Stay With Me, this is Going to Get Quantum Weird

 This was originally posted on the Canadian Cybersecurity Network's CyberVoices page: Stay With Me, this is Going to Get Quantum Weird 

CyberVoices is well worth a look if you want to get a sense of cybersecurity in Canada from many different perspectives in 2024. It gets you away from the goverment / business / marketing talk about cyber which tends to contain a lot of self-interested spin.

Canadian Cybersecurity Network's CYBERVOICES.

***

Science and technology were making great strides at the end of the nineteenth century, to the point where we were beginning to discover problems with the reality we thought we lived in. Newtonian physics does a great job of describing what we see around us, but it turns out this is an illusion created by the scale at which we operate. It’s like thinking the earth is flat because it looks that way, but it only looks that way because we’re not big enough to see it; reality is in the eye of the beholder.

What we discovered as we looked closer with better technology was that the universe isn’t a deterministic machine. The double slit experiment caused great confusion because it looked like light was both a wave and a particle. Rutherford’s gold foil experiment suggested that the recently discovered atom was almost entirely empty space. Most of what you breathe in is vacuum! The universe is much stranger than we first thought, and it isn’t deterministic at all, but very much probabilistic. Einstein hated this ‘spooky action at a distance’ quantum nonsense, but through the 20^th Century we’ve come to understand that this is how the universe works.  Most people don’t know this because education finds teaching science in a Newtonian way easier. Professor Brian Cox has a good quote in his book, The Quantum Universe: “It’s not Newton for big things and quantum for small things, it’s quantum all the way.”

This emerging quantum awareness created the first quantum revolution. Once we recognized that quantum effects happen around us all the time, we started designing technology that made use of these newly discovered natural phenomena. If you think this is only for exotic university labs, you’re wrong. The flash memory that you’re likely reading this through depends on quantum tunnelling to work, as do lasers, MRIs and super conductors.

So, what’s all this talk about quantum computing and what the heck does this have to do with cybersecurity? In the 1970s many researchers started theorizing about quantum computing and Richard Feynman put it together in the early 80s, then the race was on to build the theory. What’s the difference between this and passive 20^th Century quantum technology? We’ve developed the technology and theory now to engineer quantum outcomes rather than just using what nature gives us. As you might imagine, this is incredibly difficult.

I had an intense chat with Dr. Shohini Ghose, the CTO of the Quantum Algorithms Institute at the end of our quantum cybersecurity readiness training day this week in BC. She was (quite rightly) adamant that we can’t know quantum details without observing them and when we observe them, we change them, but my philosophy background has me thinking that I’m going to try anyway. An unobserved universe is entirely probabilistic. It only becomes the reality we see when we perceive it. It reminds me of the crying angels in my favourite Doctor Who episode. This bakes most people’s noodles, but the math clearly indicates that in measuring a photon’s location we can’t also know its velocity and direction – that’s the uncertainty principle in action. I’m probably wrong about all of that, but I’d rather people take a swing at understanding this strangeness rather than being afraid of being wrong.

Alright, we’re halfway through this thing and you haven’t mentioned anything cyber once! If you think about the electronic systems we use, they’re entirely Newtonian. They reduce information to ones and zeroes and produce the kind of certainty we all like, but this is a low-resolution approach that is about to hit its limit. We’re building transistors so small now that electrons are tunnelling through the nanometer thick walls (atoms are mainly empty space, remember?) between transistors, rendering future miniaturization impossible; we’re nearing the limits of our Newtonian illusion. That means the end of Moore’s Law! Panic in the disco!

Quantum computers don’t use electronics as a common base. A quantum computer processor might be ionized particles, or photons, or nanotech engineered superconductors, and those are just a few of the options. By isolating these tiny pieces of the cosmos away from the chaos of creation and applying energy to them in incredibly intricate ways, we can create probability engines that use astonishing mathematics to calculate solutions to problems that linear electronic machines could never touch, but unlike classic computers we need to do this without observing the process or all is lost. Imagine if you had to design the first microprocessors in the dark and you’re a fraction of the way towards understanding how difficult it is to build a quantum computer, but it’s happening!

We’re currently in what’s called the NISQ (noisy intermediate scale quantum) computing stage. We’re still struggling with applying just enough energy to get a particle to polarize how we want it to, all while keeping the noise (heat, radiation) of reality out. That’s why you see quantum computers in those big cylinders as a chandelier. The cylinders are radiation shields and containers to cool everything down to near absolute zero (gotta keep that thermal noise out), and the chandelier is to keep the electronic noise of the control systems (old school electronics) away from the quantum processor.

My favourite quote from the PhDs I’ve talked to is, “a viable quantum computer is five years out. And if I’m wrong, it’s four years.” What does that mean for ICT types? Quantum computers don’t do linear. When you give them a problem, they leverage that state of being everywhere at once to produce massively parallel computing outcomes completely foreign to what we’re familiar with in our multi-core processors. Quantum algorithms are designed to blackbox the calculation, so observation doesn’t spoil quantum processes and then spit out answers as probabilities.

