Indiana University Students Shine at Cyber 9/12 Challenge

The weekend of March 11-13, 2016 found three Indiana University students traveling to Washington, D.C. for the Cyber 9/12 Student Challenge. Funded in part by CACR, the students were the inaugural group from IU to attend the challenge. The following article discussing this challenge and the students' experience appeared in the March 16, 2016 issue of the Bloomington Herald Times:

IU students excel at cybersecurity competition in DC

By Michael Reschke 812-331-4370 mreschke@heraldt.com

None of the three students representing Indiana University at the Cyber 9/12 Student Challenge over the weekend in Washington, D.C., thought they would make it to the second round. It was the first year IU had sent a team to the event, where students are tasked with formulating responses to fictional national security crises.

“It resembled a war game,” said John Karaagac, the team’s coach and a lecturer in IU’s School of Public and Environmental Affairs.

As soon as they arrived, the team felt they were outmatched. Madison O’Day, a freshman majoring in law and public policy, said that of the 44 teams at the competition, about half were midcareer professionals in the intelligence field who had gone back to school. Every Ivy League school was represented, and a scheduling conflict caused IU to be one person short of the four-person maximum.

After presenting four possible strategies Friday for responding to an Air Force data breach, the team members thought they had done well, but felt they were off the mark. They were texting their parents to break the news and making plans to see the sights on Saturday when the announcement was made listing the teams that had made it to the next round.

“I was completely flabbergasted,” said Alexzandra Smith, a junior majoring in law and public policy. “We jumped up and down. We were so surprised.”

Feelings of elation would soon turn to stress and exhaustion as the team received its second scenario at 8 p.m. and was told to have an advance ready by 6 a.m. the next day. The situation was intense, but it was designed to mimic a real cybersecurity crisis.

The need to respond to real cybersecurity crises only grows as computers continue to play a greater role in our everyday lives, said Von Welch, director of IU’s Center for Applied Cybersecurity Research. While technologists are needed to write secure software, there is a greater need for qualified people who can help develop cybersecurity laws and policy.

“Cybersecurity is a fast-moving field,” Welch said. “The opportunity for experience outside the classroom is great for students.”

That’s why Welch, along with other faculty members, worked to get funding for the trip when O’Day started putting a team together at the end of winter break.

O’Day said she adores security policy and, as a candidate for IU’s Individualized Major Program, is working to create her own major in national security or security studies. She first learned of the cybersecurity challenge through an email from IU’s Center on American and Global Security.

“It was a whirlwind for two months,” she said about getting a team to the competition.

Things didn’t get any easier when she got to the nation’s capital. The team had to stay up all night to prepare a briefing for possible responses to the second scenario, in which an employee of a defense contractor sent a phishing email to his superiors with a link to malicious code. After submitting a written document, the team presented their response to a panel for questions.

“It was a pretty rough Q-and-A,” O’Day said. “We were not expecting it to be that aggressive.”

While the team didn’t make it to the final four, they got to network with recruiters from the CIA and the U.S. Department of Homeland Security. Roger Morris, a freshman in IU’s Kelley School of Business, said he learned a lot, especially during a hacking demonstration.

“You have this idea in your head about how it’s done,” he said, “but it’s nothing like in the movies. It takes a lot more time and cleverness on the part of the hacker.”

O’Day said it appears funding has been secured to make sending an IU team to the competition an annual event. She plans to attend next year and so does Morris, who said getting to the second round will now be an expectation rather than a surprise.

“We’re going to come back next year and do even better,” he said.