Rules of Conduct

Last Updated August 2024

Ethics Statement

The NCL aspires to communicate and promote an honor code, ethical values, and behaviors that are essential elements of the information security workforce. We are not here to help people learn to be Blackhats. Rather, we hope to help develop players to become IT and security professionals who can make a difference in our 21st century information, knowledge, and innovation economies.

Spirit of the NCL Games

The spirit of the NCL is to foster an excitement and eagerness for learning through friendly competition and we have developed the Rules of Conduct to support this spirit. These rules are designed to maintain a fairness in the competition and safeguard the community from behavior that negatively affects the experience of others.

Simplified Rules of Conduct

1. The Individual Game is an individual event - you must participate in this event by yourself. You may NOT collaborate with anyone else.
2. During the Team Game, you may collaborate with anyone on your team (per the Team Roster on cyberskyline.com) without restriction. This does NOT apply to anyone outside of your team, including others from your school who are on different teams.
3. Coaches may NOT assist students during Individual Game and Team Game (Coaches may assist students in the Gymnasium and in the Practice Game).
4. You may discuss all challenges from each game after they have ended with Coaches & fellow Players; however, you may NOT post questions or answers online at any point (even after the games have ended).
5. Behave in a professional manner, including on NCL social media channels, the NCL Slack channels, and when interacting with NCL and Cyber Skyline representatives.
6. Follow all rules of engagement against live designated targets on the cityinthe.cloud domain.
7. Do not attack the competition platform (cyberskyline.com).
8. Do not sabotage any game elements, including online resources (e.g. modifying another Player’s competition environment or editing a Wikipedia page to provide false information).
9. Do not modify any unique IDs assigned to you by the competition platform and do not access competition resources using another competitor’s unique ID. Do not misrepresent yourself or use multiple personas.
10. Do not violate any local, state, federal, or international laws.

Complete Rules of Conduct

1. Eligibility Requirements

1. The NCL competition is open to anyone enrolled in a US high school, collegiate institution, apprenticeship, or academic boot camp. Transitioning veterans who are not yet employed within the cybersecurity industry are also welcomed. The NCL is currently trialing participation from collegiate institutions in Canada.
2. Students participating in the NCL must be at minimum 13 years of age. There is no maximum age restriction to the NCL.
3. During registration, students will be given the option to indicate if they self-identify as a “cybersecurity student” or as an “experienced cybersecurity student”. Students who identify as an “experienced cybersecurity student” will be placed in a separate “Experienced Students” leaderboard to maintain fair comparisons between students and align with the NCL’s core mission of helping students enter the cybersecurity industry. The following guidance is provided to help students make their selection:
• I am a cybersecurity student
• Not yet in a cybersecurity role or hold extremely limited experience in any technical NICE cybersecurity work roles
• Enrolled in an undergraduate cybersecurity or undergraduate computer science program
• Want to compete with students who are beginners or have limited experience
• I am an experienced cybersecurity student
• Have experience working in a technical NICE cybersecurity work role for 3 or more years
• Enrolled in a graduate cybersecurity or graduate computer science program or advanced certificate program
• Want to compete with students who are have more experience

Please note that the categorization is based on your degree or work experience and not years of experience playing in the NCL.

NCL will have sole discretion to reclassify players based on their experience background to keep accurate representations of a player's skill background and to maintain a fair comparison between players.

4. To further help students enter the cybersecurity industry, the NCL is additionally open to recent graduates from a collegiate institution who are not yet employed in a cybersecurity role. Recent graduates are defined as students who have graduated within the last 365 days (1 year).
• A student that graduated during the Spring academic semester that is not yet employed in a cybersecurity role may participate in the Fall Season of the NCL.
• Any recent graduates that are employed in a cybersecurity role is not eligible to participate in the NCL.
• If an individual becomes ineligible during the course of the NCL Season, e.g. graduate AND are employed in a cybersecurity role, the individual must notify a NCL official or support staff to mark the participation as unranked for the Season in order to allow students to be fairly ranked with other students.

