# Society in Break Escape

## Overview

Break Escape occurs in a world that resembles our own 2025, but with a crucial hidden layer: most people are completely unaware of the shadow war between SAFETYNET and ENTROPY. This document explores how normal society functions, what civilians know (and don't know), and how the cyber security underground operates alongside everyday life.

---

## The Surface World

### What "Normal" People Experience

The average citizen in Break Escape's world lives their regular life, largely oblivious to the true scale of cyber threats and the covert organizations fighting over digital infrastructure.

#### Public Awareness: Limited but Growing

**What Citizens Know:**
- Cybercrime exists (ransomware attacks make news)
- Data breaches happen (their passwords get compromised)
- Identity theft is a threat
- Phishing emails are common
- Hackers are criminals (mostly)
- Antivirus software exists
- Companies get hacked sometimes

**What Citizens DON'T Know:**
- SAFETYNET exists
- ENTROPY is an organized global network
- Many "random" cyber attacks are coordinated operations
- Shadow war occurring in digital infrastructure
- Scale and sophistication of state-level threats
- Many breaches are never publicly disclosed
- Some companies are entirely ENTROPY fronts

**Why the Ignorance:**
- SAFETYNET operates covertly by design
- ENTROPY benefits from obscurity
- Government and corporate cover-ups
- Technical complexity beyond most people
- Media focuses on sensational incidents
- "Security through obscurity" of both organizations

### Media Coverage of Cyber Threats

#### What Makes News

**High-Profile Breaches:**
- Major corporations losing customer data
- Ransomware shutting down hospitals or cities
- Celebrity account hacks
- Election interference allegations
- Critical infrastructure attacks

**Coverage Style:**
- Sensationalized headlines
- Oversimplified explanations
- "Cyber attack" as catch-all term
- Focus on victim impact, not technical details
- Fear-based reporting
- Expert talking heads (varying credibility)

**What Doesn't Make News:**
- Most breaches (only major ones reported)
- SAFETYNET operations (classified)
- ENTROPY cell networks (unknown to media)
- Sophisticated attacks (too technical)
- Quiet data theft (victims don't realize)
- Prevented attacks (unknown to public)

#### Media Archetypes in Break Escape

**Tech Journalists:**
- Some knowledgeable, many superficial
- Varying levels of technical expertise
- Can be manipulated by both sides
- Occasionally stumble onto real stories
- Sometimes recruited by ENTROPY (blackmail or ideology)

**Cybersecurity "Experts":**
- Range from legitimate researchers to talking heads
- Some unknowingly spread ENTROPY disinformation
- Others are SAFETYNET assets providing cover
- Media loves simple explanations from "experts"
- Actual experts often too technical for news

**Conspiracy Theorists:**
- Some accidentally close to truth
- Most dismissed as paranoid
- Convenient cover (real operations dismissed as conspiracy)
- ENTROPY occasionally feeds them disinformation
- SAFETYNET neither confirms nor denies

---

## Corporate Security Culture

### Security Posture by Industry

#### Technology Companies
**Security Awareness: High**
- Dedicated security teams
- Regular penetration testing
- Bug bounty programs
- Security training mandatory
- Incident response plans
- High-value targets

**Challenges:**
- Still vulnerable despite awareness
- Insider threats difficult to detect
- Zero-day exploits bypass defenses
- Supply chain vulnerabilities
- Acquired companies with weak security

**In Scenarios:**
- More sophisticated defenses
- Security-aware employees
- Better monitoring and detection
- Harder but more rewarding targets

#### Financial Institutions
**Security Awareness: Very High**
- Regulatory compliance requirements
- Extensive auditing
- Multi-factor authentication standard
- Separation of duties
- Regular security assessments

**Challenges:**
- Legacy systems vulnerable
- Social engineering still works
- Third-party vendor risks
- High-value target for ENTROPY
- Compliance doesn't equal security

**In Scenarios:**
- Layered defenses
- Strict access controls
- Extensive logging
- Paranoid employees (sometimes helpful, sometimes not)

#### Healthcare
**Security Awareness: Low to Medium**
- Improving but historically weak
- HIPAA compliance focus
- Legacy medical equipment vulnerabilities
- Overworked staff
- Critical patient data

**Challenges:**
- Underfunded security
- Legacy systems can't be patched
- Medical staff prioritizes patient care over security
- Ransomware cripples operations
- Life-safety implications

**In Scenarios:**
- Vulnerable targets
- Ethical implications of attacks
- Desperate staff willing to take shortcuts
- Critical systems can't go offline

