LitterDrifter Scenario: Government Ministry Coordination

LitterDrifter Scenario: Government Ministry Coordination

Udenrigsministeriet (Ministry of Foreign Affairs): 1,500 employees, managing Ukraine diplomatic and military aid coordination
APT • LitterDrifter
STAKES
National security + Government operations + International coordination + Public trust
HOOK
Security teams at Udenrigsministeriet are seeing ministry workstations launch unknown processes when USB devices are inserted, diplomatic files open without user action, and outbound sessions to unfamiliar infrastructure from restricted offices. Multiple teams supporting Ukraine coordination report the same pattern, indicating targeted surveillance of government planning workflows.
PRESSURE
  • Strategic briefing due Thursday for 420 million DKK aid package
  • Targeted surveillance threatens diplomatic and interagency decision-making
  • Operational scope: Ministry of Foreign Affairs, 1,500 employees, managing Ukraine diplomatic and military aid coordination
FRONT • 150 minutes • Expert
Udenrigsministeriet (Ministry of Foreign Affairs): 1,500 employees, managing Ukraine diplomatic and military aid coordination
APT • LitterDrifter
NPCs
  • Katrine Fonsmark (Minister’s Chief of Staff): Owns executive coordination and escalation decisions
  • Kasper Juul (IT Director): Leads containment and infrastructure continuity
  • Bent Sejro (Department Head): Represents mission operations and policy delivery risk
  • Philip Christensen (Security Advisor): Coordinates evidence handling and national-security reporting
SECRETS
  • Trusted administrative USB workflows bypassed expected control checkpoints
  • Sensitive policy and coordination files were accessed outside approved windows
  • Similar telemetry is emerging across related public-sector organizations

Planning Resources

Tip📋 Comprehensive Facilitation Guide Available

For detailed session preparation support, including game configuration templates, investigation timelines, response options matrix, and round-by-round facilitation guidance, see:

Litter Drifter Government Ministry Planning Document

Planning documents provide 30-minute structured preparation for first-time IMs, or quick-reference support for experienced facilitators.

Note🎬 Interactive Scenario Slides

Ready-to-present RevealJS slides with player-safe mode, session tracking, and IM facilitation notes:

Litter Drifter Government Ministry Scenario Slides

Press ‘P’ to toggle player-safe mode • Built-in session state tracking • Dark/light theme support

Scenario Details for IMs

Hook

Initial Symptoms to Present:

Warning🚨 Initial User Reports
  • “USB devices trigger unknown process launches on ministry workstations”
  • “Strategic planning files open outside authorized review sessions”
  • “Endpoint logs show recurring outbound traffic to unfamiliar infrastructure”
  • “Cross-team reports indicate coordinated targeting of high-sensitivity workflows”

Key Discovery Paths:

Detective Investigation Leads:

  • Forensic review links execution to removable-media paths embedded in routine admin operations
  • Access timelines show sustained collection of policy coordination artifacts
  • Artifact cadence suggests long-dwell intelligence gathering rather than immediate disruption

Protector System Analysis:

  • Endpoint controls allow signed but unapproved binaries from removable media
  • Segmentation limits direct spread but not credential-mediated document access
  • Containment options diverge between rapid isolation and evidence-preserving triage

Tracker Network Investigation:

  • Beacon intervals and destination rotation indicate deliberate low-noise exfiltration behavior
  • Cross-organization telemetry alignment suggests coordinated campaign tasking
  • Infrastructure overlaps with prior government-sector surveillance activity

Communicator Stakeholder Interviews:

  • Executive staff need a defensible recommendation on continuity versus containment depth
  • Policy teams need guidance on what work can continue without contaminating evidence
  • External affairs teams need clear messaging for partner organizations and oversight bodies

Mid-Scenario Pressure Points:

  • Hour 1: Leadership requests a go/no-go recommendation for this week’s strategic briefing
  • Hour 2: External partners request assurance about information integrity and handling
  • Hour 3: Investigators detect additional suspicious access in adjacent policy teams
  • Hour 4: Executive office requires a written incident posture for regulators and security agencies

Evolution Triggers:

