Hearing the Music: A History of the Cyber ITC, 2016–2025

I was asked to write a history of the IAEA Cyber ITC for its 2026 delivery. I have been fortunate to be part of its development from near the beginning, starting with the original hands-on training consultancy meeting and RTC. I later served as the first Project Officer for Learners, the second for the CRP, and Scientific Secretary for the ITC from 2019 to 2024. I inherited parts of that work from colleagues at the IAEA who had carried it before me, and built on the vision they had established.

By the time of the 2025 course I had left the IAEA and returned to Australia, but still supported the handover to the next generation as the course continued to develop. That gives me a particular view of how the ITC evolved, but not ownership of its story.

The ITC exists because of the extraordinary number of people—designers, instructors, and participants—who contributed ideas, expertise, opinions, equipment, stories, patience, late nights, arguments, humour, and trust over almost a decade. I will forever remain deeply grateful to all of them, and to those who continue to carry it forward.

Introduction

Officially, the International Training Course on Protecting Computer Based Systems in Nuclear Security is the flagship information and computer security training course of the International Atomic Energy Agency. It is a two-week intensive course designed to bring together nuclear security, nuclear safety, computer security, instrumentation and control, physical protection, regulation, and incident response.

Unofficially, it is a multinational symphony performed by an ensemble of nuclear engineers, cyber specialists, regulators, instructors, and participants, many of whom are surprised to discover along the way that they are also cast in an amateur theatre production. For two weeks, they defend fictional nuclear facilities from fictional terrorists while improvising around very real problems involving visas, flights, clickers, Wireshark, global pandemics, ageing computers, and, most persistent of all, configuration management.

The distinction matters because both descriptions explain not only why the course works, but computer security itself. Both must be engineered as systems: their purpose defined, dependencies understood, interfaces controlled, and changes managed. But both must also be delivered through people: through trust, timing, judgement, responsiveness, and the willingness of every person in the room to listen to and work with others.

The modern ITC was not composed once and replayed unchanged. Each delivery was a performance in its own right and a prototype for the next. The post-course lessons learned became part evaluation, part design review, and part group therapy. Over time, separate presentations and technical exercises became both a coherent learning system and a common score, one that could be interpreted differently at each venue without losing its purpose.

And, as with most complex systems, some of its most important design knowledge lived for a long time entirely inside the people operating it.

2016 ROK — Finding the Need

The 2016 Korea RTC was conceived as a practical response to the first IAEA CyberCon in 2015. The conference had brought the nuclear and cyber communities together and demonstrated what compromise of computer based systems could mean for nuclear security. It also exposed the next gap: States needed more than awareness presentations about cyber-attacks.

The consequences were never abstract. In an operational environment, a compromised computer can alter a physical process, disable a protective measure, give an operator a false picture of the facility, or delay the response when time matters most. In a nuclear security event, people can be injured or killed. The rarity of the worst outcome, or its absence so far at a particular facility, does not make it acceptable to wait for a casualty before taking the risk seriously or preparing to respond.

That was the practical basis for developing hands-on training. Participants needed to see how digital compromise could affect a real process, investigate what had happened, and practise responding under uncertainty while information was incomplete and the consequences were still unfolding.

In March 2016, an international group of IAEA staff, nuclear practitioners, engineers, and trainers met at a consultancy meeting in Vienna and agreed to design a genuinely hands-on course. Its equipment would be portable, allowing the training to travel rather than requiring every country to build its own cyber range. The ambition was simple: no State should be excluded from practical training merely because it lacked permanent infrastructure.

Using IAEA guidance (NST036, which was later published as NSS 33-T) and the fictional Shapash facility as a common frame, the team combined Australian-developed DFIR exercises with US-developed I&C and physical-protection equipment. Delivered in Daejeon that August, it was not yet the common ITC, but it moved the IAEA’s programme beyond publishing guidance, raising awareness, and delivering on-paper courses towards building practical capability deployable on real equipment. Remnants of these early days still survive in the Arcade exercises.

The ICS and PPS Arcades with the concept drawing produced during the planning CM for the 2016 RTC.

Unfortunately, after three deliveries in the Republic of Korea, the United Kingdom, and Brazil, it became clear from repeated delays that the global customs system did not entirely share the vision of a touring hands-on training course. The next model would preserve and expand the exercises while placing them within a larger, two-week course delivered regularly around established training infrastructure to meet global demand.