#### Small-Medium Business
**Security Awareness: Very Low**
- Limited security budget
- No dedicated security staff
- Outdated software
- Default passwords common
- "It won't happen to us" mentality

**Challenges:**
- Easy targets for ENTROPY
- Supply chain entry points
- Lack of incident response
- Can't afford recovery
- No security training

**In Scenarios:**
- Weak defenses
- Low-hanging fruit
- Sympathetic owners/employees
- Collateral damage concerns

#### Government Agencies
**Security Awareness: Variable**
- Federal: High (usually)
- State/Local: Medium to Low
- Bureaucratic security theater
- Compliance-focused
- Contractor vulnerabilities

**Challenges:**
- Political considerations
- Budget constraints
- Legacy systems
- Insider threats
- Attractive targets

**In Scenarios:**
- Mixed security posture
- Bureaucratic obstacles
- Sensitive data
- Public accountability

---

## Social Attitudes Toward Hackers and Security

### Hacker Archetypes in Public Consciousness

#### "Black Hat" Hackers (Criminals)
**Public View:**
- Thieves and vandals
- Steal money and data
- Malicious and antisocial
- Should be arrested
- Threat to society

**Reality in Break Escape:**
- ENTROPY operatives
- Sophisticated and organized
- Ideologically motivated (often)
- Well-funded and professional
- Not stereotypical basement dwellers

#### "White Hat" Hackers (Security Professionals)
**Public View:**
- Good guys fighting cybercrime
- Ethical hackers
- Help companies find vulnerabilities
- Work for security firms
- Vague understanding of what they do

**Reality in Break Escape:**
- SAFETYNET agents (covert)
- Legitimate security researchers
- Penetration testers
- Bug bounty hunters
- Corporate security teams

#### "Grey Hat" Hackers (Ambiguous)
**Public View:**
- Confusing and concerning
- Sometimes helpful, sometimes not
- Morally questionable
- Legal status unclear
- Romanticized by some

**Reality in Break Escape:**
- Independent researchers
- Hacktivists with varying goals
- Potential ENTROPY recruits
- Potential SAFETYNET sources
- Walking ethical tightrope

### Cultural Representation

#### Movies and TV Shows
**Typical Portrayal:**
- Typing fast equals hacking
- Immediate results
- Visual hacking interfaces
- Genius loners in hoodies
- "I'm in!"

**Effect on Society:**
- Wildly unrealistic expectations
- Misunderstanding of security work
- Fear and fascination
- Useful cover for actual security professionals
- SAFETYNET appreciates the misconceptions

#### News Coverage
**Typical Portrayal:**
- Hackers as mysterious figures
- Cybercrime as faceless threat
- Technical details oversimplified or wrong
- Fear-based reporting
- "Cyber attack" for everything

**Effect on Society:**
- General anxiety about security
- Little understanding of real threats
- Poor security practices continue
- Easy targets for social engineering
- Security products sold on fear

#### Educational System
**Current State:**
- Minimal cyber security education
- Some universities offer programs
- High schools rarely teach security
- Most people learn through experience (breaches)
- Industry certifications important

**Needs:**
- Better security awareness training
- Critical thinking about digital threats
- Understanding of basic security practices
- Recognition of social engineering

---

## How Normal Citizens Experience This World

### Daily Life Intersecting with Cyber Security

#### Personal Devices
**Average Security Practices:**
- Weak passwords (password123)
- Password reuse across sites
- No two-factor authentication
- Clicking suspicious links
- Outdated software
- Public Wi-Fi without VPN

**Consequences:**
- Account compromises
- Identity theft
- Financial fraud
- Privacy violations
- Spam and phishing

**ENTROPY Exploitation:**
- Botnets from compromised devices
- Credential harvesting
- Social engineering targets
- Surveillance capabilities
- Entry points to corporate networks (BYOD)

#### Work Environment
**Typical Employee:**
- Mandatory security training (boring, ignored)
- Post-it note passwords
- Sharing credentials
- Personal device usage
- Clicking email attachments
- Circumventing security for convenience

**Security Theater:**
- Password changes every 90 days (written down)
- Complex password requirements (predictable patterns)
- Mandatory training (checkbox exercise)
- Security policies (rarely enforced)
- Compliance over actual security

**SAFETYNET Perspective:**
- Humans are weakest link
- Social engineering exploits this
- Security awareness crucial
- Insider threats are real
- Need to protect people from themselves

#### Banking and Finance
**Consumer Experience:**
- Online banking standard
- Mobile payment apps
- Credit card fraud alerts
- Identity monitoring services
- Breach notifications