  • If containment is delayed, additional coordination teams show parallel unauthorized access activity
  • If isolation is partial, operators observe renewed beaconing after host restart cycles
  • If decisions are made without integrity assurance, partner trust in ministry outputs degrades rapidly

Resolution Pathways:

Technical Success Indicators:

  • Removable-media execution controls are enforced across ministry endpoint tiers
  • Evidence timeline supports attribution and legal reporting needs
  • Clean working baselines are re-established for high-sensitivity document repositories

Business Success Indicators:

  • Leadership receives a defensible recommendation for schedule impact and policy confidence
  • Interagency and external partner communication remains aligned and evidence-based
  • Incident posture supports both regulatory and national-security obligations

Learning Success Indicators:

  • Team distinguishes intelligence-collection incidents from disruptive malware response patterns
  • Participants practice making high-impact decisions under uncertainty and public-sector scrutiny
  • Group coordinates technical, policy, and executive functions without breaking evidence integrity

Common IM Facilitation Challenges:

If Containment Is Too Slow:

“You can keep operations moving, but what evidence supports confidence in this week’s strategic briefing package?”

If Executive Escalation Is Delayed:

“Leadership needs an immediate recommendation: expand isolation now, or continue operations with documented residual risk?”

If Reporting Obligations Are Deferred:

Success Metrics for Session:

Template Compatibility

This scenario adapts to multiple session formats with appropriate scope and timing:

Quick Demo (35-40 minutes)

Structure: 2 investigation rounds, 1 decision round
Focus: Detecting removable-media surveillance behavior in government workflows
Key Actions: Map initial access path, isolate high-risk endpoints, issue first executive recommendation

Lunch & Learn (75-90 minutes)

Structure: 4 investigation rounds, 2 decision rounds
Focus: Coordinating containment with public-sector reporting duties
Key Actions: Build evidence timeline, assess policy-output integrity, align communications to agencies and partners

Full Game (120-140 minutes)

Structure: 6 investigation rounds, 3 decision rounds
Focus: End-to-end ministry incident response under strategic deadline pressure
Key Actions: Run containment and reporting in parallel, make confidence-based delivery decision, define durable control strategy

Advanced Challenge (150-170 minutes)

Structure: 7-8 investigation rounds, 4 decision rounds
Expert Elements: Multi-agency coordination ambiguity, cross-institution telemetry correlation, high-consequence uncertainty framing
Additional Challenges: Conflicting partner signals, constrained evidence windows, executive pressure for immediate assurance

Quick Demo Materials (35-40 min)

Guided Investigation Clues

Pre-Defined Response Options

  • Option A: Immediate Endpoint Isolation
    • Action: Isolate affected systems and disable removable-media execution while triage completes.
    • Pros: Fast containment with clear technical boundary.
    • Cons: High immediate disruption to coordination workflows.
    • Type Effectiveness: Super effective against low-noise espionage collection behavior.
  • Option B: Evidence-First Segmented Containment
    • Action: Preserve volatile evidence on high-value endpoints and isolate confirmed compromised segments first.
    • Pros: Better legal and attribution posture.
    • Cons: Requires disciplined execution under time pressure.
    • Type Effectiveness: Moderately effective when telemetry quality is high.
  • Option C: Continuity-Weighted Monitoring
    • Action: Keep priority workflows active with compensating controls and focused monitoring.
    • Pros: Minimizes schedule disruption in the short term.
    • Cons: Residual access risk remains if scope is underestimated.
    • Type Effectiveness: Partially effective and risk-heavy for broad campaigns.

Lunch & Learn Materials (75-90 min, 2 rounds)

Round 1: Initial Detection and Scope (30-35 min)

Investigation Clues:

  • Clue 1 (Minute 5): Endpoint telemetry flags unexpected execution from removable-media paths.
  • Clue 2 (Minute 10): High-sensitivity documents are accessed outside expected review channels.
  • Clue 4 (Minute 20): Cross-organization sharing indicates similar indicators in adjacent institutions.

Round 2: Reporting and Confidence Decision (30-35 min)

Investigation Clues:

  • Clue 5 (Minute 30): Integrity review finds suspicious edits and access metadata in coordination working sets.
  • Clue 7 (Minute 50): Leadership requests a written confidence statement for this week’s deliverables.
  • Clue 8 (Minute 55): Partner teams ask whether shared planning artifacts should be treated as potentially exposed.

