How to Play

In CTF, two players take on the roles of hacking teams competing in a friendly capture the flag event. Each player brings their own deck of nine cards, many of which will enable them to Advance through the layers of their opponent’s security. The first player to advance all the way through their opponent’s security system three times wins!

Contents

• Building a Deck
• Setting Up
• Anatomy of a Program Card
• Phases of a Turn
• Executing Subroutines
• Ending the Game
• Keywords
• Card Ownership

Building a Deck

The easiest way to build a deck is to open a starter pack. Each starter pack contains two complete, playable decks.

But if you wish to customize your deck (or to build one completely from scratch!) you’ll need:

• 1 Team Card, which determines which two disciplines you may use in your deck.
• 8 Program Cards, which are the main cards you’ll play each turn.
  • Each program card must match one of your team’s two disciplines.
    • One program card, reload, has no discipline. It may be included in any deck. /* And while it’s not strictly required, every deck probably should include it. */
  • Each program card must have a unique name.

Setting Up

1. Set up the playmat. Unfold the box into the middle of the table and arrange it so that one of the two Layer tracks is facing each player.
2. Start at Layer 0. Each player places their team card on Layer 0 of their track.
3. Shuffle decks. Each player reveals their reload card (if any) and sets it aside, then shuffles the remaining cards.
4. Deal out security cards. Each player deals two cards face-down into their Security Zone.
5. Create starting hands. Each player puts all the program cards they didn’t deal to their Security Zone (including reload) into their hand.

Once setup is complete, the first turn begins.

Anatomy of a Program Card

Program cards have a title bar along the top that contains, from left to right:

• an icon representing the program’s discipline
• the program name
• a QR code that points to the program’s database entry, which has a record of errata and rules clarifications for the card

Below the title bar are a number of boxes, each representing a subroutine. There are several types of subroutines:

• [0], [1], and [2] subroutines are the core of the game: they’re excecuted in ascending order when the card is played.
• service and malware subroutines are large boxes found on installable programs and represent what the program does once it’s installed. Most of the time, they’re paired with a [0] subroutine that installs them. See the section on the install keyword for more information.
• Security Alert subroutines are red boxes that are executed when they’re revealed by their owner’s security being broken.

In between subroutines, programs may also have comments. Comments are just flavor text with no effect on the game, but sometimes they might help explain more complex cards.

The bottom left corner of the card contains the collector number in the form of “[set::number]”. For example, the card autostrike is labeled “[init::20]”, which means it’s card number 20 in the set “init”.

The bottom right corner of the card contains a rarity indicator. See the [init] card set for a complete listing of rarities and their meanings.

Triggered abilities

Some subroutines have triggered abilities marked with a small triangle. The condition that will cause the ability to happen is highlighted, and the effect follows the highlighted text.

▸ When you see text formatted like this: You’ll know it’s a triggered ability.

See the section on handling triggered abilities for more information.

Phases of a Turn

In CTF, turns don’t belong to a player—play is simultaneous. Turns are broken up into seven phases. In each one, both players take the assigned action at the same time. When both players are done, they move on to the next phase together.

Step 1: Choose a Card to Play

Each player secretly chooses a card from their hand and places it face down in their Active Program area. A player who cannot play a card loses the game.

Step 2: Reveal Active Programs

Each player turns their Active Program face up.

Step 3: Execute [0] Subroutines

Each player resolves the effect of their Active Program’s [0] subroutine, if it has one.

Step 4: Execute [1] Subroutines

Each player resolves the effect of their Active Program’s [1] subroutine, if it has one.

Step 5: Execute [2] Subroutines

Each player resolves the effect of their Active Program’s [2] subroutine, if it has one.

Step 6: Check Security

If either player’s team card is on Layer 5, they break their opponent’s security. To break security:

• If your opponent has one or more cards left in their Security Zone:
  1. You reset your team card to Layer 0.
  2. They reveal their top security card. If it has a Security Alert, that ability triggers now.
  3. They put their top security card (presumably the one they just revealed) into their hand.
• If your opponent has no cards in their Security Zone, you win the game!
  • If both players would win at the same time, the game enters sudden death.

The security check happens once, as the Check Security step begins. If a Security Alert that triggers during this step causes a player to advance to Layer 5, they’ll have to wait until next turn’s Check Security step to break.

Step 7: Cleanup

Each player who still has a card in their Active Program area puts that card into their discard pile.