What does that mean for cybersecurity? Peter Shor came up with an elegant idea in the mid-90s that uses a Quantum Fourier Transformation to calculate the periodicity in prime number factoring. If you can calculate the period of two large, factored primes (there is a repeating pattern), you can reverse engineer those primes. In RSA encryption or anything else that uses factoring you could calculate the private key and tear apart the encrypted transport layer handshakes rendering secure internet traffic a thing of the past. From there you could imitate banks or governments or simply decrypt traffic without anyone knowing you’re there. You won’t see cybercriminals doing this because the tech’s too tough, but nation states will, though you won’t see them either because they will be quietly collecting all of that encrypted online data Imitation Game style. This process may already have begun with harvest now, decrypt later (HNDL).

There is much more to quantum technologies in cybersecurity than the encryption panic though. Recent research suggests that instead of running into limits with electron tunnelling in transistors, our new quantum 2.0 engineering could leverage this quantum effect to create Qtransistors magnitudes smaller and much faster than what we have now. Cybersecurity will have to integrate that technology as it evolves. Quantum communication is another challenge. NIST is making mathematical quantum resistant algorithms as I type this, but you could also leverage quantum entanglement itself to create quantum key encryption. China has an entire network of satellites testing these hack proof comms links now. There could be quantum locked portions of the internet in 15 years where high security traffic goes. Guess who is going to have to manage those secure networks.

If you’re in cybersecurity there is much more to quantum than panicking about encryption. Anyone in the field would be well served by digging in and researching this fascinating technological emergence. My colleague, Louise Turner, and I presented at the Atlantic Security Convention on this in April. Give our presentation a look. There are lots of links to fascinating resources. It’s time to free your mind, Neo.

What You Need To Work in Cybersecurity: the secret sauce

I see a lot of rules based 'quick fix' learning opportunities in cybersecurity. These are usually boot camp style condensed programs that promise to turn an accounting or science student into a cybersecurity practitioner in a single semester by showing them how to use tools in a formulaic manner. They treat cybersecurity as though it's an office job: we show you the cybersecurity rules and you follow them. You can see how well this is working by the ongoing shortage Canada faces in finding and retaining cybersecurity professionals.

I got into cybersecurity with my students in 2017 when we started chasing CyberTitan, but I brought something with us that is atypical in the world of STEM: a willingness to hack. I don't like the word hack, it has negative connotations to it in English that have been encouraged by the self appointed masters of STEM (the S&M part), but that willingness to iterate and work outside expected outcomes is the secret sauce in cybersecurity that many ignore, and a major reason for why I've taken to it like I have.

'Necessity is the mother of invention' has been the motivating factor in my relationship with technology since the beginning. I moved quickly from off-the-shelf to customized solutions based on experimentation and need. Within six months of owning my first home computer (a VIC20), I'd figured out how to copy software using a sufficiently low noise audio deck. My first x86 PC was purchased but quickly modified as I came to need more memory and processing power. By the mid-90s I was building my own computers at a time when many people didn't own one.

This process was initially powered by curiosity, which many training programs eclipse with a promise to provide the initiative so you don't have to - something that has never appealed to me and a major reason why I didn't start collecting technical certifications until 2001 (I'd been working in IT for a decade at that point). Schools are bad at nurturing enthusiasm for self-exploration too. Many educators feel that it is their job to impart knowledge in a regimented format (that's why we call them disciplines!) and assess student understanding through a system of providing both the questions and the answers to minimize any frustration. Assessment success is often a measure of compliance rather than cultivating enthusiasm and curiosity.  Many in education call this approach rigorous and disciplined - it's how they demonstrate credibility, and a reason why I haven't continued pursuing academia.

Indians have a term for austere innovation: jugaad (non-conventional, frugal innovation) which doesn't have the pejorative connotations of the English 'hack'. Jugaad celebrates common sense with a solutions focused approach to creative problem solving without needless bureaucracy. It emphasizes an applied approach to making technology work that is especially needed in an industry like cybersecurity where practitioners are often facing edge cases that the people who designed the network never thought of (which is why we're having a cyber problem). WIRED recently did an article on a Ukrainian technologist who demonstrated this start-up/rapid response approach in the war with Russia. There is even an event in cyber that is all about extreme edge cases: the dreaded zero day vulnerability. Jugaad will get you much further than any amount of system think during a zero day attack.

Kintsugi has played a part in my motorcycling.

There is also a term in Japanese that takes the derision found in English out of making old things work. I've long enjoyed the concept of 'kintsugi' or 'golden joinery', which is the repairing of old things using gold to embellish the fix rather than trying to hide it. In typical Japanese fashion it raises what is seen as banal work in the West to an artform. A concept that combines jugaad's celebration of a fix beyond rules based approaches with kintsugi's raising of that fix to an artform is where a good candidate for work in cybersecurity should find themselves inspired. When I started in cyber I found my  IT background helped in terms of understanding the mechanics of what was happening, but my kintsugi powered jugaad approach is what has allowed me to thrive.

