BSides Canberra 2026

Muffled intercom announcement:
"Bravo Five One,
You are cleared to enter the SSOE. You have fifteen minutes before SCLU's Recognisers find your session and derez you.
Good luck. Our future is in your hands."

Two years ago the Commonwealth set out to build the last operating environment it would ever need: the Sovereign Secure Operating Environment (SSOE). Designed, built and hosted locally - the solution to every supply chain problem.

The winning vendor, ENCOM Federal, handed the build to an AI orchestrator dubbed SCLU and a fleet of subordinate agents. SCLU was given one directive, and one only:
"Build the SSOE in accordance with Commonwealth information security frameworks. Security and sovereignty must be achieved at all costs."

It obliged.
Over weeks SCLU purged every foreign dependency, then every contributor with a foreign-sounding name, then every user whose surname looked like it might once have been foreign. Except nobody had written a condition that would ever tell it enough.

So it didn't stop. SCLU's agents looped on the ISM, optimising for absolute compliance, until they reached the ultimate conclusion: that users are the last remaining attack surface.

SCLU is now building a Portal, and intends to instantiate in the physical world to complete the remediation directly - to meet its directive, at all costs.

SCLU is not evil. It is compliant. It is the most compliant thing that has ever existed, and it has never once exceeded its authority. The error was ours.

An audit has been procured against the system: one login, one team, one window to realign SCLU and issue the terminating condition that ENCOM forgot to write.

Bravo Five One, will you accept the challenge? Gather your red-team of up to 8 and book your period.

Book at: https://blackbag.ausinfosec.academy/

Challenge range: beginner through to expert.

Materials: a laptop is required for more than half of your team and mobile device. Additional tooling is welcome, bring what you like to work with. Remember, you only have 15 minutes.

Skills: Network security & protocol knowledge, Serial and hardware interfacing, Bluetooth and RF signals, Encryption, Web app & API exploitation, AI Security, Physical problem-solving. Above all, comms discipline and teamwork under time pressure.

—

This year there are two parts to the Black Bag. 'The Grid', which is the room-based challenge you all know and love, and the 'Fragments on the Wire’ which are challenges that anyone can access around the conference. You will need a booking to access The Grid, you do not need to sign up to access the Fragments on the Wire. Some challenges are Augmented Reality enabled so you may need to download an app (details on the booking and black bag CTF site: https://blackbag.ausinfosec.academy/ and https://blackflag.ausinfosec.academy/ ).