[Zamzoph]

I just read through the entire Matrix section of SR5, along with the relevant part of the Gamemaster Advice section.  I like what I see thus far, and I greatly appreciate the efforts the book goes through to create a sensible visualization for what the Matrix looks like.  There are still several things I find to be unclear, however, and a common thread among them is that they involve Matrix Perception, what sees what in the Matrix.  My puzzlement is separated into different parts below.  They make references to three in-book examples: the Bank Heist and Renraku Sarariman in the Matrix section, and the Drone Battle in the Rigger section.

---

Seeing Files

In both the Bank Heist and the Renraku Sarariman, the hacker is apparently able to see files on a commlink without first having to get permission or illegally apply a mark.  The Renraku Sarariman reasons that the "target" (whether that's the file or the commlink I'm not sure) wasn't running silent while the Bank Heist states that the waitress "hasn’t protected her commlink’s privacy."  In addition, the text for the Matrix Perception action explains that one piece of information that can be obtained from a successful test is "any files [the target] may be carrying," although this point isn't shared in the red Matrix Perception box on p.235.

I spent hours thinking about how to interpret this, it seemed rather strange for everyone's commlink files to be listed for anyone to see.  They ordinarily can't even protect themselves by running silent because, as stated in GM Advice, "law enforcement services require people to run their personal device in normal mode so their identity can be verified."  That makes things rather awkward when I'm out in public with a few files in my commlink that happen to be labelled as "gratuitous porn."  My confusion was cleared up, however, when I ctrl-f'd for "files" and found a very important bit in the initial fluff part of the Matrix section:

Most of what you keep on your commlink are files, this includes music, your SIN (fake or otherwise), licenses (also fake or otherwise), maps, email messages, your contact book, AROs, and so on. These files are visible to people who can see your commlink in the Matrix, so most people keep all of their files in a protected folder.

Before, I was thinking that the best method for privacy was to have the files themselves run silent, but after this revelation, I no longer think files can even run silent in the first place.  As it says, the best way to hide your files from view is to put them in a "private" folder (which is a file itself) and then apply protection on that folder, requiring illegal action to peek inside.

With all this in mind, here's a  procedure I've come up with for taking a file from someone's commlink:

• Make a Matrix Perception Test to spot the target commlink and see its top-level files.  >100m distance from the target commlink or the target commlink running silent will require at least two net hits.
• Make a Brute Force Test or a Hack on the Fly Test to apply a mark on the target file.
• Make a Matrix Perception Test on the file to detect cracking-required protection or a Data Bomb.  If you previously made a very successful Hack on the Fly Test, you might be able to get that information already.
• Make a Disarm Data Bomb Test if a Data Bomb is present.
• Make a Crack File Test if protection is present.  Note that this is an Attack action, so a success will notify the file that it is under attack, and it will likely report to the commlink's owner, in turn.
• If you target file is a folder, make a Matrix Perception Test to see its file contents and select a new target file, returning to Step 2.
• Make an Edit File Test to create a copy of the file with you as the owner.
• Make an Edit File Test to delete the original file, if desired.

What do you think of this assessment?  Does it match the rules?

---

Running Silent

This puzzlement mainly focuses on a single sentence concerning running silent that really throws me for a loop:

Note that if there are multiple silent running icons in the vicinity, you have to pick randomly which one you’re going to look at through the Opposed Test.

I find it reasonable to assume that when it comes to security personnel, they're likely to have all of their wireless devices running silent to defend against intruders, especially since everything except their commlinks are not penalized for doing so.  So lets say a party of shadowrunners is duking it out with a bunch of them.  The hacker suspects that the guards are using smartguns and would like to brick them.  He first needs to find their hiding icons on the Matrix, so he makes a Matrix Perception Test to do a 100m sweep and confirms that there are indeed icons running silent within the vicinity.  The only problem is that there's a lot of them!  That's what happens when you're infiltrating a secret corporate complex.  Now because of the rule quoted above, the hacker has to pick one of the running-silent icons at random and hope that it's a smartgun used by one of the guards.  If there's a hundred icons running silent and three smartguns, it's very unlikely for the hacker to investigate the right target.

I imagine the way it should work is that the hacker ought to be able to specifically target an running-silent icon and try to reveal it with a Matrix Perception Test if he has an idea of what it is.  In my example above, after making a general scan for running-silent presence, he should be able to guess that a specific one of the icons associates with a smartgun his party can see in meatspace, then proceed to target it with a Matrix Perception Test.

