A gaggle of high school students huddled around a cluster of computers is unlikely to garner much attention.
But in late March, a steady stream of Air Force generals, Pentagon officials and defense industry executives visited several dozen students, all wearing matching green T-shirts emblazoned with the names of defense contractors, as they sat in small groups in a Washington-area conference center.
The groups were teams competing in the finals of the fourth CyberPatriot competition, and the draw was simple but dramatic: the military’s desperate need for more cybersecurity experts.
Confronted with a severe shortage of talent, government and defense contractors are spending time and money on programs designed to interest students in science, technology, engineering and mathematics, or STEM, with the hope that some will find their way into cybersecurity.
But while contractors and the military have long recruited talent, their targets have changed. First, they recruited graduate students, but that source lacked the volume to meet demand. Then they recruited college students but found that many STEM students are not U.S.-born, making clearances an issue. Now, companies are focusing on high school students as an important investment target, and they may not stop there.
“I’ve talked to the Air Force Association about doing something like this at the middle school level,” said Diane Miller, program director for CyberPatriot and director of operations for the cybersecurity group at Northrop Grumman, the competition’s lead sponsor for two years. “We’ve even been asked to work with elementary school kids. So we did a session on password protection.”
For contractors, the talent math is simple and disconcerting.
“Cyber is our business, and we’re invested in building that pipeline because we need the workforce,” Miller said. “We have positions open. A lot of positions open.”
Those openings, possibly in the tens of thousands nationally according to some reports, reflect a serious danger, said Alan Paller, director of research at the SANS Institute.
“What you’re seeing is an element, a pretty important element, of a national initiative to build a pipeline of talent that can help the nation compete in cyberspace,” Paller said. “It’s a big existential issue for countries, because in the next war, the tanks will be people. In the last war, the guy with the big cadre of tanks could beat the guy with the small set of tanks. This war, because your weapons can’t be reused and can be turned against you, everything depends on people’s ability to create new tools on the fly and to create new defenses on the fly, and that’s all talent.”
For many of the students in the CyberPatriot competition, the idea of cybersecurity as a career, or even going to college, was not previously part of their plan.
“It really got me thinking about going to college because I never really thought about going to college,” said Jeromy Miller, a student on a team from Reseda High School in the Los Angeles school system. “I just thought I’d finish high school and just go on with my life. Now I’m thinking about going to college to expand my knowledge and maybe get a job at one of these famous corporations.”
That interest in working for a contractor, and the creation of a talent pool that likely would not have entered the sector, offers a chance for a return on the $1.4 million investment Northrop has made in the program the last two years. The investment covers the national competition and a training program designed to teach basic cybersecurity skills to students exploring the topic for the first time. The program includes paper materials and online resources coaches can use to train local teams. The company also manages a mentoring program with its employees participating.
“There’s no guarantee that the folks that you invest in through CyberPatriot are going to come back and work for Northrop Grumman,” said Michael Papay, vice president for cyber initiatives at Northrop’s information systems division. “It’s not an easy connection to make the return on investment, but we work pretty hard to hire them as interns, the ones that we can have access to, and then getting them aware that Northrop Grumman is a company that invests heavily in cyber and knows a lot about cybersecurity.”
For some of the students, the connection is clearly made. Dante Mabin, who competed in the 2011 competition and took time off from college to coach students from his alma mater in 2012, said the competition made him aware of Northrop.
“I’d never heard of them before, but I realized how serious of a company they are, their expertise and how well they do,” he said. “Right now, I am hoping to get an internship with Northrop, and maybe work for them.”
Early interest key
Part of the push to reach kids at an earlier age comes from the recognition that early decisions, even if those decisions don’t focus on cybersecurity specifically, shape potential career paths.
“If you look at the STEM pipeline, deciding to go into a science, technology, engineering or a math field unfortunately requires early decisions, especially about grade eight to make sure that the students are taking algebra at grade eight,” said Ray Johnson, chief technology officer at Lockheed Martin. “That puts them on the pathway to complete calculus in high school and then gets them well prepared for a college STEM curriculum. So what we want to do is talk to students pre-grade eight, get them in grades five, six and seven, get them excited about STEM education.”
To create early interest, Lockheed is sponsoring the USA Science & Engineering Festival on April 28-29 at the Washington Convention Center in the District of Columbia. The event is aimed at creating excitement for kids and includes stage shows with flamboyant demonstrations of scientific concepts.
While there are no guarantees that sponsorship will directly benefit the company’s recruiting efforts, Johnson said there may be some effect.
“It’s probably not too far a stretch to say that when they see the Lockheed Martin name, and they remember being exposed to things, that does present a little bit of an attractive draw when it comes time for them to enter the workforce,” he said.
Benjamin Donnelly, a senior from Spokane, Wash., competing in the CyberPatriot competition, said he did not feel attached to a particular contractor because of his participation in the event. But the event did greatly influence his thoughts on cybersecurity as a career. The competition even caused him to end his forced separation from computers.
“A couple of years back, I realized that my vision might be damaged by looking at computers for too long, so I took out a minivendetta against them,” he said. “That lasted for about six months, and it was ended by CyberPatriot.”
He is seriously considering a career in IT, although he also has a passion for aircraft.
CyberPatriot, which included more than 1,000 teams in its first round, is not the only high school competition. The U.S. Cyber Challenge is another. But what separates CyberPatriot is that the competition, created by the Air Force Association and also sponsored by SAIC, was initially open to Air Force Junior ROTC teams. That ensured a diverse group of kids competed, as JROTC attracts students from different socioeconomic backgrounds.
Now that a second division has been created for other high schools, that diversity remains. Some of the students had never owned a computer before becoming involved. A stroll through the competition room showed students representing a variety of ethnic groups, as well as a team in which four of the six members were girls. According to organizers, the participation of the girls in the competition was encouraged by Maj. Gen. Suzanne Vautrinot, commander of Air Force Network Operations, who spent time mentoring them.
The competition was designed to create a gamelike environment that would be fun for the kids, part of creating interest that might trigger further academic pursuit. Most of the time was spent defending a network from a team of professional cybersecurity experts who tested the kids with a variety of exploits. The competition also had a “Bradley Manning simulation,” as one organizer called it, where students were expected to search a mannequin for small hidden storage devices that might contain classified data.
The need for talent is so desperate that companies need to invest, said Paller of the SANS Institute.
“It’s a survival issue for them,” he said. “This is a field where if you have 20 people on a contract, usually only one or two are really good, and if somebody steals those one or two, there’s just no way to recover.”
The students seemed oblivious to the critical role they may play in the future of the military and defense companies. As Air Force Secretary Michael Donley and Deputy Assistant Defense Secretary for Cyber Policy Eric Rosenbach strolled the competition ballroom, some of the students wrote messages on large pads behind their tables. One particularly precocious team that had finished a task early left a message for competitors: “You’re all jealous,” it read.
By Zachary Fryer-Biggs