2. Professional Conduct

1. All NCL participants, including players and coaches, are to behave in a manner befitting professional cybersecurity practitioners during all NCL activity including Games, practice and preparation, meetings, etc. Professional conduct is expected throughout all communications with the NCL community of players, coaches, and members of the NCL management team. This includes all Game responses, choice of handles, images, email, voice, chat, surveys, and social media.
2. Policies and regulations for the NCL Platform Provider – Cyber Skyline (aka the NCL Stadium), and other host sites apply throughout the Games and must be respected by all NCL participants.
3. Activities such as alcohol and drug use, swearing, disrespectful or unruly behavior (including online, e.g. communications on Discord or Slack), sexual harassment, improper physical contact, violence, or willful physical damage have no place at NCL events and will not be tolerated.
4. Challenges may intentionally or unintentionally reference real organizations or individuals. You may not call, email, contact, or harass the referenced individuals in any ways.
5. Intentional or malicious violations of the rules, as determined by NCL representatives, may be deemed unprofessional conduct and subject the violators to disciplinary actions.
6. Players behaving unprofessionally may receive a warning from the NCL representatives for their first offense. Players may have a penalty assessed against their individual/team score, be disqualified, and/or expelled from the NCL Game/Season for egregious rule violations or for subsequent violations following a warning. Players expelled for unprofessional conduct will be banned from future NCL Games for no less than 12 months from the date of expulsion.
7. NCL representatives observing spectators, and individuals other than players, behaving in an unprofessional manner may warn against such behavior or ask those misbehaving to leave the physical and/or virtual space entirely.

3. Individual Game Conduct

1. Players are forbidden from accessing or attempting to access another player’s machine, or account.
2. Players participating in the NCL Individual Game must do so without assistance from anyone, including other players and coaches, from the start of the Game to the end of the Game. All private and public forms of communication (including but not limited to, phone calls, emails, chat, texting, directed emails, forum postings, verbal and non-verbal conversations, requests for assistance, social engineering, etc.) with anyone other than the player themselves, that would help the player gain an unfair advantage, capture a flag or solve any of the puzzles, are not allowed and are grounds for disqualification and/or a penalty assigned to the appropriate player.
3. Players are allowed to use artificial intelligence (AI) tools to assist them; however, Players are strongly encouraged to be responsible in their usage of these tools so that AI tools are not replacing their learning of relevant concepts. NCL representatives will not be able to provide assistance in troubleshooting issues that may arise from results produced by AI and any associated hallucinations.
4. Players are free to examine any target systems. Attacks or other offensive activity against any other player’s systems or the NCL systems is forbidden and will not be tolerated. Any player performing offensive activity against other players’, or the NCL’s systems, will be immediately disqualified and expelled from the Game.
5. If there are any questions or concerns during the Game about whether or not specific actions can be considered offensive in nature, contact the NCL representatives before performing those actions.
6. You DO hereby have express permission to attack any asset designated as an NCL Game "target," so long as you abide by the Game rules and terms of this rules document.
7. The designated NCL Game targets are hosted by Cyber Skyline, expressly on the domain and subdomains of cityinthe.cloud. No other domains or assets of any variety should be attacked.

4. Team Game Conduct

1. Players on the same team may and are encouraged to help one another during the Team Game. They may engage in all forms of communication and collaboration. This does not apply to players on different teams, even from the same institution or organization. Otherwise the Individual Game rules apply.

5. School Representatives

1. Each team should have at least one coach available throughout the duration of the NCL Season to help organize and assist the players. The coach should be a faculty or staff member of the institution the team is representing. In those instances when the team meets in a virtual environment, the coach must also be virtually available in that environment.
2. Once the NCL Individual Game and NCL Team Game has started, coaches may not coach, assist, or advise an individual or their team until the completion of that Game.
3. Coaches must not interfere with any other individual or team.
4. The coach, or any non-team member, must not discuss any aspect of the NCL Game, specifically Game tasks, configurations, operations, or individual/team performance, and must not attempt to influence an individual or team’s performance in anyway.
5. School representatives are assigned through the process of coach pairing within the Cyber Skyline platform. Coach pairing must be completed during the registration period. To maintain the integrity of the NCL events, a player’s failure to associate with a coach on the Cyber Skyline platform will result the forfeiture of that player’s ability to submit an appeal should any incidents arise.

