The blueprints for a teleporting ray gun have been stolen. Clues that could lead to the perpetrator have been left all over the reception area. Each piece of evidence leads to a snippet of a code. That code will unlock a document that has another clue for figuring out who stole the blueprints.
That’s the opening scene from a game launched this week that could become a training ground for the next generation of cyber security experts and GCHQ spooks. And 12-year-old Ben Rackliff designed it.
“My dad helped me with the idea, but I designed all of it,” Rackliff tells WIRED.
Rackliff spent a month building the first stage of his Cluedo-like challenge, which is part of an online cybersecurity game launched this week. The game, called Cyphinx, is designed to get people excited about careers with employers like surveillance agency GCHQ, and is the latest project from Cyber Security Challenge UK.
The Challenge — which is in part-funded by the UK government and supported by GCHQ — claims to address a global lack of interest in cybersecurity. By 2020 there is expected to be a global shortfall of 1.5 million staff, according to a study by (ISC)², a non-profit organisation that specialises in cybersecurity education. The UK government‘s plan? To target Britain’s 30 million gamers, who it reckons might have the talents and interests necessary for such a career.
“The Cabinet Office is extremely proud to have sponsored the creation of Cyphinx,” says David Raw, deputy director of the Office of Cyber Security and Information Assurance in the Cabinet. “We believe that Cyphinx is going to deliver huge benefits in providing an innovative, challenging and immersive environment in which to identify the cybersecurity professionals of the future.”
The aim is to foster relationships between talented youngsters and cybersecurity professionals.
“The big thing missing from bringing talent into the industry was actually engaging the talent where they live, which is in the games world,” Jay Abbott, technical director of Cyphinx, tells WIRED. “It’s designed to try and engage people who aren’t even thinking about cybersecurity as a career.”
Cyphinx is literally a virtual skyscraper of challenges that gamers have to crack to build their digital CV. The challenges draw on the day-to-day work of cybersecurity professionals. As well as Rackliff’s challenge, which was developed for security testers ProCheckUp, tasks have also been developed by data loss prevention firm Clearswift and other cybersecurity experts.
Some of the games are similar to previous competitions hosted by Cyber Security Challenge UK’s while others others are more immersive, such as the Minecraft challenge, which tests logic and research skills in a specially designed Minecraft level.
David Mound — of 3SDL, a defence and security consultancy — designed a challenge that focuses on social engineering and the information we leave online. It takes the gamer from YouTube to Twitter, and finally to a map that needs decoding. Mound’s game is modelled on the Challenge’s more traditional competitions, but it is now within the virtual environment — a skyscraper buzzing with the avatars of other players, mentors and recruiters.
Mound has been interested in cybersecurity since he was 14. But because he didn’t have the qualifications or connections to land a job in the industry, he ended up spending 14 years in the Navy after school.
“I found it very difficult,” Mound explains. After the military, he took part in one of Cyber Security Challenge UK’s masterclasses, which led to his current job at 3SDL, a defence and security consultancy firm. “Since then people have been banging on the doors.”
Mound has worked with the Challenge ever since, and was instrumental in forming its White Hatters Academy — a group that mentors people interested in a career in cybersecurity.
Jamie Hankin is one person who found a job through The White Hatters Academy. At 18 he was bored in college and dropped out of his IT diploma. With no higher education, he struggled to find work in the security world. He began dabbling in what he describes as “some bad stuff”.
“It’s quite easy to go down that route,” says Hankin. An average of 100,000 cyber crimes are committed in the UK each year. Luckily for Hankin, soon after a friend told him “it’s really bad,” he made it onto the Cyber Security Challenge masterclass.
Within six months he landed a job at Modux, a digital security firm.
“Pretty much what I do now is my dream job,” Hankin tells WIRED. And he’s a big fan of the new game. “I think it’ll bring in a whole new generation of people.”
It’s not just autodidacts like Hankin and Mound that find it hard getting a career in cybersecurity. Only 0.6 percent of recent university graduates were recorded to be working in the cybersecurity sector in 2014. In a move to increase these numbers, GCHQ approved six masters degrees at universities across the country designed for the industry.
More recently, it launched the “Cyber First” scheme to identify talent, work with the Challenge and other competitions, and offer training and grants. There are up to 20 spots on the scheme, which also offers £4,000 grants to each participant.
“Our aspiration is simple — we want the UK to be one of the safest places to do business and use services online,” said Francis Maude, then minister for the Cabinet Office, to parliament in March. “The new Cyber First scheme will help ensure we recruit and nurture talent and that the UK has the best possible skills to protect itself for the future.”
The game is already attracting talented children who, unlike Hankin and Mound, don’t know much about digital security. Ben Rackliff is a good example of how the game could engage new youngsters. He designed the Cluedo-like game.
Ben’s father, Darren Rackliff, got involved with Cyber Security Challenge UK when he worked for ProCheckUp. He was keen to design a game for Cyphinx and needed someone to build it. He was initially hesitant to let his son design a challenge.
“I didn’t want him to do it, because I didn’t want Legend of Zelda turning up, and I didn’t want 12-year-old humour turning up in it,” he jokes. “It’s got to be a professional product because of the community it’s going out to.”
But he still had a chance to get some neat parts in there. “The chairs have realistic physics, they actually wheel around,” says Ben as he flips one chair over and sends another spinning across the room, boasting that they are “my idea.”
Another of Ben’s favourite parts is a bell that rings when you click on it. “He spends most of his spare time on his computer animating. He doesn’t play a lot of games — he’d rather make them. He’s developing a few mobile app games at the moment,” his father explains.
At the moment, Ben’s dream job is to work for Nintendo as an animator — the experience hasn’t quite tempted him to pursue cybersecurity.
“I just like making them so much, I just find it fun,” he says. He designed his level using Blender 3D, an open source software development tool. He’s also learning to use Python and Scratch at Chichester Free School, both in IT classes — which they call Challenge — and at a weekly coding club. Ben got a new Wii game and trip to Pizza Hut as a reward for his work on Cyphinx.
But the success of programs like this will very much depend on finding more people like Rackliff, Mound and Hankin. Trying to get children and gamers interested in career in cybersecurity, particularly with GCHQ’s controversial reputation, isn’t just going to be fun and games.