There are several ways to qualify for DEF CON Capture the Flag 2016: win DEF CON CTF 2015 (congratulations DEFKOR!), qualify through DEF CON CTF 2016 Qualifiers (more news on this in 2016), or win a "qualifying competition." If you run a Capture the Flag or other computer security competition and want to have your winners move on to DEF CON finals, you can become a DEF CON CTF 2016 Qualifying Competition!
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
Running a Competitive Competition
DEF CON CTF competitors are the best in the world. When less-qualified teams compete, they don’t enjoy the game, and don’t provide a lot of enjoyment for other teams either. Therefore, we must ensure only the most qualified teams are invited. Our standards are as follows:
- Your competition MUST be open to all. You MUST NOT restrict entry or winning to students or professionals. You MAY structure your game with separate qualifying and finals events.
- You MUST NOT charge a fee to competitors, except for normal admission to a conference.
- Your competition MUST allow teams of at least four people.
- You MUST publish a final scoreboard within seven days of competition ending.
- You MUST be able to privately share the winning team’s contact information with us within seven days of competition ending.
- You MUST NOT publish personal information about competitors without consent.
- You MUST NOT require consent to publish personal information from competitors or winners.
- You MUST NOT announce DEF CON CTF qualifying status prior to a Legitimate Business Syndicate announcement of same.
- You MUST either have run a competition previously, or be willing to share details and challenge samples with Legitimate Business Syndicate prior to approval.
- Your competition MAY have both offensive and defensive components.
- Your competition MAY be either online or local/in-person, or both!
If you don’t or can’t meet these requirements, please don’t ask for an exception. It’s possible we might not be a good fit for your competition as designed, and we don’t want to force you to compromise how you run your event.
Sending a Proposal
Send us an email to [email protected] before Midnight, Dec. 1, 2015 (1449014400) with answers to the following questions:
- Who is your group?
- What is your game named?
- Where and when are you hosting it?
- How do you design and build challenges?
- What’s your favorite vulnerability or exploit (CVE-number or well-recognized name)? Why?
- Do you have a favorite CTF challenge or service? How did you solve it?
- How do you plan to handle cheating?
- Have you or members of your team ever organized a CTF before? Provide details.
- Have you or members of your team participated in a CTF event? Provide details.
- How many people are involved in the following: challenge writing, game design, infrastructure, and support?
The earlier we get your submission, the earlier we'll read it and form a concrete opinion. Slots are limited. Expect a response by Dec. 9, 2015.
Rules, Disclaimers, and Caveats
- Legitimate Business Syndicate may terminate your qualifying event status at any time for any reason, including reasons not covered in this document.
- Competitions that publicly publish personal information about competitors will be forbidden from being qualifying events.
- Competitions that announce their qualifying event status before a Legitimate Business Syndicate announcement of their status will be forbidden from being qualifying events.
- Legitimate Business Syndicate reserves the right to use your competition’s name, logo, and description in promotional materials.
- Legitimate Business Syndicate will not use your or your competitors’ contact information for anything besides internal decision-making and official game communication.
All qualifying competition decisions made by Legitimate Business Syndicate members are final.