Every page in this packet carries the Blue colour stripe and a “BLUE CELL” corner tag, so you can mix this cell’s clues with the other cells’ and still tell them apart. Sort the packet into two piles:
The investigation clues — put them on walls and tables, mixed with the other cells’ clues:
Everything after the divider page is the team’s packet — the cover, the cybersecurity briefing + keypad puzzle, the Field Credential (binary) puzzle, and the two cipher sheets.
An internal IT audit note. Decode it, figure out whose account it means, then build that person's password.
| Username | Name | Assignment |
|---|---|---|
| jrivera | J. Rivera | JV Baseball (@coach.rivera) |
| mriviera | M. Riviera | Varsity Baseball (@coach.riviera) |
| arivera | A. Rivera | Front Office |
| mchen | M. Chen | Science Dept. |
More than one Rivera. Match the flagged username to the right person.
| Time | User | IP address | Location | Result |
|---|---|---|---|---|
| 07:41 | mchen | 72.14.201.5 | Campus | success |
| 07:58 | principal.vega | 72.14.201.3 | Campus | success |
| 08:03 | jrivera | 72.14.201.9 | Campus | failed |
| 08:03 | jrivera | 72.14.201.9 | Campus | success |
| 09:15 | library | 72.14.201.12 | Campus | success |
| 11:47 | mchen | 72.14.201.5 | Campus | success |
| 13:30 | tsmith | 203.0.113.44 | Conference (travel) | success |
| 16:12 | jrivera | 72.14.201.9 | Campus | success |
| 19:22 | mchen | 98.62.14.7 | Home | success |
| 20:05 | principal.vega | 98.140.20.3 | Home | success |
| 01:12:47 | jrivera | 178.45.22.89 | Unknown | failed |
| 01:12:49 | jrivera | 178.45.22.89 | Unknown | failed |
| 01:12:51 | jrivera | 178.45.22.89 | Unknown | failed |
| 01:12:54 | jrivera | 178.45.22.89 | Unknown | failed |
| 01:12:58 | jrivera | 178.45.22.89 | Unknown | success |
| 06:40 | library | 72.14.201.12 | Campus | success |
AI can clone any voice. Before acting on ANY urgent phone request, make the caller give your cell's shared secret (in your dossier). No word, no trust. Real staff will never ask you to skip this step.
Planted decoy — cut out and leave on a desk. Anyone could have scribbled it; the real verification word is on the sealed P5 dossier card.
If a caller cannot give this exact word, they are an imposter. Do not read it aloud to anyone.
Students count these to discover their Caesar shift - it is not printed anywhere. These blue keys are the Blue cell only; scatter them, and each cell counts its own color.
Hand every page from here on to the Blue cell as their dossier packet. Do not post these around the room.
Operation FIREWALL - {{SCHOOL}} Security Operations Center
You are the defenders. Reconstruct the breach, recover all five patch fragments, and deploy before the clock runs out. Trust nothing. Verify everything.
Security people are nicknamed by the colour “hat” they wear. Your cell is the Blue Hat. The attacker, NIGHTJAR, is a black-hat crew.
Cybersecurity is how we protect computers, networks, and information from people who want to steal, damage, or misuse them. Every login, every message, and every saved file depends on it — and attackers are always looking for a way in.
A school is like a building full of doors. Some attacks trick a person into opening one: a fake email, or a caller pretending to be the principal. Others slip through a door someone forgot to lock — a weak password, or a system that never got updated. Good defenders never trust a single lock; they build layers, so that if one fails, another still holds. That idea is called defense in depth.
In Operation FIREWALL, you are the defenders. An intruder called NIGHTJAR is already inside your school's network. Work the five breach layers, recover a fragment from each, and deploy the patch before the clock runs out. Trust nothing. Verify everything.
Cryptography scrambles a message so only the right people can read it. You are given the first digit of your 5-digit keypad code. Apply the four operation cards in order, left to right, one at a time, and write each new digit in the next box.
Recover your four-digit agent ID, then find the scan card printed with that number and scan it to open your network trace.
A Caesar cipher shifts every letter by a fixed number. Find your shift, set the wheel, and decode.
Cut the inner disk, pin the center, rotate it to your shift.
Use this to decode the network-trace shutdown code (Puzzle 4). Each letter is the lines around it in these grids; a dot means the second grid. Match each symbol to its letter, half by half, then combine.