**Security Measures:**
- Two-factor authentication (SMS, apps)
- Fraud detection algorithms
- Account monitoring
- Credit freezes available
- Insurance against fraud

**ENTROPY Targets:**
- Payment card data
- Banking credentials
- Cryptocurrency wallets
- Investment accounts
- Credit reports

#### Healthcare
**Patient Experience:**
- Electronic health records
- Patient portals
- Medical device connectivity
- Privacy notices (unread)
- Data breaches announced later

**Vulnerabilities:**
- Sensitive medical data
- Insurance information
- Prescription records
- Life-impacting information
- Difficult to change (can't get new SSN easily)

#### Social Media
**User Behavior:**
- Oversharing personal information
- Public profiles
- Location tagging
- Connecting with strangers
- Poor privacy settings

**ENTROPY Intelligence Gathering:**
- Personal information for social engineering
- Relationship mapping
- Location tracking
- Behavioral analysis
- Blackmail material

---

## The Underground

### Cyber Security Community

#### Security Conferences
**Examples:** DEF CON, Black Hat, BSides
**Purpose:**
- Knowledge sharing
- Networking
- Tool demonstrations
- Vulnerability disclosures
- Career development

**SAFETYNET Presence:**
- Recruiting ground
- Intelligence gathering
- Staying current on threats
- Undercover operations

**ENTROPY Presence:**
- Also recruiting
- Also intelligence gathering
- Zero-day marketplace
- Networking with potential assets

#### Online Communities
**Forums and Chat:**
- Reddit (r/netsec, r/cybersecurity)
- Discord servers
- IRC channels (still used)
- Specialized forums
- Dark web marketplaces

**Activities:**
- Technical discussions
- Tool sharing
- Vulnerability reports
- Career advice
- Varying legality

**Both Organizations Monitor:**
- Threat intelligence
- Emerging techniques
- Recruiting opportunities
- Public sentiment
- Competitor activities

#### Bug Bounty Community
**What It Is:**
- Ethical hackers finding vulnerabilities
- Companies pay for responsible disclosure
- Platforms: HackerOne, Bugcrowd
- Legitimate income for researchers

**SAFETYNET View:**
- Valuable security improvement
- Potential recruitment pool
- Intelligence on vulnerabilities
- Prefer responsible disclosure

**ENTROPY View:**
- Vulnerabilities to exploit before patches
- Recruitment targets (if bounties too low)
- Intelligence on corporate security
- Sometimes pay more than bounties

### Criminal Underground

#### Dark Web Marketplaces
**What's Sold:**
- Stolen credentials
- Zero-day exploits
- Ransomware as a service
- Stolen data
- Hacking services
- Malware

**ENTROPY Involvement:**
- Major sellers
- Some marketplaces ENTROPY-operated
- Money laundering
- Recruitment
- Resource acquisition

**SAFETYNET Monitoring:**
- Undercover operations
- Intelligence gathering
- Tracking ENTROPY activity
- Identifying victims
- Disruption operations

#### Cryptocurrency
**Role in Cybercrime:**
- Money laundering
- Ransomware payments
- Marketplace transactions
- Untraceable (supposedly)
- ENTROPY funding

**Reality:**
- Blockchain analysis improving
- Not as anonymous as believed
- Law enforcement tracking capabilities
- SAFETYNET monitors major transactions

---

## Public vs. Private Knowledge

### What Companies Know But Don't Say

**Breach Reality:**
- Most breaches not disclosed publicly
- Minimum notification requirements only
- Downplay severity
- Settle quietly
- Hope for no publicity

**Why:**
- Stock price concerns
- Reputation damage
- Customer trust
- Competitive intelligence
- Legal liability

**ENTROPY Exploitation:**
- Unreported breaches stay compromised
- Victim doesn't know to improve security
- Continued access for intelligence
- Leverage for future attacks

### What Government Knows But Won't Say

**Classified Threats:**
- SAFETYNET existence
- ENTROPY organization
- Nation-state cyber warfare
- Critical infrastructure vulnerabilities
- Surveillance capabilities

**Why Classified:**
- National security
- Sources and methods
- Prevent panic
- Diplomatic considerations
- Competitive advantage

**Effect on Society:**
- Public remains vulnerable
- False sense of security (or insecurity)
- Conspiracy theories flourish
- Trust in institutions eroded
- Critical thinking needed

---

## Social Class and Security

### The Digital Divide

#### Wealthy/Corporate
**Advantages:**
- Can afford security tools
- Hire security professionals
- Better device security
- Recovery resources
- Legal recourse

