IE 11 is not supported. For an optimal experience visit our site on another browser.

Not just for nerds: These teens are training to fight cyberattackers

In a swanky waterfront hotel outside Washington, D.C., this week, more than 100 people are feverishly battling complex cyberattacks and wor
/ Source: TODAY
Students battle to protect a network from cyberattackers at the 2014 CyberPatriot VI competition.
Students battle to protect a network from cyberattackers at the 2014 CyberPatriot VI competition.David Keith

In a swanky waterfront hotel outside Washington, D.C., this week, more than 100 people are feverishly battling complex cyberattacks and working to keep critical online systems secure. But these aren't security professionals -- they're middle- and high-schoolers who are training to protect our country from serious threats.

These online warriors are battling March 11-15 in Maryland as part of the seventh annual National Youth Cyber Defense Competition: a cybersecurity-focused contest presented by the Air Force Association's CyberPatriot education program.

The competition is like the Little League World Series, but for the cybersecurity set -- and the CyberPatriot clubs function a lot like any school baseball or basketball team. Like any other school club, they meet on a regular basis -- but instead of dribbling a basketball or snapping yearbook photos, these students are learning about online threats and how to secure our nation from the increasing number of attacks on companies like Sony, Anthem and Target.

The 2015 CyberPatriot program attracted more than 2,100 student teams from all over the United States, Canada and Department of Defense schools abroad, and after a few rounds of competition, 28 teams made it to the national finals.

"Let me tell you, what these students are tasked with is not easy," CyberPatriot commissioner Bernie Skoch, a retired brigadier general in the U.S. Air Force and former IT consultant, told TODAY. "They sit down here, and they're treated like they're the IT professionals at a real company that need to secure a company's network. We cook in all kinds of cyber vulnerabilities that the students need to fix."

The pressure of the four-round competition can be intense. The teams of five students (teams may have a sixth student as an alternate) sit down at computers and work to identify and fix problems. Perhaps everyone's password is 'password,' or every user on the network has administrative permissions they don't really need. The system could be riddled with malicious software that keeps popping up until the students find and delete the bad file. Or the students may even have to fend off real-time denial-of-service attacks or password theft. Other rounds include quizzes that ask the students to explain why they took certain actions during their defense session.

"As soon as they start the competition, we [the CyberPatriot staff] can see everything they're doing, and the team gets awarded points," Skoch said. "'Ah, they fixed the router problem, 10 points! But oops, they unfixed that password problem, so they lose 10 there.' And they can see a live scoreboard that shows how other teams are doing. It's so much fun to see them work together, to scramble to solve these problems."

The CyberPatriot VII competition, of which defense company Northrop Grumman is the main sponsor, has awarded more than $200,000 in scholarships to the winning high-school teams since the competition's inception in 2009.

"It's incredible to see how we started in 2009 with eight teams, and now we have more than 2,100," Skoch said. "We don't know exactly why -- I don't think it's because we're particularly good looking! -- but it was serendipitous. We tapped into something that's happening in our world, and added this team-based, competitive aspect that I think is truly unique."

'It absolutely has the flavor of a sport'

That's what attracted Josh Even, the captain of Team Maroon at Red Bank Regional High School (RBR) in New Jersey, who is competing this week.

"I was attracted to it because of the opportunity to apply the skills I learned in class, but I really fell in love with the competition," Even, a senior, told TODAY. "It's definitely tough to go from working alone to working in a team, but it really teaches that you need to be cooperative with your teammates."

Even compared the competition to his experience as a varsity tennis player, and he pointed out "almost every kid on the team is a varsity athlete. We're well-rounded kids. This isn't just, like, for nerds."

Even's teacher, Mandy Galante, laughed at that: "He's right on two fronts: One, it absolutely has the flavor of a sport, and two, I've never had kids with such broad lives. I'm like, what is this girlfriend thing? We have practice!"

Team Maroon practices almost every Wednesday for about two hours, with occasional weekend meetings, under the supervision of Galante, who has won several awards during her time teaching at RBR's Academy of Information Technology.

The high school program has been such a success that Galante recruited her daughter-in-law Kristen Galante, a middle-school math teacher at Markham Place School in nearby Little Silver, New Jersey.

"We talked last summer and said, OK, we'll see if we get enough interest [at Markham] to make even one team," Kristen Galante told TODAY. Instead, Markham Place signed up two teams: one four-girl group and a team of two girls and three boys. Both teams made the national finals.

"I don't want girls to have to feel the stigma that [cybersecurity] is somehow a boys' thing," Kristen Galante said. "And it's clear they don't feel that way. They're giving the boys a run for their money."

Middle school may sound young for kids to be taking cyber defense lessons, but Kristen Galante said "people would be amazed at what these kids can do. I hear them using the vocabulary, see them running down the checklist of what they need to do, and it's just like: Oh my gosh. They really understand this stuff."

'I want to be someone who knows the issues that are facing our nation'

It's unlikely that middle-schoolers have careers on their minds as they work through the CyberPatriot program. But for the oldest students, post-high-school life beckons -- and at least one team says their paths have been altered by the CyberPatriot experience.

All six members of the CyberSloths team at Grissom High School in Huntsville, Alabama are in their last year of high school -- and they're competing this week for the final time. Five of the team members have already held jobs or internships in cybersecurity fields, including at local engineering and IT firm Dynetics.

"I'm planning to become an officer in the Air Force," Morgan Wagner, one of two women on the CyberSloths team, told TODAY. "We have to be worried about cyberwarfare. I want to be someone who knows the issues that are facing our nation, and someone who can teach others."

The CyberSloths, led by math and computer science teacher Chris Sutton, are a tight-knit group who spend "about 80 percent of our time together," said teammate Michelle Driessnack. They've papered their meeting room with two dozen photos of their mascot, the Astronaut Sloth (of 2012 meme fame). This past fall, team captain James Brahm convinced the superintendent to let the team host a LAN party -- to play multi-player video games on a local network -- as an alternative to the school's homecoming dance.

In addition to preparing for this week's competition, the Sloths have been busy over the past year mentoring the four younger teams in their school district. And next month, they'll host a "Cybersecurity Prom" at Grissom.

"It's just become a huge part of our lives, in every aspect," Brahm said. "I can't believe it's our last year. It's been everything."

The Grissom CyberSloths play games at the alternative Homecoming party they hosted last fall.
The Grissom CyberSloths play games at the alternative Homecoming party they hosted last fall.Courtesy James Brahm

'This affects every one of us'

That's the type of sentiment that keeps Skoch, the CyberPatriot commissioner, inspired to introduce science, technology, engineering and mathematics (STEM) fields at an early age. About 90 percent of CyberPatriot competitors attend four-year programs after high school, he said, and almost 70 percent of team members end up in STEM fields.

"I can remember my own STEM moment: My father bought me a telescope when I was 12. I saw the rings of Saturn and I said, 'Holy cow! I'm hooked!' I want other people to have their own STEM moment," Skoch said.

Skoch, a father of six and grandfather of 14, said CyberPatriot is about to introduce an elementary-school cyber initiative.

"I joke that eventually we'll have in-vitro education," Skoch said. "But the truth is, cybersecurity affects all of our lives. It affects every one of us, and we need to start training early. "

Skoch said he isn't "smart enough to have a silver bullet that'll stop the bad guys," but he hopes one of CyberPatriot's young cyber warriors will.

"We have to find the solution, because the problem transcends all barriers," Skoch said. "It's almost existential. We could face a major catastrophe if we don't get this right, and we believe our students are the key."

This story was originally published on March 13 at 11:50 a.m.