# CyberPatriot

CyberPatriot is a national youth cyber education program created in the United States to help direct students toward careers in cybersecurity or other computer science, technology, engineering, and mathematics disciplines. The program was created by the Air Force Association (AFA). It features the annual National Youth Cyber Defense Competition for high and middle school students. It is similar to its collegiate counterpart, the Collegiate Cyber Defense Competition (CCDC), especially at the CyberPatriot National Finals Competition.
CyberPatriot places teams in a scenario where they take on the role of cybersecurity experts, responsible for protecting various systems in a set amount of time. The competition consists of online rounds where teams are provided with virtual machines and challenged to identify and fix vulnerabilities, answer forensics questions, and secure critical services. Currently, the CIAS designs, builds and supplies the technology and virtual machines used in the CyberPatriot. This simulation tests students' skills in cybersecurity, problem-solving, and critical thinking, as they work under pressure .
The National Youth Cyber Defense Competition is now in its seventeenth season and is called "CyberPatriot XVII" indicating the season's competition. CyberPatriot XVII is open to all high schools, middle schools, and accredited home school programs around the country. JROTC units of all Services, Civil Air Patrol squadrons, and Naval Sea Cadet Corps divisions may also participate in the competition. Outside of the regular competition, CyberPatriot also hosts two additional sub-programs: Summer CyberCamps and an Elementary School Cyber Education Initiative. The Northrop Grumman Foundation is the "presenting sponsor". A British spin off program is called Cyber Centurion.

## History

CyberPatriot began in 2009 as a proof-of-concept demonstration at AFA's Air Warfare Symposium in Orlando, Florida. Four organizations were responsible for developing the competition: the Air Force Association, the U.S. Air Force, the defense contractor SAIC, and the Center for Infrastructure Assurance and Security (CIAS) at The University of Texas at San Antonio (UTSA). Eight high school teams from AFJROTC and Civil Air Patrol squadrons competed. The second phase of the program was limited to Air Force AFJROTC and Civil Air Patrol teams. Online training and qualification competitions were held during the fall of 2009 with nearly 200 teams from 44 states competing for eight slots in the first in-person National Finals Competition in February 2010, held in Orlando, Florida. The final phase of the developmental program, full national deployment, is now underway. Over 1,500 teams from all 50 states, Canada, and DoD Dependent schools overseas competed in CyberPatriot VI. CyberPatriot VII began in October 2014, with over 2,100 teams registered to compete. The Middle School Division was added in CyberPatriot V. CyberPatriot IX, which started in October 2016, featuring over 4,300 registered teams. The previous national commissioner who had served in that position since 2008, General Bernie Skoch, retired in June 2021, and has been replaced by Acting National Commissioner Rachel Zimmerman, who has served in other leadership roles prior to her term as commissioner.

## Goals and objectives

CyberPatriot is designed to be accessible to any high school or middle school student, provides a path from high school to college/workforce, and benefits all national CyberPatriot partners. The program increases the awareness of cybersecurity by delivering a basic education in a competitive format that enhances leadership, communication, and cooperation skills among its competitors.

## Organization and preparation

Teams have the following members:
* Coach: Supervises, chaperones team. Usually a teacher. Does not need to have a technical background.
* Competitors: 2-6 students (5 competitors, 1 alternate)
* Technical Mentor (Optional): Particularly useful when the Coach is not cyber-savvy. Helps teach cyber concepts.
* Team Assistant (Optional): Assists Coach with daily administrative tasks related to the competition
Each team is required to have a registered Coach and registered Competitors. Coach registration begins in the late spring to allow preparation over the summer. The qualification rounds of the competition are completed online at the teams' home locations from September to early January.