**Still Vulnerable:**
- High-value targets
- Sophisticated attacks
- Insider threats
- False confidence

#### Middle Class
**Reality:**
- Basic security tools
- Limited knowledge
- Targets of opportunity
- Moderate consequences
- Some recovery ability

**Challenges:**
- Balance cost vs. security
- Learning curve
- Time constraints
- Competing priorities

#### Poor/Disadvantaged
**Vulnerabilities:**
- Can't afford security tools
- Limited devices/access
- Low digital literacy
- High-risk behaviors (necessity)
- Difficult recovery

**Consequences:**
- Identity theft impacts harder
- Less recourse
- Predatory targeting
- Cascading problems
- Social support limited

**SAFETYNET Mission:**
Protecting infrastructure protects everyone, but individual security varies by resources.

---

## Geographic Considerations

### Urban vs. Rural

#### Major Cities
**Characteristics:**
- Dense network infrastructure
- Major corporate headquarters
- High-value targets
- Tech-savvy population (generally)
- Better connectivity

**ENTROPY Activity:**
- High concentration
- Major operations
- Front companies prevalent
- Recruitment easier

**SAFETYNET Presence:**
- Major operations centers
- More agents deployed
- Better resources
- Faster response

#### Smaller Towns/Rural
**Characteristics:**
- Limited infrastructure
- Small businesses
- Lower security awareness
- Tighter communities
- Less connectivity

**ENTROPY Activity:**
- Smaller operations
- Supply chain targets
- Critical infrastructure (power, water)
- Less detection risk

**SAFETYNET Presence:**
- Limited coverage
- Remote operations
- Local law enforcement cooperation
- Slower response

### International Scope

**Break Escape Focus:**
Primarily Western/developed nations, but ENTROPY operates globally.

**Cultural Differences:**
- Security practices vary by country
- Legal frameworks differ
- Social attitudes toward privacy differ
- Government surveillance varies
- Corporate culture varies

---

## How Society Is Changing

### Growing Awareness

**Positive Trends:**
- More security education
- Better corporate practices (slowly)
- Improved tool accessibility
- Growing profession
- Public discussion increasing

**Negative Trends:**
- Threats growing faster than defenses
- Sophistication increasing
- More valuable data at risk
- Greater connectivity = more attack surface
- Complacency despite breaches

### The Next Generation

**Digital Natives:**
- Grew up with technology
- Sometimes better security practices
- Sometimes worse (overconfidence)
- More aware of privacy issues (sometimes)
- Future security professionals

**Educational Push:**
- More universities offering cyber security
- Certification programs growing
- Corporate training improving
- Government initiatives
- Still insufficient

### Future Trajectory

**Optimistic View:**
- Better security becomes standard
- Education improves practices
- Tools become more accessible
- Profession grows and professionalizes
- Threats contained

**Pessimistic View:**
- Threats outpace defenses
- Breaches become normalized
- Privacy erodes
- ENTROPY grows stronger
- Society increasingly vulnerable

**Realistic View (Break Escape):**
- Ongoing cat-and-mouse game
- Neither side wins permanently
- Society slowly adapts
- Crisis drives change
- SAFETYNET and ENTROPY continue shadow war

---

## Scenario Design Implications

### Using Society in Stories

#### Innocent Bystanders
**Considerations:**
- Most employees are innocent
- Collateral damage is real
- Ethical implications matter
- Player choices affect lives
- Not everyone deserves suspicion

#### Public Perception
**Story Elements:**
- News coverage of operations (if public)
- Social media reactions
- Corporate statements
- Government responses
- Community impact

#### Class and Access
**Puzzle Design:**
- Wealthy targets have better security
- Poor security in small businesses
- Social engineering varies by class
- Different environments, different challenges

---

## Summary: The World Beneath the Surface

Most people in Break Escape live normal lives, unaware of the shadow war occurring in digital infrastructure all around them. They:

- Experience cyber threats as random nuisances
- Don't understand the sophistication of attacks
- Have poor security practices
- Are targeted by ENTROPY
- Are protected by SAFETYNET (usually without knowing)
- Live in a world where the truth is classified

This creates:
- Tension between public and private knowledge
- Ethical questions about secrecy
- Opportunities for storytelling
- Realistic security scenarios
- Stakes that matter (protecting innocents)

The player exists in both worlds: the mundane surface and the covert underground. This duality is core to Break Escape's identity.

---

**Version:** 1.0
**Last Updated:** November 2025
**Maintained by:** Break Escape Design Team
