Trace Labs CTF Rules
Since the Trace Labs CTF involves real people, we must be very strict with our rules. Most of these rules are designed to ensure there is no criminal activity by contestants but also to ensure we are respectful to missing person and their family.
Please follow the rules. Failure to follow the rules may result in CTF disqualification and being removed from our Slack channels. If you have questions, please ask someone (either onsite or in the Slack channels).
- Passive Reconnaissance: All Trace Labs contestants are limited to passive reconnaissance. This means you can view but not engage. Zero touch reconnaissance is required in order to avoid interrupting ongoing criminal investigations and causing more trauma to the family. Contacting the subject, family of the subject or friends of the subject will result in immediate disqualification (this includes tagging, friending, liking or any other interaction). Basically, performing anything but passive reconnaissance, will result in disqualification. This means you don’t “friend” or comment on any social media related to the subject.
- Blacklisted Sites: We do not permit the following type of sites to be used as submission sources:
- Law enforcement
- Missing persons (includes Missing Persons Facebook pages and WebSleuths).
- Verifiable: To score points, you’r submissions must be verifiable. This means a link to the public information you discovered. Information behind a pay wall is not worth any points as it can not be verified.
- Relevancy: All submissions must have relevance. For example, if you provide a Friend submission, it must show why this friend is relevant. If you try submitting all the friends listed in their FaceBook then the judge will likely reject all of these submissions. Ensure you take time to provide details that describe why this submission is important.
- Valid Teams: Only registered teams/individuals can participate in the contest.
- On Prem/Virtual: The event will explicitly say if you are required to be onsite or if virtual/remote participation is allowed.
- Attacking: Attacking any Trace Labs, contestants or hosting group’s infrastructure will result in immediate disqualification and permanent ban.
- Interference: Attempting to interfere or exploit any other players will result in immediate disqualification and permanent ban.
- Login Attempts: Using passwords from publicly available data breaches will result in immediate disqualification. While the data is public, the use of that data is illegal, immoral and not in the spirit of Trace Labs mission. Using tools to see which of their accounts have been breached is acceptable and encouraged.
- Fake Intelligence: You cannot create (fake) the intelligence. We will be checking this.
- Law Enforcement: Do not engage the law enforcement or media. At the end, the contest organizers will send local law enforcement everything we collect.
- Gaming the System: Do not try to “game” the system. This includes repeatedly submitting the same information or trying to use categories with higher point values when the intel is not in that category. This will greatly reduce the speed at which we process your data which will mean your team’s progress will not be shown on the leader board and ultimately you will lose all these points.
Trace Labs reserves the right to enforce any new rules that are reasonable.
If in doubt, ask us. We will be happy to provide guidance. Questions, concerns and recommendations can be sent to: info [at] tracelabs.org or post in our Slack channel.
Get access to our Slack channel by signing up here: