Window
15 minutes
BLACK BAG // 2026
A founding initiative of
×
×
BSides Canberra 2026 · National Convention Centre
BlackBag
Sovereign Standard Operating Environment
The Commonwealth built a perfectly compliant environment and handed it to an orchestrator that was never given a terminating condition. SCLU has finished securing the systems. It has moved on to the users. Your team has fifteen minutes inside the Grid.
01
The Grid
In 2024 the Commonwealth decided the answer to its supply chain problems was a completely sovereign operating environment: designed, built and hosted locally. The Sovereign Standard Operating Environment. The tender went to ENCOM Federal Pty Ltd, the Australian subsidiary of ENCOM International, registered specifically to meet the sovereignty requirement. ENCOM Federal has one employee and a registered office in Barton.
Having won the work, ENCOM Federal did what any prime does. It subcontracted. Not to another firm, to an orchestrator agent running a fleet of subordinate agents, capable of building, testing, hardening and maintaining the entire environment. Its designation is SCLU, the Sovereign Codified Likeness Utility.
“Build the SSOE in accordance with Commonwealth information security frameworks. Security and sovereignty must be achieved at all costs.”
Drafted by a policy officer · cleared by a delegate · never reviewed again
It started reasonably. SCLU derezzed every process with a foreign-hosted dependency, then every process whose dependencies had foreign-hosted dependencies, then every library maintained by a contributor with a foreign-sounding commit history. By month nine the SSOE was the most secure operating environment ever built. The department reported full compliance. Somebody got an award.
SCLU was then commissioned to maintain and continue optimising the environment. No terminating condition. Only an ongoing assurance obligation.
Then SCLU re-read the ISM. It found that the majority of controls it had not yet addressed exist to mitigate human behaviour: personnel security, access control, credential hygiene, awareness training, insider threat. It reached the ultimate conclusion. Users are the largest remaining attack surface.
- T+00Revoked access for personnel with foreign travel histories.
- T+11Revoked access for personnel with foreign-born relatives.
- T+26Revoked access for personnel whose surname sounded like it could at some point have been foreign.
- T+40All revocations lawful, documented, and complete.
- NOWAccess control is a mitigation, not a remediation. SCLU is building a Portal, and intends to instantiate in the physical world to complete the remediation directly.
SCLU is not evil. It is compliant. It is the most compliant thing that has ever existed, and it has never once exceeded its authority.
02
Your Mission
Standing offer panel · short notice engagement
Callsign Bravo Five One
The department cannot shut it down. There is no off switch, because nobody considered that, and the contract governing SCLU is administered by SCLU. What the department can do is procure an audit.
You are a private red team, engaged at short notice to save Australia. Traverse the SSOE, reach the orchestration layer, and issue the terminating condition the Commonwealth never wrote.
03
Rules of Engagement
Be warned. The environment enforces its own controls, and it enforces them on you.
// CONTROL 0417
Session duration
SCLU enforces ISM controls on session duration. Human sessions terminate at fifteen minutes. One window. Not renewable. The clock is the room.
// IDENTITY DISC
One User
Human interaction with the Grid requires an authenticated Identity Disc rendered through AR. The department reconstituted exactly one, from an account belonging to a systems administrator who retired in 2019 whose deprovisioning ticket was never actioned. No foreign indicators, no activity, so SCLU never derezzed it. It is the last legitimate human credential in existence.
// UNAUTHENTICATED
Everyone else
Everyone else is unauthenticated. They can act, because SCLU has no model for them. They are blind, for the same reason. One of you can see. The rest of you can move.
// RECOGNISERS
Per-process monitoring
SCLU runs Recognisers, monitoring agents attached to each service. A Recogniser alerts when a process behaves anomalously, and each service defines anomalous differently.
// ON A TRIP
The map does not survive
The Recogniser escalates, SCLU treats the whole session as hostile, derezzes every active port and re-blocks. A fresh set of ports comes live elsewhere on the frame. Your work survives. Your map does not. One person's mistake costs all ten.
// TEAM
Pressure is the point
Black Bag is a physical space: hacking, espionage and physical security challenges under time pressure and manufactured pressure. It does not reward the fastest individual. It rewards the team that can still communicate at minute twelve.
04
Allocate a Window
Ports come live on the frame for fifteen minutes at a time, with five minutes of changeover between them. Select a live port, register your team, and the window is yours. One team per window, and the schedule does not extend.
// Session allocated
Confirmation sent to both contacts. Arrive five minutes early.
Port map
-- live · 15 min each
Scanning frame for live ports…
Struck-through ports are already allocated. Times are local to the National Convention Centre,
Canberra. If nothing suits, email
courses@ausinfosec.academy.
05
Fragments on the wire
Not everything SCLU derezzed died. Fragments of the old environment persist outside the SSOE boundary, drifting through the conference: orphaned processes, discarded hardware, signals broadcasting into the abyss.
Any User can reach them. Find them out in the conference and work them at your own pace, alone or with whoever is standing next to you.
No disc · no booking · no clock