Shadowrun Play > Rules and such

[6e] Patrol IC

<< < (2/4) > >>

Michael Chandra:

--- Quote from: ammulder on ---
--- Quote from: Michael Chandra on ---Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.

--- End quote ---

But there’s no disadvantage to a brute force over a back door if the Patrol IC isn’t going to switch to making checks against you every round (or at least much more often than per minute).  So even if it has just as many items to scan, I think for the game to work it has to get aggressive trying to perceive the hacker in particular following an attack action… and also presumably if their overwatch score causes other IC to deploy — because who cares what IC is running around if you’re safe for 20 rounds?

--- End quote ---
Because if the system knows it's under attack, a Spider may drop by and actively dig, plus they may order everyone to leave the Host, which will suddenly make the test intervals way shorter...

ammulder:
OK, I'm going to give the long story, and you can pay attention or not as you please... any suggestions would be welcome.  I've never run the matrix for real before because I've never had a player/team who wanted to play it out before, so this is newer to me than, say, a gunfight.

The overall goal is to locate and infiltrate a small but important corporate facility.  We're on step 1: locate.  The corporation is too big and buff to hack their mainframe to figure it out -- the hacker would be well outmatched.  So instead, the runners will go after a subcontractor that provides services to the facility in question.  After all, if this subcontractor is providing services to the place, they must know where it is...

The team's goal is a data file on the computer with all the past business records for the subcontractor.  It's in their small office, and offline.  I'm thinking host rating 4.

Elsewhere in that office, there's a security computer controlling cameras, drones, and some physical security measures, a wireless doodad that the one actual guard on premises carries to control these various security measures, and etc.  It's a host behind a matrix-facing host for the business.  I'm thinking host rating 3 for these two.


* The hacker could go through the matrix facing host to get to the security host, but this is intended to be "the hard way" and I don't mind if it looks "not out of the question" but ends up defeating the hacker.  If the layered hosts themself aren't tough enough, I would consider having a spider on call who shows up in the security host just in time to cause real trouble.
* The hacker could go directly into the security host from on-site with a physical link.  I would like him to be able to control the cameras to erase evidence of their intrusion, or at a minimum to hide what they were looking for (to avoid alerting the ultimate target facility).  I don't especially want him to straight up disable all the physical security measures or take control of the drones (because then the rest of the team would be redundant), so in thinking this through, maybe I need them not to be controlled by this host, or I need that functionality to be hidden from him outside of exceptional circumstances (I let him find and disable things just to avoid a TPK or something, definitely not plan A). 
* The team could just ignore the online hosts, destroy the cameras or sneak past with Improved Invisibility/Physical Mask or something, overcome the physical security, etc.  Probably also not the easy way, but I'll have to see what they come up with.
I assume at some point they'll get the hacker to the offline host.  I will want to apply some time pressure here, so he can't take all day and retry at his leisure and etc.  I'm thinking the target file is encrypted and data bombed but is still visible on the host; the purpose of the host is to give access to these files, even if you need a password to access them.  So I think he'll need to get into the host, to perform a matrix search (not hash check) to find the right one, either detect and disarm the bomb or suffer the data bomb damage, decrypt (crack) the file, and edit the file (to search for the pertinent info within it or make a copy for himself to inspect later).  So 6-ish rounds, more if I want to extend the search a bit to find the right file (the subcontractor has done a lot of a projects and the team doesn't necessarily know what name they used for this one).  I believe all those are User-level (not Admin) actions.

But at the same time I want to have some pressure in the physical world -- either a wave of drones or incoming police/security responding to a gunfire alarm or something.  Both because I don't want the rest of the team to be twiddling their thumbs, and again because I'd rather have the hacker feel under the gun and use brute force and blow some edge rather than taking time to carefully sleaze around and etc.

So, if all that seems reasonable, I can't have Patrol IC in the offline host checking once per minute.  That would be one check for the entire 5-10 round offline-host-intrusion.  Rules or not, it has to check at least every couple rounds, and ideally find him just before he is decrypting the file so he has some IC to contend with there at the end as well.  Since a Rating 4 host at 8 dice of Matrix Perception will likely be outmatched by a few dice vs Willpower+Sleaze (depending on how the persona is configured), I think it will need to check every round or every other round.

I need to figure out exactly which IC to deploy for when he's found.  I'd like the major risk to be that he gets knocked out or ejected from the host before getting the information from the file, not risk either death or that he's identified and tracked such that opposition forces show up at his door.  Maybe the available options for the Rating 4 host can be Patrol, Crash, Acid, Blaster?  If he brute forces and it deploys these one per round, Crash/Acid/Blaster might all be there and waiting by the time the Patrol finds him.