## Competition guidelines

The competition is a tournament structure with three divisions:
* Open High School Division: Open to all public, private, parochial, magnet, charter, home schools, and special groups such as CampFire, Boys & Girls Club, Boy Scouts, Church Youth Groups, Girl Scouts, etc.
* All-Service Division: Open to all JROTC Services, Civil Air Patrol squadrons, US Naval Sea Cadet Corps units. The registration fee is waived for teams competing in the All-Service Division
* Middle School Division: Open to all middle schools and junior high schools which follow the same common organizations as mentioned above in the Open High School Division.
The early rounds of the competition are done online during weekends via the Internet from teams' schools or other sponsoring organizations' facilities. Before the round, teams download virtual image representations of operating systems with known flaws or cybersecurity vulnerabilities. Each team is tasked to find the flaws while keeping specified computer functions (services such as email) working. Team progress is recorded by a central CyberPatriot scoring system.
The scores from Qualification Rounds 1 and 2 are totaled to determine which tier a team advances to:
* Platinum: Top 30% of teams. Rounds include State (guaranteed), Semifinals, and National Finals
* Gold: Middle 40% of teams. Rounds include State (guaranteed) and Semifinals.
* Silver: Bottom 30% of teams. Rounds include State (guaranteed) and Semifinals.
Teams in the Platinum tier are the only teams eligible to qualify for National Finals.
In CyberPatriot XIII, there were only 3 rounds total and round 1 was held later than usual in CyberPatriot XIII due to COVID-19 in order to give coaches more time to recruit (according to AFA email announcements). Round 3 determined the National Finalists teams that year.
See additional rules below:
* The Qualification Competition begins as soon as this image is opened and ends 4 consecutive hours later, after which the score will be logged. Attempting to continue after the time limit will incur penalties. It is the coach's responsibility to ensure their team does not exceed the limit.
* Only one instance of the image can be opened at any given time. Opening multiple instances of a virtual image will result in a penalty.
* No person may compete on a team with which they are not registered, and may only be registered with one team per competition.
* During the competition, no outside assistance may be given to or received from anyone.
* No competitor may offer assistance to another after their round ends and the other begins.
* No outside communication is allowed during the competition. This includes but is not limited to verbal, electronic, written or coded.
* No offensive activity of any kind is permitted, including but not limited to hacking through programs or manual code injection, interfering with another team through social engineering and/or deception, or attaining the opposing machine.

## National Finals Competition

The top-scoring Semifinal teams from each division, approximately 28 teams, are invited (all expenses paid) to the in-person National Finals Competition each spring. For CyberPatriot IV-VII, National Finals Competitions were held at the Gaylord National Resort & Convention Center in National Harbor, Maryland in March. From the CyberPatriot VIII season through the CyberPatriot XI season, the National Finals Competitions moved to the Hyatt Regency Baltimore Inner Harbor in Baltimore, Maryland, and were held in April of each year. Beginning in the CyberPatriot XII season, the National Finals Competition has been held at the Bethesda North Marriott Hotel & Conference Center in Bethesda, Maryland outside of Washington, D.C., in March. However, the CyberPatriot XII In-Person National Finals Competition, which was the first planned year at the Bethesda North Marriott, was canceled due to the COVID-19 outbreak, and a virtual, in-home competition was held online in May, about two months after the originally scheduled in-person competition event. The CP-XII Virtual National Finals was held on May 2, 2020, and marked the first-ever online virtual CyberPatriot National Finals Competition. Due to the widespread outbreak of COVID-19, the CyberPatriot XIII season had modifications to accommodate the delay in team administration as well as provisions for additional procedures for competing at home. Because the spread of COVID-19 in the US continued, some schools had restrictions on in-person activities, which was accounted for by arrangements for optionally staying home to compete as well as an organization type for registration.
The Challenges that teams may face include:
* Network Security Challenge, in which teams fix vulnerabilities in "images" of Operating Systems that have been purposely tampered with while protecting the virtual machines(VMs) from "Red Team" which is a group of "hackers" that will exploit vulnerabilities on the competitor's machines. The Operating Systems in CP-XVII include: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Ubuntu 22, and Mint 21.
* Cisco Networking Challenge, in which teams show their knowledge about Cisco Packet Tracer, and take a Cisco quiz.
* CyberPatriot Web-Based Challenge, in which computers compete in a CTF-like challenge. This challenge is currently only in the Semifinals Round.
* Boeing Cyber-Physical System Challenge, in which teams are presented with an operational system that tracks and maintains flight information. This challenge is currently only in the Semifinals Round.
Winning teams in the Open and All Service Division earn education grants to the school of their choice. First place teams earn $2,000 per competitor, second place teams earn $1,500 per competitor, and third place earns $1,000 per competitor. The scholarship money is provided by the Northrop Grumman Foundation. In CyberPatriot VII, for first, second, and third place, an additional $2,000, $1,500, and $1,000 were awarded to the teams, respectively, by the National Security Agency

