[nogusielkt]

• Make a Crack File Test if protection is present.  Note that this is an Attack action, so a success will notify the file that it is under attack, and it will likely report to the commlink's owner, in turn.

Crack File is either an attack action or a sleaze action, your choice, as each has it's own advantages and disadvantages.  This allows you to actually get in and out without anyone knowing you touched the file (so long as you don't fail).  Note during the bank run that the decker gets marked when he fails to crack the file, thus must have been using it as sleaze, then he switches to attack as he is injured from feedback next time.

[Xenon]

I personally think it does make a lot of sense that you should be able to do it as a sleaze action but while it is listed as both attack and sleaze in one of the tables and the BK example use it as both as a sleaze and attack action, Aaron stated that you can only do it as an attack action, that the table and the example is wrong and that it will be changed in a future errata.

[nogusielkt]

I personally think it does make a lot of sense that you should be able to do it as a sleaze action but while it is listed as both attack and sleaze in one of the tables and the BK example use it as both as a sleaze and attack action, Aaron stated that you can only do it as an attack action, that the table and the example is wrong and that it will be changed in a future errata.

 

A follow up, I know you're detected when you use an attack action, but it never states they know what file you attacked, right?

[Psikerlord]

I just read through the entire Matrix section of SR5, along with the relevant part of the Gamemaster Advice section.  I like what I see thus far, and I greatly appreciate the efforts the book goes through to create a sensible visualization for what the Matrix looks like.  There are still several things I find to be unclear, however, and a common thread among them is that they involve Matrix Perception, what sees what in the Matrix.  My puzzlement is separated into different parts below.  They make references to three in-book examples: the Bank Heist and Renraku Sarariman in the Matrix section, and the Drone Battle in the Rigger section.

---

Seeing Files

In both the Bank Heist and the Renraku Sarariman, the hacker is apparently able to see files on a commlink without first having to get permission or illegally apply a mark.  The Renraku Sarariman reasons that the "target" (whether that's the file or the commlink I'm not sure) wasn't running silent while the Bank Heist states that the waitress "hasn’t protected her commlink’s privacy."  In addition, the text for the Matrix Perception action explains that one piece of information that can be obtained from a successful test is "any files [the target] may be carrying," although this point isn't shared in the red Matrix Perception box on p.235.

I spent hours thinking about how to interpret this, it seemed rather strange for everyone's commlink files to be listed for anyone to see.  They ordinarily can't even protect themselves by running silent because, as stated in GM Advice, "law enforcement services require people to run their personal device in normal mode so their identity can be verified."  That makes things rather awkward when I'm out in public with a few files in my commlink that happen to be labelled as "gratuitous porn."  My confusion was cleared up, however, when I ctrl-f'd for "files" and found a very important bit in the initial fluff part of the Matrix section:

Most of what you keep on your commlink are files, this includes music, your SIN (fake or otherwise), licenses (also fake or otherwise), maps, email messages, your contact book, AROs, and so on. These files are visible to people who can see your commlink in the Matrix, so most people keep all of their files in a protected folder.

Before, I was thinking that the best method for privacy was to have the files themselves run silent, but after this revelation, I no longer think files can even run silent in the first place.  As it says, the best way to hide your files from view is to put them in a "private" folder (which is a file itself) and then apply protection on that folder, requiring illegal action to peek inside.

With all this in mind, here's a  procedure I've come up with for taking a file from someone's commlink:

• Make a Matrix Perception Test to spot the target commlink and see its top-level files.  >100m distance from the target commlink or the target commlink running silent will require at least two net hits.
• Make a Brute Force Test or a Hack on the Fly Test to apply a mark on the target file.
• Make a Matrix Perception Test on the file to detect cracking-required protection or a Data Bomb.  If you previously made a very successful Hack on the Fly Test, you might be able to get that information already.
• Make a Disarm Data Bomb Test if a Data Bomb is present.
• Make a Crack File Test if protection is present.  Note that this is an Attack action, so a success will notify the file that it is under attack, and it will likely report to the commlink's owner, in turn.
• If you target file is a folder, make a Matrix Perception Test to see its file contents and select a new target file, returning to Step 2.
• Make an Edit File Test to create a copy of the file with you as the owner.
• Make an Edit File Test to delete the original file, if desired.

