Eight guys with laptops gathered one Saturday in a Prince George’s County office park for a hunt. Joined by four companions logged in from elsewhere, these cyber-sleuths split into teams of six. The mission for each: Scour a simulated computer, or virtual machine, to find and neutralize 20 security threats. The game scenario called for them to “harden” the computer’s system to ward off thieves and saboteurs.
Strewn across a long table were tangles of wire and cable, cans of orange soda, ginger ale and the detritus of lunch on throwaway plates. A decal on the back of one laptop, adorned with the image of a mudflap girl, said: “Hack Naked.”
Racing a six-hour deadline, the teams ransacked the innards of their virtual machines (VMs), scrolling through the System Configuration Utility, the Registry Editor, the Process Monitor and any other tools that might yield clues. They bantered in tech lingo. Every once in a while there were eurekas.
“See, these updates are knocking out quite a few of those vulnerabilities.”
“Yeah, that one’s wrong, dude. ’Cause look at this.”
“It’s, like, staring at you: ‘There’s something wrong here, buddy.’ ”
Often it became pure confusion.
“Hang on, guys,” said Matt Matchen, a team captain. “My VM’s not working. I mean, it’s totally frozen.”
Meet the Cyber Padawans of the University of Maryland University College. They are, for now, the poster team of an institution that has nothing remotely like Terps or Hoyas basketball to rally students and market the school. They represent a public university that has capitalized on a special relationship with the military to become a major force in online education.
Matchen, 33, of Laurel, a network security specialist, is pursuing a bachelor’s degree in international business. Aaron Demory, 34, of Woodbridge, an information technology expert, is seeking a master’s degree in cybersecurity. R. Jean Costello, an IT specialist who declined to give her age, is aiming for a second bachelor’s degree, in computer networks and security, years after earning her first, in accounting.
Costello was tied into the hunt from her home in St. Louis via Google Hangout and Skype. She said she is motivated in part by outrage over the proliferation of hacking, at a time when even day-care providers are falling victim to cyber-scams.
“Just despicable,” said Costello, who works on cyberdefense for the Girl Scouts of eastern Missouri. “My goal is to help make the Internet a safer place.”
With a name coined from a term for Jedi apprentices in the “Star Wars” films, the Cyber Padawans compete against collegiate and professional rivals in events promoting the fast-growing field of cybersecurity. The team took a silver medal a year ago, just behind a Dutch squad, in an event called the Global CyberLympics in Miami. On this September day, the Cyber Padawans were in the first round of the third annual Maryland Cyber Challenge. At stake was $5,000 for each member of the winning team, a purse funded by the National Security Agency.
More was at stake for their highly unusual school. It aims to build a national brand to stand out in an increasingly fluid and crowded online market.
UMUC has headquarters in Adelphi, an academic/operational center in Largo, classes online, classrooms around the globe — but nothing that resembles a traditional college campus. There is no football stadium, basketball arena or even a bookstore. About 93,000 students a year take UMUC classes, according to the university, roughly a third of them at U.S. military bases overseas. For many Americans, especially those outside the military and the Washington region, UMUC could be the biggest state school they’ve never heard of.
Over the past 15 years, UMUC has become the largest public online university in the country. Only seven universities have larger online enrollment, according to the Boston-based consultant Eduventures. Six are run for profit, led by the University of Phoenix. The seventh, Liberty University, is a private, nonprofit evangelical Christian school in Lynchburg, Va.
UMUC faces numerous competitive threats. Major public universities in New York, California, Arizona and elsewhere are seeking to expand online even as student demand nationwide appears to be slackening. There is public competition from the Penn State World Campus and a University of Massachusetts initiative called UMassOnline. Adding to the turbulence are massive open online courses, or MOOCs, which have emerged in the past two years as vehicles for prestigious universities to promote their scholarship and offer the masses a free taste of elite higher education.