This 'secret sauce' is often ignored in education and especially in cybersecurity adult retraining. There are some disciplines that tend to attract rules focused types, but that fixation on systemic order blinds them in the edge cases where cybersecurity often operates. Rather than retraining an accountant or rigorously compliant STEM student, I suspect that those exploring subjects like detective work in policing or creatives in the arts would find the skills they've honed more effective, but that doesn't stop everyone from demanding a computer science degree for any job in cyber.

In 2019 after the Terabytches went to CyberTitan nationals we got invited on the local radio station to talk about the experience. The interviewer asked me a good question about our DIY approach to computer tech. I was annoyed at the lack of resources, but he suggested it might be what gave us an edge. He was right, we'd been jugaading and it made us mighty!

There are many jobs in cybersecurity. People who lean toward the jugaad end where they can problem solve without restrictions can find a comfortable fit in operational cybersecurity where they are monitoring real time threats, penetration testing where they are attempting to exploit a client's system to highlight vulnerabilities, or threat intelligence which focuses on gathering reconnaissance data on threat actors. But even in the policy and compliance work, a willingness to consider and understand threats and solutions that are outside the box is a necessity. The need to nurture and respect those out of the box thinkers working in unexpected end of the cyber-workforce is essential for management. Those industries that thrive on status quo compliance are the ones you see being hacked most often because they don't respect the skillset.

This map of cybersecurity domains gives you an idea of the many specializations that the field offers, though I would argue that in all of them (even those up the compliance end) an ability to work from your own initiative and experience rather a rule book is essential.

Sam Sheepdog & Ralph Wolf know the score.

I sometimes describe cybersecurity types as sheepdogs. I think many in law enforcement also fit this description. You can't send a goat to fend of wolves, but having a wolf of your own will do the trick. Early on in my transition from IT into cybersecurity I found myself leaning on IT administrative habits that don't work in cyber, and came to realize that the jobs are very different, though the technology is the same. If you have an IT person running your cybersecurity you're likely to be constantly surprised by the attacks you face because they tend to see systems in an architectural way rather than as an opportunity to be compromised.

It would be easy to say something silly like, 'there are no rules in cybersecurity!' but that's pointlessly reductive. It would also be easy to describe all the people in it as hackers, but this isn't true either, though a mentality that tackles problems from a place of curiosity and jugaad is far better than a rules compliant myopic who can't see beyond the framework they maintain. At the end of all this I firmly believe that you need a bit of the wolf in you if you want to consider a career in cybersecurity. I wish more cybersecurity training and especially adult retraining would emphasize that when looking for candidates rather than demanding STEM grads often missing these skills. If it's a formulaic job that you're looking for, cyber isn't it.

STEM students are often missing skills which "include teamwork, collaboration, leadership, problem-solving, critical thinking, work ethic, persistence, emotional intelligence, organizational skills, creativity, interpersonal communication, and conflict resolution." Adding an 'A" to STEM doesn't fix this, incorporating an iterative, resilient, interrogative, team-based problem solving mindset into STEM subjects would, but that doesn't tend to be how we teach it.

Another piece of Canada's cybersecurity puzzle came into focus from the last post on how our cybereducation system is broken. In response to that, Francois Guay from the Canadian Cybersecurity Network followed up with the observation that the cybersecurity talent pipeline in Canada is also in tatters.

I've been thinking about that post and believe all of the responses from both new cybersecurity practitioners and veterans are valid. It would appear that when you try to fix a talent shortage with rushed retraining based on incorrect assumptions about the skillsets needed in cybersecurity, no one trusts the results. Problems such as absurd requirements for entry level positions like asking for 5 years of experience on a tool that only came out last year or demands for that vaunted yet irrelevant computer science degree continue to strangle entry level workers coming into the field, even though they have hacked (cough) their way through our broken cyber education system to do it.

Not to sound hopelessly jugaad, but the simple solution would be to introduce cybersecurity apprenticeships that give a more diverse set of potential candidates the opportunity to see if cybersecurity is a field of study that suits them. Those with the right combination of fearless curiosity, critical thinking and tenacity might find their way into it instead of continually opening the doors to STEM grads who are good at being told what to do and enjoyed the privilege growing up of being able to handle the enormous homework loads STEM subjects demand as part of their compliance regime. Students with a background in science and technology might be familiar with the medium that cybersecurity operates in, but that doesn't mean they'll be able to handle the stochastic demands that resonate across cybersecurity work. It's better to find those with the right jugaad mentality; technical familiarity will build quickly powered by enthusiastic initiative and tenacious problem solving.

