# SAFETYNET Cover Operations

## Overview

SAFETYNET agents operate under various cover identities depending on mission requirements. These covers provide both legal framework for their activities and plausible deniability if operations are exposed. The art of maintaining a cover story is the difference between a successful mission and an international incident.

## Standard Cover Identities

### Cyber Security Consultants

**Cover Story**: External security consultant conducting authorised penetration testing
**Legitimacy**: Supported by real contracts, NDAs, and statements of work
**Common Usage**: Corporate infiltration, vulnerability assessments, compliance testing

**How It Works**:
- SAFETYNET maintains several legitimate security consultancy firms as fronts
- Contracts are drawn up with target organisations (sometimes without their full knowledge)
- Agent arrives with official paperwork, badges, and authorisation letters
- Activities can be explained as "testing security" even when they're gathering intelligence

**Advantages**:
- Broad access to systems and facilities
- Expected to ask questions and probe defences
- Suspicious behaviour is part of the job
- Can document and photograph security measures openly

**Limitations**:
- May be escorted or monitored by legitimate security staff
- Expected to produce deliverables (actual security reports)
- Technical competence is assumed—can't fake expertise
- Contract scope may limit access to certain areas

**Example Scenario**: Agent 0x0042 is assigned to penetration test a financial services company suspected of ENTROPY ties. The contract authorises network testing; the real objective is finding evidence of data exfiltration to ENTROPY.

### New Employees

**Cover Story**: Recently hired employee in relevant department
**Legitimacy**: Backed by falsified employment records, references, and background checks
**Common Usage**: Long-term intelligence gathering, deep infiltration

**How It Works**:
- SAFETYNET arranges for agent to be hired through normal recruitment processes
- References and work history are fabricated but verifiable
- Agent works as a legitimate employee while conducting covert investigation
- Can take weeks or months depending on mission requirements

**Advantages**:
- Unrestricted access to employee areas and systems
- Time to build relationships and gather intelligence
- Natural presence—no one questions why you're there
- Access to internal communications and office politics

**Limitations**:
- Must actually perform the job duties convincingly
- Background must withstand HR scrutiny
- Long-term deployments can be psychologically taxing
- Difficult to conduct obvious security testing without raising suspicion

**Example Scenario**: Agent 0x0067 is hired as a junior IT administrator at a technology startup. Over three months, they document network architecture, identify ENTROPY-associated personnel, and map data flows—all while actually fixing servers and resetting passwords.

### Incident Response Specialists

**Cover Story**: Emergency response expert called in after security breach
**Legitimacy**: Contracted through incident response retainer agreements
**Common Usage**: Post-breach investigation, rapid intelligence gathering

**How It Works**:
- Target organisation experiences a security incident (sometimes SAFETYNET-induced)
- Agent arrives as part of "incident response team"
- Broad access granted due to emergency circumstances
- Investigation covers both the actual incident and covert ENTROPY indicators

**Advantages**:
- Access during chaos when security protocols are relaxed
- Expected to examine systems in detail
- Can identify and exploit additional vulnerabilities
- Urgency justifies rapid, aggressive investigation

**Limitations**:
- Time-sensitive—must complete objectives before incident is resolved
- High visibility means actions are scrutinised
- Must produce actual incident response deliverables
- Failure to find the "official" problem raises suspicions

**Example Scenario**: A ransomware attack hits a healthcare provider. Agent 0x0053 joins the incident response team. While investigating the ransomware, they discover ENTROPY has been exfiltrating patient records for months—the ransomware was a distraction.

### Security Auditors

**Cover Story**: Compliance auditor performing regulatory assessment
**Legitimacy**: Backed by regulatory requirements and audit contracts
**Common Usage**: Financial institutions, healthcare, government contractors

**How It Works**:
- Regulations require periodic security audits
- SAFETYNET consultancy firms bid for audit contracts
- Agent conducts "compliance assessment" while gathering intelligence
- Detailed questionnaires and system reviews provide excellent intelligence collection opportunities

**Advantages**:
- Organisations are legally required to cooperate
- Can request access to detailed system documentation
- Can interview employees about processes and systems
- Findings can be vague enough to avoid revealing intelligence value

**Limitations**:
- Must follow audit methodology to maintain credibility
- Expected to understand relevant regulations in detail
- Audit findings become official record
- Limited to organisations in regulated industries

**Example Scenario**: Agent 0x0038 audits a defence contractor for CMMC compliance. While reviewing access controls and data protection, they identify anomalous data transfers to ENTROPY-controlled infrastructure disguised as cloud backups.