“Lots of schools are rushing in,” said analyst Richard Garrett of Eduventures. “But the market is not growing the way it once did. For UMUC, the pressure is very much how does it consolidate its position and add more value? Can they become a genuinely national provider?”
Carving a niche in cybersecurity, a relatively new academic discipline, could be one way for UMUC to stand out. The university has enrolled thousands of cybersecurity students in the past three years, answering a call from military and business leaders for a new generation of specialists to protect vital public and private computer systems. It pushes cybersecurity education in frequent advertisements on cable television, radio and Web sites.
The NSA and the Department of Homeland Security, touting a similar theme, recently have identified “centers of academic excellence” for education and research in the closely related field of information assurance. Among them are numerous colleges and universities in the District, Maryland and Virginia.
Skeptics say the nation might be better off, especially at the undergraduate level, with a broader emphasis on teaching computer science and information systems. But there is no doubt cybersecurity is hot.
“A lot of schools are on the cybersecurity bandwagon,” said Richard Forno, a cybersecurity expert at the University of Maryland Baltimore County, which recently added a master’s degree in the subject. “Some do it better than others. It’s sort of where the interest and momentum is these days. Folks see it’s a booming career field.”
Since its founding, UMUC has been career-oriented. It also has been overshadowed.
The full name throws people off. Some stumble on “university college,” a term with roots in British academia. (The University College at Oxford dates to the 13th century.) Many confuse UMUC with Maryland’s flagship public university in College Park.
Javier Miyares, a Cuban immigrant and two-time U-Md. graduate who was named UMUC president in October 2012, said he had to explain the job even to his family. “They said, ‘Oh, you’re the president of the University of Maryland.’ No. I’m the president of the University of Maryland University College.”
Independent since 1970, UMUC grew out of a branch of U-Md. established in 1947 to provide evening classes for World War II veterans. For more than half a century, it also has provided education for U.S. troops in Europe and Asia who want academic credentials to advance in the military or prepare for a return to civilian life.
UMUC instructors have taught at bases in Germany, Iraq, Vietnam and many other countries. A UMUC graduation reception last year in Kandahar, Afghanistan, was interrupted by rocket fire. Among the courses UMUC offers this fall at the Bagram Airfield are human biology, introduction to psychology, college mathematics and living religions of the world.
In July, UMUC won renewal of a longstanding Pentagon contract to teach U.S. troops in Europe. The contract is estimated to be worth more than $250 million over 10 years. But the pullback of U.S. troops from the Middle East and Central Asia means the university’s overseas enrollment is shrinking.
Domestically, the school aims to serve adults wherever they are in life. It doesn’t recruit high school juniors or seniors. It doesn’t care about SAT scores. Instead it pursues career switchers, corporate climbers, military families, community college graduates and just about anyone who may have picked up college credits here and there over the years. Racial and ethnic minorities account for more than half of the school’s stateside enrollment.
In the last school year, UMUC awarded 10,509 degrees, many in fields linked to IT, business and management. But the school also offers undergraduate majors in English, history and East Asian studies. Most domestic classes are online, but some are taught in person.
It is hard to measure such an unconventional school by conventional standards. Federal data show the share of UMUC undergraduates who earn a degree within six years is 4 percent. The national average is more than 50 percent. But the government counts only first-time, full-time students, who are not UMUC’s target market. The federal data were based on outcomes for 186 students who started in fall 2006, a tiny fraction of the school’s enrollment.
The university, which receives more than $36 million annually in state support, says another way to judge its record is the performance of all undergraduates who began in fall 2002. About a quarter of those 3,490 students graduated within five years and a third within 10 years. The university also cites surveys that show most alumni said they had jobs and “would attend UMUC if they had to do it over again.”
UMUC’s federal student loan default rates are lower than the national average, a sign that most former students are earning enough to repay their debts. The school’s tuition, well below what public flagships U-Md. and the University of Virginia charge, is part of the reason.