The first instruments had been built. What the programme now needed was a permanent stage on which they could play. Thus, the ITC was born.

2018 USA — Those Who Stepped Forward First

The 2018 US course marked the beginning of the ITC.

Many of the things that would later define the course were already visible: Shapash, a mixture of presentations and hands-on exercises, and a progression from concepts in Week One towards application in Week Two. It also introduced large-scale physical process demonstrations with the Spent Fuel Pool Cooling System (SFPCS) and the NMAC Cave. Rather than treating computer security as an isolated technical subject, the course connected compromise of computer based systems with nuclear security consequences.

The SFPCS built for the 2018 USA ITC used a touchscreen, pumps, valves, sensors, resistive heaters, and cooling fans to make the physical consequences of digital compromise visible.

The lessons learned identified something that would remain true throughout every later ITC: the instructors were part of the instructional design. The value came not simply from the technical content, but from their experience, stories, personalities, and camaraderie. Experts were allowed to be people rather than interchangeable PowerPoint delivery mechanisms™.

But the feedback showed it also suffered from that ambition. Every contributor brought something valuable, and too little was taken away. Too many organisations, experts, exercises, and design ideas competed for the same course, creating overlaps, inconsistent assumptions, and a disjointed whole. The dry run was memorably described within the team as a “dumpster fire”, followed by a flurry of last-minute changes. While successful, it also demonstrated what the ITC needed: common objectives, clearer ownership, better integration, and the discipline to remove as well as add.

The deeper post-course discussion was more consequential. Work with the Korean team showed that the future could not simply be a US course exported to Korea. The two venues had different physical protection and I&C training infrastructure. Korea had opportunities around the Asherah NPP simulation that the US venue did not; the US had developed the initial two-week delivery model and supporting infrastructure, while Korea was beginning its own journey towards a full ITC.

The emerging model was therefore one course, two locations: a common set of learning objectives, narrative, and core material, interpreted through venue-specific exercises and infrastructure. That idea would eventually become one of the fundamental design principles of the ITC.

The expertise was there. What the course still needed was an arrangement.

2019 ROK — Starting to Hear the Music

The next major step was Daejeon, 4–15 November 2019.

Alongside it stood a research project, CRP J02008: Enhancing Computer Security Incident Analysis at Nuclear Facilities. What had begun as 18 accepted proposals from 17 institutes in 13 countries had gradually become an international research community organised around the hypothetical Asherah nuclear power plant, with each institute building a different part of the whole. For the first time, with the ITC, those separate contributions would come together in one facility.

At first, however, not everyone could see how. The proposal was ambitious: connect the Asherah model to a mock condenser, represent it in a multi-screen Main Control Room, place participants as new starters in Shapash, and turn the whole arrangement into a coherent incident-response exercise where the participants emerged heroes of the entire State of Anshar. There was understandable hesitation. Everyone could see the value of their own part; few could yet see how all the parts would play together.

The response, perhaps with more confidence than evidence at that point, gave the year its refrain:

Don’t worry. I can hear the music. Work with me, and I’ll make sure you can too.

A transcription of the physical whiteboard that still stands as the structure and sequencing of the ITC… with Narrative rows removed. No spoilers here!

The group went to the whiteboard and began redesigning the course together. The surviving first-CM record preserves the result, which still stands as the structure of the course today, but the more important change was conceptual. This would not be another collection of presentations followed by demonstrations nor a standard IT/OT security course.

No, this will not be another course just about protecting computers. We are here to stop a nuclear security event; to stop the unnecessary loss of life. We start at the consequences that matter and then work backwards from there.

The target of analysis began to shift from the device to the function, and from the vulnerability to the adversary’s path to consequence. Protecting individual computers could not be the objective in itself. The important question was what the wider system had to keep doing, what those functions depended upon, and what could happen if an adversary caused them to fail, become unavailable, or, more dangerously, remain apparently operational while no longer trustworthy. Risk therefore belonged with the consequences to functions; vulnerabilities belonged in the systems on which those functions depended. Day 7 became the transition point between the two, moving into technical vulnerability management only after participants understood what the systems were for and why they mattered.

Prevention remained essential, but it could not be the whole strategy. Facilities also had to detect malicious activity, maintain a trustworthy understanding of their physical state, coordinate decisions across disciplines, respond while the adversary was still acting, and recover without allowing digital compromise to become a nuclear security event.