The one in-book example we have for detecting running-silent icons via Matrix Perception is the Drone Battle:

Spike performs a Matrix Perception actions, knowing that Driver’s RCC and his rotodrone are running silent within 100 meters. He makes a Computer + Intuition [Data Processing] roll, while Driver and his drone make their Logic + Sleaze rolls. Spike gets at least one net it on each icon, locating both devices. He can’t find the Optic-X or the LDSD-41 because they’re too far away.

Unfortunately, this doesn't provide the clarification I hoped to get because from I can tell, the RCC and rotodrones are the only two running-silent icons within the 100m vicinity, so all Spike had to do was two successive opposed Matrix Perception Tests to reveal both of them.

How do you think the rules for detecting running-silent icons work?

---

Sharing Spotting Information

On p.247, a point is made to say that a host and it's IC instantly share spotting information, but I could use a little clarification on what exactly that means.  Obviously, when an IC or host spots a hidden (i.e., silent-running) persona, the entire collective will then instantly spot it, as well.  Now lets say that the persona uses the Hide action (which only applies to one target icon) on one of the ICs or the host.  Does this cause all of the ICs and the host to then all lose sight of the persona?  Or does the action only work on that target and then becomes negated when instant spotting data is shared again by the others?  The Bank Heist example appears to suggest the former.  The hacker uses Hide on the bank host, causing the host and all of its ICs to lose sight on him.  If that's so, then it seems to me that a host and its ICs effectively count as a single entity when it comes to things they're spotting (along with bearing marks).

A more important question, however, is how sharing spotting information works among personas.  Say Persona A spots a hidden icon.  Can it share that information to Persona B so that Persona B can see that icon, as well?  Does this work instantly?  Or does Persona B have to do a Matrix Perception Test to find the icon for itself?  Assuming both Persona A and B can see the icon, what happens if the icon uses a Hide action on one of them?  Does shared information negate the action from doing anything?  The answer to these questions becomes especially crucial when it comes to a host (and its ICs) sharing spotting information with a security spider and vice versa.

---

Patrol ICs and Security Spiders on Patrol

When it comes to a hacker infiltrating a host, there are likely to be a couple of watchful icons to be wary of: the Patrol IC and the security spider.  Both of them will be using the Matrix Perception action to seek out intruding personas, but a point of concern is just how often they should be doing such actions to achieve their end.  Technically, a Patrol IC (or spider) can make a Matrix Perception Test every combat phase, meaning that it can likely do over 30 tests in a single minute.  It's not like it has anything else to do, anyway.  Obviously, this would be ridiculous for a GM to play out.  A balance needs to be found between letting the hacker PC do what he wants to do and having the Patrol IC and security spider pose a threat by allowing them to do what they're suppose to do.

Furthermore, when a Patrol IC (or spider) actually sees a hacker, how exactly should it determine if the hacker is an intruder, especially if the host expects to have customers/guests/clients?  Should it make a Matrix Perception Test on the hacker to look for illegal programs or an illegal last action?

Let us consider for a moment the other ways for a hacker to get caught besides through the solo efforts of a Patrol IC or spider:

• Host convergence
• Failing on a Sleeze action
• Succeeding on an Attack action

The last point is particularly puzzling because it doesn't instantly reveal the hacker and his intrusion, but prompts the Patrol IC (or spider) to look for him.    In this case, how often should the Patrol IC do Matrix Perception Tests against the hacker?  How long should it make tests against the hacker until it gives up and goes back to its normal routine?  Overall, is solo Patrol IC/spider investigation worth simulating besides one or two Matrix Perception Tests, or is it enough just to have these other ways for the hacker to get caught?

[Razhul]

<3 This thread!

Agree with that's how seeing and copying files works.

Running silent and spotting also has "If you know at least one feature of an icon running silent, you can spot the icon (Running Silent, below)." P.235, red box. That means that you can "filter" a little. A guard investigating sudden silent icons would use the random method as indicated in the text. If you know you're looking for a deck (that's a feature) or you can physically see the gun pointed at you or the cybergoggles on the goon's face, you can single those out from the group of silent icons and roll the Computer+Int test on that immediately.

Am unsure about sharing spotting information. Could be a Free action to send that piece of info but that would make it extremely difficult to hide from them again (as it seems you can only hide from 1 target at a time).

Concerning Patrol IC, I think I can help:
It depends on the host settings. If no silent icons are allowed in there, then the Patrol IC would probably start hammering the hidden icon with Computer + Int tests until it can properly spot it and run a Matrix Perception on it to check programs running as well as last Matrix action performed. It would share this with the host.

If there is no hidden icon in the host, it will just "pulse" the Matrix Perception action with probably the first hit always being consumed by "are there silent icons?", followed by additional hits being used to get information about other icons in the host. That will give the hacker quite some time / lower probability of being the one being scanned.