Undergraduate tuition is $250 per credit for military personnel. For civilians, it is $258 per credit for Maryland residents and $499 for those who live out of state. For full-time civilian students, that translates to $6,192 a year at the in-state rate. But most enroll part time.
Most of UMUC’s 3,400 instructors are part-timers, too. Some full-timers hold the title of collegiate professor. But none have tenure. Miyares said that gives UMUC an edge over other public institutions in a field that requires rapid pivots.
“The culture here has always been entrepreneurial, taking risks, everything very student-centered,” Miyares said. “To be very blunt with you, we are not faculty-centric.”
Two years ago, UMUC ditched about 10 percent of its undergraduate courses and overhauled others to fit them into eight-week schedules. Previously many courses had been 12 to 16 weeks. The idea was to align course schedules worldwide for UMUC students, giving them more flexibility and chances to enroll year-round. Such a radical shift would have been tough to engineer at a university with tenured faculty. It drew some internal criticism at UMUC. But that apparently has died down. So, too, have concerns about the university’s leadership.
In February 2012, the president who for six years had spearheaded UMUC’s online growth, Susan C. Aldridge, suddenly went on leave. A few weeks later, with no explanation from the University System of Maryland, she resigned. State university officials praised her accomplishments but remained tight-lipped about the abrupt transition.
Under Aldridge, domestic enrollment had surged more than 50 percent. Aldridge also pushed for the debut of bachelor’s and master’s degree programs in cybersecurity in fall 2010. It was good timing. That fall the U.S. Cyber Command became fully operational at the U.S. Army’s Fort Meade, establishing Maryland as a center in the field.
Critics said Aldridge put too much emphasis on recruiting and revenue and not enough on teaching and learning. Such claims prompted U.S. Sen. Tom Harkin (D-Iowa), chairman of the Committee on Health, Education, Labor and Pensions, to request records on UMUC’s enrollment and workplace practices dating to 2006.
That inquiry illuminated the university’s operations. UMUC spent about $30 million, or about 8 percent of its revenue, on marketing and advertising in 2011. It also experimented for several years with paying fees to contractors to find prospective students via the Internet — a controversial practice known as “lead generation” that has since been discontinued.
In a separate review that concluded in February, the Maryland Office of Legislative Audits revealed that UMUC had potentially overpaid a lead-generation company as much as $3.3 million from 2007 to 2009. The contractor had improperly billed the university for 43,662 Internet leads that were never received, according to the report, at a cost of $75 each.
Aldridge, recently hired by Drexel University to oversee its online learning, declined to comment on the audit findings. But in an interview in October at her Bethesda townhouse, she defended her record.
“After six very successful years, I decided to step down,” Aldridge said. “That’s all I can say.”
Miyares, 66, who took over from Aldridge after serving as a UMUC administrator since 2001, described Aldridge’s departure as an internal matter between the state university Board of Regents and the president. Whatever the reasons for the transition, Miyares has managed to steer UMUC through what he at one point last year termed “a crisis.”
One way to learn about the university is to don a headset at its 24-hour service center on McCormick Drive in Largo, just outside the Capital Beltway.
“Hello, and thank you for calling UMUC. My name is Lemar. How may I assist you, please?”
Lemar Johnson, 28, has a pleasant voice and unflappable demeanor. You want someone like him taking cold calls from prospects.
On a recent weekday morning, Johnson was one of about 75 people answering phones, overseen by an associate vice president who once ran call centers for AT&T. Besides the cold calls, there were queries about financial aid, billing and IT issues. A large monitor on a wall displayed the average time it took to answer incoming calls that morning: four seconds. UMUC allowed The Washington Post to listen in on several of Johnson’s live and recorded calls.
Call centers are crucial not only for UMUC but also for any online university, public or private, serving the adult market.
These schools do not have normal admissions cycles. They do not recruit via college fairs or letters wooing high school students. They get scant attention from college guidebooks.
