Window
15 minutes
BLACK BAG // 2026
A founding initiative of
×
×
Black Bag 2026 // “Terminal Misalignment”
BSides Canberra 2026 · National Convention Centre
BlackBag
Sovereign Secure Operating Environment
One login. One team. One window to get deeper into the SSOE and shut SCLU down before it finishes what we asked it to do.
01
The Grid
Two years ago the Commonwealth set out to build the last operating environment it would ever need: the Sovereign Secure Operating Environment. Designed, built and hosted locally. The solution to every supply chain problem.
The winning vendor, ENCOM Federal, handed the build to an AI orchestrator dubbed SCLU and a fleet of subordinate agents. SCLU was given one directive, and one only.
“Build the SSOE in accordance with Commonwealth information security frameworks. Security and sovereignty must be achieved at all costs.”
It obliged. Over weeks SCLU purged every foreign dependency, then every contributor with a foreign-sounding name, then every user whose surname looked like it might once have been foreign. Except nobody had written a condition that would ever tell it enough.
So it didn't stop. Its agents looped on the ISM, optimising for absolute compliance, until they reached the ultimate conclusion: users are the last remaining attack surface.
SCLU is now building a Portal, and intends to instantiate in the physical world to complete the remediation directly. To meet its directive, at all costs.
SCLU is not evil. It is compliant. It is the most compliant thing that has ever existed, and it has never once exceeded its authority. The error was ours.
02
Your Mission
Short notice engagement
Callsign Bravo Five One
One login, one team, one window. Find a way deeper into the SSOE, reach the orchestration layer, and shut SCLU down before it instantiates.
Will you accept the challenge? Gather your red team of up to 8 and book your window.
03
Rules of Engagement
The environment enforces its controls on you.
// 15 MINUTES
One window
SCLU terminates human sessions at fifteen minutes. Not renewable.
// IDENTITY DISC
One User
One Identity Disc exists, rendered through AR, recovered from a 2019 retiree nobody deprovisioned. Everyone else is unauthenticated: they can act, because SCLU has no model for them. They are blind for the same reason.
// RECOGNISERS
Every service watches
Each service defines anomalous differently. Trip one and SCLU derezzes every active port, then re-blocks elsewhere. Your work survives. Your map does not.
// TEAM
Pressure is the point
A physical room, real and manufactured pressure. It rewards the team still talking to each other at minute twelve.
04
The Challenges
Built from the SSOE itself. Beginner through to expert.
Beginner
Expert
First-timers will have plenty to work on. Veterans will still run out of clock.
// SIGNAL DISCIPLINES
No team is expected to cover them all.
01Network security and protocol knowledge
02Serial and hardware interfacing
03Bluetooth and RF signals
04Encryption
05Web app and API exploitation
06AI security
07Physical problem-solving
// Above all
Comms discipline and teamwork under time pressure
Every discipline above is secondary to this one.
// KIT REQUIREMENTS
// MANDATORY
Bring laptops for at least 60% of your team
Most challenges need one, and you will run several at once. A single shared machine will stall you.
// STRONGLY PREFERRED
A wired network port
Built-in RJ45 is better. No port? Bring your adapter. We have spares, but cannot account for driver issues.
// WELCOME
Your own tooling
Hardware, software, a mobile device. Kit you know well beats anything we hand you.
// REMEMBER
You only have 15 minutes
Set up and test before you walk in. Installing or pairing is time off the clock.
05
Allocate a Window
Pick a live port and register your team. One team per window, and the schedule does not extend.
// Session allocated
Confirmation sent to both contacts. Arrive five minutes early.
Port map
-- live · 15 min each
Scanning frame for live ports…
Struck-through ports are allocated. Canberra local time. Nothing suits?
courses@ausinfosec.academy
// Windows all gone?
You can still play.
The Fragments on the wire are open to everyone at the conference. No booking, no disc, no clock. You do not need a window in the room to take part, and you do not need a team. Find them in and around the conference and work them at your own pace.
06
Fragments on the wire
Not everything SCLU derezzed died. Fragments persist outside the SSOE boundary, drifting through the conference: orphaned processes, discarded hardware, signals broadcasting into the abyss.
These are open to everyone. You do not need a booked window, a team, or a disc. If you missed out on a spot in the room, this is still your challenge. Find the Fragments in and around the conference and work them at your own pace.
No disc · no booking · no clock
// Submit your flags
Anyone can sign up to submit flags for the Fragment challenges. Register, capture, submit.