CyberPatriot Trains Kids To Protect America

VIENNA, Virginia — The scene doesn't look all that different from study hall or an after school club meeting. Middle school students, aged 12 to 14, sit huddled around computers. There's light chatter but most kids are silent, intently focused, faces lit by the glow of their screens.

James Henry turns to his teammate Mitchell Yam and says, "Password complexity is enabled." Moments later, the tune from Mario Kart that sounds when a level is complete rings across the room. The students don't pause to celebrate; they just nod at each other and turn back to their screens.

"The goal is to score as many points as you can, and to do that you have to solve these issues that hackers can exploit to get into the computer," Henry explained later.

He and his teammates from Kilmer Middle School in this Washington, D.C. suburb are part of an annual cyber defense competition called CyberPatriot.

Staged in five rounds over six months, CyberPatriot pits teams of middle and high school students against each other as they try to secure their simulated computers against everything from malware and hackers to disgruntled former employees.

More than 25,000 students across the U.S. competed this year.

"Basically the kids get a scenario," Henry's coach and Kilmer Middle School information technology teacher Susie Suchodolski explained. "So they own a business and they have to protect that business from their employees and from people in the outside world that want to gain information about something on their computer system."

It's a skill that's in stark demand right now. As of March of this year, more than 300,000 cybersecurity jobs across the U.S. were unfilled, according to CyberSeek. The Center for Cyber Safety and Education predicts there will be a global shortage of 1.8 million cybersecurity professionals by 2022.

The struggle to attract and maintain top cyber talent was a recurring theme in confirmation hearings for Gen. Paul Nakasone, the new commander of U.S. Cyber Command and director of the National Security Agency, who said talent recruitment would be his first priority going into the job.

Such a priority that Nakasone — a supporter of CyberPatriot — agreed to give NBC News' Cynthia McFadden his first interview since being confirmed.

"In being able to address that shortage, organizations like CyberPatriot are critical," Nakasone told McFadden.

"When we think about the future, think about what these young people are going to do. Whether or not they're in government, they decide to join the military, they're in private sector, this is the strength of our nation," he explained.

It was the same idea that propelled the non-profit Air Force Association (AFA) to start CyberPatriot back in 2009.

The AFA's board members saw a 2008 study from the Congressional Research Service that cited bleak statistics about America's future in math and science.

"We saw us falling behind in STEM education as a national security issue. If China and Russia have better STEM people, then we're going to fall behind in that," CyberPatriot's Deputy Commissioner Rachel Zimmerman explained.

Meant to promote students' interest in STEM fields like cybersecurity and computer science, the AFA launched CyberPatriot with only eight teams in the Orlando, Florida area. Nearly a decade later, it has grown into a competition that draws kids from all 50 states, Puerto Rico, and the U.S. Virgin Islands.

The threats facing America's cyber infrastructure have grown with it.

Data breaches cost American companies $7.35 million on average last year, according to a study sponsored by IBM, and a data breach at Equifax compromised the personal information of more than 147 million Americans.

"Everybody uses a computer, no matter what industry you go into. Knowing how to secure it, and not being that employee who downloads malware onto your company's computer, is going to be beneficial no matter what you go into," Zimmerman said.

That logic appealed to a slew of organizations that agreed to help fund CyberPatriot, from Facebook and Symantec to the U.S. government itself.

Defense contractor Northrop Grumman, CyberPatriot's primary funder, rewards the competition's winners with thousands of dollars in college scholarship money.

To Nakasone, the fact that the program has drawn the interest of both government and the private sector is natural. "I think it speaks to the recognition, not only of the need, but the importance of what we do and what we're going to do in the future in cyberspace."

Ret. Gen. Suzanne Vautrinot even hired a team of CyberPatriot competitors as interns when she was leading the Air Force's cyber command.

"It was actually classified," Vautrinot said, "We got them clearances to be able to do work as a high school student, as an intern. And they learned on the floor. The next year, that team won CyberPatriot."

