Competition Rules

Thank you for your interest in the picoCTF 2023 competition (“picoCTF 2023” or the “Competition”) organized by Carnegie Mellon University (“CMU”).

BY CREATING A PICOCTF ACCOUNT (WHETHER FOR YOURSELF AND/OR ON BEHALF OF YOUR CHILD OR YOUR STUDENT) AND PARTICIPATING IN THE COMPETITION CHALLENGES, YOU ARE AGREEING TO THESE COMPETITION RULES WITH RESPECT TO THE COMPETITION. THESE COMPETITION RULES ARE PART OF THE PICOCTF TERMS OF USE AND ARE A LEGALLY BINDING AGREEMENT BETWEEN YOU AND CMU. IF THESE COMPETITION RULES ARE NOT ACCEPTABLE TO YOU (AND TO YOUR SCHOOL, IF APPLICABLE), YOU MUST NOT PROCEED WITH REGISTRATION, AND YOU MAY NOT PARTICIPATE IN THE COMPETITION (NOR, IF APPLICBLE, MAY YOUR SCHOOL AND/OR ANY STUDENT USERS TO WHOM YOU WANTED TO FACILITATE ACCESS).

IF YOU ARE A PARENT OR GUARDIAN AND YOU PROVIDE CONSENT FOR YOUR MINOR CHILD TO CREATE AN ACCOUNT AND PARTICIPATE IN THE COMPETITION CHALLENGES, YOU AGREE TO BE BOUND BY THESE COMPETITION RULES ON BEHALF OF YOUR CHILD WITH RESPECT TO YOUR CHILD’S PARTICIPATION IN THE COMPETITION.

IF YOU ARE A TEACHER OR SCHOOL ADMINISTRATOR THAT FACILITATES A REGISTRATION ON BEHALF OF A MINOR STUDENT, YOU REPRESENT AND WARRANT THAT YOU HAVE APPROPRIATE AUTHORITY AND ALL NECESSARY PERMISSIONS FROM YOUR SCHOOL TO AGREE TO THESE COMPETITION RULES ON BEHALF OF YOU, YOUR SCHOOL AND ANY STUDENT USERS IN YOUR CLASS FOR WHOM YOU ARE ENABLING TO PARTICIPATE IN THE COMPETITION CHALLENGES. YOU ALSO AGREE THAT YOU HAVE OBTAINED ALL NECESSARY PERMISSIONS AND CONSENTS FROM SUCH STUDENT USERS AND THEIR PARENTS OR LEGAL GUARDIANS FOR YOU TO REGISTER THE STUDENT USERS FOR THE COMPETITION UNDER THESE COMPETITION RULES AND THE TOU, INCLUDING THE RIGHT FOR YOU TO PROVIDE THE INFORMATION NECESSARY TO CREATE ACCOUNTS FOR SUCH STUDENTS, PRIOR TO CREATING SUCH ACCOUNTS AND/OR PROVIDING THE STUDENT USERS WITH ACCESS TO THE SERVICES SUCH AS THE COMPETITION CHALLENGES.

AS A REMINDER, THESE COMPETITION RULES ARE INCORPORATED INTO AND MADE A PART OF THE TERMS OF USE. PLEASE BE SURE TO REVIEW THE TERMS OF USE IN ADDITION TO THESE COMPETITION RULES.

By using and/or participating in the Competition, you are agreeing to fully comply with these Competition Rules, without modification by you. If you do not agree with these terms and conditions as stated, your only recourse is to discontinue using and participating in the Competition.

Modifications of Terms.

CMU shall have the right to modify these Competition Rules at any time, which modification shall be effective immediately upon posting. Accordingly, we suggest that you check review our Competition Rules when you use the Services to stay informed. If you disagree with the changes to these Competition Rules, you should discontinue your participation in the Competition. To make your periodic review more convenient, we will post a date at the top of this page.

What is picoCTF ?

picoCTF is a computer security game targeted at middle and high school students. The game consists of a series of challenges centered around a unique storyline where participants must reverse engineer, break, hack, decrypt, or do whatever it takes to solve the challenge. The challenges are all set up with the intent of being hacked, making it an excellent, legal way to get hands-on experience.

What is the 2023 Competition? When does it start/end?

The Competition involves trying to solve a designated number of problems within a specified timeframe. The Competition begins on 14 March 2023 at 12:00pm Eastern Daylight Time and continues until 28 March 2023 at 3:00pm Eastern Daylight Time (the “Competition Period”).

Who is eligible to participate in the Competition?

Each individual who participates in the Competition (“Participant”) must:

• be at least 13 years old;
• if under 18, have the consent of their parent or legal guardian to participate;
• form a team alone or with up to 4 other Participants; and
• have a valid picoCTF account created through CMU’s picoCTF platform (currently available at picoctf.org or https://picoctf.com)
  • Note: in order to create a picoCTF account, you will need to provide certain information to register. If you are under 18, a parent or legal guardian must provide their email address as part of your account registration to indicate their consent to your account registration, unless you have a student account created by a teacher through a teacher batch registration.

How do I participate in the Competition?

To participate, you must have created your own individual picoCTF account before or during the Competition Period and work on the Competition challenges during some and/or all of the Competition Period. If you are on a team with other Participants, each of you must have your own valid picoCTF account. You may not share a picoCTF account with another person.

You do not have to enter the Competition by the first day of the Competition Period. However, the later you enter, the less time you have to work on the challenges during the Competition Period. For clarity, you cannot begin working on the Competition until you have a valid picoCTF account.

NOTE: NOT EVERY PARTICIPANT IN THE COMPETITION IS ELIGIBLE TO WIN PRIZES. PLEASE SEE DETAILS BELOW.

Collection/Use of Your Information.

As described in more detail below in these Competition Rules, CMU may ask you for additional information to confirm that you are in compliance with these Competition Rules and/or the Terms of Use and/or (if applicable) that you are eligible to receive prizes in the Competition (including but not limited to written verification of any necessary parental consent). Please see our picoCTF Privacy Statement for information about how we collect, use and disclose information you provide.

How do I form a Team?

Each team is made up of 1-5 Participants (a “Team”). The registration page will explain how you can invite others to join your Team (which may involve use of a special invitation code).

WHEN SELECTING A TEAM NAME, YOU MAY NOT INCLUDE ANY NAMES OR OTHER PERSONALLY IDENTIFIABLE INFORMATION IN YOUR TEAM NAME.

How do I become eligible to win Team prizes?

In order to be eligible to compete for Team prizes, each Participant and all other members of the Participant’s Team must: (i) be at least 13 but younger than 20 and not have a high school diploma or GED; (ii) have indicated in their registration that they are a middle or high school student and resident in the US; and (iii) be enrolled in an accredited United States middle school or high school (“School”) and/or be in the process of being home-schooled at the middle or high school level in compliance with the applicable home-schooling requirements of the applicable student’s home state.

How are the winners determined?

The Team that solves the most problems within the allotted time will be the winner. If more than one Team solves all of the problems, then the Team that solved the problems in the shortest amount of time will be the winner. As described in more detail below, winners (including any tie breakers, questions about eligibility, etc.) are determined by CMU in its sole discretion.

What are the Team prizes?

Subject to these Competition Rules and the Terms of Use, the Team prizes will be:

• 1st place: $3,000 and may have opportunity to visit Carnegie Mellon University's Pittsburgh campus for an award ceremony
• 2nd place: $2,000 and may have opportunity to visit Carnegie Mellon University's Pittsburgh campus for an award ceremony

• 3rd place: $1,000and may have opportunity to visit Carnegie Mellon University's Pittsburgh campus for an award ceremony

• Highest placing all middle school team: $500
• 2nd highest placing all middle school team: $300
• 3rd highest placing all middle school team: $150

What are the other rules and terms for picoCTF 2023?

CMU may display one or more Competition leaderboards and/or scoreboards. These boards may be available to other Participants and/or the public, and may show the Team name, the country of residence and/or school identified by the Team leader, and/or the name of the School identified by the Team leader.

While there are no limitations on the resources or tools that Participants can use, only the eligible Team Participants may solve challenges as part of the Competition. Team advisors, or anyone outside the Team, may help facilitate the Team's work, such as by helping set up tools or providing resources, but may not provide direct assistance on any problems.

Teams may not interfere with the progress of other Teams, nor with the operation of the Competition's infrastructure. More specifically, attacking the scoring server, other Teams, or machines not explicitly designated as targets is cheating. This includes both breaking into such machines, and denying others access to them or the ability to solve problems (for example, by altering a key or ping-flooding). Sharing keys or providing overly-revealing hints with other teams is cheating, as is being directly assisted by personnel outside the Team (using tools from the internet is OK; asking people on the internet to help solve the problem is not). We encourage Participants to solve problems in novel and creative ways using all available resources, but we do require that Participants solve the problems themselves.

You must comply with the picoCTF Terms of Use and these Competition Rules. As a reminder, the Terms of Use include, among other things, a description of prohibited conduct and limitations on liability and damages.

Answers to problems including challenge write-ups may not be publicly posted or otherwise shared with anyone outside of your Team members until after the Competition is over.

All information provided to establish an account must be true and correct. You are responsible for keeping such information up-to-date. Failure to keep your account up-to-date may, among other things, jeopardize your eligibility for prizes.

You are solely responsible for keeping your account names and passwords confidential. You are responsible for activity that takes place under your account (including but not limited to activity that may affect your eligibility for prizes). If you believe that your account (or an account you have created on behalf of your child or a student) has been or may be compromised, you must notify CMU by contacting other@picoCTF.org as soon as possible.

If you register to be on a Team with other Participants, you understand that information about you may be provided to other Team Participants. In addition, you understand that your School may be informed about your participation in picoCTF and/or may be asked to verify your enrollment in order to verify your eligibility to receive prizes. To the extent your School cannot legally release such information about you without your consent and you do not provide such consent, you agree that you and/or your Team may be ineligible for certain prizes if CMU cannot verify your eligibility.

At any time, in the sole and absolute discretion of CMU, CMU shall be entitled to disqualify a Participant and/or Team in the event of a failure to meet relevant eligibility criteria or any other violation or suspected violation of these Competition Rules and/or any Terms of Use (including but not limited to cheating). In the event of a Participant’s disqualification, CMU may also notify the Participant’s School.

CMU will determine participation eligibility, declare winners (including but not limited to in the event of a tie), and award prizes in its sole and absolute discretion. You agree that such decisions are final and are not subject to review or reconsideration, and that Teams are not entitled to be informed of other Teams’ results.

Winning Teams may be asked to produce written solutions for several challenges before receiving prizes. Each Participant of a winning team will need an adviser or faculty member at the Participant’s School to serve as a point of contact.

CMU reserves the right to verify the identity and eligibility of all Participants and Teams at any time. Without limiting the general nature of the prior sentence, prior to (and as a condition of) awarding any prizes, you agree that CMU in its sole and absolute discretion may require additional paperwork to be executed by the relevant Participants. This information could include, among other things, written verification of parental consent (if applicable), verification of information needed to confirm eligibility or compliance with these Competition Rules and/or the Terms of Use, and information needed to facilitate the provision of prizes, and all paperwork requested by CMU to enable it to comply with all applicable state, federal and local tax reporting (which may require the provision of social security numbers or other personal information as needed). All paperwork must be returned within seven (7) days of the date provided by CMU (or such other date specified by CMU). All prizes will be net of any taxes that CMU is required by law to withhold. To the extent permitted by law, all taxes imposed on prizes are the sole responsibility of the winners. If a potential winner fails to provide such documentation within the timeframe required or fails to comply with such laws, the prize may be forfeited and CMU may, in its discretion, select an alternate potential winner.

In its sole discretion, Carnegie Mellon University may extend an invitation to an awards ceremony at its Pittsburgh campus. Reimbursement for travel expenses is currently expected to include a round-trip domestic airline ticket (coach) to/from Pittsburgh, hotel accommodations and ground transportation for each applicable Participant on the winning Team, plus one adult chaperone for the Team. As determined by Carnegie Mellon in its sole discretion, Carnegie Mellon may make direct arrangements for such items and/or may reimburse the winning team members and chaperone for their respective documented and reasonable and customary, out –of-pocket expenses for such items. Any and all other costs associated with attendance at the awards ceremony are the responsibility of the relevant Participants and their chaperones.

