Report 3.2: Describing the Serious Game Design HAPKIDO Work Package 3: Governance

The continued development of quantum computers pose a risk to public key infrastructure systems (PKIs). PKIs is one the most ubiquitous cybersecurity systems, and they are employed by public sector actors like governments, as well as private sector actors like banks. Within the scope of this report, there is a specific focus on the Netherlands and the impending there quantum transition there. This report describes the design of a serious game that can facilitate actors in the transition to quantum-safe (QS) PKIs. It does so, by firstly exploring the contexts of the transition from a governance and policy perspective, highlighting the differences in approach to quantum-safety as well as quantum innovation, between academics, practitioners, and policy makers. Secondly, the report will cover the methodology used to uncover the critical elements for the design, such as design requirements and design principles. Moreover, the report also examines the differences between one unsuccessful and one successful prototype of the game. Thirdly, the report touches upon the theories underlying the game, and lastly the report provides a walk-through of the game in its current paper form. The reports concludes that the game design provides a theoretical contribution to collective action theory through extending the theory into the socio-technical sphere and providing empiric data for the mapping of ontological and epistemological perspectives within a cybersecurity perspective. Furthermore, the report concludes that the success elements for a serious game that can facilitate in the transition to QS PKIs are the seven design requirements found in the development of the game, which are 1) knowledge-sharing, 2) meeting space, 3) interaction, 4) increased comprehension, 5) neutral ground, 6) awareness, and 7) next steps. Of these requirements, the game design presented in the report failed at achieving 7) next steps, and it is concluded it is due to a failure in the immersive experience of the game, which can be contributed to the game being to macro level in its approach and needing to improve its narrative structure. To improve these points, the report suggests bringing the game down to a meso level and utilizing more specific cases in the game.