Before I jump into the heart of the topic, let me give you some context. I am currently the game designer on CryptoKnight, my semester long project at the Entertainment Technology Centre. We are tasked with creating a game for picoCTF 2018, a computer security competition for middle and high school students. picoCTF has been associated with the ETC twice in the past, once in 2013 and once in 2014. Both of these projects, slapped a narrative onto the existing competition and created a nice interface for the game and called it a day.

In order to differentiate ourselves from the previous projects we sought help from faculty and they advised us that we should address some of the problems that are inherent in the competition. We looked at data collected from the picoCTF 2017 and the problem was pretty evident, the questions that the problem development team had created last year were extremely hard and more than 50% people could not solve more than the first 4 questions and the drop off in participants was extremely high. Assuming that the problem development team addresses this issue this year and creates a more gradual difficulty in the questions, we decided to target the middle schooler demographic of students who were just getting exposed to computer science and computer security and had no prior experience in these areas.

Difficulty of picoCTF 2017 showing the sharp drop-off in the number of participants after the first few questions.

We decided that with our project, we aim to expose young middle schoolers to the various concepts that are part of computer security. We did not aim to teach the students anything as that requires coming up with decent metrics to measure whether the students have actually learned something and also our faculty advised us that it was not our job to teach.

In order to tie the entire experience into one cohesive ball, we needed a story or a narrative context that the players could relate to while interacting with the educational concepts. This story would also form the basis around which the educational experiences would be built. I came up with the idea that, the city you are in is under the imminent threat of attack from a disgraced evil scientist and you and your team are being recruited by a secret agency to help save the city from danger. This allowed us to present the scaffolding i.e. the actual educational material in the form of missions for the players. Another problem that we needed to tackle was that of making the game inclusive for all genders and races. This was something that previous games had failed to do, we chose to incorporate a story element where, it is unsafe for you to go outside and you must control a robot remotely through the city.

We started prototyping on our ideas, by choosing Cryptography and more importantly, Encryption and Decryption as the basis of the puzzle. During my research, I tried to learn as much as I could about particular topics. Apart from learning the topics online, I also took help from the problem development team to help simplify the concepts. After learning these concepts, I tried breaking them down to the most basic level. For cryptography, we wanted the players to understand why cryptography was important. From encrypting your data to protect it from intruders and everyone, to decrypting it so that it is in a human readable format. Once we had these pieces, I started making the simplest of puzzles out of them.

The Cryptography mission, where you need to get through a security scanner with the encrypted key.

I chose to make a simple move from point A to point B kind of puzzle for this topic. The character’s robot had a key in their hand, which looked like a briefcase. The players had to go through enemy security to get to the other part of the level. To get past security safely, the players need to “encrypt” the key. Encrypting the key is basically clicking a button and playing an animation of what a transposition cipher would look like in that scenario. After the players have gotten past security, they need to deposit the key into a portal like device, but before they can do that they need to decrypt the key. This is one of the more simpler puzzles that I created and the art and sound in the level is doing some heavy lifting. The initial iterations of this level had us stuck on how the player would interact with the key and how much interaction we wanted to add into the level while making sure that the concepts that we are trying to convey don't get lost in the mix. The following images show how the animation for the encryption and decryption worked. We decided to keep the interactivity at this point low on purpose as the players would not know what to do as this is not a straightforward mechanic.

During the first playtest of our game, we received overwhelming feedback from our players that they wanted the core of the puzzle to be more interactive. I took this feedback into account while designing the second mission. This mission was about Brute Force attacks and how you can simplify them. The idea behind brute force attacks is that, you create a dictionary that might be very small or very large depending on the lock. I used this concept to form the core of the puzzle. The story of the mission is that you are trying to intercept the armed nuclear football on the way out of the city and then disarm it.

The stealth part of the brute force mission where you are following the enemy robot.

The first half of the mission is a simple stealth mission, where you need to tail an enemy without getting caught or losing track. As soon as the enemy turn onto an alleyway, the mission shifts gears and you now have the opportunity to disarm the enemy robot and the bomb. As you get the briefcase, you realize that it is locked by a 3 digit code and logically you should realize that without any help this could take you a long time. We then give you a clue that contains the first 2 digits of the code and you can use them to to unlock the briefcase as after this the last digit is just trial and error. In short, we reduced the size of the dictionary from a 1000 option to 10. The following images show how the interaction with the briefcase looks like.

This mission was received much better than the previous one as it had the right amount of interactivity along with the educational content that allowed the players to take something away from the game. As of writing this blog, this mission is still in development and the players are still having difficulty traversing through the level, but with each iteration, the level is improving just enough to make the player experience a good one.

Last weekend, we had 7 middle to high schoolers playtest our game and we received some valuable feedback on the quality of our game. Most playtesters were able to understand at least part of the problem and enjoyed going through the game despite its rough edges. We were able to identify potential walls for the players and mitigate those problems early.

Playtesting data showing how the 7 players understood the problems in the game differently

In summary, creating educational experiences for children requires you as the designer to be well versed in the topics that are in the game. This helps you take those topics and break it down to the most basic level that a middle schooler would be able to understand and take something away from. Also, keep playtesting a lot, as this will help you understand what is working for your audiences and what isn’t.