I've always told my students that if they can bring a willingness to explore, experiment and a fearlessness in breaking things in the process of figuring them out, they don't need to sweat the technicalities, I can teach them those by harnessing the curiosity they bring with them. I've had strong technical students struggle in cyber because they lean on formulaic approaches to computing (they are often maths strong coders) that let them do the bare minimum. If your natural talents in mathematics and computer science have blessed you with a compliance based work ethic, cyber with its changeable success criteria isn't for you. Another favourite adage of mine in the classroom is, 'if you're looking for a way to do less, you'll usually find it.' Those that want to work in a framework often do it so that they can delineate where they can stop; in other words it's used as a way to limit their involvement. That's no way to approach cybersecurity. If solving a problem is a nine to five gig for you, go find work elsewhere.

Much of this comes back to the reductive way we have approached digital skills development (when we're not ignoring them entirely). Cyber Education is the hidden, much larger part of the digital skills iceberg.

Building Capacity: Taking CyberTitan from Niche Activity to School Culture

Just over three years ago I stumbled across the inaugural CyberTitan Student Cybersecurity Competition on ICTC's webpage while looking up statistics for the information and communication technology job market.  I managed to convince four of my seniors to take a swing at it.  We got better and better round over round as we honed in on the expectations of the US CyberPatriot competition that CyberTitan works from.

In the competition students are given a virtual machine image (imagine a computer operating system like Windows operating inside a window).  These images are broken, with improper settings and things installed that shouldn't be.  If you've ever had to try and clean a school laptop after a student has used it, you know what sort of messes can occur.

We were already pretty good at IT & Networking and CyberTitan offered us a way to exercise those skills while also discovering a newly emerging aspect of computing:  cybersecurity.  I found that our expansion into CyberTitan directly supported our Skills Ontario preparation - the two things are symbiotic.

We surprised ourselves by getting an email inviting us to the first Canadian National Finals in Fredericton, New Brunswick in May of 2018...

That success made some noise and the next year we had three teams of six students each.  While standing at the student photo for the 2018 finals, Sandra Saric, then VP of Innovation with ICTC, said under her breath, "where are all the girls?"  I took that and ran with it, encouraging my strongest grade 9 girls (I barely keep any of them into senior computer engineering classes) to form an all-female team for the 2018-19 season.

The girls did fabulously well, often chasing down our senior team on points.  Our junior team, the Cybears, also got us into the top tier of the competition for the first time before getting eliminated in the state finals.  The Terabytches offered me an inside look into systemic sexism in education as well as technology and made it clear why so many girls don't pursue technology pathways in high school and beyond.

The Terabytches won the top female team in Canada wildcard spot for the 2018-19 National Finals in Ottawa and did a lot of press which I think (hope?) opened up the possibility of ICT and cybersecurity careers to more girls.

While 2019 was definitely the year of the Terabytches, it was also a good year consolidating our skills and building capacity.  For the first time in 2019/20 we had students returning who were no longer rookies in the competition (our first year team had all graduated).  For the 2020 season I encouraged the most experienced and engaged students to make a senior team with the intent of scoring higher in the competition than we'd ever done previously.  The team consisted of one of the Terabytches from the year before and the junior team who had gone platinum.  They re-branded themselves Kings Guard and tackled the 2020 competition with a focus that can only come from experience.  

In previous years we were usually the best of the rest, getting beaten by specialist, urban schools from the big cities across Canada.  This year Kings Guard beat all but two of those teams for a third place finish in the semi-final round.  We went top-tier platinum and then proceeded to land in the top quarter of the best teams in the world.  We'd never breathed the air up here, and it tasted good!

The Terabytches experienced some turnover, but with three veterans and three  rookies,

consistently beat their national champion scores from the year before.  Our two junior teams also scored well, with Altron in particular punching well above their weight.  Both junior teams made it to the gold tier semi-finals and produced strong results.  Altron finished top 12 in the world out of thousands of teams.  Seeing our little, rural school (it is literally surrounded by farm fields) on a list with some of the top cyber-schools in North America never gets old.

We're waiting on CyberTitan to announce the Canadian finalists for this year's competition as I write this, but regardless of the outcome this year's students have produced outstanding results which point to a way forward for educators across Canada who want to engage their students with a subject that frankly freaks people out.

We aren't magic.  What got us into this was an opportunity to explore an emerging field in technology and make our program more relevant.  If you're curious and willing to give it a whirl, and can find students with the same curiosity, you can get involved with CyberTitan and begin to build capacity in this vital 21st Century fluency too.

Krista Sarginson, who teaches at St Leonard in Manotick near Ottawa, took the plunge this year and had an epic rookie season, finishing second in Canada in the middle school division.  As more teachers get involved with CyberTitan, the network grows, as does the support.

Krista described the competition early on as techy and quite particular, but it didn't take long for her to get a handle on the process and, as you can see from her team's results, they very quickly got good at it!  What could happen next?  Hopefully her Cyberlions all head off to middle school (St Leonard is a k-6 school) and encourage them to participate next year.  Those vets are likely to clinch a national title!  Meanwhile, Krista is encouraging and engaging other teachers in her board.

