How to Play

In CTF, two players take on the roles of hacking teams competing in a friendly capture the flag event. Each player brings their own deck of nine cards, many of which will enable them to Advance through the layers of their opponent’s security. The first player to advance all the way through their opponent’s security system three times wins!

Building a Deck

The easiest way to build a deck is to open a starter pack. Each starter pack contains two complete, playable decks.

But if you wish to customize your deck (or to build one completely from scratch!) you’ll need:

1 Team Card, which determines which two disciplines you may use in your deck.
8 Program Cards, which are the main cards you’ll play each turn.
- Each program card must match one of your team’s two disciplines.
  - One program card, reload, has no discipline. It may be included in any deck. (And while it’s not strictly required, every deck probably should include it.)
- Each program card must have a unique name.

Setting Up

Set up the playmat. Unfold the box into the middle of the table and arrange it so that one of the two Layer tracks is facing each player.
Start at Layer 0. Each player places their team card on Layer 0 of their track.
Shuffle decks. Each player reveals their reload card (if any) and sets it aside, then shuffles the remaining cards.
Deal out security cards. Each player deals two cards face-down into their Security Zone.
Create starting hands. Each player puts all the program cards they didn’t deal to their Security Zone (including reload) into their hand.

Anatomy of a Program Card

Program cards have a title bar along the top that contains the program’s name and an icon representing its discipline.

Below the title bar are a number of boxes, each representing a subroutine. There are three types of subroutines:

[0], [1], and [2] subroutines are the core of the game: they’re excecuted in ascending order when the card is played.
service and rootkit subroutines are blue boxes found on installable programs and represent what the program does once it’s installed. Most of the time, they’re paired with a [0] subroutine that installs them.
Security Alert subroutines are red boxes that are executed when they’re revealed by their owner’s security being broken.

In between subroutines, programs may also have comments. Comments are just flavor text with no effect on the game, but sometimes they might help explain more complex cards.

Playing the Game

In CTF, players don’t take turns; instead, each round, there are 7 steps where both players take actions simultaneously. Once both players have completed a step, proceed to the next one.

Step 1: Choose a Card to Play

Each player secretly chooses a card from their hand and places it face down in their Active Program area.

Step 2: Reveal Active Programs

Each player turns their Active Program face up.

Step 3: Execute [0] Subroutines

Each player resolves the effect of their Active Program’s [0] subroutine, if it has one.

Step 4: Execute [1] Subroutines

Each player resolves the effect of their Active Program’s [1] subroutine, if it has one.

Step 5: Execute [2] Subroutines

Each player resolves the effect of their Active Program’s [2] subroutine, if it has one.

Step 6: Check Security

If either player’s team card is on Layer 5, they break their opponent’s security. To break security:

If your opponent has one or more cards left in their Security Zone:
1. You reset your team card to Layer 0.
2. They reveal their top security card. If it has a Security Alert, that ability triggers now.
3. They put their top security card (presumably the one they just revealed) into their hand.
If your opponent has no cards in their Security Zone, you win the game!

The security check happens once, as the Check Security step begins. If a Security Alert that triggers during this step causes a player to advance to Layer 5, they’ll have to wait until next turn’s Check Security step to break.

Step 7: Cleanup

Each player who still has a card in their Active Program area puts that card into their discard pile.

Executing Subroutines

To resolve a subroutine, most of the time you simply follow its instructions in the order written. If part of a subroutine is impossible, do as much as you can. If one action is dependent on another, there will be some condition (“if you do,” “if you can’t”, “otherwise,” etc.) to make that dependency clear.

Like most other card games, CTF has a golden rule: if the text on a card contradicts these rules, the card takes precendence.

Most of the time, simultaneous effects don’t conflict with each other, but there are a few common cases that could be confusing:

If a [0] subroutine tries to move the opponent’s active program to another zone, the opponent’s [0] subroutine will still resolve normally, but later ones won’t. The same is true for [1] subroutines.
- If a subroutine tries to move the opponent’s active program to another zone, and the same subroutine of the opponent’s program also tries to move itself somewhere, the opponent’s ability takes priority. Most commonly, this happens when a [0] subroutine tries to move a service or rootkit that’s trying to install itself. In that case, the installation succeeds.
If players each have an effect requiring them to make a choice, and the outcome of one of those choices would affect the other, players make them in secret, then reveal them both simultaneously.
If a player is simultaneously instructed to advance and fall back, they advance first, then fall back.

If you’re unsure of how an interaction plays out, look up the cards involved in the card database to see if there are any clarifying rulings.

// TODO: include some way to reach out if a player is still unsure

Ending the Game

The game ends when one of two things happen:

A player breaks security when their opponent’s Security Zone is empty, or
A player’s hand is empty at the beginning of a round, and they’re unable to play a card.

If two players would win the game at the same time, the player with more cards in their hands is the winner.

If this happens and both players have the same number of cards in their hands, the game is a draw.

Keywords

Advance N

To Advance N, move your team card N layers higher on the layer track, stopping if you hit Layer 5.

Fall Back N

To Fall Back N, move your team card N layers lower on the track, stopping if you hit Layer 0.

Install

To install a card in your own system, place it in front of you. To install a card in your opponent’s system, place it in front of them.

Installable cards contain either a service subroutine (generally a positive effect you install in your own system) or a rootkit subroutine (generally a negative effect you install in your opponent’s system).

The effects listed in the service or rootkit subroutine apply to the player whose system it’s installed in. In particular, any instances of “you” or “your” refer to that player, not necessarily the card’s owner.

Discard

To discard a card, move it from wherever it is into its owner’s discard pile.

Erase

To erase a card, remove it from the game. It is no longer in any zone, and nothing can return it to the game.

Store

To store a card, tuck it under the card that told you to store it. The effect instructing you to store a card will also tell you what to do with the card afterward (for example, the stored cards may be returned to their owners’ hands when the card they’re stored under changes zones).

Leaves Play

A player’s active program leaves play when it leaves the active program zone. An installed card leaves play when it stops being installed.

Full/Empty Security Zone

A player’s security zone is empty if it has no cards in it. A player’s security zone is full if it has at least two cards in it (even if it had more than two at another point that game).

Card ownership

A card’s owner is the player who started the game with that card in their deck. Some effects allow you to play opponents’ cards, store them under your cards, or install them in your system. It’s possible for cards you don’t own to end up “on your side”; this doesn’t change ownership of those cards.

Importantly, though: cards can only go into their owners’ hands, discard piles, or security zones. If an effect instructs you to put an opponent’s card into your hand, discard pile, or security zone, put it into its owner’s corresponding zone instead.