WICC 2026 Meme Awards

At the closing ceremony, alongside the real medals, CTFRadar handed out a set of meme awards computed from the range telemetry it had been collecting across both days: Burst Mode, the Nosy Neighbour, Old Faithful, Spray ‘n’ Pray and the rest. They’re still online at the WICC Observed Activity Awards, where every card has its own URL and a QR code, so a trophy could be scanned straight off the venue screen.

The names were deliberately ridiculous. The numbers underneath were real, within the limits of what CTFRadar could actually see, and they even rhymed with the results: the teams that finished on the podium, Europe, the US and Oceania, averaged more visible activity than the rest of the field. More on that below.

The full awards board from the closing ceremony. Each award opens as its own certificate.

Where was the data sourced

The telemetry awards come from Google VPC flow logs: sampled at 50%, rolled up into one-minute windows, no payloads, no packet capture. A port number was often the closest thing available to an explanation of what a flow might have been. Over 99% of the internal range traffic couldn’t be attributed to a team, and that figure is printed on the ceremony page itself. Pronunciation and first/last-solve awards came from separate observations and competition facts, as described below.

The awards describe the slice of traffic that CTFRadar could both observe and connect to a team: observed activity, not a judgement of who attacked or defended best.

Built into CTFRadar

The meme awards are a built-in CTFRadar feature, not a one-off script. The board tracks the candidates throughout the event, and at the end the operator flips a single switch: the telemetry is frozen as a snapshot, the awards toggle on, and from that point the ceremony page always shows the same result.

The winners themselves aren’t stored anywhere. The browser runs the award code against the frozen snapshot on every load, ties go to the lower team ID, and a team with no attributable traffic can’t win anything. Team Africa had withdrawn, so they were excluded rather than losing awards in a competition they were no longer playing.

Burst Mode

The biggest spike relative to a team’s own average:

const m = mean(sp), peak = maxOf(sp);
return m > 0 && peak >= MIN_BURST_BPS ? [peak / m, peak] : null;

The floor stops one stray packet after a long silence winning on a near-infinite ratio. The UK Cyber Team won at 522 times its average: nearly all of that minute went at a single objective, and those sixty seconds were about a third of its visible traffic for the whole event.

The UK Cyber Team’s busiest minute reached 522 times its event average.

Spray ‘n’ Pray

Despite the name, this is an award for evenness: the Shannon entropy of a team’s traffic across its objectives.

H = −Σ pᵢ log₂ pᵢ

Canada touched more objectives, twenty-three to twenty, but Europe spread its traffic more evenly across the ones it reached and took the award.

Fewer objectives than Canada, but a more even spread.

Old Faithful

The steadiest signal, scored on the coefficient of variation: standard deviation over mean, lower is steadier. The winning card read:

Team Europe — only 428% variation, steady as she goes

Not a typo. Europe’s standard deviation was 4.28 times its mean, and that was still the lowest on the board. I left the number on the certificate because it was funnier than anything I could have written around it.

“Steady” turned out to mean 428% variation.

The Comeback Kid

A raw late-over-early ratio rewards whichever team barely registered at the start, so this one has a gate: quieter than the median team early, louder than it late. Ukraine had the biggest raw ratio and failed the gate, because being quiet all day is not a comeback. Europe qualified, eight times louder at the end than the start.

The gate exists so that being quiet all day doesn’t count as a comeback.

Turning fifteen hundred minutes into one result

The award code scores a one-minute snapshot, so the event result meant rolling roughly fifteen hundred windows into one: volumes summed, peaks kept. That choice decides winners. Nosy Neighbour changes hands depending on whether you use the final minute, the highest minute or the whole-event sum, and its winning card pairs a recon score and a port count that peaked forty minutes apart. It’s a summary of two days, not a photograph of one moment.

Both numbers are real. They happened forty minutes apart.

Then the real data arrived

I tuned the thresholds on a synthetic feed before the event, and almost none survived contact with the real one: the recon gate sat above anything the real data produced, and the quiet floor sat above the real median. The synthetic feed proved the scoring code worked. It said nothing about what the real distribution would look like.

Did the traffic match the scoreboard?

Loosely, yes. The three podium teams averaged about 62MB of attributable traffic each against 48MB for the rest of the field, and the champions left the clearest signature of anyone: Europe’s three data awards were steadiest signal, most even spread and strongest finish. Consistent, everywhere, and accelerating when it counted. Oceania, third officially, moved the most traffic outright and took the Bandwidth Baron.

It’s an indication, not a law. The US Cyber Team finished second with only the fifth most visible traffic, and the LAC Women’s Cyber Team moved the second most traffic of anyone while finishing seventh. Rank the teams by visible bytes against the official standings and the correlation is positive but weak. With half the traffic sampled away and most of it unattributable, that’s as much as the data honestly supports: the podium was busy, but busy didn’t buy a podium.

Who ended up with what

Team Europe took six awards, Canada four, the UK three, and Oceania, LAC and the United States one each.

Not every card came from flow logs. Each team had an epithet from Irish mythology, which naturally produced two pronunciation awards: Team Europe won Fáinne Óir for pronouncing “Ériu” correctly, and the US Cyber Team received the Cúpla Faux-cal for its attempt at “Uirne”. The bookends were the only direct competition facts on the board: Canada took the first solve of the tournament, Europe the last.

The award for winning the most awards.

The meme awards didn’t decide the competition standings. In the end, though, winning the most awards did have an official consequence: you got 1 extra point.

Check the arithmetic

The ceremony page is still online, along with the frozen snapshot and the full minute-by-minute event series it was computed from. Anyone can rerun the numbers, score the awards differently, or decide that Canada was robbed by Shannon entropy.