The Rule Philosophy of Top Hackers: From CTF to DARPA's AI Cyber Challenge

Title

Top Hacker's Philosophy of Rules: From CTF to DARPA's AI Cyber Challenge

Rules are what hackers should understand best. Mike Walker, a research manager at Microsoft Research, put it bluntly on the Microsoft Research Podcast: "You have to understand the rules in order to do what you want to do." This cybersecurity researcher, who led DARPA's Cyber Grand Challenge (CGC), sees rules as a social construct—and understanding the social context behind rules is more important than mechanically obeying or defying them.

From a Tinkering Kid in Ohio to a Hacker "Found by the Country"

Walker grew up in Columbus, Ohio, with a father who was "half scientist, half venture capitalist" and often brought home industrial equipment for him: helium-neon lasers, high-voltage power supplies, handed over with a safety warning and then left alone. With this gear he replicated the Michelson-Morley experiment and spent countless hours tinkering with an Apple II—trying to wire it into every corner of his life.

Before college he was already running a BBS (bulletin board system), connecting via dial-up modem to one small system after another, each "a universe unto itself." Looking back, he says he was actually "doing cybersecurity all along, just didn't know what it was called."

The turning point was September 11, 2001. He was working at a telecom technology startup in Maryland; his wife was in Washington, D.C. that day, all phone lines were down, and F-16s flew over the company. Afterwards the capital began a hunt for people who understood computer security—"that search found me."

According to Weisheng Liu, host of the Microsoft Research Podcast, Walker later became a core member of the DEF CON CTF community. He describes the atmosphere of this circle as "a café-like environment where everyone is getting stronger," one that pushes people to rise fast.

CTF and CGC: Getting Machines to Play Soccer

DEF CON's Capture the Flag is similar in form to summer camp games but different in spirit. Eight to sixteen teams each defend their own flag (data or control over a networked system) while trying to break into opponents' servers to capture theirs. The key point: all the protected software is written specifically by the organizers for that year's competition, and contestants see it for the first time the moment they sit down—whoever understands the software first gains both defensive and offensive capability at once.

DARPA's Dan Kaufman and Norm Whitaker saw humans playing CTF and asked: can machines play? That was the starting point of CGC—the world's first fully automated machine hacking tournament.

Walker stresses that CGC is fundamentally different from today's AI: it was an "expert systems competition," where machine learning was not the key player—what really mattered was fusing a whole set of autonomous tools to accomplish the task. What today is called a "harness"—such as the M-Dash cyber reasoning system built by Team Atlanta members in AIXCC—would have been called an expert system in the context of 2016.

CGC ran entirely on autonomous systems in an air-gapped environment; if something failed, no one could go in and restart it. Walker recalls that for three and a half years before it actually worked, whenever anyone asked him whether it could succeed, his answer was "wait and see." In a 2016 interview with The New York Times, he said making cyber technology safer is a "civilization-level challenge"—a statement he believes still holds today, even more so, because civilization's dependence on networked systems only grows.

DEF CON CTF is the world's most influential hacker attack-and-defense capture-the-flag competition, held annually at the DEF CON hacker conference in Las Vegas. The format is usually attack-defense: each team maintains its own services while attacking opponents' services to steal "flags" (a string proving successful intrusion). Unlike Jeopardy-style challenge competitions, it emphasizes real-time confrontation and automated tools. DEF CON CTF has long been regarded as a "live-fire training ground" for cultivating top security talent; many participants later joined security research institutions or founded security companies.

Air-gapped means a computer network is physically completely isolated from external networks (including the Internet), with no wired or wireless connection. This environment is often used in high-security scenarios such as the military and critical infrastructure. In CGC, all machines must run autonomously in an air-gapped environment, meaning competing systems cannot rely on external human intervention or cloud resources and must rely entirely on themselves to discover, exploit, and patch vulnerabilities.

Red Team, Blue Team, and Why the Real Team Is Purple

Walker is skeptical of the red-blue dichotomy. His argument is simple: what you call a program depends on who holds the key. A program that encrypts all your files and unlocks them when needed is either an encryption tool or ransomware, depending on who holds the key; a program that allows remote login and control is either malware or a remote management tool, again depending on who holds the key.

At the atomic level, cyber attack and defense capabilities are dual-use. Once an attacker breaks in, they must protect their intrusion—lateral movement and data exfiltration all the way through are about avoiding detection; the defender's log analysis tools can themselves become attack targets, and defenders need to find vulnerabilities and write proofs of exploit, which is itself an attack skill. So the meaning of purple team is not compromise but acknowledging that offense and defense share the same set of skills and tools.

Walker's team, New Security Ventures, positions itself as "developing highly offense-aware defensive tools"—building defensive tools, but building them knowing they are targets.