6. Local (Player & Team) Internet and Site Usage

1. Use of Internet resources such as FAQs, how-to's, pre-existing forums and responses, and publicly accessible company websites, are permitted for Game use, provided there is no fee required to access those resources and access to those resources has not been granted based on a previous membership, purchase, or fee.
2. All Internet resources used during the Game must be freely available to all players.
3. Where allowed, public Internet activity and access will be monitored, and any player caught viewing inappropriate or unauthorized content will be subject to disqualification and/or a penalty assigned to the appropriate individual/team. For the purposes of the NCL Games, inappropriate content includes pornography or explicit materials, pirated media files, sites containing key generators and pirated software, etc. If there are any questions or concerns during the Game about whether or not specific materials might be considered unauthorized, contact the NCL representatives before using those materials.
4. The Game network is publicly accessible, not a protected, isolated environment; as such, NCL representatives are not responsible for the security of any information, including login credentials, which players place on the Game network. It is suggested that competitors NOT use credentials in the NCL environment that are mirrored from any other system.
5. Any local on-site mechanisms that interfere with Game system access or the accuracy or functionality of the scoring engine or manual scoring checks are exclusively the responsibility of the player/team. This includes but is not limited to Internet connectivity, firewall rule, Intrusion Detection/Prevention Systems, Network Access Controls, and other player-side defensive actions.

7. Scoring System Attacks

1. DO NOT, under any circumstance, attack the NCL Game or scoring systems. This includes, but is not limited to, launching automated scans or tools targeted towards the scoring system, attempting injections, altering targets, or attempting to manipulate data stored within the scoring system. Players found manipulating, or attempting to manipulate, the scoring system will be immediately disqualified from the current and future NCL events.
2. If you are ever unsure if your actions will result in an attack against the scoring system, open a support ticket with the NCL platform provider - Cyber Skyline.

8. Disabling or Altering Challenges or Puzzles

1. DO NOT under any circumstance purposely disable, alter, or damage a challenge/puzzle and/or target in a manner that will disrupt the solution or structure of the puzzle or gameplay. This includes, but is not limited to, changing core system configurations (passwords, firewall rules, services, etc.), manipulating any network settings, and/or altering, introducing, or removing vulnerabilities on the system. Altering public Internet resources related to puzzles is not permitted.
2. Puzzles and targets break, but do not purposefully attempt to limit or disable another player's ability to complete a challenge.
3. Some challenges require you to make changes to a system (adding files, executing commands, exploiting vulnerabilities, etc.). Players should limit their interaction to the scope of the puzzle - don't change the way the challenge works.
4. Players found manipulating the puzzles and targets may be disqualified from playing in current and/or future NCL events and/or have their scores altered.

9. Challenge Artifacts

1. Challenges may include associated data or computer resources necessary for the solving of a challenge (such as images, text log files, network traffic data, code snippets, web servers, computer programs, raw binary data, etc.). In some instances, artifacts may be made available for download. In others, artifacts may be provided directly within the Cyber Skyline platform.
2. Some artifacts may resemble malware or contain information mimicking real cyber-attacks. While these artifacts have been designed to be as inert as possible, artifacts may affect player’s computer environments and may trigger an antivirus response. It is the responsibility of the player to take the proper precautions to interact with challenge artifacts in a safe manner. NCL and its affiliates are not responsible for any damages arising from player’s use of challenge artifacts.
3. When artifacts are provided directly within the Cyber Skyline platform, it is the responsibility of the player to interact with these artifacts in a non-damaging way. Artifacts modified or damaged by the player may or may not be reset at the NCL/Cyber Skyline operation team’s discretion.
4. In some instances, publicly shared artifacts will be automatically reset to ensure that everyone has an equal opportunity to access the artifacts.

10. Collusion or Flag Sharing Violation Repercussions and Actions

1. DO NOT provide any other player with answers to challenges and DO NOT accept answers to challenges from any player, coach, or other source during a Game. Questions or artifacts should not be posted during or after a Game.
2. A proprietary algorithm and method for determining flag sharing may be employed by the NCL. Participants agree to accept the judgment and findings of the Commissioner as to whether flag sharing has occurred. These findings will become final and binding after the available appeals process has been exhausted.
3. If a player is identified as sharing flags or for rule violations, post-Game adjustments will be made. This may result in one or more of the following:
1. Point deductions for the player or team in question
2. Removal of the player or team from the leaderboard and disqualification for any prizes, Scouting Report, or Certificate of Participation
3. A ban from participating in the NCL
4. Again, during NCL Team Game, players from the same team are encouraged to work together to solve the challenges.

