We were able to spend last Thursday and Friday in Crystal City, Virginia, observing the Atlantic Council's Cyber 9/12 Strategy Challenge. This competition, which the Atlantic Council organized in partnership with Lockheed Martin, challenged teams of students to develop policy response recommendations for the US President. The scenario, a tabletop exercise with well-crafted ancillary material, presented the competing teams with an evolving situation designed to capture much of the ambiguity crises carry. Congratulations to the two winning teams and their coaches: NDU Team 3 of the US National Defense University won the Professional track, and the US Air Force Academy's team Delongrand took top honors in the Student track. And congratulations to the other participants as well. The ones we observed represented themselves and their home institutions with credit.

The exercise was for the most part conducted under Chatham House rules, and we'll honor the conventions of non-attribution by confining ourselves to general observations. It was striking how difficult the teams found it to acknowledge, and work under, conditions of uncertainty. The exercise materials intentionally left a great deal in doubt, and most of the teams tended in their recommendations to be more confident in their understanding of the evolving situation than the evidence warranted. The teams also tended to perceive connections among disparate events where in fact no such connection existed. Simple correlation, similarity, coincidence, and so forth led many to conclude that the scenario painted a picture of a large-scale coordinated cyber attack by a hostile nation-state. One of the harder lessons to learn is skepticism about our tendency as humans to perceive noise as signal.

In the presentations themselves, some of the teams drifted away from considering their audience. A decision briefing is prepared for a particular decision-maker, and it's goal is to inform the decision, not to display the briefers' command of their material.

One other lesson was drawn by a student we had occasion to speak with: policy is a lot harder and more complex than technical people tend to think it is.

So another interesting exercise by the Atlantic Council, and, again, a very good and intelligent effort by all who competed.