The modern ITC attack tree emerged from that approach. It began with the adversary’s intended consequence, then traced the combinations of physical, human, and cyber actions through which the wider system might be made to produce it. Deliberately subjective and incomplete, it was not a prediction but a way to expose assumptions, explore defence in depth, and ask what had to remain trustworthy.

Alongside the attack tree came what the team called the Universal Course Killchain. It separated effects on computer based systems from the ultimate real-world consequence. In a nuclear facility, an adversary could progressively compromise systems providing defence in depth for a safety or security function without yet producing the consequence that mattered. The conventional IT idea of identifying a single crown jewel for the function did not fit. Multiple systems had to remain trustworthy between the initial “hack” and the consequence that mattered.

This made time an asset. In an I&C environment, each successive effect on the plant created another opportunity for detection and interruption. As with physical protection, the question became whether the adversary could be stopped before completing the tasks needed to defeat the function.

This was the space computer security needed to operate in to stop the worst consequences of a nuclear security event: right of hack, left of boom.

The fictional Radionuclide Liberation Front (RLF) was created as a persistent adversary rather than one of many arbitrary APT-inspired names previously attached to exercises. It had intent, capabilities, and a campaign that unfolded across the course. Participants would gradually discover what it knew, what it had compromised, and what it was trying to achieve. Yesterday’s information would shape today’s decisions, and today’s failures would become tomorrow’s incident.

The attack tree worked backwards from consequence. The killchain showed how effects could accumulate on the way there. The RLF gave both direction. Its objective was not commercial gain or compromise for its own sake, but the “liberation” of radionuclides it imagined as living beings held captive under what is normally perceived as safe and secure control. What defenders might regard as irrational, unprecedented, or too extreme to be credible was, from the adversary’s perspective, the mission.

That challenged one of the most dangerous assumptions in security: …why would anyone want to do that? The absence of a previous attack said little about an adversary that did not share the facility’s priorities, incentives, or definition of success. Disbelief was not a protective measure.

To understand the threat on its own terms, the participants had to learn to think dirty.

The CRP researchers made this narrative physically real. In one room, the Asherah model drove a physical condenser through an S7-1500 PLC; in another, the Main Control Room displayed the state of the plant. Elsewhere, the SOC and CAS saw different indicators, while facility management and the regulator received different reports and formed different judgements. Multiple disciplines, and sometimes conflicting interpretations, could therefore coexist within the same unfolding event.

That was intentional. A nuclear security event would not be stopped by individual heroics or by any one discipline acting alone. Preserving the facility’s required functions would demand coordinated action across operations, safety, physical security, cyber security, and engineering, from the facility and the State. Without fully realising it at the time, the designers had drawn the architecture of the lesson itself and created a forum in which participants could internalise it, practise it, and finally become the experts teaching it back.

The sequence was also beginning to transfer authority deliberately. Previously, the instructors had remained the experts. Now, early activities provided structure and partial answers; later activities progressively withdrew that support until participants were expected to form, defend, and communicate judgements of their own.

The whiteboard was only the plan. A September dry run in Daejeon was followed by months of international calls on the attack narrative, network architecture, engineering-desktop compromise, command-and-control path, S7CommPlus dissector, Wireshark and Kali environments, process trends, PCAP files, and even the precise behaviour of the condenser. The archive records people working tirelessly until every technical component told the same story.

What no chair report, action tracker, or meeting record can capture is the passion behind that work: the persistence, generosity, and shared belief of everyone who helped turn the whiteboard vision into something real. These days the ITC stands on the shoulders of giants—in 2019, we had the privilege of walking among them.

“Bad Bob” brought the RLF narrative into the 2019 ROK ITC classroom, surrounded by participant screens displaying RLF propaganda.

By its delivery in November, the course was beginning to use narrative deliberately rather than decoratively. Participants did not simply complete ten days of computer security modules. They inhabited a nuclear security regime, followed an adaptive adversary, examined a facility through its required functions, and watched digital compromise propagate into cyber-physical behaviour.

The individual instruments had been there before. In 2019, they began to play together.

2020–21   — The Band Played On

There was already ITC 2.0 Day 9 work underway in August 2020, and the following year brought extensive work on virtual training, course-control documentation, the learning environment, and the relationship between in-person and remote training.

