilege is not a shortcut. It is the only honest answer when the institution that holds the gate has proven it cannot open it.

Give them their licenses. They earned them. The bar exam did not.