# TEMPLATE: Suspicious Encrypted Communications

**Fragment ID:** EVIDENCE_AGENT_ID_001
**Gameplay Function:** Agent Identification Evidence (Digital)
**Evidence Type:** Intercepted encrypted communication
**Rarity:** Common
**Substitution Required:** [SUBJECT_NAME], [ORGANIZATION], [POSITION]

---

## Evidence Summary

**Item:** Encrypted email communication from corporate account
**Subject:** [SUBJECT_NAME], [POSITION] at [ORGANIZATION]
**Evidence Quality:** MEDIUM (encrypted but pattern suspicious)
**Admissibility:** Medium (circumstantial, requires corroboration)

---

## Intercepted Communication

```
From: [SUBJECT_NAME]@[ORGANIZATION].com
To: secure-contact-7749@protonmail.com
Date: [CURRENT_DATE - 3 days], 23:47
Subject: Re: Consultation project update
Encryption: PGP encrypted (partial decryption successful)

[Decrypted portions:]

...understand the concerns about timeline. The access you
requested will be available during the maintenance window
as discussed.

[ENCRYPTED BLOCK - Unable to decrypt]

...payment arrangement confirmed. Standard terms as before.
The documentation you need will be transferred via the
agreed method.

[ENCRYPTED BLOCK - Unable to decrypt]

...regarding the security audit team arriving Thursday -
I can ensure they have the credentials and building access
without additional verification. Same procedure as last time.

Looking forward to our continued partnership.

Best regards,
[SUBJECT_NAME]
```

---

## Analysis Flags

**SUSPICIOUS INDICATORS:**

🚩 **Encrypted Communication from Work Email**
- Corporate email policy prohibits personal encryption
- PGP usage violates IT security policy
- Suggests deliberate obfuscation of content
- Professional email should not require encryption

🚩 **ProtonMail Recipient (Anonymous Service)**
- Recipient uses privacy-focused email service
- Address format suggests throwaway account
- No legitimate business contact uses this pattern
- Common in ENTROPY operational communications

🚩 **After-Hours Timing (23:47)**
- Sent late at night from personal device
- Suggests secretive communication
- Outside normal business hours
- Pattern consistent with covert activity

🚩 **"Payment Arrangement Confirmed"**
- Reference to financial transaction
- Not related to normal job duties
- "Standard terms as before" suggests ongoing payments
- Typical ENTROPY asset compensation language

🚩 **Security Audit Team Access**
- Offering to bypass verification procedures
- "Same procedure as last time" suggests repeat behavior
- Willing to violate security protocols
- Classic insider threat action

🚩 **"Documentation Transfer via Agreed Method"**
- Euphemism for data exfiltration
- "Agreed method" suggests dead drop or covert channel
- Not standard business file sharing
- Matches ENTROPY operational security patterns

---

## Investigation Recommendations

**IMMEDIATE ACTIONS:**
```
□ Monitor [SUBJECT_NAME]'s email for additional encrypted messages
□ Check employment records for financial stress indicators
□ Review building access logs for unusual patterns
□ Identify "security audit team" referenced
□ Trace ProtonMail recipient if possible
□ Review past "maintenance windows" for suspicious activity
□ Check for data exfiltration during previous access grants
```

**SURVEILLANCE PRIORITIES:**
```
□ Financial transactions (unusual deposits)
□ Meetings with unknown individuals
□ USB drive usage or file transfers
□ After-hours office access
□ Encrypted communication patterns
□ Dead drop locations (document transfers)
```

**CORROBORATING EVIDENCE NEEDED:**
```
□ Financial records showing unexplained income
□ Access logs showing policy violations
□ Witness testimony of suspicious behavior
□ Technical evidence of data exfiltration
□ Additional encrypted communications
□ Connection to known ENTROPY operatives
```

