The format
A capture the flag competition is the standard way the security industry trains and plays: solve a challenge, find the hidden flag, submit it, score points. The SPARK version kept that shape and scaled it down to primary school: five rounds across the term, one flag per round, ten points per flag, fifty points for a clean sweep.
Everyone played. Rounds ran across multiple classes and year levels, and because flags accumulated over the term, the competition had a season-long arc rather than a single lunchtime spike. Miss a round and you could still climb; sweep all five and you joined the small club at the top of the board.
Real challenges, not simulated ones
The design rule for every round was authenticity. Wherever possible, students worked against real systems rather than worksheets pretending to be systems. Along the way they met public and private key cryptography years before most curricula would dare introduce it.
That round did more for understanding digital money than any slideshow could. The flag wasn't trivia, it was proof you'd navigated a genuine piece of financial software and read it correctly.
The leaderboard
Submissions ran through Google Forms, one form per round, which meant zero accounts and zero friction: type your name, your class and your flag, hit submit. A self-contained leaderboard page then scored everything from the form responses, showing every player, every flag column from F1 to F5, and the running totals.
By the final round there were 196 students on the board and 174 of them had captured at least one flag, with the top students holding all five. The leaderboard became a fixture of the room, part scoreboard, part wall of fame, and the single most checked page on the classroom's big screen.
What the data taught the teacher
Here's the part nobody warns you about: the hardest security problem in a primary school CTF is name entry. Free-text forms produce every spelling of a student's name you can imagine and several you can't, grades written five different ways, and the occasional submission from "me". Building the scoring logic meant writing genuinely defensive parsing, normalising names and grades so the same kid's flags always landed in the same row.
Which is to say the leaderboard was its own little lesson in data engineering, and the competition quietly trained its organiser as much as its players.
From flags to castles
The CTF proved the appetite: students would chase security challenges all term if the scoring was visible and the challenges were real. Its successor took the next step. The flag hunt grew into Red vs Blue, a whole-school program where teams defend real servers and versioned Minecraft castles all term, and the final-day treasure hunt for a hidden IP address is, at heart, one last flag.
If you want to run something similar, start smaller than you think: one form, one flag, one visible leaderboard. The competition takes care of the rest.