### Freelance Security Researchers

**Cover Story**: Independent researcher investigating vulnerabilities
**Legitimacy**: Supported by bug bounty profiles and security community reputation
**Common Usage**: Reconnaissance, vulnerability discovery, initial access

**How It Works**:
- Agent maintains legitimate security researcher persona online
- Participates in bug bounty programs and publishes security research
- "Discovers" vulnerabilities in target organisation's public-facing systems
- Responsible disclosure process provides contact and access

**Advantages**:
- Can operate independently without organisational affiliation
- Flexible methodology and scope
- Security community reputation provides credibility
- Low commitment—can disengage easily if compromised

**Limitations**:
- Limited to externally-facing systems initially
- Must actually find valid vulnerabilities
- Bug bounty scope may exclude certain testing
- Requires genuine security research skills

**Example Scenario**: Agent 0x0071 identifies a vulnerability in a logistics company's web portal. Through the disclosure process, they gain access to internal security team communications, identifying ENTROPY infiltration of the development team.

## Advanced Cover Identities

### Vendor Representatives

**Cover Story**: Representative from technology vendor providing support or sales
**Applications**: Access to specific systems or technologies
**Legitimacy**: Temporary vendor badges and support tickets

**Example**: Agent poses as representative from a security appliance vendor to gain physical access to server rooms and network infrastructure while "performing maintenance."

### Temporary Contractors

**Cover Story**: Short-term contractor hired for specific project
**Applications**: Access without long-term employment commitment
**Legitimacy**: Contractor agreements and limited-duration badges

**Example**: Agent hired as temporary contractor during office relocation project gains access to backup systems and offline archives during the chaos of the move.

### Conference Attendees

**Cover Story**: Security professional attending industry conference
**Applications**: Intelligence gathering, networking with targets
**Legitimacy**: Paid registration and professional reputation

**Example**: Agent attends security conference where ENTROPY-affiliated researchers are presenting, using social events to gather intelligence and identify connections.

### Media and Journalists

**Cover Story**: Technology journalist writing article about industry
**Applications**: Interviews with key personnel, facility tours
**Legitimacy**: Real publication with assigned article

**Example**: Agent interviews company executives for "article about cybersecurity in healthcare," gathering intelligence about internal security practices and concerns.

### Academic Researchers

**Cover Story**: University researcher conducting legitimate research
**Applications**: Access to data, interviews with technical staff
**Legitimacy**: Actual academic affiliation and research ethics approvals

**Example**: Agent conducts "research study" on organisational security practices, using surveys and interviews to map target organisation's security posture and identify weaknesses.

## Maintaining Cover Legitimacy

### Before the Mission

**Building the Legend**:
- Establish online presence appropriate to cover (LinkedIn, GitHub, conference talks)
- Create verifiable history (actual work products, published research, conference attendance)
- Develop relationships with legitimate professionals who can vouch for you
- Maintain technical competency in cover role's domain

**Documentation**:
- Legitimate contracts and statements of work
- Non-disclosure agreements (that actually protect SAFETYNET operations)
- Business cards, email accounts, and phone numbers
- Corporate credentials and badges
- Reference contacts (usually other SAFETYNET agents or cooperative organisations)

**Rehearsal**:
- Practice cover story until it's second nature
- Prepare for likely questions about background and experience
- Understand the business and technology of the role
- Plan responses to unexpected challenges

### During the Mission

**Staying in Character**:
- Always assume you're being watched or recorded
- Maintain cover even in "private" moments (bathroom conversations, after-hours)
- Use cover-appropriate language and behaviour
- Avoid technical discussions that contradict your supposed expertise level

**Managing Scope Creep**:
- Stay within the bounds of your cover's legitimate access
- If you need access beyond cover authorisation, invent plausible reasons
- Document activities in a way that appears consistent with cover role
- Be prepared to explain any unusual behaviour

**Handling Questions**:
- Answer questions confidently and consistently
- Have prepared backstory details (previous employers, projects, personal history)
- Redirect uncomfortable questions to less sensitive topics
- Use professional jargon appropriate to cover role

**Communication Security**:
- Use only approved communication channels with handlers
- Never discuss actual mission objectives in potentially monitored spaces
- Maintain separate phones and devices for cover and actual work
- Be paranoid about electronic surveillance

### Extracting from Cover

**Normal Conclusion**:
- Complete cover role's deliverables (security reports, audit findings, etc.)
- Maintain professional relationships for potential future use
- Leave on good terms consistent with cover
- Close out contracts and access in appropriate timeframe

**Emergency Extraction**:
- If cover is blown or mission compromised, follow extraction protocols
- Handler coordinates removal from site
- Cover story shifts to explain sudden departure
- Burn cover identity if necessary to protect agent

**Post-Mission**:
- Debrief with handler on cover effectiveness
- Document lessons learned for future operations
- Determine if cover identity can be used again
- Monitor for signs that cover was compromised

