On March 25-26, the Atlantic Council held its 10th Annual Cyber 9/12 Strategy Challenge. This event is the premier foreign policy competition for university students who respond to a hypothetical, but realistic, international crisis scenario. Students are evaluated on both written and oral policy briefs by panels of expert judges drawn from the cybersecurity and policy communities. AU Cyber 9/12 team member Taylor Kerr, SIS/MA ’23, provided this first-person rundown of the exciting weekend in which the university’s team, the AU Cyber sQuad, ultimately triumphed with a first-place finish.

On the first day of the FIFA World Cup in Doha, Qatar, a cyberattack has disabled the country’s largest desalination plant, 12 miles south of the capital. The plant’s workstations are locked, displaying only the names of deceased migrant workers. Panic spreads over water shortages. A Beijing-based incident response firm identifies a software backdoor that enabled the attack and attributes it to the US government. How should the National Security Council respond?

This was the hypothetical scenario delivered to teams participating in the 2022 Cyber 9/12 Strategy Challenge in Washington, DC. Now in its tenth year, the competition, hosted by the Atlantic Council’s Cyber Statecraft Initiative, attracted 39 university teams from across the US and included teams from Israel and Malawi. Students were tasked with proposing whole-of-government policy recommendations to the NSC—balancing diplomatic, security, economic, legal, and technical considerations.

To address this broad scope, the AU team assembled students from both SIS and the Washington College of Law: Alex Neubecker, SIS/MA ’22; Taylor Kerr, SIS/MA ’23; Laila Abdelaziz, WCL/JD ’22; and Kady Hammer, WCL/JD ’23. Their chosen name, AU Cyber sQuad, was a nod both to their four members and to the Quadrilateral Security Dialogue in the Indo-Pacific; past scenarios often implicated US-China relations, and this year was no exception. The team met regularly in the two months before the March 2 scenario release to study past competition materials and share research on current US cyber policy and authorities, anticipating the potential evolution of events.

The Cyber sQuad was coached ably throughout by SIS professor Eric Novotny and WCL professor Melanie Teplinsky. Novotny has coached award-winning AU Cyber 9/12 teams since the competition’s founding in 2013, more recently with Teplinsky coaching teams since 2017. Both professors are also faculty advisors for the AU chapter of the Women in Cybersecurity national organization, the “Botnettes,” which includes former Cyber 9/12 competitors.

The Cyber 9/12 scenario unfolds in three stages, as teams receive intelligence briefs containing simulated open-source and classified information. After the first intel packet is released, teams have two weeks to prepare a two-page brief outlining their assessment and policy recommendations, with caveats for levels of risk and uncertainty. Once this is submitted, teams have one week to condense their recommendations onto a one-page document and prepare to deliver a ten-minute oral presentation as well as be cross-examined by expert judges. Prior to the competition, the AU Cyber sQuad rehearsed extensively with faculty and cyber professionals from SIS, WCL, SPA, and the public sector.

After the qualifying round on Day One, semifinalists receive the second intelligence packet that evening and must update their policy recommendations and oral presentations by early the next morning. This time, the team received reports that infrastructure attacks had proliferated throughout the Chinese Belt-and-Road footprint, that the NSA and CIA were responsible for the supply-chain backdoor, and that US-based hacktivists were implicated in the initial attack in Qatar.

“Situations can dramatically change quickly,” says Neubecker. “[Key to] developing an appropriate response is to know what’s within your realm of control, the mechanisms to leverage in your response, and what the thresholds are to determine when a response should be made.”

By midday on Day Two, the AU Cyber sQuad was announced as one of three finalists to receive the third intelligence packet and face a panel of senior judges from the White House, Department of Homeland Security, the Atlantic Council, and the private sector. In the final round, the team had only fifteen minutes to review the updates—an American insider at the desalination plant was arrested in Qatar, a US hacktivist group claimed responsibility, and France was organizing diplomatic backlash—and adjust their oral presentation accordingly. Throughout the competition, the team was praised by judges for their teamwork, the breadth and detail of their policy knowledge, and for their professionalism and composure under pressure.

The success of AU’s team is the culmination of efforts across the university, including guidance, feedback, and insights from faculty coaches, practice judges, Cyber 9/12 alumni, and fellow students. This broad base of support will be a foundation for AU student success in years to come.

“The Cyber 9/12 competition is a unique experience that not only allows students to cement their knowledge, but learn from brilliant professors like Dr. Novotny and Professor Teplinsky and build long-lasting friendships,” says Hammer. “I cannot recommend this opportunity enough to other students.”