The Air Force Association’s CyberPatriot—The National High School Cyber Defense Competition—attracted a record number of teams—more than 1,200—for its fifth season. Participants hailed from all 50 states and the Canadian province of Manitoba, plus Department of Defense schools in Europe and the Pacific.
The contestants began last October with practice rounds. Then they battled through three official online rounds to determine who was best at protecting simulated computer networks from a variety of intruder attacks. The top 28 scoring squads earned a trip to the National Finals Competition, held in March just outside Washington, D.C.
CyberPatriot is split into two tracks. One is the Open Division, for teams unaffiliated with the military, from any public, private, parochial, or accredited home school or civic organization. The second is the All Service Division, which includes high school teams with military ties, such as Junior ROTC, Civil Air Patrol (CAP) units, and Naval Sea Cadet Corps.
CyberPatriot V saw the top three teams in both divisions as first-time winners. In the past, CyberPatriot has seen some teams repeat as winners.
“There were some interesting developments in who made the medal round,” said CyberPatriot Commissioner Bernard K. Skoch.
Teams from Virginia swept the Open Division. First place went to a squad named “VOID” from Chantilly Academy in Chantilly, Va. Second and third went to two teams, “Flying Bacon” and “_Invaders,” from the same school, Marshall Academy in Falls Church, Va.
JROTC teams affiliated with the Marine Corps swept the All Service Division. First went to the “Devil Dogs” from Marine Military Academy, Harlingen, Tex. Second went to the “Marine Raiders” from Montachusett Regional Vocational Technical School, Fitchburg, Mass. The “CyberBears” from La Cueva High School in Albuquerque, N.M., took third.
The cream may have risen to the top in what is becoming an ever-more intense competition. Skoch said the fact that teams concentrated in Northern Virginia and with Marine Corps connections dominated the leaderboard in CyberPatriot V was “a reflection of the seriousness of the competition.”
This year’s National Finals Competition was far more business-like than previous years, said Skoch. Students came in better prepared and more intent on winning than just soaking up the atmosphere.
Teams got right down to work after the clock started ticking. They had their processes better defined. They worked by checklists. They knew what they were looking for.
“I think that our program has grown into adulthood,” said Skoch. “People have learned the value of it not just as a competition itself but as a genuine source of education and training for these young people.”
CyberPatriot V attracted 21 percent more teams than CyberPatriot IV. Though most had five or six members, one team composed of only two students—from Flour Bluff High School in Corpus Christi, Tex.—made the final round.
“What we have learned is that smaller teams do very well in competition,” says Skoch. “Each student gets a broader exposure to cyber security.”
Backed by AFA, presenting sponsor Northrop Grumman Foundation, and other supporters, CyberPatriot is intended to get high school students interested in cyber defense, an area of great national need, as well as science, technology, engineering, and math in general.
Today, the news is full of stories about cyber attacks on every level, from individual hackers attacking Facebook pages to national-level assaults on US government agencies and critical industries. The development of national cyber defenders and cyber airmen in particular is vitally important, noted CMSgt. Linus Jordan, command chief for Air Force Space Command, in a speech to space and cyber industry leaders at the National Space Symposium in Colorado Springs, Colo., earlier this year.
Video Games
Jordan is the father of an airman in the cyber operations field. He cited CyberPatriot as an example of the sort of program that could draw more young people into cybersecurity.
“There is goodness in that type of program [CyberPatriot] for those young Americans, whether they join our team or not, because it exposes them to what the opportunities of the future may be,” said Jordan. “More importantly, it reinforces just how critically important STEM is to them as individuals and to us as a nation.”
CyberPatriot is set up as a competition because that appeals to youngsters who have grown up playing video games, including games that are run as an online multiplayer environment. CyberPatriot also develops teamwork and provides pride and peer recognition to computer-oriented kids who may not play football or other interscholastic sports.
