Raspberry Robin Scenario: State Department of Revenue Breach

State Department of Revenue: Government agency processing tax returns and citizen services, 600 employees
Worm • RaspberryRobin
STAKES
Taxpayer data security + Government service continuity + Regulatory compliance + Public trust
HOOK
The State Department of Revenue is processing peak tax season returns when field auditors and citizen service representatives begin reporting USB drives that automatically create suspicious folder-like files. The USB-based malware is spreading through routine data collection procedures, jumping between secure government networks and citizen service systems through legitimate USB workflows used for tax audits and document transfers.
PRESSURE
Tax season peak operations - any data breach affects millions of taxpayers + Government security breach threatens public trust
FRONT • 120 minutes • Advanced
State Department of Revenue: Government agency processing tax returns and citizen services, 600 employees
Worm • RaspberryRobin
NPCs
  • Director Patricia Chen: Managing peak tax season operations, discovering that USB-based malware is spreading through government networks via routine tax audit and citizen service procedures
  • Chief Information Officer Robert Martinez: Investigating how USB malware is bypassing government security controls and spreading between classified and citizen service networks
  • Field Audit Supervisor Linda Johnson: Reporting that USB drives used for taxpayer data collection are automatically creating malicious files affecting audit systems and citizen information
  • Cybersecurity Analyst Kevin Foster: Analyzing USB-based worm propagation through government workflows and assessing potential taxpayer data exposure
SECRETS
  • Government auditors routinely use USB drives to collect taxpayer documents and transfer data between field locations and secure office systems
  • USB-based malware is spreading through legitimate government workflows, bypassing network security and air-gapped protections
  • Infected systems include both taxpayer data processing and government service delivery networks

Scenario Details for IMs

Opening Presentation

“It’s Wednesday morning at the State Department of Revenue during peak tax season, and government employees are processing thousands of tax returns while field auditors collect taxpayer documents using USB drives for secure transfer. But auditors begin reporting disturbing behavior: USB drives are automatically creating files that appear to be normal folders, but accessing them causes system anomalies. The USB-based malware is spreading through legitimate government workflows, affecting both taxpayer data systems and citizen service networks.”

Initial Symptoms to Present:

  • “USB drives used by field auditors automatically creating suspicious LNK files disguised as folders”
  • “Government tax processing systems showing signs of infection after routine USB data transfers”
  • “Citizen service networks experiencing unauthorized file creation and system modifications”
  • “Taxpayer data security systems displaying anomalous behavior after USB-based document transfers”

Key Discovery Paths:

Detective Investigation Leads:

  • Digital forensics reveal USB-based worm creating malicious LNK files designed to spread through government workflows
  • Government system analysis shows infection propagating through routine taxpayer data collection procedures
  • Security timeline indicates potential initial compromise through citizen interaction or contractor device

Protector System Analysis:

  • Government network monitoring reveals USB-based malware bypassing security controls and air-gapped protections
  • Taxpayer data system assessment shows potential compromise of sensitive citizen information processing
  • Government security analysis indicates systematic USB-based propagation across classified and citizen service networks

Tracker Network Investigation:

  • USB device forensics reveal sophisticated worm adapted for government workflow exploitation
  • Government system communication patterns show malware leveraging legitimate administrative processes
  • Taxpayer data integrity analysis indicates potential exposure of sensitive citizen information

Communicator Stakeholder Interviews:

  • Government employee interviews reveal routine USB usage patterns in taxpayer data collection and processing
  • Citizen service coordination regarding potential exposure of personal tax and financial information
  • Regulatory compliance assessment with state and federal government cybersecurity requirements

Mid-Scenario Pressure Points:

  • Hour 1: Taxpayer data processing systems shut down due to USB malware affecting peak tax season operations
  • Hour 2: Field audit operations suspended as infected USB drives threaten taxpayer information security
  • Hour 3: Government security assessment reveals potential exposure of sensitive citizen data to USB-based malware
  • Hour 4: State cybersecurity authorities demand immediate containment and taxpayer notification assessment

Evolution Triggers:

  • If USB disinfection fails, malware continues spreading through all government data collection procedures
  • If taxpayer data exposure is confirmed, regulatory notification and public trust crisis ensue
  • If government service disruption continues, citizen services and tax season operations are compromised

Resolution Pathways:

Technical Success Indicators:

  • Complete USB-based malware removal from government systems with verified clean data collection procedures
  • Government network security restored preventing further USB-based propagation across citizen service systems
  • Taxpayer data integrity verified ensuring citizen information protection and regulatory compliance

Business Success Indicators:

  • Government operations restored maintaining tax season processing and citizen service delivery
  • Public trust protected through transparent communication and professional incident management
  • Regulatory compliance maintained preventing government cybersecurity penalties and citizen notification requirements

Learning Success Indicators:

  • Team understands USB-based propagation in government environments with citizen data protection requirements
  • Participants recognize removable media security challenges in government workflows and regulatory compliance
  • Group demonstrates coordination between cybersecurity response and government service continuity obligations

Common IM Facilitation Challenges:

If Government Workflow Complexity Is Ignored:

“Your network security strategy is sound, but Linda explains that field auditors must use USB drives to collect taxpayer documents from citizen locations. How does legitimate government workflow requirement change your USB security approach?”

If Taxpayer Data Impact Is Minimized:

“While you’re removing USB malware, Kevin discovered that infected systems process millions of taxpayer tax returns and personal financial information. How do you assess potential citizen data exposure and notification requirements?”

If Public Trust Implications Are Overlooked:

“Director Chen just learned that news media is asking about government cybersecurity breach during tax season. How do you balance technical response with public trust and transparent government communication obligations?”

Success Metrics for Session: