The Danish Cyber Championships 2025 – Rules

1. Introduction

These rules are adopted by the Jury Committee, consisting of:

• Nicola Dragoni, Technical University of Denmark
• Jacopo Mauro, University of Southern Denmark
• Alessandro Bruni, IT University of Copenhagen
• Adam Blatchley Hansen, Aarhus University
• Raghava Rao Mukkamala, Copenhagen Business School
• Jens Myrup Pedersen, Aalborg University
• Michael Vinther Larsen, Centre for Cyber Security

The rules were most recently revised on 8 January 2025.

Any questions of interpretation are decided by National Coach Jens Myrup Pedersen, or by the judge appointed for the relevant part of the competition. If a participant disagrees with a decision, the matter may be submitted to the full jury committee.

These rules may be changed at any time based on decisions made by the jury committee.

2. Fair Play

Both players and judges are expected to follow general fair play principles. It is not permitted to exploit systems or rules in unintended ways, including in situations not explicitly described in the rules. In cases of doubt as to whether an action constitutes unintended exploitation of rules or systems, the national coach/judge must be contacted before any actions are taken.

All participants are expected to behave politely and respectfully toward one another. Bullying and harassment are not tolerated.

3. Rules

3.1 All participation is individual.

It is not permitted to assist other participants unless this is explicitly stated in the individual tasks (e.g. team tasks). This includes sharing flags, hints, or other types of information.

Note that this only applies during the actual competition (qualification, regional, and national championships). During training sessions where no points are awarded, participants are welcome to help each other.

3.2 Who may participate

There are two participant categories:

• 15–20 years
• 21–25 years

Age is determined as of 31 December in the competition year.

Participation in the European Championships furthermore requires Danish citizenship. Therefore, Danish citizenship is a requirement for participation in the final round of the competition (National Championships). All 15–25-year-olds residing in Denmark may participate in both the qualification round and the Regional Championships.

3.3 Physical attacks

Physical violence and attacks are strictly prohibited.

3.4 Scope of the competition

Only tasks included in the competition may be solved. Attacks against other participants (unless explicitly included in a task description) or against the platforms and infrastructures on which the competition/tasks are run are not permitted. This means, among other things, that:

• DoS/DDoS attacks are not permitted.
• It is not permitted to attack the networks provided (e.g. access to websites and labs, or WiFi/LAN).
• It is not permitted to manipulate the scoring system beyond receiving the points one is entitled to.
• It is not permitted to interfere with the platform or infrastructure.

3.5 Problems with a task

If a participant experiences problems with a task, they may contact the responsible judge or another representative of the competition for assistance, for example to reset the task.

3.6 Writeups

It is permitted to publish writeups once the individual competitions have concluded. This means that writeups from Qualifiers may be published from 17 March 2025, writeups from Regionals from 6 April 2025, and writeups from Nationals from 4 May 2025.

3.7 Complaints or irregularities

Complaints must be submitted directly to the relevant judge. In the case of technical errors, where the complainant wishes to receive points (e.g. a non-functioning flag), it is important to secure evidence such as screenshots to support the complaint. Complaints must generally be received before the competition is decided and winners are announced. Only in very special cases (e.g. if it later emerges that a participant attacked the infrastructure, or if it is revealed that a participant provided incorrect information regarding age or nationality) will it be possible to consider complaints submitted afterwards.

4. About the competition

The competition consists of the following elements:

• The virtual qualification, where participants must solve 6 tasks to qualify for the Regional Championships. Anyone who qualifies within their age group may register for the Regional Championships.
• The 5 Regional Championships, held in each region. These are conducted simultaneously, following the same programme and using the same tasks.
  • In each region, the five best participants in each age group qualify for the National Championships. This is determined based on the total competition score.
  • Additionally, a combined national ranking list is created for both age groups. From this list, the 25 best participants in each age group who have not already qualified are selected to participate in the National Championships.
  • In the event of tied scores, placement is determined by who first submitted the final completed task (total completion time).
  • Only participants with Danish citizenship are included in the calculation of qualification for the National Championships.
  • Dynamic scoring is used for the Regional Championships. This means that the number of points awarded for a task depends on how many others solve the same task. This calculation is performed across regions, ensuring that the same task yields the same number of points regardless of region.
• The National Championships, with a total of 50 participants in each age category – selected from the Regional Championships.
  • Based on the total score from the National Championships, a winner is declared in each age category.
  • Based on the National Championships, the national coach selects approximately 25 participants (the preliminary squad) for a bootcamp for the Danish National Cyber Team, with the aim of selecting the final 10 team members.
  • Dynamic scoring is used for the National Championships.

5. Sanctions

• In the event of rule violations, the judge may impose one of the following sanctions, or a combination thereof:
  • Disqualification. This sanction is typically imposed for serious, repeated, or intentional violations of the rules.
  • Warning. This sanction is typically imposed for minor rule violations where the participant has not knowingly or intentionally cheated or attempted to cheat. Two warnings result in disqualification.
  • Deduction of points. This sanction is applied if it is assessed that a participant has gained an advantage through intentional or unintentional rule violations.

FAQ (Updated continuously)

May you participate and solve tasks if you are over 25 years old?

• No, the championships are for participants aged 15–25. Opportunities will be provided for everyone to try the tasks, either during or after the official competition.

Is participation in the virtual qualification required if you wish to join the national team?

• Yes. The virtual qualification is a prerequisite for participating in the Regional Championships, which in turn is a prerequisite for qualifying for the National Championships, from which the national team is selected.

What should I do if I experience technical problems?

• Send an email to support@cybermesterskaberne.dk, and we will try to help.

Do I need to be a Danish citizen to participate?

• Danish citizenship is a requirement for participating in the final round of the competition (National Championships). All 15–25-year-olds residing in Denmark may participate in both the qualification round and the Regional Championships.