11. Laws

1. DO follow the laws in your area and the United States.
2. DO NOT under any circumstance violate any laws or the terms you've agreed to in this Rules document.
3. Violations of local, state or national laws will be reported to law enforcement.
4. DO follow all institutional policies, including your institution’s honor code.

12. Intellectual Property

1. All text, graphics, user interfaces, visual interfaces, photographs, trademarks, logos, sounds, music, artwork, computer code, challenges, and artifacts used within the NCL Games are owned or licensed by the NCL and is protected by copyright, patent, and trademark laws. You may not copy, reproduce, alter, modify, resell, mirror, or create derivative works of the materials used within the NCL Games.
2. Documents containing our challenges or associated artifacts, commonly referred to as "writeups" or “solution guides” may not be published or distributed without our written permission.
1. Participants are allowed to use NCL intellectual property for non-commercial, personal use where the intellectual property is not distributed to the public (e.g. saving challenges for private practice, sharing a writeup with an employer during the hiring process)
3. All participants agree to grant NCL and its agents a royalty-free, worldwide, transferable, sub-licensable, irrevocable and perpetual license to incorporate or otherwise use any suggestions, enhancement requests, recommendations or other feedback.
4. All participants own their own content and intellectual property generated from their participation in the NCL Games. We do not represent any ownership or claim any intellectual property rights over the information that you provide or that is provided to us.

13. Scoring

1. Scores will be maintained by the NCL representatives and will be shared as soon as possible after the Game. The NCL will do its best to periodically update a leaderboard with running totals provided during the Game. Any (individual or team) action that interrupts the scoring system is exclusively the responsibility of that individual/team and will result in point penalties/disqualification. Should any question arise about scoring, the scoring engine, or how they function, the School Representative should contact NCL representatives. Leaderboard scores are subject to change after the end of the competition based on analysis of results.
2. In the spirit of learning for the NCL competition, players and teams should use critical thinking and independent research to solve the challenges. Players and teams may not brute force the answers as a scoring strategy. Players and teams found to be brute forcing answers or otherwise attempting to circumvent the NCL Rules of Conduct may be deemed as unprofessional and unsportsmanlike conduct and may be subject to a penalty or a point deduction at the sole discretion of the NCL. If you have any questions about a particular conduct, you are welcome to open a support ticket for a clarification.

14. Questions

1. Prior to the Games, Players and Coaches are encouraged to work with NCL officials to resolve any questions before the Game begins or before any other deadlines to allow time for resolution steps. Questions regarding the active Game challenges must be raised before the Game ends. All questions can be submitted as a Support Ticket within the Cyber Skyline platform.
2. During the Games, players may not conduct social engineering attempts against NCL officials or support staff. Players may ask clarification questions in which a clarification may be provided at the sole discretion of NCL officials or support staff. To ensure a fair competition environment, players asking questions in a form that utilizes the support system as a mechanism to pre-check answers will constitute a social engineering attempt. Players will be provided a warning notice (without penalty) if an NCL official believes that a social engineering attempt was made by a player. Further violations of this rule after the warning notice may be subject to a penalty or a point deduction.

15. Nondisclosure

1. The NCL management team strives to make being part of the NCL community an enriching experience. All members of the NCL management team are open to feedback, suggestions for improvement, and conveying areas of concern or dissatisfaction.
2. Participants are forbidden from publishing, posting on the Internet, or publicly communicating details of the competition. This includes the disclosure of puzzles and their respective artifacts and solutions for both individual and team play as well as the gym.
3. Participants are forbidden from publishing, posting on the Internet, or publicly communicating speculation on the content of the NCL Gym, Individual or Team Games, nor speculation of the performance of any other individual or team, nor speculations concerning different possible outcomes.
4. Institutions may publish, post on the Internet, or publicly communicate news stories of a general nature about the NCL, and may also enumerate participating individuals, teams and winners.