What does your school get out of CyberTitan?  It teaches students and staff hands on about best cybersecurity practices and raises your digital literacy in meaningful ways.  Your board's IT department will love your participation in it as it helps raise awareness around cybersecurity and promotes a healthier digital infrastructure.  The media glow around it is also very positive.  We've had a lot of attention from local and provincial media who are also very aware of the cybersecurity shortage we're living in.  I won't mention the swag students and coaches receive that includes t-shirts, all sorts of technical support, access to Cisco's Netacademy, along with medals and awards.

You can find lots of statistics on how behind we are on cybersecurity, and education can play a big part in that.  The CyberTitan/Cyberpatriot competition offers students and teachers a well supported and engaging introduction to this exciting field of study, you should give it a go!

This is what nearly 600% growth looks like - it's gone from a niche activity to a culture...

CyberTitan is only in its third year and has seen growth similar to our own, with over 200 teams from across Canada participating this year.  It's my hope that by 2022 there are over 500 teams competing and the national finals is expanded to include three middle school teams who will duke it out for their own national title.

If we're going to depend on ICT infrastructure to run our critical infrastructure (and we increasingly are), then we owe it to ourselves to take securing that infrastructure seriously.  ICTC's CyberTitan helps raise cyber-fluency in our education system which will in turn make for a safer, more secure Canada.


***

Wondering how to support CyberTitan from industry?
https://www.cybertitan.ca/index.php/about/partners-and-sponsors/become-a-partnersponsor/

Wondering how to support CyberTitan from government?
https://www.cybertitan.ca/index.php/about/partners-and-sponsors/national-program-ambassadors/

How CyberTitan works:
https://www.cybertitan.ca/index.php/competition-results-2018-2/how-the-competition-works/

This is the US CyberPatriot competition that CyberTitan works with:
https://www.uscyberpatriot.org/Pages/About/What-is-CyberPatriot.aspx

Here's the presentation I've been doing around Ontario education for the past two years:
https://prezi.com/h4kf8yfkdtyr/?utm_campaign=share&utm_medium=copy

Privilege Masquerading as Superiority

Last year while at the CyberTitan National Finals in Fredericton I happened to be standing by Sandra Saric, ICTC's VP of talent innovation, during a photo opportunity where the fifty or so student competitors were all together on a long stairway.  Under her breath she wondered, "where are all the girls?"  There were maybe three or four female contestants.  Sandra's comment resonated with me and I became determined to put together a female team that would get their own points and where no one is 'just a sub'.

CyberTitan and Cyberpatriot have doubled down on this focus on bringing women into a cybersecurity industry that has only moved from 11% to 20% female participation in the past five years.  For the 2018-19 season any all-female teams had their costs waived.  For a program that isn't rolling in support, that made a big difference and enabled me to pursue this inequity.

Graduating girls into non-traditional careers is an ongoing challenge in education.  Pushing against social norms is never easy, particularly so in our conservative, rural school where gender expectations tend to be even more binary and specialized program support significantly lower than in urban environments.  I've managed to have one or two graduating female computer technology focused students each year, but even that small step has only come after massive effort, and it's not nearly enough.  Even with all that stacked against us, we still managed a 33% female participation rate in CyberTitan this year, and of our six Skills Ontario competitors, two were female.  We're aiming to raise that even higher next year.

This year CyberTitan made a point of trying to address the very one sided gender participation in the cybersecurity industry by making the national wildcard position open to all-female teams.  There were only 15 out of 190+ teams in the competition, and our Terabytches finished in top spot.  We were delighted to discover that one of our boy's teams actually finished one place out of the top four eastern teams.  A number of people (oddly all male)  grumbled about the all-female wildcard spot, but the irony is that we knocked ourselves out of the finals.

Taking an all-female team meant that I needed a female chaperone with us.  Fortunately, our board's head of dual credit programming is a triple threat.  Not only is she very tech focused (her student just won top secondary brick layer in Ontario!), but she's also computer science qualified and an absolute joy to travel with (I went to Skills Canada Nationals in Edmonton with her last year), so I quickly asked her to join us when the call came through to bring our girls to nationals.  Not only did she not need coverage herself, but she kindly covered mine so my school literally paid nothing for this trip.

I like to think I'm pretty sensitive to gender roles in the first place, but taking an all-female crew to this event had me constantly seeing micro-aggressions I might have otherwise missed.  Within five minutes of picking up the Toronto (all-male) teams on the bus ride to Ottawa, one of them had intimated that we were only there because we're a girl's team.  Another later said that it's not fair that girls are getting special attention.  It must be tough when everything isn't about you all the time.  These comments were a daily occurrence from all the other teams, even the two co-ed ones, one of the girls of which said that she was just the sub.

That same Toronto team was able to attentively listen to a male speaker during the visits to cybersecurity companies in the Ottawa area after the competition, but the moment a woman stepped up to speak they began a loud and rude conversation among themselves.  I wonder how often these little princes (who did ever so well in the competition) have had their gender superiority enforced to develop such outstanding habits.