---

## Gameplay Integration

**This Fragment Enables:**

**Investigation Actions:**
- Flag [SUBJECT_NAME] as suspected ENTROPY asset
- Unlock surveillance mission on subject
- Enable deeper background investigation
- Trigger financial forensics check

**Player Choices:**

**APPROACH A: Immediate Confrontation**
- Confront subject with evidence
- Risk: May destroy evidence or alert ENTROPY
- Benefit: Quick resolution if subject cooperates
- Success depends on subject's psychology

**APPROACH B: Continued Surveillance**
- Monitor for additional evidence
- Build stronger case before action
- Risk: Subject may complete operation
- Benefit: Identify ENTROPY contacts and methods

**APPROACH C: Controlled Exposure**
- Feed false information through subject
- Use as unwitting double agent
- Risk: Complex operation, may fail
- Benefit: Intelligence on ENTROPY cell operations

**APPROACH D: Immediate Isolation**
- Suspend subject's access immediately
- Prevent ongoing operation
- Risk: Legal challenges if insufficient evidence
- Benefit: Stop potential breach quickly

**Success Metrics:**
- Evidence + Financial records = 75% confidence
- Evidence + Access logs = 65% confidence
- Evidence + Surveillance + Financial = 90% confidence
- Evidence alone = 40% confidence (insufficient for action)

---

## Template Substitution Guide

**When implementing this fragment, replace:**

```
[SUBJECT_NAME] → Actual NPC name (e.g., "Jennifer Park", "David Chen")
[ORGANIZATION] → Company/org name (e.g., "TechCorp", "Vanguard Financial")
[POSITION] → Job title (e.g., "Network Administrator", "Security Analyst")
[CURRENT_DATE - 3 days] → Game timeline appropriate date
```

**Maintain consistency:**
- Use same substituted name throughout fragment
- Email address format: firstname.lastname@company.com
- Position should match NPC's actual in-game role
- Timeline should fit scenario chronology

**Example with substitutions:**
```
From: jennifer.park@techcorp.com
To: secure-contact-7749@protonmail.com
Date: November 12, 2025, 23:47
Subject: Re: Consultation project update

...payment arrangement confirmed...

Best regards,
Jennifer Park
Network Security Analyst
TechCorp Industries
```

---

## Scenario-Specific Customization

**For Corporate Infiltration Scenarios:**
- Emphasize "security audit team" access
- Reference "maintenance windows" for data access
- Focus on credential provision

**For Data Exfiltration Scenarios:**
- Emphasize "documentation transfer"
- Reference specific data types in encrypted blocks
- Focus on file access patterns

**For Infrastructure Scenarios:**
- Reference SCADA/control system access
- Mention facility access credentials
- Focus on physical security bypass

**For Research Scenarios:**
- Reference proprietary research data
- Mention lab access or sample transfers
- Focus on intellectual property theft

---

## Related Fragments

**Supporting Evidence Types:**
- EVIDENCE_AGENT_ID_002: Financial records (shows payments)
- EVIDENCE_AGENT_ID_003: Access log analysis (proves violations)
- EVIDENCE_AGENT_ID_004: Surveillance photos (documents meetings)
- EVIDENCE_AGENT_ID_005: USB usage logs (data exfiltration proof)
- EVIDENCE_AGENT_ID_006: Recruitment approach (how ENTROPY contacted them)

**Collect Multiple for Higher Certainty:**
- 1 evidence type: 40% confidence (suspicion only)
- 2 evidence types: 65% confidence (strong suspicion)
- 3 evidence types: 85% confidence (probable cause)
- 4+ evidence types: 95% confidence (near certainty)

---

**CLASSIFICATION:** EVIDENCE - AGENT IDENTIFICATION
**TEMPLATE TYPE:** Reusable with substitution
**PRIORITY:** MEDIUM (requires corroboration)
**DISTRIBUTION:** Investigation teams, scenario designers
**USAGE:** Insert into scenarios with suspected insider threats