## CyberPatriot Winners

All Service Division Winners :
| Year | Season | Team Name | School/Organization | City |
| 2009 | CyberPatriot I | Osceola High School AFJROTC | Osceola High School | Kissimmee, FL |
| 2010 | CyberPatriot II | Clearfield High School Air Force JROTC | Clearfield High School | Clearfield, UT |
| 2011 | CyberPatriot III | Team Wilson | Orlando Cadet Squadron | Orlando, FL |
| 2012 | CyberPatriot IV | Wolfpack | Colorado Springs Cadet Squadron | Colorado Springs, CO |
| 2013 | CyberPatriot V | Marine Military Academy | Marine Military Academy | Harlingen, TX |
| 2014 | CyberPatriot VI | Osceola High School AFJROTC | Osceola High School | Kissimmee, FL |
| 2015 | CyberPatriot VII | Fearsome Falcons | Clearfield High School | Clearfield, UT |
| 2016 | CyberPatriot VIII | Netrunners | Centurion Battalion | Winter Park, FL |
| 2017 | CyberPatriot IX | Wolfpack | Colorado Springs Cadet Squadron | Colorado Springs, CO |
| 2018 | CyberPatriot X | Cyber Warriors 0 | Troy High School Navy JROTC | Fullerton, CA |
| 2019 | CyberPatriot XI | Byte Sized Falcons | Scripps Ranch HS Air Force JROTC | San Diego, CA |
| 2020 | CyberPatriot XII | chmod 755 -r /srv/ftp/Anime/ | Roosevelt High School Army JROTC | San Antonio, TX |
| 2021 | CyberPatriot XIII | Runtime Terror | Troy High School Navy JROTC | Fullerton, CA |
| 2022 | CyberPatriot XIV | The Terabyte Falcons | Scripps Ranch HS Air Force JROTC | San Diego, CA |
| 2023 | CyberPatriot XV | Runtime Terror | Troy High School Navy JROTC | Fullerton, CA |
| 2024 | CyberPatriot XVI | W.A.T.T | Troy High School Navy JROTC | Fullerton, CA |
Open Division Winners :
| Year | Season | Team Name | School/Organization | City |
| 2009 | CyberPatriot I | N/A | N/A | N/A |
| 2010 | CyberPatriot II | N/A | N/A | N/A |
| 2011 | CyberPatriot III | Red Bank Regional High School | Red Bank Regional High School | Little Silver, NJ |
| 2012 | CyberPatriot IV | Alamo Academies | Alamo Academies | San Antonio, TX |
| 2013 | CyberPatriot V | Chantilly Academy | Chantilly Academy | Chantilly, VA |
| 2014 | CyberPatriot VI | Azure | North Hollywood High School | North Hollywood, CA |
| 2015 | CyberPatriot VII | CyberSloths | Grissom High School | Huntsville, AL |
| 2016 | CyberPatriot VIII | Sudo | Summit Technology Academy | Lee's Summit, MO |
| 2017 | CyberPatriot IX | Togo | North Hollywood High School | North Hollywood, CA |
| 2018 | CyberPatriot X | Togo | North Hollywood High School | North Hollywood, CA |
| 2019 | CyberPatriot XI | Troy Tech Support | Troy High School | Fullerton, CA |
| 2020 | CyberPatriot XII | CyberAegis Strange Quark II | Del Norte High School | San Diego, CA |
| 2021 | CyberPatriot XIII | CyberAegis Cobalt | Del Norte High School | San Diego, CA |
| 2022 | CyberPatriot XIV | CyberAegis Flashpoint | Del Norte High School | San Diego, CA |
| 2023 | CyberPatriot XV | CyberAegis Tempest | Del Norte High School | San Diego, CA |
| 2024 | CyberPatriot XVI | Half Dome | Franklin High School | Elk Grove, CA |
Middle School Division Winners :
| Year | Season | Team Name | School/Organization | City |
| 2009 | CyberPatriot I | N/A | N/A | N/A |
| 2010 | CyberPatriot II | N/A | N/A | N/AHA |
| 2011 | CyberPatriot III | N/A | N/A | N/A |
| 2012 | CyberPatriot IV | N/A | N/A | N/A |
| 2013 | CyberPatriot V | N/A | N/A | N/A |
| 2014 | CyberPatriot VI | Cyber Knights | Beach Cities Cadet Squadron | San Pedro, CA |
| 2015 | CyberPatriot VII | Team 1 | Nysmith School for the Gifted | Herndon, VA |
| 2016 | CyberPatriot VIII | CyberFalcon Millennium 360 | Oak Valley Middle School | San Diego, CA |
| 2017 | CyberPatriot IX | Error 37 | Summit Lakes Middle School | Lees Summit, MO |
| 2018 | CyberPatriot X | CyberAegis Cancer Minor | Oak Valley Middle School | San Diego, CA |
| 2019 | CyberPatriot XI | CyberAegis Chaos | Oak Valley Middle School | San Diego, CA |
| 2020 | CyberPatriot XII | CyberAegis Polariton | Design 39 Campus | San Diego, CA |
| 2021 | CyberPatriot XIII | CyberAegis Technetium | Oak Valley Middle School | San Diego, CA |
| 2022 | CyberPatriot XIV | CyberAegis Cobra | Design 39 Campus | San Diego, CA |
| 2023 | CyberPatriot XV | CyberAegis Vitalis | Design 39 Campus | San Diego, CA |
| 2024 | CyberPatriot XVI | CyberAegis Callisto | Oak Valley Middle School | San Diego, CA |