It’s almost March which means that the National Cyber 9/12 Competition hosted by the Atlantic Council in Washington, D.C. is around the corner. Several Columbia teams have been vigorously preparing for the event. As part of the preparation, the Columbia SIPA team that won second place in the New York regional event, “Gone Phishing”, recounts the process of the #NYCyber912 and the steps that made them successful this past November.

Last year, on November 4th and 5th, 16 university teams came to SIPA to participate in the Cyber 9/12 Challenge – its fourth year running, and the first time that an event was hosted in NYC. Competing against West Point, King’s College London, and schools from across the Ivy League were four teams from Columbia SIPA. Ours, Gone Phishing, had the high honor of coming in second to West Point, along with winning Best Policy Brief.

The event was organized and run by the SIPA Digital and Cyber Group, and they asked us for our thoughts on the experience of the tournament. Here’s Gone Phishing’s official account of an epic weekend, for the benefit of the community here at SIPA and for those participating in the tournament next year.

The challenge is “part interactive learning experience and part competitive scenario exercise”. The structure of the competition is intense, with three rounds over two days. To start, each four-person team is given a hypothetical, but realistic, scenario of a cyber attack against the United States. The teams then prepare short policy briefs and a notes-only presentation, as if delivering to the National Security Council. The scenarios are frighteningly real; last year, students were asked to prepare for a situation where Russian hackers interfered with the US elections.

On Day One, teams hand in their document and present in front of a panel of three to four judges (the ‘National Security Council’), after which judges question each team for ten minutes. That evening, during a reception at PwC’s headquarters in midtown, half the teams move through to the second round and are given new developments related to their scenario. Teams that go through are punished for their ‘win’, as they have to leave the reception for a second all-nighter to prepare for the next day. On Day Two during the semi-finals, the same format is repeated – decision documents are handed in, presentations are delivered, and teams go through ten minutes of questioning.

After lunch on Day Two, the four final teams are named and sequestered in a lecture room with no laptops or phones. Over the afternoon, one by one the teams are brought upstairs, where they are given a fresh piece of intelligence and 15 minutes to prepare a brand-new verbal briefing. They are then taken into an auditorium where all teams and coaches are gathered as an audience, and provide their updated set of recommendations before being questioned a final time. The winners are announced shortly thereafter.

The experience is exhausting. By the time we felt like we were completely comfortable with what we were doing, it was already the second round. The presentations are bracing but the judges’ questioning periods are nerve-wracking, requiring you to handle difficult, complex questions on the fly. And as we got less and less sleep, hammering out proposal details in the early hours in one of Columbia’s cafes, we had less and less time to prepare for each successive stage.

However, there is a silverlining – especially for policy students. For one, Cyber 9/12 is not for the technical. Although those with technical backgrounds are welcome, the tournament does not really care about programming skills or networking backgrounds. Only one of our group members had any IT background, and it was not in cyber security. Cyber 9/12 is for big thinkers and future decision-makers. Cyber threats affect finance, transport, infrastructure, utility and military targets. We were tasked with becoming familiar with government institutional protocols, private sector capabilities, US cyber and military response patterns, and international legal frameworks. We had to develop policy responses with major global implications for scenarios with little to no precedent.

Cyber 9/12 is also relevant. Cyber is increasingly a focus of policy – certainly so in security, but also across areas like finance, development, and infrastructure. The competition is a brilliant way of coming to know the institutions and the people that are shaping that language and that world. The judges in each round have very rich backgrounds – by our final round, we were presenting to the Chief of Staff of the Under-Secretary of Defense, an executive from BlackRock, Mastercard, and a Senior Fellow at Harvard Belfer Centre who previously worked for the NSA.

SIPA is one of the best places to prepare you for these issues. We had the opportunity of being coached by Jason Healey, Senior Research Scholar at SIPA, and worked with SIPA’s Cyber Fellow, Hugo Zylberberg. Choosing an expert coach is critical and helped the team navigate nuances in the 9/12 Intelligence Reports.

If you’re as lucky as we were, you’ll find a group where teamwork, complementary skillsets, and a lot of hard work together will carry you to the final round. Our only regret is that they didn’t have a best team name competition, because we had that one locked up.

@GonePhishing (Anne, Jon, Léo, and Tom)

Gone Phishing and other teams from Columbia SIPA are proud to compete alongside this year’s participating schools in the national competition this March. Columbia will be joined by 31 other universities from 17 states, including teams from:

  • Air University
  • American University
  • Arizona State University
  • Brown University
  • Carnegie Mellon University
  • Columbia University
  • Daniel Morgan Graduate School of National Security
  • Duke University
  • Georgetown University
  • Indiana University
  • John Hopkins University
  • Lewis University
  • Marymount University
  • Middlebury Institute of International Studies at Monterrey
  • National Defense University
  • National Intelligence University
  • Stanford University
  • Texas A&M University
  • The George Washington University
  • Tufts University
  • United States Air Force Academy
  • United States Military Academy
  • United States Naval Academy
  • United States Naval War College
  • University of Maine
  • University of Maryland, College Park
  • University of Maryland, Baltimore County
  • University of South Alabama
  • University of South Carolina
  • University of Texas Austin
  • University of Texas El Paso
  • University of Virginia