16. Appeals Process

1. To process an appeal, individual(s)/teams(s) must have a coach from the beginning of the season. Otherwise the right of appeal is forfeited. Appeals by any individual(s)/team(s) must be presented by the Faculty Coach via video conferencing. Faculty Coaches must book a time with the NCL Team and present their appeal within 72 hours of notification.
• It is possible that an appeal during an event could have some initial solution that might prevent or allow continued play by a player or team.
• If a player or team is allowed to continue after an appeal, any further violations will accumulate and may result in a point penalty and/or disqualification.
2. The NCL will act on the appeals within three (3) days of initial individual/team appeal.
3. Individuals/teams might appeal:
• Accuracy of a ruling.
• Introduction of new information about the case. Appealing party must provide data to support their contention.

NCL representatives will be the final arbitrators for any appeals or questions arising before, during, or after the Game.

4. Rulings by the NCL representatives and Game results are final after the appeals process has been exhausted.
5. In the event of an individual(s)/team(s) disqualification, the player(s)/team(s) must leave the Game environment immediately and will be barred from re-entry.
6. Disqualified individuals/teams are ineligible for individual/team awards, certificates of participation, Scouting Reports, scholarships, etc., as defined by the NCL.
7. Appeals may be addressed to appeals@nationalcyberleague.org.

Sanctioned Schools Policy

The Sanctioned Schools Policy is NCL’s last resort in dealing with schools with repeated major Rules of Conduct violations. A school may avoid becoming sanctioned if their faculty refers the major Rules of Conduct violations to their student honor enforcement office. The outcome determined by the honor enforcement office will have no bearing on the NCL Sanctioned School Policy. Sanctioned schools will have their players unranked during the NCL Games for the duration of their sanction.

Sanctioned Schools are schools with repeated, problematic Rules of Conduct violations. The purpose of school sanctions is to maintain the integrity of the NCL competition when proper discipline is not being enforced at a school. School sanctions are a last resort after discussions with faculty at a school fails to curb Rules of Conduct violations.

A sanctioned school will have the following restrictions imposed:

1. The sanctioned school will not be included in the Cyber Power Rankings.
2. Students from the sanctioned school will be unranked and placed in Pewter Bracket.
3. Students from the sanctioned school will not qualify for a Scouting Report, Certificate of Participation, or any prizes.

A school will become sanctioned if one or more of the following conditions are met:

1. Students from the school have Rules of Conduct violations in two or more seasons in the past two years AND there is no responsible coach for the school. An effort will be made to attempt to identify a responsible coach during the first Rules of Conduct violation.
2. There have been Severe Rules of Conduct violations in two or more seasons in the past three years with coaches being informed of the violations.
1. If school representatives are cooperative with NCL and the students involved in the Rules of Conduct violations are referred to the school’s honor enforcement office, then the violation will be exempted from counting towards this sanction condition. The outcome of the honor enforcement office will NOT have any bearing on the exemption.
2. There is no exemption if a coach has a Rules of Conduct violation
3. There has been a Severe Rules of Conduct violation from a school whose sanction ended in the past two years.

Severe Rules of Conduct violations are violations where one of the following occurs:

1. Someone posts NCL content online or asks questions on how to solve a challenge online.
2. Someone sabotages the game (eg. edits a Wikipedia page, intentionally posts or provides false information to confuse other players).
3. Members of a team provide or receive unauthorized assistance and they place in the overall top 20% of the Team Game.
4. A group of two or more students collaborate together in violation of the Rules of Conduct and any of them place in the overall top 20% of the Individual Game.
5. A group of five or more students collaborate together in violation of the Rules of Conduct.
6. A Coach has a Rules of Conduct violation.

When a school meets the condition to be sanctioned, the school will be sanctioned between one to three years depending on the severity of the infraction and the level of cooperation from faculty at the school.

NCL will attempt to take steps to prevent a school from being sanctioned, such as:

1. The first Rules of Conduct violation of any type will result in a notification to the coach.
2. The second Rules of Conduct violation or the first Severe Rules of Conduct violation can result in a meeting with the coach, their supervisor, and an academic affairs representative from the school.
3. Any Rules of Conduct violation from a coach will result in a meeting with the coach, their supervisor, and an academic affairs representative from the school.