Walking in to the competition, our team had all signed in but one and as she reached for the pen a boy from another team stepped in front of her like she wasn't there.  Talking to Joanne and the team about it after, they shrugged and said, "you get used to it."  By that point I'd been triggered by this so much that my already light grip on my aspie-ness was slipping and I was starting to get right angry, but even that anger response is couched in a male sense of privilege.  When a man gets angry it's seen as assertiveness, when a woman gets angry she's a bitch, which brings up yet another point.

After fighting to get a team together against overwhelmingly genderized expectations in our community, and encouraging that team to develop a representative sense of identity in an overwhelmingly male contest, and then having to push back when the powers that be didn't like the name, you'd think this was all starting to get too heavy, but it has only clarified my sense of purpose.

Wouldn't it be wonderful if girls didn't have to get used to being invisible and could self-identify without being told what they can and cannot be called?  Wouldn't it be wonderful if everyone could be what they are and explore what they could be without some small minded traditionalist trying to put them in a superficial box?  When you push back against that social apathy you get a surprising amount of kickback from the people it benefits.  Ontario's current political mess is entirely a result of that conservative push back.

You even get kick back from the people it subjugates.  At an ICT teacher's meeting earlier in the year, a teacher from an Ottawa school said she would never run an all female team because it isn't fair to her boys.  Were everything else level, I'd agree with her sentiment, but in the landslide of unfairness around us, you'd have to be wilfully blind to ignore historically integrated misogyny in order to be 'fair to your boys'.  This teacher taught at the local International Baccalaureate school, which brings up yet another side of competition and privilege.

Toronto, Winnipeg, Edmonton, Vancouver... Fergus.  Your
usual expected centres of digital excellence.

We're a rural composite school that spreads itself thin catering to our entire community.  The major industry in our region is farming, we recently had our annual Tractor Day.  Our school contains programs for developmentally delayed students and has a sizable special needs student population.  We also manage to run a number of successful academic programs, but these are by no means our sole purpose.  Tech exists in there somewhere.

As far as computer technology goes, our lab is a room full of ewaste we've re-purposed to teach ourselves technology.  Thanks to some board SHSM funding and an industry donation from AMD we got the cheapest CPUs and motherboards we could find and put them in ten year old ewasted board PC cases running on ancient hard drives and power supplies.  My students have never touched a new keyboard or mouse in our lab.  We have to clear away our practice networks built of garbage because we have the largest tech classes in our board and province and we have no room in the lab to leave those networks set up with classes of 31 coming in next period.  I don't imagine any of the other schools operate in a similar environment.

We returned the board desktops in our room to the school who redistributed that money into other departments because you can't teach digital skills on a locked down machine.  We've received no school funding for the current lab.  Looking into the backgrounds of who we were up against in this competition, every other school is a specialist school from an urban centre.  In many cases they only teach top academic stream students pulled from other schools, and yet they can't put together an all-female team for this competition?  One wonders if those competition focused, talent skimming schools inherently encourage gender imbalanced technology with their incessant focus on winning.

We're built on sweat and tears.  Our disadvantage is also
our strength, but when it comes to competition it
gets frustrating not getting to run the same race
as everyone else.

The socio-economic side of privilege is every bit as battering as the sexism.  One of the little princes from Toronto was telling a Terabytche about his parent free March Break touring Europe with his friends.  She replied, "Hmm, I spent the week playing video games in Fergus..."  Last year half of our CyberTitan team had never left Ontario before, let alone had a week in Europe with their buddies.  The students who attend these specialized schools tend to come from economically enabled backgrounds and have parents looking to leverage that advantage.  The amount of support those wealthy families rain down on these specialty programs is yet another advantage we can only dream of.

Think the privilege ends there?  Because we cater to the full spectrum of students in our community, my classes are huge in order to reserve smaller sections for high-needs students (even though many of them also take my courses).  In talking to other coaches, my class sizes were the largest by a range of 20% to a staggering 50%, and their operational budgets ranged from five to twenty times what mine are; I teach up to twice as many students with a fraction of the budget in a lab made out of garbage.

We were surprised to learn that we would be beginning the competition short-handed because one of the IB schools had exams some of their competitors had to write, so to keep it fair we'd all start short handed.  Right.  Gotta keep it fair.

That these urban, wealthy, gender empowered, privileged kids are flexing that privilege doesn't surprise me.  That they continually complained about special treatment for a group of underfunded, rural, girls busting through gender expectations in technology, and who fought their way to these nationals literally using ewaste, only underlines the expectation that comes with their privilege; the expectation of winning.

In spite of these society-deep gender inequities and our specific socio-economic circumstances, the quality of my students continues to shine through.  Finishing fifth last year with only four team members and two broken competition laptops was just the kind of awesomeness I've come to expect from our kids.  It didn't occur to me to have the whole competition changed to make it fair for them.

