event coverage
Cyber 9/12
March 17 - 18, 2017 Washington, DC, USA
Not capture-the-flag, but convince-the-executive
The Atlantic Council and its partners held their Cyber 9/12 competition on Friday and Saturday, March 17th and 18th, 2017, at the American University in Washington, DC. Cyber 9/12 is a contest for student teams that differs from the more familiar capture-the-flag competitions in that its focus is on technically informed policy recommendations.
Each four-person team was assigned the role of junior staffers briefing the US National Security Council with policy recommendations developed in response to an ambiguous (yet clearly serious) crisis in Sino-American relations.
The scenario went roughly as follows: Set in 2018, and notionally occurring between August 29th and September 5th of that year, the fictional situation described rising tensions between the US and China, already somewhat elevated by Chinese fears that US public statements hinted at a retreat from the longstanding "One China" policy. A major Chinese bank has come under successful distributed denial-of-service attack, and there are news reports that the botnets involved exploited deliberately induced bugs in open-source software—and there's speculation US intelligence services caused vendors to leave those vulnerabilities in place.
US investigation suggests the probability that Chinese criminal organizations and (maybe) North Korean Dark Seoul actors were involved in the attack. The attack, however, seems to be spreading to US financial institutions, one of which has informed the Department of Homeland Security of its intent to hack back against the botnets. (The bank will do this under authorities granted private sector actors by "The Cyber Marque and Reprisal Act of 2018.)
Unfortunately the hacking back may have affected devices—including medical devices—that use the BusyBox open-source code, and there are reports that this may have caused at least some medical crises (perhaps a few actual deaths) in China. Such problems are likely to spread. China has communicated its strong outrage both privately and publicly, blaming the US for, in effect, an attempted assassination as part of a larger aggression. And, finally, a US Navy unit, USS Blue Ridge, operating in the Western Pacific, has come under cyberattack, with its C4ISR systems at least temporarily degraded.
Of course, the National Security Council needs to present the President with some options, and doing so was each team's task. They gave a series of ten-minute briefings to panels of judges playing the role of the National Security Council.
Their proposals, developed under realistic conditions of limited time and limited information, were varied and interesting. Those teams that had clear, multidisciplinary capabilities appeared to fare best.
The students represented a variety of backgrounds, disciplines, and levels of experience, with more political science and law students than one usually sees at such events. Forty-five teams came from thirty-three institutions:
Air University
American University
Arizona State University
Brown University
Carnegie-Mellon University
Columbia University
Daniel Morgan Graduate School of National Security
Duke University
The George Washington University
Georgetown University
Indiana University
Indiana University, Maurer School of Law
The Johns Hopkins University
Lewis University
Marymount University
Middlebury Institute of International Studies at Monterey
National Defense University
National University of Intelligence
Stanford University
Texas A&M University
Tufts University
United States Air Force Academy
United States Military Academy
United States Naval Academy
United States Naval War College
University of Maine
University of Maryland
University of South Alabama
University of South Carolina
University of Texas, Austin
University of Texas, El Paso
University of Virginia
Yale University
The winner at the end of the two-day competition was a team from the US Naval War College. We'll have more on Cyber 9/12 and the events surrounding it over the course of the week.