Online schools depend on volume, and they enroll continously. They are seeking adults who have a yen to improve themselves, spot an 800 number on TV or the Internet and seize the impulse to dial it. Sometimes these people know what they want. Sometimes they don’t.
A woman from Florida was on the line. She sounded a bit unsure.
“I was asking you that if I did a semester in college, like my first time, and I proved to the college that I’m good at where I’m at, can I transfer all my credits to your school or no?”
“Sure, I’d love to assist you,” Johnson said. He explained that UMUC would need to see her transcript for a credit evaluation, and that she could transfer up to 70 credits from community college.
“Which program are you interested in here at UMUC?” Johnson asked.
“Child care, if you have that. Child-care development.”
“Okay. Let me just make sure that we offer that on the undergraduate level. Just one moment.” There was a pause while he looked. “We don’t offer child-care development on the undergraduate level.”
There was another pause while the caller absorbed the answer.
“Okay. Do you offer some form of child-care, or early childhood, development or anything?”
“Let’s see what’s the closest program we offer. Just another moment. [Again, a pause.] No, unfortunately.”
There was a finality to the reply. Notably, Johnson did not seek to push the caller toward a specific UMUC degree program. There was no hard sell.
During another call at the Largo hub, a UMUC adviser spotted evidence that a student in Silver Spring was mis-classified as an out-of-state resident. The adviser, Meghan Wilson, 27, urged the student to send in paperwork for a possible in-state tuition discount. Her advice was all the more striking because the student, a military veteran, had not even raised the subject of tuition.
Like many UMUC students, Matt Matchen learned about the school through a military connection. His mother is in the Air Force. Years ago, Matchen took a few UMUC classes at an air base in Germany when she was posted there.
Now Matchen works for a small tech company near Fort Meade. He resumed studies in 2009 and plans to finish work on his bachelor’s degree next spring. With heavy travel obligations for his job, online classes were essential. “I’ve learned a lot of business concepts,” he said. “The degree helps me to be more rounded.”
He joined the Cyber Padawans in 2011 when a professor put out the word that a cybersecurity gaming team was being formed to compete against other college and professional squads.
“I like the challenge, the collaborative opportunity, working with others, sharing knowledge,” Matchen said. “To me, it’s better than video games.”
Aaron Demory came to UMUC in 2012, after earning a bachelor’s degree in computer science from Virginia Military Institute and a master’s in systems engineering from George Washington University. A father of three children ages 10 to 15, he studies at night, reading and writing from 10 p.m. to 1 a.m. He said the classes for a master’s in cybersecurity are quite challenging. “Really surprised,” he said. “The quality is fantastic.”
Jeff Tjiputra, 38, the Cyber Padawans coach, holds a doctorate in systems engineering from George Washington University. A native of Indonesia, he has been on the UMUC faculty for three years. Among the books on his office shelf is “Hands-on Ethical Hacking and Network Defense.” One eight-week class he teaches is “fundamentals of networking,” with 30 students. All of their work is online.
In a typical week, Tjiputra holds live Web conferences with students, answers their e-mail, speaks with them by phone if needed and gives them numerous assignments in a virtual laboratory. Example: “You are a network technician for a small corporate network. You need to configure a new employee’s work station.”
Tjiputra said the Cyber Padawans began in 2011 as a few motivated students wanted to test their mettle against rivals from other schools. “Now we have students coming out of nowhere saying, ‘I want to join the team,’ ” he said.
He screens them by giving them a series of tasks and scoring the results. About 40, he said, are now considered strong enough to represent the university in competitions. Ninety more are trying to qualify.
For the Maryland Cyber Challenge, UMUC’s two collegiate squads competed against 17 others. The Cyber Padawans cleared the first round, then the second, a forensics test that required investigating evidence of a security breach. Among those ousted in Round 2 were entrants from U-Md. in College Park, Bowie State University, Frostburg State University and Montgomery College.