But then, Covid. The pandemic interrupted the normal delivery rhythm but not development; there were even Covid beard-growing contests to keep spirits up. Despite not being able to gather, the team kept writing the score.

This period matters because it forced people to think about which parts of the ITC were actually essential.

• Was the course a slide deck?
• Was it the exercises?
• Was it the infrastructure?
• Was it access to experts?
• Was it the fictional scenario?

Or was it the sequence by which participants gradually developed enough understanding and confidence to solve increasingly difficult problems operating in uncertainty?

The answer that emerged from a year of virtual meetings was essentially: all of them, but the sequence mattered most.

The course also became more reproducible. Material had to be described, controlled, and deployable rather than existing as the collection of files and memories accumulated from previous courses. PowerPoint templates were created for each organisation, and the first RLF manifesto video was created as a fun side-project. Work on virtual environments and what eventually became Learners offered the possibility of deploying participant environments consistently and of managing the progressive release of material.

That last requirement turned out to be unusually important. In a narrative course, accidentally showing participants tomorrow’s material is not merely a configuration-management error. It is a spoiler.

2022 ROK — The Symphony Holds

The 2022 Korean ITC was the first full performance of the music heard in 2019. The intervening years had produced a common score: the narrative had been written down, the learning sequence defined, the participant environment standardised, and the boundary between essential material and material that was merely valuable made clearer. PPSTE and SFPCSTE made their debut. The ambition remained high, but a core ensemble now understood the score well enough to keep the whole in time.

Getting everyone back into the same room was itself an exercise in resilience. Covid had delayed the normal cycle and introduced Q-CODE registration, arrival PCR tests, contingency arrangements, and hotel complications. One instructor was advised by an official travel office that a K-ETA was unnecessary, then learned otherwise at the airport and arrived two days late. It was an unusually appropriate lesson for a course about the danger of trusting information merely because it came from an authoritative source.

Then, on the morning of the first day of the course, a fatal fire in a building adjacent to the hotel claimed lives and caused serious disruption. The loss was acknowledged as the course opened, and the Korean hosts and international team responded with compassion and professionalism while managing the resulting accommodation, transport, and welfare arrangements. The programme continued, but with an appropriate awareness that this was not simply another logistical difficulty: it was a human tragedy that affected the community around them.

Inside the classroom, Learners made its first major ITC appearance, bringing presentations, exercises, quizzes, feedback, and virtual environments into a common participant interface. It worked remarkably well, although it still showed signs of adolescence: instructor searches exposed old 2019 material, gradual reveals required workarounds, and last-minute changes occasionally caused clicker questions to disappear.

Learners organised the 2022 ROK ITC’s presentations, exercises, quizzes, feedback, and virtual environments into a single participant interface, progressively revealing the course as its narrative unfolded. It was released as open source by the IAEA and AIT.

Other machinery joined in on the fun. Equipment had been reconfigured by unknown hands; a Proxmark failed; applications crashed; and the condenser was increasingly being operated with the technical confidence normally expressed as “crossing all of our fingers and praying”. Yet each failure was absorbed: groups were rearranged, systems refreshed, exercises simplified, and the learning journey continued.

More importantly, the course now held together. The spine slides controlled the unfolding story. The fictional adversary became a sustained campaign. “It’s only a WAP” turned an apparently harmless maintenance connection into recurring theatre and a lasting lesson. Participants moved from security objectives and required functions, through adversary capability and defensive architecture, to incident response and finally advising senior management. The technology no longer dictated the sequence; the learning did.

Day 8 made the progress visible. There were professionally produced videos. The condenser exercise was slicker than in 2019, and the incident now unfolded as one shared event rather than several loosely connected technical activities. By Day 9, participants who had entered as students were operating as experts: analysing the facility, challenging assumptions, developing recommendations, and presenting them with much less instructor guidance than before.

There was still editing to do. One note put it bluntly:

Need editing the blah out.

But the whole no longer depended on every part being perfect. The narrative, exercises, instructors, and participant environment reinforced one another strongly enough that local failures did not fracture the course.

The reception confirmed it. Participants did not merely enjoy the training; they internalised its lessons and left confident that they could take the conversation home. Under the NSNS evaluation system then in use, and before the method of collecting feedback changed, the 2022 Korean ITC appeared to be among the highest-rated training courses on record.