"You're not babysitting them," she explained, "You're injecting them with something that is going to make them a superhero in the future."

For Kaylee Kirkwood, 16, and her all-female team from Highlands Ranch, Colorado, cybersecurity wasn't an interest — let alone a passion — before they joined their high school's CyberPatriot club.

"It's mostly marketed towards boys. And they make the stereotype that it's like, 'Oh, well boys love videogames. Boys will be boys,' you know? And it makes it so girls, like even for me, I didn't even consider this to be a thing that I could be doing," Kirkwood said.

Despite being first-time competitors, Kirkwood and her team were among the less than one percent of CyberPatriot participants who made it to the final round held in Baltimore, Maryland.

One of the perks of making it that far is exposure to some of the biggest employers in technology and a tour of Northrop Grumman.

"They have people, they come in, to try to infiltrate the company, you know?" Kirkwood recalled, "It was just interesting to see how it's applied from a business standpoint."

"We get to connect with these people in more of a professional setting before we've even gotten to college or thought a lot about college, so it's really a game changer for a lot of us making our decisions," Kirkwood's teammate Katherine Rocha said.

It was certainly a game changer for Kirkwood, who has decided that she wants to pursue cybersecurity at the Air Force Academy after high school.

"I didn't really know what I wanted to do until I joined this club," Kirkwood went on, "Right now, you know, I do kind of want to go and pursue this as a career."

NBC News:

US Air Force Hacked By Teenager:

« US Builds The Fastest Supercomputer. For Now.
The Five Most In-Demand Cybersecurity Roles »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Code Decode Labs

Code Decode Labs

Code Decode Labs provides consulting for IT Technology, Cyber Security, Advanced Defense & Policing Technologies, Intelligent Networks, and Information Security.

Securosis

Securosis

Securosis is an information security research and advisory firm dedicated to improving the practice of information security.

Daon

Daon

Daon offers a universal biometric authentication platform for mobile devices.

Leibniz-Rechenzentrum (LRZ)

Leibniz-Rechenzentrum (LRZ)

The LRZ supports ground-breaking research and teaching in a wide range of scientific disciplines including information security and data protection.

Cymulate

Cymulate

Cymulate is a SaaS-based breach and attack simulation platform that makes it simple to know and optimize your security posture any time, all the time.

Ashley Page

Ashley Page

Ashley Page offer a unique cyber insurance and risk management solution - Cyber+Insure.

US-Africa Cybersecurity Group (USAFCG)

US-Africa Cybersecurity Group (USAFCG)

USAFCG provides cybersecurity consulting services and delivers training programs for capacity building in Africa.

Envelop Risk

Envelop Risk

Envelop Risk is a global specialty cyber insurance firm, combining decades of insurance industry expertise with sophisticated cyber and artificial intelligence-based analytics.

Kennedys

Kennedys

Kennedys is a global law firm with expertise in litigation/dispute resolution and advisory services, particularly in the insurance/reinsurance and liability sectors, including cyber risk.

Krista Software

Krista Software

Krista is an intelligent automation platform that combines iPaaS and Conversational AI to automate complete business processes across your teams and apps.

Gen Digital

Gen Digital

At Gen™, our mission is to create technology solutions for people to take full advantage of the digital world, safely, privately, and confidently – so together, we can build a better tomorrow.

Scybers

Scybers

Scybers are a global cybersecurity advisory and managed services company. With our deep expertise, we help our clients reduce their cyber risks with confidence.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

Xact IT Solutions

Xact IT Solutions

Xact IT Solutions are a certified cybersecurity firm offering cybersecurity, compliance and managed services.

CR Group

CR Group

CR Group is a Swedish-owned, cyber-security company oriented towards the European market. We offer solutions for vital societal functions that are both easy-to-buy and easy-to-use.

Xygeni

Xygeni

Xygeni is a leader in Application Security Posture Management (ASPM). Our advanced technology detects malicious code in real-time to prevent malware infections.