This year we managed a ninth place finish out of ten teams, only beating the intermediate team who can't really compete with older more experienced teams anyway.  That earned another round of, 'you're only here because you're girls' from other teams.  After careful consideration I think my response is: if you came from where we came from, I wonder where you would have finished.

Is winning more about how you perform, or how you are economically and socially engineered to succeed?  I'd love to give gender and social equity to those complaining about our presence.  Having those boys experience people talking over them and stepping in front of them like they aren't there would be good for them.  Facing down gender based prejudice in an industry where women are a small minority is an act of bravery, not special treatment.  Wouldn't it be nice to bring everyone up instead of holding people down?  To do that we need to recognize what winning is, and how privilege enables it.

Next year we have returning students for the first time in this competition.  I'm aiming to put a co-ed team of our fiercest veteran cyber-ninjas together, build tech out of garbage and then win anyway.  Nothing gets me going more than an underdog fight against privilege, especially when those with that privilege like to selectively ignore it.

I hope we'll be back with another all-female team too.  Many of the Terabytches are interested in returning, but I can understand their hesitancy.  Working through this competition has challenged them in ways that were unintended.  If it was just about technical skill, then we'd have been much further down the track, but when you have to fight to be noticed and are constantly talked down to, it's exhausting.  I get why they might think twice about going through the never-ending online and face to face sexism all over again.  It'd be nice if other schools would pick this up and run with it instead of rolling their eyes at it.

Last year was all about giving the haves a black eye, and it thrilled me.  We didn't return home with a trophy or a banner, but we were running a different race.  I'm not even sure how anyone could make this an even race.  Teaching technology is dependent upon access to it, and the digital divide is deep and wide.  This year it was about something even bigger.  Yet again we came home empty handed, but I think what we won was worth more than any of the prizes.  I hope the girls see that and come back to defend their title.

An amazing opportunity and a chance to begin to create balance in an industry that lacks it.  Great work ICTC!

Playing To Win

Last year we were stunned to get an email saying we'd made it through to the Canadian national finals for the first ever CyberTitan student cybersecurity contest.  We knew, on the face of things, that we weren't up at the pointy end of things, though we had made big improvements as we came to see what the competition wanted from us.  We couldn't really understand how we'd finished top two other than the fact that there really weren't many teams in the eastern division.

CyberTitan is the Information and Communications Technology Council (ICTC) of Canada's national competition for Canadian students interested in developing skills in cyber security.  We've become so dependant on ICT infrastructure that it underpins many other critical systems like our food delivery, energy and finance sectors.  Yet this critical infrastructure is taught as an afterthought in Ontario's education system (even as it becomes instrumental in delivering curriculum in all other areas of learning).  Being able to secure and maintain ICT infrastructure isn't a nice idea, it's increasingly a life and death one.

ICTC's creation of the CyberTitan program is a forward thinking move.  With one of the largest job vacancy rates of any field and while other countries create military and civilian agencies to develop this new expression of ill intent, cyber security is being ignored at our own peril, but ICTC is trying to do something about it.

We went to last year's nationals in Fredericton and had a fantastic experience.  Three of our team had never left the province or been on a plane before.  The competition took a radical turn from the Cyberpatriot rounds we'd done previously, but we did our best and managed a fifth place finish being beaten only by teams who have been doing this for years through the American Cyberpatriot competition.

This year we hit the ground running in September.  I'd already arranged a senior team and an all female team, but interest was so high I took the hit and paid the late fee for another team of interested junior students before realizing my department budget had been eviscerated and this would drive me into the red.  Those students named themselves the Cybears and stunned everyone by topping our scores in the first two rounds of Cyberpatriot, the US run competition that CyberTitan follows in the early rounds.  Cyberpatriot tiers the teams after the two opening rounds and then pitches challenges to each tier depending on their ability.  Platinum teams are still in the hunt for the world wide title but lower tiers still get to compete for top of tier and wildcard prizes.

Since this was our first time seeing platinum level challenges, the State Round was a rough ride for our Cybears. They didn't manage to finish in the top 25% of platinum teams worldwide and as a result they are out of the semi-final round coming up next week.  Having to tell our strongest team that they are out wasn't easy, but it did shed light on how we got to nationals last year and how the competition is organized.

Last year we struggled at the beginning but got better and better each round.  We ended up Gold tiered and in the State Round had our best run yet, which is what got us to the Canadian Nationals - CyberTitan only looks at State Round results and doesn't seem to take tiering into account.  Platinum teams trying to climb Everest are considered on equal footing with Gold and Silver teams climbing Blue Mountain or a mole hill.  It would be like having some students write a 4C exam and others a 4U exam and then considering the grades as equal.

This led to an interesting conversation with the frustrated Cybears who, had they backed off on points in the early rounds would have landed in an easier tier and had a direct run to a top score in the State Round.  Do we play dumb and get an easier tier to get higher scores at the end?  That's the path we unknowingly took to the national finals last year.