Executing Subroutines

To resolve a subroutine, most of the time you simply follow its instructions in the order written. If part of a subroutine is impossible, do as much as you can. If one action is dependent on another, there will be some condition (“if you do,” “if you can’t”, “otherwise,” etc.) to make that dependency clear.

A term that appears bolded on a card will have its definition in the Keywords section.

Like most other card games, CTF has a golden rule: if the text on a card contradicts these rules, the card takes precendence.

Most of the time, simultaneous effects don’t conflict with each other, but there are a few common cases that could be confusing:

• If a [0] subroutine tries to move the opponent’s active program to another zone, the opponent’s [0] subroutine will still resolve normally, but later ones won’t.
  • The same is true for [1]: a subroutine trying to move the opponent’s active program won’t prevent their own [1] subroutine from executing.
  • If a subroutine tries to move the opponent’s active program to another zone, and the same subroutine of the opponent’s program also tries to move itself somewhere, the opponent’s ability takes priority. Most commonly, this happens when a [0] subroutine tries to move a service or malware that’s trying to install itself. In that case, the installation succeeds.
• If players each have an effect requiring them to make a choice, and the outcome of one of those choices would affect the other, players make them in secret, then reveal them both simultaneously.
• If a player is simultaneously instructed to advance and fall back, they advance first, then fall back.

If you’re unsure of how an interaction plays out, look up the cards involved in the card database to see if there are any clarifying rulings. You can scan the QR code in the corner of the card to go directly to its database entry.

// TODO: include some way to reach out if a player is still unsure

Handling triggered abilities

Triggered abilities in service or malware subroutines are always looking for their conditions as long as the card they’re on is installed.

Triggered abilities in [0], [1], or [2] subroutines watch for their conditions from the time their subroutine is executed until the end of the turn.

For example, the triggered abilities on autostrike can trigger at any time when autostrike is installed. By contrast, the triggered ability on lockdown can trigger only once its [0] subroutine has been executed, and only until the end of that turn.

Ending the Game

The game ends when one of two things happen:

• A player breaks security when their opponent’s Security Zone is empty (in which case, they win the game), or
• A player is unable to play a card (in which case they lose the game).

Sudden Death

If both players would win the game by breaking security at the same time, the game enters sudden death. Both players reveal and erase their reload cards from whatever zone they’re currently in (even if they’re stored under a card), then reset to Layer 0. The game continues with no reloads.

In sudden death, if a player breaks security while their opponent’s security zone is empty, they win (unless both players do so at the same time, in which case sudden death continues).

If one player is unable to play a card at the beginning of a turn, that player loses. If both players are unable to play a card at the same time, the game is a draw.

Keywords

Words on cards generally have their normal English meanings, but some words have meanings specific to CTF. Those are listed below.

Advance N

To Advance N, move your team card N layers higher on the layer track, stopping if you hit Layer 5.

Fall Back N

To Fall Back N, move your team card N layers lower on the track, stopping if you hit Layer 0.

Install

To install a card in your own system, place it in front of you. To install a card in your opponent’s system, place it in front of them.

Installable cards contain either a service subroutine (generally a positive effect you install in your own system) or a malware subroutine (generally a negative effect you install in your opponent’s system).

The effects of a service apply to the player whose system it’s installed in. This is also true of malware, but malware subroutines use the term infected player for clarity.

Discard

To discard a card, move it from wherever it is into its owner’s discard pile.

Erase

To erase a card, remove it from the game. It is no longer in any zone, and nothing can return it to the game.

Store

To store a card, tuck it under the card that told you to store it. The effect instructing you to store a card will also tell you what to do with the card afterward (for example, the stored cards may be returned to their owners’ hands when the card they’re stored under changes zones).

Leaves Play

A player’s active program leaves play when it leaves the active program zone. An installed card leaves play when it stops being installed.

Full/Empty Security Zone

A player’s security zone is empty if it has no cards in it. A player’s security zone is full if it has at least two cards in it (even if it had more than two at another point that game).

Card ownership

A card’s owner is the player who started the game with that card in their deck. Some effects allow you to play opponents’ cards, store them under your cards, or install them in your system. It’s possible for cards you don’t own to end up “on your side”; this doesn’t change ownership of those cards.

Importantly, though: cards can only go into their owners’ hands, discard piles, or security zones. If an effect instructs you to put an opponent’s card into your hand, discard pile, or security zone, put it into its owner’s corresponding zone instead.