For any cash prizes awarded to a Team involving more than one Participant, each Participant shall be awarded an equal share of such prize, which shall be paid in United States dollars. Carnegie Mellon may, in its sole discretion, condition the payment of some or all of the winning Team's cash prize on the Team attending the event at Carnegie Mellon University.

Any prizes awarded are non-transferable, and any non-cash prizes are not exchangeable for cash. CMU’s ability to offer any and all prizes is subject to applicable laws and regulations.

Competition problems or other content on the picoCTF site remains the property of CMU (and/or its content providers). CMU and its relevant content providers reserve any and all of their respective rights in such materials. You are authorized to access and use such materials solely with respect to registration for and/or participation in picoCTF 2023 by you (or on behalf of your child or a student, where applicable). You may not use the picoCTF 2023 site or any materials on it (including but not limited to the Competition problems) for any unauthorized purpose.

The Competition for prizes is available only to residents of the United States. The Competition and these Competition Rules are governed by the laws of the Commonwealth of Pennsylvania without regard to its conflicts of laws provisions. Any claims or disputes relating to picoCTF 2023 or these Competition Rules must be settled in accordance with the Terms of Use (including the dispute resolution and jurisdiction provisions in the Miscellaneous section of the Terms of Use).

The Competition is subject to all disclaimers, limitations on liability and damages set forth in the Terms of Use, as supplemented by these Competition Rules. Without limiting the general nature of the foregoing, you understand and agree that picoCTF 2023 is offered on an AS-IS, WHERE-IS basis without warranties of any kind, and that any and all implied warranties or duties regarding it are hereby disclaimed (including but not limited to warranties of merchantability, fitness for a particular purpose or non-infringement). CMU can discontinue the Competition at any time in its sole discretion. To the maximum extent permitted under applicable law, Carnegie Mellon University, its directors, officers, employees, agents, representatives, affiliates, licensors, content providers, contractors (including but not limited to Third Party Providers) and sponsors (collectively, “picoCTF Parties”) shall not be liable for any damages, losses or claims resulting from any person’s participation (or attempted participation) in the Competition. To the maximum extent permitted under applicable law, neither CMU nor picoCTF Parties are responsible for technical problems or technical malfunction or other occurrences which may affect the operation of the Competition (including but not limited: to hardware or software errors; faulty computer, telephone, cable, satellite, network, electronic, wireless or Internet connectivity or other online communication problems; failure of any e-mail transmissions to be sent to or received; lost, late, delayed or intercepted e-mail transmissions; inaccessibility of the picoCTF 2023 web site or any third party service providers in whole or in part for any reason; traffic congestions on the Internet or the picoCTF 2023 site; and/or inaccessibility or unavailability of an email account used in connection with picoCTF 2023). To the maximum extent permitted under applicable law, you hereby release CMU and the PicoCTF Parties from any and all claims, damages or liabilities arising from or relating to participation in picoCTF 2023.

To the maximum extent permitted under applicable law, you agree to indemnify and hold harmless CMU and picoCTF Parties from and against any and all claims, suits, actions, losses, expenses, damages, penalties, and costs, including reasonable attorneys’ fees resulting from any actual or alleged violation of these Competition Rules by you and/or your participation in the Competition.

These Competition Rules shall be enforceable to the maximum extent permitted under applicable law. If any portion of this these Competition Rules is determined by any court or governmental agency of competent jurisdiction to violate applicable law or otherwise not to conform to requirements of law, then the rest of these Competition Rules will remain in effect and the parties will substitute a suitable and equitable provision for the invalid/unenforceable provision in order to carry out the original intent and purpose of the original Competition Rules.

The picoCTF 2023 site or materials may link to and/or refer to third party websites and/or services. CMU does not control or endorse such sites. You are responsible for determining the suitability of those sites or services.

You may not assign, delegate or transfer any of your rights or obligations under these Competition Rules. Any attempted assignment, delegation or transfer shall be void.

These Competition Rules and the Terms of Use and your picoCTF 2023 registration represent your entire agreement with CMU with respect to picoCTF 2023.

Version Date: January 23, 2023