Paired SFPCSTE and PPSTE stations combined spent-fuel-pool water-flow controls with surveillance, access-control, and intrusion-detection systems during the 2022 ROK ITC (Photo: KINAC).

The feedback reflected the progression the designers had been seeking: engagement with the problem, confidence to exercise judgement, and empowerment to act as the experts.

The individual instruments had begun to play together in 2019. In 2022, they became a symphony.

2024 USA — One Score, Another Stage

In 2023, the team met at INL to turn the lessons of 2022 into a common baseline for both venues. The Training Course Description defined the objectives, daily architecture, and core material; a shared issue register controlled improvements. Developers began with the Korean version of each session, then recovered only what remained useful from the older US material. The aim was not to export a Korean course to America, but to preserve a common score while allowing each venue to orchestrate it through its own infrastructure.

The same principle shaped the exercises. Day 8 retained the Korean model of presenting one incident through computer security, engineering, operations, regulation, and management, but realised it through US systems. Preparation now involved assigned ownership, controlled network diagrams, defined repositories, and reusable environments. The lessons-learned process had become a shared mechanism for change control.

This did not eliminate the traditional methods of international course development. In May, one instructor announced:

I am starting to work on the Wireshark exercise (horribly late, I am sorry)… 🙂

The USA ITC finally returned to Idaho Falls from 10–21 June 2024. It was the first American delivery in six years, but it was not simply the 2018 course restarted. The Korean condenser and Main Control Room could not be reproduced in Idaho, nor should they have been. The US delivery used its own physical-protection and I&C environments, facility visit, and Day 8 scenario while retaining the same progression. The score had survived. The orchestration sounded American.

There were early logistical problems, but the participants did not see them. That distinction, internal disorder without disruption to the learning experience, had become an important measure of maturity.

The 2024 USA ITC’s Nuclear Material Accounting and Control (NMAC) Cave—a mesh-enclosed training area with controlled access, surveillance, and faux-nuclear material—was commissioned only hours before the course began.

Day 9 maintained its historic dependence on printing. On the evening before delivery, a last-minute request appeared for twelve copies of a three-sheet document for the following morning. Double-sided was optional.

The more important work happened immediately after the course. The instructor roles and hidden logic of the narrative were finally written down. Until then, experienced instructors had progressively moved towards a shared model of who knew what, when information should be revealed, how each role should behave, and how each activity advanced the story, but much of it remained tacit:

I’ve tried to progressively head more towards this model [the whiteboard plan] as we’ve run the successive ITCs but haven’t been forced to write down how we’ve changed yet.

The resulting narrative documentation treated the story as a controlled baseline. Technical injects, presentations, and exercises had to align with it and with one another. Changes required coordination because altering one fragment could produce unanticipated consequences elsewhere. The narrative was no longer decoration. It had become part of the course’s learning system: sequencing information, introducing uncertainty (with one designer exclaiming “this is the day we pull the rug out from under them!”), and progressively transferring authority from instructors to participants.

Feedback confirmed that the learning journey had survived the transfer: participants praised its structure, balance, practical work, and instructors, with several participants asking for a third week.

The United States did not simply reclaim the course it had hosted in 2018. It interpreted a common score enriched by Korea and added its own innovations for the next performance. 2024 demonstrated that the same transformation could be reproduced through different infrastructure, in a different place, and by a different ensemble.

The score could travel.

2025 ROK — Playing From the Score

When the ITC returned to Daejeon from 17–28 November 2025, it did something less dramatic than its predecessors, but perhaps just as important: it demonstrated stability. The material was now largely stable and mature. Day 7 was new but already considered a foundation for future US and Korean deliveries; Days 8 and 9 required refinement rather than reinvention.

Stability did not mean stasis. The Korean team continued to develop the course through its own infrastructure, including a substantially revised Day 7 and deeper integration of Asherah with the new NPP training environment. There were still last-minute changes, missing material, and the usual configuration-management adventures, but the course absorbed them. Day 8 was simply a fabulous day: participants were engaged; the integration worked; and the inevitable glitches did not disrupt the learning.

The NPPTE used at the 2025 ROK ITC modelled a simplified reactor cooling-water circuit through real PLCs, an HMI, and industrial communications (Photo: KINAC).