What do you think of this assessment?  Does it match the rules?

---

Running Silent

This puzzlement mainly focuses on a single sentence concerning running silent that really throws me for a loop:

Note that if there are multiple silent running icons in the vicinity, you have to pick randomly which one you’re going to look at through the Opposed Test.

I find it reasonable to assume that when it comes to security personnel, they're likely to have all of their wireless devices running silent to defend against intruders, especially since everything except their commlinks are not penalized for doing so.  So lets say a party of shadowrunners is duking it out with a bunch of them.  The hacker suspects that the guards are using smartguns and would like to brick them.  He first needs to find their hiding icons on the Matrix, so he makes a Matrix Perception Test to do a 100m sweep and confirms that there are indeed icons running silent within the vicinity.  The only problem is that there's a lot of them!  That's what happens when you're infiltrating a secret corporate complex.  Now because of the rule quoted above, the hacker has to pick one of the running-silent icons at random and hope that it's a smartgun used by one of the guards.  If there's a hundred icons running silent and three smartguns, it's very unlikely for the hacker to investigate the right target.

I imagine the way it should work is that the hacker ought to be able to specifically target an running-silent icon and try to reveal it with a Matrix Perception Test if he has an idea of what it is.  In my example above, after making a general scan for running-silent presence, he should be able to guess that a specific one of the icons associates with a smartgun his party can see in meatspace, then proceed to target it with a Matrix Perception Test.

The one in-book example we have for detecting running-silent icons via Matrix Perception is the Drone Battle:

Spike performs a Matrix Perception actions, knowing that Driver’s RCC and his rotodrone are running silent within 100 meters. He makes a Computer + Intuition [Data Processing] roll, while Driver and his drone make their Logic + Sleaze rolls. Spike gets at least one net it on each icon, locating both devices. He can’t find the Optic-X or the LDSD-41 because they’re too far away.

Unfortunately, this doesn't provide the clarification I hoped to get because from I can tell, the RCC and rotodrones are the only two running-silent icons within the 100m vicinity, so all Spike had to do was two successive opposed Matrix Perception Tests to reveal both of them.

How do you think the rules for detecting running-silent icons work?

---

Sharing Spotting Information

On p.247, a point is made to say that a host and it's IC instantly share spotting information, but I could use a little clarification on what exactly that means.  Obviously, when an IC or host spots a hidden (i.e., silent-running) persona, the entire collective will then instantly spot it, as well.  Now lets say that the persona uses the Hide action (which only applies to one target icon) on one of the ICs or the host.  Does this cause all of the ICs and the host to then all lose sight of the persona?  Or does the action only work on that target and then becomes negated when instant spotting data is shared again by the others?  The Bank Heist example appears to suggest the former.  The hacker uses Hide on the bank host, causing the host and all of its ICs to lose sight on him.  If that's so, then it seems to me that a host and its ICs effectively count as a single entity when it comes to things they're spotting (along with bearing marks).

A more important question, however, is how sharing spotting information works among personas.  Say Persona A spots a hidden icon.  Can it share that information to Persona B so that Persona B can see that icon, as well?  Does this work instantly?  Or does Persona B have to do a Matrix Perception Test to find the icon for itself?  Assuming both Persona A and B can see the icon, what happens if the icon uses a Hide action on one of them?  Does shared information negate the action from doing anything?  The answer to these questions becomes especially crucial when it comes to a host (and its ICs) sharing spotting information with a security spider and vice versa.

---

Patrol ICs and Security Spiders on Patrol

When it comes to a hacker infiltrating a host, there are likely to be a couple of watchful icons to be wary of: the Patrol IC and the security spider.  Both of them will be using the Matrix Perception action to seek out intruding personas, but a point of concern is just how often they should be doing such actions to achieve their end.  Technically, a Patrol IC (or spider) can make a Matrix Perception Test every combat phase, meaning that it can likely do over 30 tests in a single minute.  It's not like it has anything else to do, anyway.  Obviously, this would be ridiculous for a GM to play out.  A balance needs to be found between letting the hacker PC do what he wants to do and having the Patrol IC and security spider pose a threat by allowing them to do what they're suppose to do.