[Zamzoph]

Glad you like it.  Took me all day to put together.  Just wish I'd get more replies.

The point about spotting an icon running silent in the Matrix Perception red box does seem to infer exactly what I was suggesting.  Thanks for pointing it out.

Thinking more about how to set up a host, I suppose that it would be standard procedure to not allow silent icons for any host that cares at all about security.  Therefore, the Patrol IC would only ever have one anomaly popping up on its vicinity scans: an intruding hacker trying to be sneaky.  It'd only be natural, then, for the Patrol IC to immediately try and spot the one silent icon and, provided it doesn't find something incriminating right off the bat, keep an eye on it from then on.  Now if the hacker comes and tries to blend in with the crowd, perhaps the Patrol IC would just see it as another icon in its long queue to continuously scan, especially if it doesn't take note of new entrants.  The hacker might even be able to use the Change Icon action and Wrapper program to disguise itself as just another customer or employee in a persona-crowded host, or a file in a huge database host.  Sure, the hacker can't resist being Matrix Perceived on, but it might take a while for the Patrol IC to get around to him, or the Patrol IC might even not scrutinize the hacker well enough and move on completely oblivious.  In this case, the one point where a hacker might actually want to run silent is if he intends to make Attack actions and will require protection from being spotted as he succeeds and sets off alarms.

[Razhul]

Spot on what I think.

[inca1980]

W.r.t Patrolling IC, I have been handling it the same way I handle meat space patrolling guards.  Technically there are no rules for knowing when a guard is present or not, it's totally up to the GM.  So what I do is either do a random die roll to see if the hacker/runner got unlucky and a guard/Patrol IC is present and then do a perception roll for said guard/IC.  The other method I'll use is just resort to my discretion and make rolls when they seem appropriate or place them to build tension.  I also like to make my rolls visible because that gives players more of a feeling that they barely got away with something and builds more tension. 

Ok, so now for questions. 
1. What is the sleaze rating of devices that don't have sleaze?  Do they just roll Logic?  It says on pg 234 that devices only have two matrix attributes Data Processing and Firewall.  The confusing part is in the drone battle where they say that the rigger rolls Logic + Sleaze, but as far as I can tell, RCC's and drones only have DP and Firewall.   In the section on Stealth Tags in the gear section on pg 440, they say that Stealth tags have a Sleaze attribute, which implies that the other tags don't have a Sleaze rating.

2. Do drones suffer -2 to all their actions if they're running silent?  What about RCC's?

[Xenon]

Seeing Files

As you figured out. Everyone can protect their own files. This action is a regular Dataprocess action so you anyone can do it on a regular commlink. The "norm" is probably that files are protected and only files you like to share or display for others are not protected.

Make a Matrix Perception Test to spot the target commlink and see its top-level files.  >100m distance from the target commlink or the target commlink running silent will require at least two net hits.

You don't need to successfully roll a perception test to spot devices (such as commlinks) within 100m that are not hidden. You detect them automatically. You just have to look at it.

Make a Brute Force Test or a Hack on the Fly Test to apply a mark on the target file.

You don't need to have a mark on the file in order to inspect it. (so 3 comes before 2). Also note that a successful brute force will always inform the owner that his file is under attack and a failed hack on the fly will not only inform him that he is under attack, he will also be given a mark on the hacker's your persona (the hacker will be very obvious on his augmented reality).

Make a Matrix Perception Test on the file to detect cracking-required protection or a Data Bomb.  If you previously made a very successful Hack on the Fly Test, you might be able to get that information already.

Yes.

Make a Disarm Data Bomb Test if a Data Bomb is present.

Yes.
Note that this is not an illegal action. This action will not generate OS.

Make a Crack File Test if protection is present.  Note that this is an Attack action, so a success will notify the file that it is under attack, and it will likely report to the commlink's owner, in turn.

Yes.
and the rest. Yes


I am not sure about files being layered into different folders structures where you can have protected files within protected files within protected files....

I think there are probably just an area with "shared files" and one area with "protected files". Think sharepoint or facebook. Or even your forum profile here on this site. You have information that is public for everyone and you have information that is private (but not in multiple "layers"). If you drop the file in the "protected files" area you will run an edit file action to protect it (maybe even without doing anything, it might just happens in the background sort of). One single success is enough to make it impossible to for others to read the file (unless they have a cyberdeck or is a technomancer). And anyone can do it. If you don't have computer skill it will default to Logic -1 dice.

[Xenon]

Sharing Spotting Information

I like to think of it like this;

The host have a set of different skills and abilities. She can mark icons, she can kill icons, she can track icons etc. All the skills and abilities are represented by IC. To spot an icon the host must run Patrol IC (and all hosts run Patrol IC 24/7 from the looks of it) as Patrol IC is the eyes of the host. If there is no Patrol IC present, then the host have no way to do matrix perception tests. IC are extensions of the host. It is the Host that does all the things to you, through her IC. All her extensions are aware of the same information. They are one.