This year’s competition began in early November. In three preliminary rounds conducted online, teams downloaded simulated computer networks preloaded with security problems. They raced to patch these holes, throw out “intruders,” and armor the system against new attacks, while a central CyberPatriot server kept their time and score.
This year’s CyberPatriot finals added a new twist: a Cisco Networking Event. It consisted of teams taking Cisco-provided hardware and designing, building, and securing their own virtual networks. Event scores constituted 10 percent of the teams’ final total.
Training for the networking element began before the teams traveled to Washington, D.C. Cisco arranged for more than 20 teams of adult engineers to meet with finalist teams and coach them in network design and sub-netting, physical design, and network configuration.
“It added another element to the competition. It received rave reviews,” said Skoch.
The finals also featured a new Digital Forensics Event. This forced competitors to decrypt and decode rogue files on their computers while competing in the network security aspect of the competition.
Compared to this year’s event, CyberPatriot IV had featured an additional test: a cyber forensics crime scene. In this, teams received a cyber crime scenario and the interrogation transcript of a “suspect.” Teams got to search a “suspect” mannequin for concealed passwords, thumb drives, and other evidence to help construct an idea of what had happened.
This was a popular activity but CyberPatriot V was not able to offer it because at the last minute the Department of Defense Cyber Crime Center personnel who designed and constructed it were unable to attend due to sequester-related budget cuts.
“We’re hoping to see them next year,” said Skoch, who added that the crime scene cancellation “was unavoidable.”
Work on CyberPatriot VI is well under way. Preregistration opened in January. Within a few weeks nearly 400 teams had signed up and were looking forward to the 2013-2014 competition.
The extensive training materials available online at CyberPatriot’s website are now much improved, thanks to help from the Center for Infrastructure Assurance and Security at the University of Texas, San Antonio. CIAS is a pioneer in the area of cyber competitions and runs a contest for college students. In addition, competition software has been much improved, meaning the online rounds no longer have outages or other problems to deal with.
“We’re already rolling into next year,” Skoch said.
But perhaps CyberPatriot’s biggest jump does not deal with its high school competition. In April, the organization announced it is expanding its offerings to the middle school level.
A middle school pilot program will begin in the Los Angeles Unified School District in late summer. More pilot programs in CyberPatriot Center of Excellence areas will begin in October. The intention is for CyberPatriot Middle School to go national in 2014.
This program will have two aspects. The first will be education aimed at inoculating the younger students against the dangers they face on the Internet and their smartphones. CIAS is helping CyberPatriot design cyber safety modules of instruction for kids younger than high school age.
Meeting the Demand
“In some cases we expect to have whole school assemblies. In some cases we’ll do a subset of a school. We’re aiming to help them be safer users of the Internet,” Skoch said.
The middle school initiative also will provide a taste of what CyberPatriot participation would offer the students when they are old enough for high school. Skoch said AFA has long fielded requests from educators to provide materials suitable for younger children.
“Our challenge is going to be meeting the demand that is out there,” he said.
Five seasons in, CyberPatriot is just beginning to be able to collect hard data about its effect on the educational and employment choices of past contestants. Everything they have had up to this point is anecdotal—but encouraging, said Skoch.
“I am absolutely positive we are drawing more students to STEM. Students who compete in our competition universally say it is wonderful and it has shaped [their] career intentions,” he said.
In this sense, CyberPatriot fits into a broader universe of national efforts. Laterally, there are other STEM opportunities for high school youth, from robotics contests to rocketry design. Vertically, CyberPatriot veterans can move on to more sophisticated college-level cyber defense competitions.
In this niche there is still much room for growth. The Northrop Grumman Foundation has announced a three-year commitment to CyberPatriot operations, so the program has an element of financial stability as well.
“We have an enormous opportunity in front of us,” said Skoch. “There are 40,000-plus high schools in America, and we’d like to reach every one. There are three times as many middle schools, and we’d like to reach them, too.”