## Cover Identity Management

### The Cover Database

SAFETYNET maintains extensive databases of:
- **Active Covers**: Currently deployed cover identities and their status
- **Burned Covers**: Compromised identities that can't be reused
- **Dormant Covers**: Established identities held in reserve
- **Cover Props**: Physical and digital assets supporting cover stories

### Front Companies

SAFETYNET operates numerous legitimate front companies:
- Security consultancies (the most common)
- Incident response firms
- Compliance auditing services
- Software development companies
- Technology vendors and resellers

These companies:
- Conduct actual business to maintain legitimacy
- Employ both SAFETYNET agents and unwitting civilians
- Generate real revenue (which funds operations)
- Have genuine client relationships and reputation

### Legal Considerations

The legal status of cover operations is... complicated:

**Theoretically Legal**:
- Authorised penetration testing under contract
- Compliance auditing with organisation cooperation
- Security research within responsible disclosure norms

**Legally Grey**:
- Exceeding the scope of authorisation to gather intelligence
- Falsifying employment documents to gain access
- Using covers to bypass consent requirements

**Definitely Illegal (But We Do It Anyway)**:
- Accessing systems without authorisation
- Stealing confidential information
- Impersonating officials or employees
- Breaking into facilities

The Field Operations Handbook addresses this with its usual clarity: "All operations shall be conducted in full compliance with applicable laws, except when such compliance would impede mission objectives, in which case agents should ensure their actions remain sufficiently deniable."

## Cross-References

- **Overview**: See [overview.md](./overview.md) for SAFETYNET's mission and philosophy
- **Agent Classification**: See [agent_classification.md](./agent_classification.md) for who operates under cover
- **Rules of Engagement**: See [rules_of_engagement.md](./rules_of_engagement.md) for operational constraints
- **Technology**: See [technology_resources.md](./technology_resources.md) for tools supporting cover operations

## For Scenario Designers

### Using Covers in Your Scenarios

**Establishing Player Cover**:
- Begin each scenario by establishing the player's cover identity
- Provide concrete details: company name, contract terms, expected deliverables
- Give players their "official" reason for being on-site
- Explain what access their cover provides and what would be suspicious

**Cover as Constraint**:
- Use cover limitations to create interesting challenges
- Players must balance completing objectives with maintaining cover
- Some actions (breaking doors, accessing restricted areas) should risk exposure
- Create tension between fastest solution and most deniable approach

**Cover as Resource**:
- Players can use their cover to ask questions and gather information
- Cover provides legitimate explanation for presence in certain areas
- Can leverage cover role's authority or expertise
- Other NPCs should respond based on the cover identity

**Cover Under Pressure**:
- Create scenarios where cover is questioned or challenged
- Players must think on their feet to maintain legitimacy
- Failed cover maintenance can escalate mission difficulty
- Complete cover failure might trigger emergency extraction

### Writing Cover-Related Dialogue

**NPCs Addressing the Player**:
- NPCs should refer to the player by their cover role
- Security guards might be suspicious of consultants accessing unusual areas
- Employees might ask technical questions the player should be able to answer
- Managers might make demands consistent with the cover contract

**Handler Communication**:
- Handlers should remind players of cover constraints when necessary
- Can provide updates to cover story as mission evolves
- Should warn players when actions risk cover exposure
- Can authorise cover deviation in emergencies

### Example Cover Scenarios

**Penetration Tester**:
- "You're here representing Sentinel Security to conduct a network penetration test. Your contract authorises testing of the corporate network but specifically excludes the R&D segment. Of course, that's exactly where we suspect ENTROPY is hiding."

**New Employee**:
- "You started as a helpdesk technician three weeks ago. You've been doing actual password resets and printer fixes to maintain your cover. Tonight, after hours, you need to access the CEO's office to plant a monitoring device. The cleaning crew arrives at 8 PM."

**Incident Responder**:
- "Ransomware hit their systems two hours ago. You're part of the incident response team. Everyone's panicking, security is chaos, and you have maybe 12 hours before they contain the situation. Find out if ENTROPY planted the ransomware as cover for data exfiltration."

**Auditor**:
- "You're conducting a SOC 2 audit. That means you can ask to see any security control, review any policy, and interview any employee. It also means they expect a detailed audit report at the end. Better make sure it's convincing."

### Common Pitfalls to Avoid

- **Ignoring Cover**: Don't let players forget their cover identity—remind them through NPCs and consequences
- **Unrealistic Cover**: Don't give covers access to everything—limitations create interesting challenges
- **Inconsistent NPCs**: Make sure NPCs react appropriately to the cover role
- **No Consequences**: Failed cover maintenance should have narrative impact
- **Over-explaining**: Trust players to understand their cover—don't repeat it constantly