Furthermore, when a Patrol IC (or spider) actually sees a hacker, how exactly should it determine if the hacker is an intruder, especially if the host expects to have customers/guests/clients?  Should it make a Matrix Perception Test on the hacker to look for illegal programs or an illegal last action?

Let us consider for a moment the other ways for a hacker to get caught besides through the solo efforts of a Patrol IC or spider:

• Host convergence
• Failing on a Sleeze action
• Succeeding on an Attack action

The last point is particularly puzzling because it doesn't instantly reveal the hacker and his intrusion, but prompts the Patrol IC (or spider) to look for him.    In this case, how often should the Patrol IC do Matrix Perception Tests against the hacker?  How long should it make tests against the hacker until it gives up and goes back to its normal routine?  Overall, is solo Patrol IC/spider investigation worth simulating besides one or two Matrix Perception Tests, or is it enough just to have these other ways for the hacker to get caught?

I think this is mostly right but have 3 concerns, concerns which has bugged me from day 1 abuot the matrix 5e.

The first is the randomly analysing icons that are running silent - basically this breaks the game with enough hidden icons in any one area, and easily doable by anyone with a handful of "decoy" commlinks all running silent.

Secondly, the putting files in folders, and protecting the folders. If you can do this, couldnt you have 10 folders, all with protection, which will also break hacking... because it will take so long to get to the real info that your OS will be at 40 before then. That line you referenced about people keeping their files in a protected folder is very interesting. It is a shame there is not clear example of how that is supposed to work, they really need one - errata!

Thirdly, even the mechanic is that you have a "shared" and "not shared/protected" folders only, it bugs me that your commlink's firewall doesnt help you. At all. Any hacker can see your two folders, but has to crack the protected one to get more. In order to crack the folder your commlink's firewall is completely irrelevant. From memory the defender's dice pool is simply protection x2.  That's just... dumb. Personally i greatly prefer a bit of 4e here - along the lines of you have shared and private folders on your commlink. Anyone can view the shared folder (like a standing invite to mark or something). To access the private folder however the person has to hack your commlink first. Firewall is therefore involved. Once they have a mark on your commlink, then the hacker can do the usual things marks let them do, attempt to crack protected files, and so on. I really hope there is an errata to files and the matrix, or some optional rules in the eventual matrix book that make this process more intuitive/sensible (even if it might take slightly longer, one extra dice roll?).

[Xenon]

...it never states they know what file you attacked, right?

If you successfully attack the protection then you destroyed the protection. If the file is located on a cyberdeck then anyone can read it (the file is "public"). They still can't alter or copy it without a mark on the file, but they can still read it.

If the file is located on a host then anyone with access to the host (have at least 1 mark) can read it. (In the BK example you don't seem to need a mark on the file located in a Host, just a mark on the Host, to use Edit File).

If the owner or the host is not told directly which file that is under attack, it is pretty sure he will find out - eventually.


(having a sleaze version could maybe open up a small gap in the protection for a short period of time. Enough to do your alterations or copy the file... and then let the let protection slid back in place. we are probably talking house ruling now though)

[Aaron]

Crack File is either an attack action or a sleaze action, your choice, as each has it's own advantages and disadvantages.

Forgive my asking, but are you certain about that? I'm looking at p. 238 and it doesn't seem to allow for Sleaze cracking.

(I just typed "Sleaze cracking." Huh huh. Huh huh.)

[Aaron]

I personally think it does make a lot of sense that you should be able to do it as a sleaze action but while it is listed as both attack and sleaze in one of the tables and the BK example use it as both as a sleaze and attack action, Aaron stated that you can only do it as an attack action, that the table and the example is wrong and that it will be changed in a future errata.

I can't find the example that demonstrates file cracking as a sleaze action. Would you mind helping me find it?

Thanks.

[Xenon]

table on p.244 list crack file as a sleaze action (as well as an attack action). The action description on p.238 only list the test with an Attack attribute.


