Operation Water Cooler – A structured narrative card game

Game Aim

I want to use a card game to assist my teaching Unit 32: Networked Systems Security to a Year 13 class (18 – 20 year olds).

Educational aims

a) familiarise the students with the 7 step model of a cyber attack

b) engage the students with relevant cyber terms, concepts and keywords

Teams and Game Play

The game will be played in classes ranging from 20 to 23 students. I will form several 4 player teams all playing simultaneously – led by me the teacher. The game has to be mechanically very simple, and quick.

The game will be played using customised set of cards, one set for each stage of the cyber attack model.

Phase one – Reconnaissance
Phase two – Weaponization
Phase three – Delivery
Phase four – Exploitation
Phase five – Installation
Phase six – Command and control
Phase seven – Action on objective

Game Cards

One of the starting Reconnaissance Cards

Each card will contain a title and description of the activity / event, and the possible outcomes if played. In the play test version I also added three factors Cost, Time, and Risk of Detection.

Order of Play

Players decide what card to play from starting hand
Players update resources used by that card $, Days and Risk
Teacher gives outcome cards, perhaps some narrative commentary
Players read additional cards and decide what to play next turn.

Narrative – in teaching

I want the game to deliver a structured narrative of a hack as I know from previous attempts to teach this subject that the students find “the story” of a hack engaging and memorable.

In general students – including adults – remember stories, especially if personalised or delivered as gossip.

In lessons I often make or embellish stories about my experience or a friends experience to illustrate a point. I once invented a character called “Tracy” who lived at home with her Mum and younger sister, kept cats, loved the Voice and Ball Room Dancing, and had a job working for a bookshop and was not very good with spreadsheets. She was the person we were creating a spreadsheet for. “What would Tracy want?” became a catch phrase that term. At the end of the year the careers assistant, called Tracy, came to talk to the class. I was asked, did I model spreadsheet Tracy on Tracy?

Part of Camp Spinney’s ICT System.

My Design Constraints

The game will give the players sufficient decisions to enable them to fail or to win, with some less good or less bad end results.
The game mechanics are simplified to give the players a set number of routes through the game. The players’ main decision is to identify the best route and how to obtain it within budget and within the deadline and not get caught.
Each card should contain all the information required to decide to play it, and what the costs and outcomes of playing it will be.
There will be multiple teams and only one teacher (control).

Game Brief

Scenario

Your mission is to disrupt the Orange government’s base – Camp Spinney – that enriches uranium isotopes.

To do this directly is difficult as Camp Spinney is very well guarded and has been designed to be self-sufficient with its own electrical generators, satellite communications, living quarters for personnel and large stores of food, spare parts, fuel etc.

Operation Water Cooler

Your analytical team has noted there is one weakness to Camp Spinney, the water supply for the base is reliant on a privately owned and run water company that also supplies the local civilian population with water treated and pumped from a nearby reservoir. The base requires a large supply of water as a coolant for their on-site generators and also the action of the centrifuges used in the enrichment process. Without water the machinery will soon overheat and will have to be switched off and the enrichment process will be halted.

It is known that in 4 weeks the enrichment process will reach a particularly critical phase and if this is interrupted it will waste a whole batch of uranium isotope and potentially damage and possibly contaminate a lot of critical equipment.

Target: Western Water Company

Objective: Disrupt water supply to the Orange Government’s Uranium Enrichment Base

Budget: $100,000

Timeline: 4 Weeks

Information Gathering

Your first task is to gather information on the Western Water Company and then analyse what vulnerabilities it has.

Your team will then allocate further resources to weaponise, deliver, exploit, install, control and implement your attack.

Playtest

I was joined for the play test by Andy H, Nick D, and Pickles.

We managed to get through to Phase 3 of the game in an hour of play. The players had had three reconnaissance actions and had uncovered details and vulnerabilities of several areas of Camp Spinney ICT structure. These vulnerabilities suggested several cyber weapons that they could develop.

I was pleased that the players were asking questions that I would hope the students would, not about the game rules, but about the descriptions or implications of the cards they had in their hand. In other words, content not game play!

The players did suggest that it was too easy to see what the best route was. But then I was dealing with Pickles who had optimally analysed the maths behind the game. I doubt my students will be as analytical as Pickles.

Development

After this play test I now realise I have to simplify the game even more and will probably remove the cost and time cost of each card play. I will use a simple rule of thumb, that the game will be won by the team who finishes successfully first. Another method might be to count the number of cards they had played as an indication of effort – cost and time – they had had to put in.

I think this will speed up the game as I only have 90 minutes to run the game – and that includes the usual time sucks of getting them into the class, calling the register, and then allocating teams and explaining the game.

I also need to reduce the number of cards in play and make the links between card play and outcome much quicker to do. I had thought to give specific cards in response to a specific card play, but will probably opt to just draw cards from a deck as the response to a card play.

My thanks to my players.

Still lots to do.