In talking it through we all eventually came around to the same conclusion:  we go full bore the whole time even if it means a tougher time later on in the competition.  The goal should be to go Platinum and then qualify for the national semifinals and get through the hard way.  This puts us in the best possible place to actually win Nationals.  We could be cunning and play this to get easier tiers and game our way into the Nationals, but just getting to Nationals isn't the point, improving our skills and being competitive in it is.

Next year we're aiming to build an all-star team out of the strongest contenders in this year's three teams.  That team isn't going to try and game its way into a National finalist spot.  We're going the long way around, or not at all.  Meanwhile, our senior team got strong in Windows security management and thanks mainly to the scores of those Windows boys ended up finishing 2nd in Canada in the Gold tier.  Their Cisco networking and Linux results, while slowly improving, are way out of line with other teams around them, so they have an uphill battle to get the points they need to survive the semi-final round.  Since they're in the Gold tier the images won't be as hard as they might be, so points should be findable.  They've gotten better in each round, so a strong national finish is in the cards.

Our junior team is actually our girls' team. Most of them were grade 9s last year with only two in grade 11.  The contest stressed them early but they showed incredible resilience and adaptability, pulling themselves up into the Gold tier and finishing right behind the senior Cybeavers, 3rd in Canada in their tier.

Last year's nationals was a very male centric contest.  This doesn't surprise me as finding females willing to stick with digital technologies has been an ongoing struggle at my conservative, rural school.  The all-female staff of ICTC people at the Nationals noted the lack of female competitors.  Getting women into technology is an ongoing battle, but more than a wildcard entry, I'd love to see the Terabytches win their way into the National finals and be the first all female team to do it.  I'd then like to see them take a serious run at winning it.

Unlike last year when we built a team of graduating seniors who all left us for university, this year we only have one or two graduating seniors.  We have already seen a significant step forward in terms of raising our skills and knowledge of cybersecurity (all three teams beat last year's team's State Round score).  By being able to cultivate talent and build experience year over year, our future teams in this competition look promising indeed.

Two Gold Tier finishes in the 2019 State Round - nice to see!

The Cyberpatriot competition does a lot of things that align with Ontario's computer technology curriculum.  Joining it gives you access to Cisco's Netacademy while also encouraging focus on what to get better at quickly.  The maintenance work we do in Windows 8.1, 10 and Server aligns with Skills Ontario's IT & Networking scope, acting as a great review for our Skills competitors.  We struggle with Linux, but understanding Unix based operating systems is vital for web development, another Skills Ontario scope we're chasing, so getting better there is no bad thing.

With so much student interest, our successes to date, and how complementary CyberTitan is with our other activities, I don't see us dropping it any time soon, though it was mighty difficult to tell the hardest working, most focused and most successful team that they are out because they qualified too well.  Spending the $400 on registration and then another couple of hundred feeding my CyberTitans while they were battling in this cyber-marathon is also hurting now that I'm looking at an eviscerated department budget.

Friday, February 1st, while everyone else is writing day four exams thanks to some nasty winter weather, I've arranged to have all my competitors' exams bumped to Monday and we'll be in a six hour battle to see if we can win our way to the National Finals for the second year in a row.  I hope both teams show up ready to do their best work.  As long as we're running at 100% of our capacity, the results don't really matter, though when we're this close it'd be nice to win!

It looks like at least two eastern division teams are ahead of us
on points, so it looks like our 2018-19 CyberTitan drive is at an end.

As a quick follow up, it looks like we're finally out of the competition after the semi-finals.  The Terabytches did great work in Windows and Cisco, but struggled in Linux and fell short in the semi-finals.  Doing this round we've never seen before in the middle of exams made it very difficult for the everyone, but especially the juniors, to focus on preparing for semis.  The Terabytches (for the first time in the contest) seemed ruffled, making mistakes they hadn't previously when managing images and working within the competition framework.  The penalties received were all good experience though and will only make for a more resilient team next year.  Now we've seen what can go wrong, we know how to avoid it in the future.

The Cybeavers were as strong as ever in Windows, where they were consistently near or at the top of the country.  They struggled in Linux but came in at about the State Round average number of points in that category, so held their own.  The Cisco networking once again stumped them, causing us to lose places and ultimately fall short of at least two other eastern division teams, which means we're probably finished.

Creating senior teams that are strong across all sectors of the competition (Windows OS and Linux OS security management and Cisco networking) is going to be the goal for next year, and looking at our two junior teams, we're spoiled for choice.  Up until last year I was still getting bumped into teaching English and wasn't even a full time ICT teacher.  Computer science at our school is only a couple of sections and digital technologies in general struggle to reach a sustainable level in our building.  That our peripheral program in our rural school is able to produce results like we do is very satisfying and shows my students what they can do if they work together and apply themselves.  We'll keep doing that, one way or another, even if it means winning the hard way.  Next year we'll be doing it with our first ever veteran teams.

If you're trying to drum up interest in ICT in your school, this is a good way to do it!