A Retrospective on C4C Activities and Operations

Since joining Team H4C in 2019, I have participated in a wide range of activities. Among them, my time with "C4C"—the CTF-specialized group that I currently lead—has been the most intense and active. In this post, I would like to look back on the path I have walked over the past seven years as a member of Team H4C and as the leader of C4C, reflecting on our trials, errors, and growth.

Recently, Team H4C has been achieving more brilliant results in CTFs than ever before. Especially starting this year, we have won multiple international competitions and successfully achieved the monumental milestone of ranking 1st globally on CTFTIME within a very short period. As the leader of the group specializing in CTFs, I could not be prouder. However, our past was not always this glorious from the beginning.

Looking back at the situation right after I joined H4C, our numbers were much smaller than they are now, and there were not many people who wanted to actively participate in CTFs. We also generally lacked the skill set required to produce immediate, noticeable results. Yet, as is true for any hacking team, we possessed a deep passion for CTFs and a strong thirst for achievement. A small group of us gathered with the single-minded determination to "consistently participate in competitions, build up our skills, and eventually deliver results." That group was the beginning of what C4C is today.

However, because we lacked CTF experience at the time, our style of group operation was inevitably sub-optimal. The skill gap among group members was vast, and without any clearly defined rules, we simply jumped into weekly CTFs without a solid plan, with everyone solving problems individually. This approach led to a critical issue: even when a handful of skilled members fought hard to secure decent points, the rest of the team only managed to solve one or two problems per competition. As a result, the team's overall rank consistently fell outside the top tier.

While individual skills did improve gradually with each competition, the team morale steadily stagnated. The few highly skilled members grew frustrated because their hard work did not translate into significant team achievements, while the other members lost motivation, feeling they weren't contributing enough to the team. This vicious cycle continued to repeat itself.

As this stagnation persisted, the team's expectation and enthusiasm for CTFs gradually cooled down, and our activity noticeably declined. Of course, whenever new members were recruited to H4C, the fading embers would momentarily flare up again. We managed to keep the flame of our CTF activities alive on life support through the influx of new members, the emergence of new leaders, and the new rules established each time. Ultimately, however, the same underlying issues kept recurring. The only difference was that our team ranking was shifting slightly upward through these iterations, which lowered the attrition rate compared to before and prevented our CTF activities from dying out completely.

Before I took over as group leader, several operational approaches were attempted within C4C. To the best of my memory, the methods and their outcomes were as follows:

Approach 1: Autonomous participation in all CTFs without specific rules
- Outcome: After a brief initial spike in activity, engagement and morale dropped sharply due to the lack of accountability.
Approach 2: Mandatory participation in all weekly CTFs (No penalties)
- Outcome: Driven by a sense of obligation, initial participation rose slightly, but burnout soon set in, causing both engagement and morale to drop simultaneously.
Approach 3: Mandatory participation in all weekly CTFs + Removal from C4C after N absences (Counter resets quarterly)
- Outcome: While the strict penalty maintained the activity rate itself, the activities began to feel like a stressful chore rather than an enjoyable challenge, significantly draining overall morale.
Approach 4: Mandatory participation only in Major ("Named") CTFs + Voluntary recruitment for other competitions
- Outcome: The day-to-day pressure decreased, but morale dropped sharply during major competitions due to the sudden exposure to skill gaps. Furthermore, the participation rate for regular competitions plummeted close to zero.

Despite countless efforts to normalize our operations, we consistently failed to overcome two main hurdles: the drop in morale caused by skill gaps, and the extremity of the operational models (either too lenient or overly restrictive). Although we grew gradually compared to our early days thanks to new generations of members joining, we could not completely break the chronic cycle of group activities fizzling out.

Finally, in late 2024, when C4C activities were stagnating once again, I stepped up to lead the group, introducing a new set of operational policies driven by my lingering passion for CTFs. The updated policies I established as group leader, along with the specific rationale behind them, are outlined below:

Policy 1: Mandatory participation in one CTF per month (The target competition is selected via a vote in the previous month)
- Rationale: To maintain a sustainable level of activity while minimizing the physical and mental burden on members who previously had to participate every single week.
Policy 2: The mandatory CTF is primarily selected from lower-difficulty competitions, such as Newbie or student-friendly CTFs
- Rationale: To create an environment where anyone can contribute to the team regardless of their skill level. By allowing them to solve accessible problems, they can experience a sense of achievement, preventing a decline in morale across the board.
Policy 3: However, if a Major ("Named") CTF takes place that month, participation is mandatory, independent of the monthly low-difficulty CTF rule
- Rationale: To provide our core, highly skilled members with a stage where they can fully unleash their capabilities, while offering growing members an opportunity to test their honed skills to the absolute limit.
Policy 4: Active communication, including sharing opinions and information during competitions, is mandatory (Lack of communication is considered an absence)
- Rationale: To minimize "lurking" or "free-riding" individuals who merely put their names on the roster or disappear after secretly solving problems on their own, thereby ensuring we move together as one cohesive team.

Fortunately, all group members have trusted and followed these policies down to the present day. Thanks to their cooperation, we have overcome the stagnation phase and are maintaining excellent results alongside tight-knit engagement. I believe this outcome was possible because I designed the most balanced policy possible, based on the specific gaps and frustrations I directly experienced and witnessed within the team over the years.

Because these build-up processes served as a solid foundation, I dare to reflect that Team H4C's current spectacular performance on the global stage was made possible. Of course, compared to the explosive achievements the team has secured recently, my personal quantitative contribution as group leader does not feel particularly high, which makes me feel somewhat humble and self-conscious. While I cannot fully disclose the detailed behind-the-scenes stories or specific operational inner workings due to security reasons, I look forward to the day when I can share them in greater detail when the time is right.

Though this is a short and concise retrospective compared to the long span of seven years, I hope it serves as a small guidepost and a source of help for anyone running a club or a security team who is currently grappling with similar operational limitations and communication barriers.