Round Transition Narrative

After Round 1 -> Round 2:

Facilitation questions:

  • “What is your minimum evidence threshold before certifying strategic package integrity?”
  • “Which decision can be safely deferred, and which cannot wait another hour?”
  • “How do you communicate uncertainty without losing stakeholder confidence?”

Debrief Focus:

  • Running containment and reporting in parallel under public-sector scrutiny
  • Preserving evidence while maintaining policy-operational continuity
  • Framing technically uncertain findings for executive decision-making

Full Game Materials (120-140 min, 3 rounds)

NoteHow Full Game Differs from Lunch & Learn

The Full Game expands the scenario from 2 guided rounds to 3 open-ended rounds. Players drive their own investigation using the Key Discovery Paths above rather than receiving timed clues. Round 3 shifts from immediate containment to institutional hardening and trust recovery.

Round 1: Executive Briefing and Scope Discovery (35-40 min)

Players investigate openly using role capabilities. Key findings include removable-media execution, policy-file access anomalies, and external telemetry overlap.

If team stalls: “You can keep systems running, but leadership still needs a defensible statement on whether this week’s outputs remain trustworthy.”

Round 2: Agency Coordination and Integrity Decision (35-40 min)

  • Technical teams complete artifact collection and present containment options with risk tradeoffs.
  • Executive staff request a clear recommendation on schedule impact and confidence level.

Facilitation questions:

  • “What combination of controls would let you proceed with bounded and explicit residual risk?”
  • “How will you document decision rationale so it remains defensible in post-incident review?”

Round 3: Strategic Recovery and Control Redesign (40-45 min)

Opening: Two weeks later, immediate threats are contained and leadership asks for a durable strategy covering removable-media policy, interagency telemetry exchange, and evidence-retention standards.

Pressure events:

  • Partner institutions request proof of control improvements before sharing high-sensitivity planning artifacts
  • Oversight stakeholders request a formal lessons-learned package with accountable owners
  • Executive office requires a 90-day roadmap with measurable milestones

Victory conditions for full 3-round arc:

  • Verified clean baseline for affected ministry systems and planning repositories
  • Defensible reporting package aligned to regulatory and national-security expectations
  • Sustainable control improvements for removable-media risk and cross-institution signal sharing

Debrief Questions

  1. “Which early indicator most strongly signaled sustained surveillance rather than isolated misuse?”
  2. “How did strategic deadlines alter risk tolerance and communication quality?”
  3. “What evidence was essential for external trust, and what was optional?”
  4. “How should ministries coordinate faster on shared indicators without overexposing sensitive workflows?”

Debrief Focus

  • Surveillance-oriented incidents demand different decision patterns than purely disruptive events
  • Removable-media and trust-boundary controls remain critical in government operational environments
  • Executive confidence depends on technical rigor, timing discipline, and explicit uncertainty handling

Advanced Challenge Materials (150-170 min)

Red Herrings and Misdirection

  1. Routine removable-media maintenance workflows generate benign signals similar to malicious execution.
  2. A legitimate interagency data-transfer event overlaps with suspicious timeline artifacts.
  3. A separate credentials-hygiene issue appears related but is operationally independent.

Removed Resources and Constraints

  • No ready-made incident playbook for removable-media espionage in policy environments
  • Limited historical telemetry retention on selected administrative endpoints
  • Delayed external partner responses during the first executive decision window

Enhanced Pressure

  • Leadership requests same-day assurance for strategic outputs despite incomplete evidence
  • External partners demand immediate indicator sharing before legal review is finalized
  • Program teams request containment exceptions to preserve policy deadlines

Ethical Dilemmas

  1. Preserve richer evidence and accept short-term operational risk, or isolate faster and reduce attribution depth.
  2. Delay deliverables for stronger confidence, or proceed with explicit residual risk to protect policy timelines.
  3. Share broad technical indicators to help partners quickly, or restrict disclosure to protect internal architecture details.

Advanced Debrief Topics

  • Designing ministry incident doctrine for low-noise, long-dwell collection campaigns
  • Structuring executive governance when confidence is uneven across technical teams
  • Strengthening interagency readiness without eroding confidentiality boundaries