Example is on p.224

He reaches for the lock, firing up his cracking utilities, and something goes wrong. The host has undoubtedly already marked him and will be launching IC any second.

Failed Sleaze action automatically give the host a mark on the Decker's persona and the host automatically spot him (so this was a failed sleaze action, not an attack action). Host will launch at the end of the combat turn. BK was not attacked by Probe IC (which is the only IC that can put a mark on him).

Killer IC load. BK Erase Mark. BK Hide. Host launch Track IC. Patrol IC does matrix perception to find BK but fails. BK Data Spike Patrol IC. Host is now blind until she can load new Patrol IC.

Working quickly, he tries to smash the file’s tiny lock. Again it proves too tough. The backlash from the host’s firewall slams up his arm and into his deck, which crackles slightly in real life. This is one tough file protection.

Failed Attack action automatically hit him with unresisted matrix damage (so this was a failed attack action, not a sleaze action). This is the second time he attacked the lock "...again it proves too tough..." - but the first time he didn't break the lock and he didn't take unresisted matrix damage (but the host did get a mark on him... which it would against a failed sleaze action).

Host load a new Patrol IC.

BK tries one more time, slamming into the lock with all his virtual strength. This time, the lock gives way and vanishes. The Patrol IC starts searching for the intruder with inhuman resolve.

Successful attack break the protection, but since it is an attack action the host is alerted. Patrol IC use perception to locate the intruder.

[Razhul]

Yeah, that's been confusing me too.

Those two places (p.244 and the BK example of him clearly failing a Sleaze action the first time around) suggest that you can Crack File as a Sleaze action. The actual action on p.238 is Attack only, though.

If we could choose (similar to Brute Force vs. Hack on the Fly), then it would make "get in and out undetected" Decking possible again which I find in the spirit of Shadowrun.

[nogusielkt]

If you're only looking to copy, I believe you could wait until someone else accesses it and snoop the traffic, which should also (although I'm not sure it ever states), allow you to avoid protection and databombs.

[Xenon]

If we could choose (similar to Brute Force vs. Hack on the Fly), then it would make "get in and out undetected" Decking possible again which I find in the spirit of Shadowrun.

Agreed.

Just like brute force is forcing the system to give you a mark and hack on the fly is more about tricking the system to give you one we should have that option here as well.

Where the "attack" option would smash and kill the protection for everyone, while the "sleaze" option would leave the protection intact after you are done (and maybe if you had reasons to access the file for multiple combat turns, maybe to edit several seconds of video, then you would have to sleaze the same protection more than once).

Disarm Data Bombs is a Firewall action so that is not such a big issue I guess, but it would still be cool if you could trick the file into giving you a temporary mark without using force, then bypass the Data Bomb without disarming it, bypassing the file protection without killing it, edit the file and get out without leaving a trace.

That would be so cool

[Aaron]

table on p.244 list crack file as a sleaze action (as well as an attack action). The action description on p.238 only list the test with an Attack attribute.

That's one for the errata, I think. Good catch.

The example, I think, is from a time when there were two actions to open files, one Attack and one Sleaze. The Sleaze one was removed early in the process, and I suspect nobody checked the example because it was more like a story; it didn't have any mechanics in it. If you think it's misleading, might I suggest offering errata at the same link above?

[Psikerlord]

but why would you want crack file ti be attack only, and therefore always alert the target to yr crack attempt. there is no way to stealthily take a protected file, then?

[Unahim]

Yeah, that's kind of a bummer.

[Xenon]

but why would you want crack file ti be attack only, and therefore always alert the target to yr crack attempt. there is no way to stealthily take a protected file, then?

probably to protect files on commlinks (that can't launch IC or attack you back if you only use sleaze actions). it would be harmless to sleaze protected files located on commlinks. Worst case he would notice that he is under attack, but lacking attack rating make it impossible to act on the mark he is given. There would be no danger.

as an attack action his commlink have a chance to fight back, dealing unresisted matrix damage. there is a danger involved. it also play well with the whole idea of the new matrix protocol. decking in SR5 is more about speed. get in... get out before the drek hit the fan. once you decide to crack the file protection you might only have seconds before the owner go off grid, rebooting his device. dropping your marks.