Red Team usually refers to simulating attackers to discover and exploit system vulnerabilities; Blue Team is responsible for defense, detection, and response. This division originated in military exercises and was later widely adopted by the cybersecurity industry. However, in reality the boundary between offense and defense is often blurred: attackers need to protect their foothold (e.g., establishing persistence, clearing logs), and defenders also need to simulate attacks to validate defenses. The concept of Purple Team exists precisely to break down the red-blue opposition and emphasize offense-defense collaboration—red and blue teams share intelligence and improve defenses together rather than working separately. Walker's view goes further: offense and defense skills are essentially the same in origin, and the distinction lies only in intent and authorization.

Project Freta: Cloud-Scale Memory Forensics That Bypasses Tampering

He uses an analogy of sneaking into a store to explain "tampering": rather than practicing difficult moves to dodge cameras and laser lines, it's easier to walk in boldly, cut the camera feed, and replace it with a fake signal source playing a recording of an empty store. In computer security, tampering is often the attacker's easier path.

Project Freta, named after Marie Curie's birthplace, aims to solve this problem at cloud scale: when defenders collect telemetry, they don't rely on software that could be deleted or tampered with, but collect signals directly from cloud hardware. It is a from-scratch, full-system memory analysis environment built specifically for analyzing memory from cloud hardware.

As for whether disclosing technical details helps attackers, Walker's distinction is: "You can publish a technique, or you can publish its deployment. I published the technique but didn't disclose the deployment." He further points out the interesting game theory of offense and defense—attackers adjust their strategies based on their perception of defenders' behavior, so "claiming to have a certain capability," "actually having it," and "the mismatch between claim and reality" all become usable strategies.

Memory forensics is a branch of digital forensics that involves collecting and analyzing volatile data in computer memory (RAM) to discover traces of running processes, network connections, encryption keys, malicious code, and more. Unlike disk forensics, data in memory disappears when power is lost and is harder for attackers to persistently tamper with. In cloud environments, memory forensics faces additional challenges: virtual machines may be controlled by tenants, and the hypervisor layer may also be attacked. Project Freta's goal is to capture memory snapshots directly at the cloud hardware level, bypassing potentially compromised guest operating systems to obtain more trustworthy telemetry.

Rules, Trust, and Team Intelligence

Back to the topic of rules, Walker offers an equation often overlooked by security practitioners: every time a security system asks something of users, it is demanding trust; trust is scarce, and once abused, the security mechanism itself collapses. Therefore, beyond immediate adjudication, we need resilient ways of making judgments that connect with social norms.

He and the host played a rule-judging game called No Vehicles in the Park—using the rule "no vehicles in the park" to judge whether the International Space Station flying over the park violates it. Walker usually struggles to exceed a 50% agreement rate; the host got 96% on the first try, and he joked that it was like "being assimilated by the zeitgeist."

On leadership, Walker mentions advice a mentor once gave him: the decisions you disagree with may simply be based on information you don't have. Ever since, whenever he hears any decision, he first asks "what do they know that I don't?" He also realized during a CTF qualifier that no one on the team knew who was working on which already-solved problems, who lacked tools, or who should be paired with whom—"I could quantify the IQ in the room, but I couldn't quantify how well we collaborated." This led him to a long-term focus on social intelligence in technical teams and on abandoning the individual-hero narrative.

Bicycles, Rules, and the Self

Walker turned to cycling after a basketball knee injury, and later became hooked on mountain biking in "steep terrain where normal people wouldn't ride." He followed a structured training plan to prepare for the High Cascades 100-mile endurance race, training from January to July. Interestingly, he admits he follows training plans far more strictly than ordinary rules, to the point of being warned not to become a "training robot"—he once used ERG mode on the trainer for a long time, letting the machine decide how much power to pedal at, before learning to return to free riding and listen to his body's feedback.

He finished that race 69th out of 329 participants. As for the pain of cycling, his division is crisp: the real pain is the day-before checklist, logistics, and hunting for a bike shop to fix a flat tire; once you set off, the rest "is the best part."

If he hadn't entered cybersecurity, he says he would be a science fiction writer, one hundred percent—he recommends Haldeman's "The Forever War."

Security and rules are never purely technical problems. The clues from Walker's experience are: thoroughly understand the social nature of rules, acknowledge the dual-use nature of offense and defense skills, and treat trust as a resource that can be depleted—these principles explain both why a machine hacking tournament matters and why a team wins.

One-line Summary

Microsoft Research's Mike Walker, from hacker to CGC lead, discusses rules, dual-use offense-defense, and trust.

Paragraph Summary

Based on an interview with Mike Walker on the Microsoft Research podcast, this article traces his journey from a tinkering kid in Ohio to a cybersecurity researcher, focusing on his leadership of DARPA's Cyber Grand Challenge (CGC)—the world's first fully automated machine hacking tournament. Walker points out that CGC was essentially an expert systems competition, fundamentally different from today's AI. He questions the red-blue dichotomy, arguing that offense and defense skills are dual-use at the atomic level and that purple team is the reality. He also introduces Project Freta, which collects memory signals directly from cloud hardware to avoid tampering, and emphasizes that every demand a security system makes consumes trust—once trust is exhausted, the security mechanism collapses. Finally, he shares his thoughts on team social intelligence and the social nature of rules.