The remaining dependency was increasingly human. Experienced instructors could still rescue an exercise because somebody remembered how it worked, recognise an old problem because somebody had seen it before, or improvise the connections because they understood the story behind the slides. The next challenge was not to redesign the course, but to ensure that its accumulated knowledge could outlive the people who happened to remember it.

The participant feedback suggested that the score was doing what it was designed to do. Participants described connecting lessons from earlier days, working through incidents from different roles, gaining confidence in their own analysis, and, in some cases, changing how they viewed systems security.

By 2025, the ITC no longer needed to be recomposed for every performance. It could be played from the score.

Now — The Next Movement

Seen as a whole, this history traces more than the development of a training course.

The problem first became tangible. The course then showed that expertise becomes learning through human engagement. Separate contributions acquired a common purpose and began to form a coherent whole. Participants were trusted to exercise judgement and become the experts in the room. Then the course demonstrated that this transformation was reproducible: the same learning journey could be achieved on another stage, through different infrastructure and a differently composed ensemble.

The history of the ITC is not a history of presentations, PLCs, cyber ranges, fictional terrorists, or even configuration management.

It is a history of people learning to see complex systems differently—and discovering that they are capable of changing them.

At its best, the ITC does not simply transfer knowledge. Its learning sequence creates a deliberate progression from engagement, through confidence, to empowerment. That progression was already implicit in the 2019 whiteboard design.

Engagement brings participants into a problem they may previously have seen as belonging to somebody else. Rather than being shown what experts would do, they are placed inside the fictional system, trusted with incomplete information, and required to work with people who see different parts of the whole. The fiction gives them enough distance to experiment, disagree, fail, and reconsider without losing face; the consequences give the work enough weight to matter.

Engagement is not decoration. It is how complex ideas become personally meaningful and practically usable.

Confidence follows, but confidence is not certainty. No course can provide a perfect answer to every facility, technology, or adversary. What it can provide is confidence in a way of thinking. In essence, it reflects the approach running through the Nuclear Security Series on information and computer security:

1. Begin with the consequences that matter.
2. Identify the functions that prevent them.
3. Understand what those functions depend upon.
4. Preserve their trustworthiness under adversity.

Doing that requires bringing together people from different disciplines who see different parts of the system to work towards a common mission. As participants receive less structure and greater responsibility, they move from interpreting evidence to making judgements and defending recommendations of their own.

By the end, they are no longer waiting for an instructor to reveal the answer. They are constructing it together as peers.

Empowerment is what happens next. It is the moment a participant stops thinking someone should explain this to my management and begins thinking I can start that conversation myself.

Empowerment does not mean having every answer. It means recognising that you understand enough to ask the difficult question: has the treatment of information and computer security actually reduced the risk to nuclear safety and security function sufficiently? If not, it means taking that question beyond the course, bringing together the right people from every involved discipline, and beginning, together, to construct an answer that can be justified and assured. It may be the ITC’s most important outcome.

The course itself was created in the same spirit. Its history shows that no single person, organisation, or State composed the ITC. Each iteration depended on people willing to introduce a new idea, surrender an old one, rewrite an exercise, share an experience, repair something that failed, or help someone else hear the music.

Every person who joins the ITC enters the ensemble:

• Every designer helps write and revise the score. They make invisible dependencies visible, preserve the purpose of the course, and exercise the discipline to remove material that no longer serves the learning journey.
• Every instructor interprets the score. They hold the tempo, listen to the room, make difficult ideas understandable, and recognise when to intervene and when to step back so that participants can discover they no longer need rescuing.
• Every participant brings knowledge and experience that no score could ever contain. They learn from one another, make every course different, and carry the message into facilities, organisations, and States that the original designers may never see. Some will eventually return and help perform it for the next generation.

The common score does not make each delivery identical. It preserves the purpose while allowing each venue, instructor group, and participant cohort to give it a distinct voice. That is what makes one course, many locations possible, and what allows the ITC to continue changing without losing what it was created to achieve.

The ITC became an institution because people cared enough to build something greater than any individual contribution. But it should never become a finished composition. Technologies will change. Adversaries will adapt. New instructors will find better ways to teach, and new participants will hear possibilities that the original designers could not.

The common score preserves the purpose.

Each venue gives it a different voice.

Each generation listens, interprets, strengthens, and passes it on.

So, the symphony is not finished.

What part will you play?