So when you hide you hide from the Patrol IC (the eyes of the Host). The Patrol IC being an extension of the Host, just like the Killer IC and the Trace IC. Once the host lose track of you (because she can no longer spot you with her Patrol IC) then she can no longer use her ability to kill your icon (Killer IC) and if she does not have a mark on your icon she can't use her ability to track you (with Trace IC).

You can kill her extensions. Her IC. That will temporary make her blind, unable to spot. Or disarmed, unable to attack. But she will just load a fresh copy and continue the next combat turn.

A security spider is normally a rigger (and they are very common).

A security Decker is not at all as common as security spiders but they sometimes work together with security spiders to protect them from matrix attacks.

A security decker will not automatically spot an icon that the Host spot, and vise verse. But the host will inform the security decker that it is under attack (the same second it is under attack, without delay - no surprise tests).

[Xenon]

Ok, so now for questions. 
1. What is the sleaze rating of devices that don't have sleaze? 

Null

Do they just roll Logic? 

Yes

2. Do drones suffer -2 to all their actions if they're running silent?  What about RCC's?

You only take -2 dice on your matrix actions.
Drones normally dont take matrix actions

RCC will take -2 when they do matrix actions (control device for example)

[Xenon]

physical devices are also represented in the matrix. physically close devices to your cyberdeck or commlink are brighter and and you can see them more clearly.

I like to think that it work a bit like this:

if you are in augmented reality and see a person 10m infront of you, you will also see his corresponding wireless devices in the matrix 10m infront of you.

If the person enter a room and close his door you will no longer see him, but you will still see his corresponding wireless devices in the matrix.


an awakened character that use astral perception will see a person 10m infront of her, she will also see his corresponding aura in the astral plane 10m infront of her.

If the person enter a room and close his door she will no longer see him, but she will still see his corresponding aura in the astral plane.

[NightRain]

an awakened character that use astral perception will see a person 10m infront of her, she will also see his corresponding aura in the astral plane 10m infront of her.

If the person enter a room and close his door she will no longer see him, but she will still see his corresponding aura in the astral plane.

The walls and door of the room are opaque in astral space.  Heck, even windows are opaque.

[Xenon]

The walls and door of the room are opaque in astral space.  Heck, even windows are opaque.

I must have missed it. Can you point me to the page where i can read about that?

I know Mana barriers are solid, hazily opaque walls that impose a visual penalty when you try to look through them in astral space (so while they do stop or slow magic and projecting magicians even they are not solid black and you can still sense through them).

but mundane walls...?

I thought mundane walls without recent strong emotions tied to them were just sensed as blurred, intangible shadows and that you would have no problem sensing a living astral aura standing in the middle of the room on the other side of the wall.

[NightRain]

I must have missed it. Can you point me to the page where i can read about that?

They're not explicitly labelled as transparent, rather they're described as "featureless grey shadows of their physical form". There is nothing to suggest that they're transparent. 

Additionally, in 4th ed, they were explicitly stated as being opaque, and without anything to suggest it's changed from that, it's a pretty safe assumption that it still works that way.

I thought mundane walls without recent strong emotions tied to them were just sensed as blurred, intangible shadows and that you would have no problem sensing a living astral aura standing in the middle of the room on the other side of the wall.

They are intangible.  You can move through them.  But if you want to see through a wall in astral space, you need to stick your astral head through it...

[Xenon]

Not sure I follow. A featureless gray shadow of a mundane wall would not let me see a bright and colored emotional aura of an angry or passionate living person behind it...?

Mana barriers are explicit stated as solid hazily opaque walls; but you can sense auras through them and you only get a visual penalty equal to the barrier's force. A mana wall with force 3 would just impose a visual modifier equal that of moderate rain or dim light...

[NightRain]

Not sure I follow. A featureless gray shadow of a mundane wall would not let me see a bright and colored emotional aura of an angry or passionate living person behind it...?

Well, it explicitly didn't allow for you to see someone in previous editions.  If the laws of astral space had changed from one edition to the next, it's a safe assumption they'd have made it explicit.

As I said, it's not spelled out explicitly, but that's true of previous editions as well.  It was clarified in Street Magic, rather than the main rules.

There's nothing iron clad here, but which is more likely?  They've said nothing about a change because it hasn't changed, or they've said nothing about a change because they forgot to mention it?

[Xenon]

Anyone got some input on how to resolve running and patrol IC activities. That are the two topics in the OP i wonder most about myself.