Watching amateur coders foil a 'bioterrorist plot'
This is what a 21st century recruitment drive looks like.
A woman's voice blares out through the building's loudspeaker. "Stay calm," she says, as the room's lights fade away, bathing everyone in an ominous red glow. People in white hazmat suits stream in from multiple entrances and begin sweeping the room. One suited lady focuses in on a man sitting a few feet away from me, who's been engrossed in his laptop the entire time. As she begins scanning his arm for traces of chemicals, he looks up toward me, and can't help but crack a smile. The reason for his nonchalant attitude about being singled out as a suspect? None of this is real. He's an amateur code-breaker and a contestant in the UK's Cyber Security Challenge Masterclass final, which bills itself as the "most realistic civilian cyber-terrorist attack simulation" ever.
The Masterclass has a 24-esque plot in which our would-be Jack Bauers (or, more likely, Chloe O'Brians) are tasked with foiling a bioterrorism plot. The final kicked off the night before, when 42 contestants gathered to respond to a tip-off: someone called in a potential threat coming from a fictitious pharmaceutical company named ZSB Formulas. The competitors formed teams to analyze the situation.
After using scanning software to map out ZSB Formulas' network, they discovered an employee had opened a new port in the company's firewall and added a rogue machine to the network. Analyzing packets going across the network, they spotted the new PC was sending data to another machine over the internet. By the time they accessed its mailbox, the PC's emails had been wiped, but by accessing the company's Exchange server they were able to read a conversation between the employee and an operative of a shadowy terrorist organisation named "Black Oleander." In the messages was a schematic for an airborne virus that could be distributed by an A/C system.
A contestant's notes on the bioterrorism plot.
After analyzing more of the outgoing data from the machine, the teams discovered a fragmented image. When reconstructed, the picture turned out to be a floor plan. Scribbled by hand in the corner of was the words "Church House," the name of a conference center by Westminster Abbey and the UK's Houses of Parliament, and a time: 1:30PM. Not coincidentally, that was the start time for an international summit where members of the Royal Family, senior government officials and foreign dignitaries were due to be in attendance. With this information in mind, the big picture became clear: the terrorist group Black Oleander was trying to extort money in exchange for not releasing the virus. The contestants' goal? To stop the virus without a penny changing hands.
They achieved it, of course. With an array of applications and tools used by security professionals, the teams located an environmental control box and a control machine. The latter was sending packets to the former, of which twelve (among thousands of others) were processes that would release the virus at 1:30. As a seasonal twist, the teams were able to discern the correct order to shutdown the signals using lyrics from The Twelve days of Christmas. At 1:30, a video was played showing a robot finding the physical virus and removing it from the A/C unit. They'd saved the day.
An actor in a hazmat suit "scans" one of the competitor's arms for traces of chemicals.
The Masterclass was designed by Qinetiq, a defence company headquartered in the UK, with support from law enforcement agencies and other IT and security companies like Simudyne, Cisco and BT. Its timing couldn't have been worse. The Paris attacks had happened less than a week before, which led to GCHQ -- the British intelligence agency that drew infamy from the Snowden leaks -- and defense giant BAE Systems both pulling out at the last minute. The reason for so many important companies taking an interest in the contest is that it's not really a contest. Sure, there are prizes , namely access to educational programs worth over £100,000 ($150,000), but the Masterclass is less a competition, more a ridiculously elaborate recruitment drive.
This was all an elaborate recruitment drive
Cyber Security Challenge UK, the not-for-profit that organizes Masterclass, was established "to bolster the national pool of cyber skills" in the country. Through a program of training, online coding games, and contests, it aims to uncover "hidden talent" laying in wait. Every company spokesperson I talked to reiterated the importance of Cyber Security Challenge's events. As online threats grow more complex and prevalent, companies have struggled to hire enough people through traditional methods like graduate entry schemes. Events like Masterclass aim to fill the skills gap in a number of ways.
First and foremost, companies actively recruit from the contestant pool. The judges all work for partner organisations and, as well as assessing for the competition, they're identifying raw talent that could join their respective companies. No one could give me a firm number on how many contestants have been picked up over the years, but all of the companies had at least hired one.
A coder, unfazed by the changing conditions.
Even those that don't make the grade still benefit from the experience. The scenario is planned so that the amateur contestants get used to the order and structure of a working environment. One particularly novel aspect of the contest was a rule that made sure no "laws" were broken during it. Coders were required to gain permission from the relevant (imaginary) authorities before accessing external servers that didn't belong to them. Through this and other workflows, it's hoped that amateur contestants will discover how their skills could be used in a workplace, where they might trade counterterrorism for helping to prevent hacks or tracking down the perpetrators of data theft.
It's highly unlikely that any of the contestants will end up foiling real bioterrorist plots, but Masterclass is a smart way to inspire a new generation. The bright minds testing their skills are really just learning to use industry-standard tools in a methodical way. Their eventual day-to-day jobs might not be as fast-paced and glamorous, but they could be just as rewarding.