The final round, at the Baltimore Convention Center, had the Cyber Padawans facing six other teams in a digital version of capture the flag. The opponents included one team from Indiana Tech, two from Towson University and three from UMBC, known as the CyberDawgs.
The object of the cyber-battle was simple: hack and defend.
All of the teams were connected to a single network. On it were an array of virtual machines using Windows and Linux systems, nine VMs at the start and 16 by the end. Teams were challenged to penetrate as many VMs as possible during the six-hour scrum, plant a unique code inside them to signal a capture, and fend off others trying to do the same thing at the same time. The winner would have the most points under scoring that gives weight to planting flags, maintaining control and keeping the VMs functional.
On a Wednesday morning in early October, 48 college students sat down at eight circular tables in the convention center, fired up their laptops and started hacking.
For the uninitiated, a cyber-battle of this sort is intriguing, but it is not exactly a gripping spectator event. Contestants were seated for hours at a time. They got up once in a while to refill their coffee, get a boxed lunch, take a bathroom break. They couldn’t explain their hacking or defense strategy out loud because a team at the next table could overhear it. Never mind that the strategy probably would have been incomprehensible to all but experts.
A giant display monitor outside the seating area showed the big picture of the battlefield. Within the first 45 minutes, Towson, UMBC and UMUC had flags planted. Throughout the morning there was no clear leader.
In the afternoon, there was a flurry of back-and-forths. The Cyber Padawan team captained by Matchen planted three flags, claiming a lead, then traded control of one VM with a rival team three times in five minutes.
“It’s been neck-and-neck,” said Rodrigo D. Cabrera, 31, one of Matchen’s teammates, stepping out of the battle zone for a minute. “They take one; we take one.”
In the final hour, a pattern took hold: Matchen’s Cyber Padawans had two flags, and two CyberDawg teams had two apiece. Those were the apparent leaders when the battle ended at 3:30 p.m. Several of the 16 VMs were never breached.
“It was brutal,” Matchen said while the contestants were waiting for the winner to be announced. “We were trying all kinds of stuff, anything that would work.”
“I was hammering away on one machine for probably close to an hour,” said Mark Stevenson, 44, another teammate. Success, he said, meant “dumb luck sometimes.” They figured they had finished no worse than third, maybe second. They seemed pleased.
Contest organizers announced that a UMBC team had taken second place. Then they announced that Matchen’s team had won the $30,000 first prize. Shocked, the Cyber Padawans let out a whoop. It was made all the sweeter when a UMUC faculty-alumni team claimed victory in a professional division of the event.
Tjiputra savored the moment.
“It’s a good end to the story, isn’t it?” he said, after the group posed for numerous photos. “They worked hard. They earned it. We have good students. We have good faculty and good alumni. It just proved that we are for real in terms of cybersecurity.
“Here we are.”
Nick Anderson is an education writer for The Washington Post.
Key facts about the University
of Maryland University College
Founded: 1947 as a continuing studies branch of the University of Maryland
Became independent: 1970
Governed by: University System of Maryland Board of Regents
Accredited by: Middle States Commission on Higher Education
Reach: Has major contracts to teach in person at U.S. military bases overseas. Teaches largely online domestically, with some
Undergraduate tuition: $250 per credit for active-duty military personnel, $258 for Maryland residents, $499 for out-of-state residents.
Full-time, in-state undergraduate tuition:
$6,192 a year
who took UMUC classes
at some point during the fiscal year that ended June 30
Students enrolled domestically
as of fall 2003
Students enrolled domestically
as of fall 2012
Number enrolled in Asian division (Far East) in fall 2012
Number enrolled in European division (including Middle East and Central Asia) in fall 2012
Number of instructors
Percentage of domestic students who work full time
Percentage of domestic students who live in Maryland
Percentage who live in Virginia
Percentage who live in D.C.
Percentage of domestic undergraduate students age 25 or older
Percentage of instructors who are full time
Percentage of instructors who have tenure