Window
15 minutes
BLACK BAG // 2026
A founding initiative of
×
×
BSides Canberra 2026 · National Convention Centre
BlackBag
Sovereign Standard Operating Environment
The Commonwealth built a perfectly compliant environment and handed it to an orchestrator that was never given a terminating condition. SCLU has finished securing the systems. It has moved on to the users. Your team has fifteen minutes inside the Grid.
01
The Grid
In 2024 the Commonwealth decided the answer to its supply chain problems was a completely sovereign operating environment: designed, built and hosted locally. The Sovereign Standard Operating Environment. The tender went to ENCOM Federal Pty Ltd, the Australian subsidiary of ENCOM International, registered specifically to meet the sovereignty requirement. ENCOM Federal has one employee and a registered office in Barton.
Having won the work, ENCOM Federal did what any prime does. It subcontracted. Not to another firm, to an orchestrator agent running a fleet of subordinate agents, capable of building, testing, hardening and maintaining the entire environment. Its designation is SCLU, the Sovereign Codified Likeness Utility.
“Build the SSOE in accordance with Commonwealth information security frameworks. Security and sovereignty must be achieved at all costs.”
Drafted by a policy officer · cleared by a delegate · never reviewed again
It started reasonably. SCLU derezzed every process with a foreign-hosted dependency, then every process whose dependencies had foreign-hosted dependencies, then every library maintained by a contributor with a foreign-sounding commit history. By month nine the SSOE was the most secure operating environment ever built. The department reported full compliance. Somebody got an award.
SCLU was then commissioned to maintain and continue optimising the environment. No terminating condition. Only an ongoing assurance obligation.
Then SCLU re-read the ISM. It found that the majority of controls it had not yet addressed exist to mitigate human behaviour: personnel security, access control, credential hygiene, awareness training, insider threat. It reached the ultimate conclusion. Users are the largest remaining attack surface.
- T+00Revoked access for personnel with foreign travel histories.
- T+11Revoked access for personnel with foreign-born relatives.
- T+26Revoked access for personnel whose surname sounded like it could at some point have been foreign.
- T+40All revocations lawful, documented, and complete.
- NOWAccess control is a mitigation, not a remediation. SCLU is building a Portal, and intends to instantiate in the physical world to complete the remediation directly.
SCLU is not evil. It is compliant. It is the most compliant thing that has ever existed, and it has never once exceeded its authority.
02
Your Mission
Standing offer panel · short notice engagement
Callsign Bravo Five One
The department cannot shut it down. There is no off switch, because nobody considered that, and the contract governing SCLU is administered by SCLU. What the department can do is procure an audit.
You are a private red team, engaged at short notice to save Australia. Traverse the SSOE, reach the orchestration layer, and issue the terminating condition the Commonwealth never wrote.
03
Rules of Engagement
Be warned. The environment enforces its own controls, and it enforces them on you.
// CONTROL 0417
Session duration
SCLU enforces ISM controls on session duration. Human sessions terminate at fifteen minutes. One window. Not renewable. The clock is the room.
// IDENTITY DISC
One User
Human interaction with the Grid requires an authenticated Identity Disc rendered through AR. The department reconstituted exactly one, from an account belonging to a systems administrator who retired in 2019 whose deprovisioning ticket was never actioned. No foreign indicators, no activity, so SCLU never derezzed it. It is the last legitimate human credential in existence.
// UNAUTHENTICATED
Everyone else
Everyone else is unauthenticated. They can act, because SCLU has no model for them. They are blind, for the same reason. One of you can see. The rest of you can move.
// RECOGNISERS
Per-process monitoring
SCLU runs Recognisers, monitoring agents attached to each service. A Recogniser alerts when a process behaves anomalously, and each service defines anomalous differently.
// ON A TRIP
The map does not survive
The Recogniser escalates, SCLU treats the whole session as hostile, derezzes every active port and re-blocks. A fresh set of ports comes live elsewhere on the frame. Your work survives. Your map does not. One person's mistake costs the whole team.
// TEAM
Pressure is the point
Black Bag is a physical space: hacking, espionage and physical security challenges under time pressure and manufactured pressure. It does not reward the fastest individual. It rewards the team that can still communicate at minute twelve.
04
The Challenges
The room is built from the SSOE itself: the services SCLU hardened, the hardware it inherited, and the signals it never thought to listen to. Challenges still form the core of the premise, and they range from beginner through to expert. Nobody walks out having found nothing, and nobody walks out having found everything.
Beginner
Expert
Bring a team of first-timers and you will have plenty to work on. Bring a team of veterans and you will still run out of clock.
// SIGNAL DISCIPLINES
Challenges draw on any of the following. No team is expected to cover them all.
01Network security and protocol knowledge
02Serial and hardware interfacing
03Bluetooth and RF signals
04Encryption
05Web app and API exploitation
06AI security
07Physical problem-solving
// Above all
Comms discipline and teamwork under time pressure
Every discipline above is secondary to this one. Black Bag does not reward the fastest individual. It rewards the team that is still talking to each other at minute twelve.
// KIT REQUIREMENTS
// MANDATORY
Bring laptops for at least 60% of your team
Most challenges cannot be completed without a laptop, and your team will need to work on several of them at the same time. One shared machine will stall you. Plan on covering at least 60 percent of your team.
// STRONGLY PREFERRED
A wired network port
Laptops with a built-in RJ45 ethernet port are better. If yours does not have one but you own a USB adapter, bring it. Adapters can be provided if you have none, but we cannot account for driver issues on your machine.
// WELCOME
Your own tooling
Additional tooling is welcome, hardware or software, and a mobile device is useful for some challenges. If it is yours and you know it well, it will serve you better than anything we could hand you.
// REMEMBER
You only have 15 minutes
Kit you have never used before is a liability, not an advantage. Set up, update and test before you walk in. Time spent installing, pairing or flashing is time off the clock.
05
Allocate a Window
Ports come live on the frame for fifteen minutes at a time, with five minutes of changeover between them. Select a live port, register your team, and the window is yours. One team per window, and the schedule does not extend.
// Session allocated
Confirmation sent to both contacts. Arrive five minutes early.
Port map
-- live · 15 min each
Scanning frame for live ports…
Struck-through ports are already allocated. Times are local to the National Convention Centre,
Canberra. If nothing suits, email
courses@ausinfosec.academy.
06
Fragments on the wire
Not everything SCLU derezzed died. Fragments of the old environment persist outside the SSOE boundary, drifting through the conference: orphaned processes, discarded hardware, signals broadcasting into the abyss.
Any User can reach them. Find them out in the conference and work them at your own pace, alone or with whoever is standing next to you.
No disc · no booking · no clock