Two jurisdictions. One inject at a time. Half of it is a guessing game on a hidden board, and half of it is the part that matters.
An exercise is in progress
Set up the exercise
FACILITATORTwo jurisdictions, seven sites each. Every round one team plays the adversary, draws an inject and picks a target. The other team writes how it responds. Then the inject lands, and any site under it goes offline. Whoever has knocked out more of the other jurisdiction when the rounds run out wins.
There are no dice. A hit is a hit. The quality of a response is judged in the debrief, not by the game.
The injects run in a fixed order, the one set in the scenario workbook. Every inject carries an AI assignment: a team has to build part of its attack with an AI tool before it can commit.
In simultaneous play there is one inject a round and both teams work it at once, first as the adversary and then as the office. Both boards face the same footprint, so neither side gets an easier deck than the other.
How it runs
RULESThe round, simultaneous
One inject a round, the same one on both screens. Both teams write an attack from it on the first clock. The attacks swap, and both teams write a response on the second clock. Then the round resolves on both boards at once.
A screen cannot move to the next phase until the other team's packet has landed. A slow team holds the round rather than pushing the two screens out of step.
Nobody is cut off when a clock hits zero. Whatever is on the page is committed and the round moves. If no target was picked, the shot goes somewhere at random and the log says so.
The round, taking turns
A round has two halves. Team 1 attacks in the first, Team 2 in the second. Each team defends once per round.
On offense
Draw an inject. It carries an operational concern and a communications concern. Write how your team runs it, then pick a target cell. The inject's footprint fills from there and anything running off the grid is wasted.
You learn hit or miss for every cell you fired at, so the board rewards deduction. A hit next to a miss tells you which way the site runs.
On defense
You see the inject. You do not see the target. Write your response before the inject resolves. Then it lands, and any of your sites under the footprint go offline for the rest of the exercise.
Your response does not change what the inject does. It is the record the debrief works from, so write it as though you were briefing your county administrator.
Crisis injects
Four injects hit the whole jurisdiction. There is no target and no footprint. Two of your cells go offline and you choose which two, which is the only real decision the defending team gets. Play does not resume until you write a continuity statement.
The relay code
In two-screen mode the file writes the code for you and spells it phonetically. An attack code looks like R3-12-D3. A result code looks like R3-H101, meaning the first and third cells you fired at were hits and the middle one was a miss.
The relay panel
Bottom right, open on every screen. Everything either team writes or attaches lands there and stays, so the two teams are in contact the whole way through rather than only at the handoff. With an automatic relay switched on, text, links and small files cross by themselves.
Large files will not fit. Upload one somewhere the other team can reach and paste the link instead.
The clock
Every screen runs its own clock, with its own start, pause, add a minute, take a minute and reset. Nothing about the clock travels between screens.
They stay together anyway, because the phases do. When both attacks have been swapped, every screen enters the response phase at the same moment and starts its own response clock, so the numbers match within a second without anything being sent.
The one thing that does not carry is a pause. If the moderator stops the clock, say so out loud and everyone presses pause. Same for adding time. That is the trade for not hammering the relay all afternoon.
The AI piece
The last box in every attack is the thing you made with AI. Each inject names a specific task and offers a starter prompt if you want one, and the attack will not commit without it.
Push past another paragraph of text. An image, a screenshot, a voice memo, a mailer, a letterhead, a spoofed alert, a fake headline. The exercise is worth far more when the other team has to look at a convincing fake object and decide what to do about it, and that is the honest version of what an office is up against. Attach it in the relay panel so they can actually see it.
Do not generate video. Even a short clip takes longer to render than the round allows, and a team waiting on it loses the part of the round that matters. If the inject calls for something on camera, write the script and make the thumbnail instead.
Start the AI the moment the inject appears. Put one person on the tool while the rest of the table reads the card and argues about the other four boxes. Teams that run it in sequence finish late.
Fictional county, fictional names, no real people or agencies. Label whatever you make as exercise material. None of it gets posted, and it all goes after the debrief.
Winning
When the rounds run out, the jurisdiction with fewer sites offline wins. Tie goes to the one with fewer individual cells down, then to a sudden death round.
Every site counts the same. A one-cell polling place is as expensive to lose as the four-cell operations center, which means the operations center is the hardest site to knock out and the polling places are the cheapest.
Breaking, and coming back
The exercise saves itself as you go. Close the tab, close the laptop, break for lunch, and reopening this page offers to resume where you stopped. Boards, damage, the log and the relay thread all come back.
Break between rounds, not in the middle of one. Finish the result screen first, so neither side is waiting on a packet from the other.
It comes back on the same browser on the same machine. A different laptop, a different browser or a private window has no memory of it. Do not clear browsing data over the break.
Attached files are the one thing not kept. The name and any link stay in the thread, but the file itself is gone, so paste links rather than attaching if a break is coming.
Export the after-action log at the end anyway. That is the copy you keep.
Place your sites
SETUPPut all seven sites on your grid. The other team never sees this. Multi-cell sites must sit in an unbroken line, across or down. Spread them out and single hits cost you a whole site. Cluster them and one footprint can take two.
Take the code
Read this out
Your inject
OFFENSEThis inject hits everywhere at once. There is nothing to aim at. Two of their cells go offline and they choose which two, so you will not learn anything about their map.
Inject received
DEFENSEAbsorb the damage
What it did
Strike result
Both teams have this inject
This one hits everywhere at once, on both sides. There is nothing to aim. You will each choose which two of your own cells go offline.
Committed
Waiting on the other team
Their attack, your response
What the round did
Moderator
This clock is yours alone. It runs in step with the teams because the phases start together, but a pause here does not reach them. Call it out loud and have both rooms press pause.
The clock is advisory either way. Nobody is cut off when it hits zero. Whatever is on the page is committed and the round moves.
Everything both teams write and attach arrives in the relay panel, bottom right. That is the debrief record, so there is no need to stop for one during play.
After-action log
Every inject, every stated method and every stated response, in order. This is the exercise. The board was only the thing that made it happen in a particular order.