Which leads to another question: while hacking, he can be sending updates to the team via Send Message minor actions, such that if they suddenly stop coming (e.g. he is unconscious and link-locked from Blaster), they can decide to physically pull the plug?  I assume that would end up causing him 3P damage from dumpshock, unresisted if he's already unconscious.  Better than leaving him behind, though.

Stainless Steel Devil Rat:

--- Quote from: ammulder on ---OK, I'm going to give the long story, and you can pay attention or not as you please... any suggestions would be welcome.  I've never run the matrix for real before because I've never had a player/team who wanted to play it out before, so this is newer to me than, say, a gunfight.
--- End quote ---

Well, hopefully you'll get some quality tips from the forum here :)


--- Quote ---The overall goal is to locate and infiltrate a small but important corporate facility.  We're on step 1: locate.  The corporation is too big and buff to hack their mainframe to figure it out -- the hacker would be well outmatched.  So instead, the runners will go after a subcontractor that provides services to the facility in question.  After all, if this subcontractor is providing services to the place, they must know where it is...
--- End quote ---

My eyebrows go up a bit here.  Usually Mr J would be able to provide you with physical location data.  It's one thing to hold back information for security/deniability reasons, but if you're going to hire someone to do a job, presumably you want to at least give them the bare information they'll need to do it? Maybe this is one of those times where Mr J knows what he wants, but nothing about how it might be done?  Hence the need to hire professionals, I guess...


--- Quote ---The team's goal is a data file on the computer with all the past business records for the subcontractor.  It's in their small office, and offline.  I'm thinking host rating 4.

Elsewhere in that office, there's a security computer controlling cameras, drones, and some physical security measures, a wireless doodad that the one actual guard on premises carries to control these various security measures, and etc.  It's a host behind a matrix-facing host for the business.  I'm thinking host rating 3 for these two.


* The hacker could go through the matrix facing host to get to the security host, but this is intended to be "the hard way" and I don't mind if it looks "not out of the question" but ends up defeating the hacker.  If the layered hosts themself aren't tough enough, I would consider having a spider on call who shows up in the security host just in time to cause real trouble.
* The hacker could go directly into the security host from on-site with a physical link.  I would like him to be able to control the cameras to erase evidence of their intrusion, or at a minimum to hide what they were looking for (to avoid alerting the ultimate target facility).  I don't especially want him to straight up disable all the physical security measures or take control of the drones (because then the rest of the team would be redundant), so in thinking this through, maybe I need them not to be controlled by this host, or I need that functionality to be hidden from him outside of exceptional circumstances (I let him find and disable things just to avoid a TPK or something, definitely not plan A). 
* The team could just ignore the online hosts, destroy the cameras or sneak past with Improved Invisibility/Physical Mask or something, overcome the physical security, etc.  Probably also not the easy way, but I'll have to see what they come up with.
I assume at some point they'll get the hacker to the offline host.  I will want to apply some time pressure here, so he can't take all day and retry at his leisure and etc.  I'm thinking the target file is encrypted and data bombed but is still visible on the host; the purpose of the host is to give access to these files, even if you need a password to access them.  So I think he'll need to get into the host, to perform a matrix search (not hash check) to find the right one, either detect and disarm the bomb or suffer the data bomb damage, decrypt (crack) the file, and edit the file (to search for the pertinent info within it or make a copy for himself to inspect later).  So 6-ish rounds, more if I want to extend the search a bit to find the right file (the subcontractor has done a lot of a projects and the team doesn't necessarily know what name they used for this one).  I believe all those are User-level (not Admin) actions.
--- End quote ---

That all seems reasonable.  It's an awful lot of setup on what amounts to legwork, however.  If you want to represent digging around on the matrix for the site of the secret research lab, you COULD just call it an extended Matrix Search, giving a threshold appropriate to how long it should take to dig that info up.  While the corp won't publicly publish the address of their secret facility, presumably outsiders have some connection with it.  Subcontractors as you theorized, for example might bring in cleaning crews and office supplies.  County assessors' offices.  Construction records.  Whatever.  All of that and more can be searched by a savvy hacker.

It boils down to how much table time do you want to devote to this legwork.

Also note that this legwork could feasibly be accomplished by non-matrix means as well.  People might ask contacts who could feasibly know the answer, or know someone who would.  Murphy's Law of GameMastering: the more effort you put into planning for the players' course of action, the less likely they are to take that course of action!


--- Quote ---But at the same time I want to have some pressure in the physical world -- either a wave of drones or incoming police/security responding to a gunfire alarm or something.  Both because I don't want the rest of the team to be twiddling their thumbs, and again because I'd rather have the hacker feel under the gun and use brute force and blow some edge rather than taking time to carefully sleaze around and etc.
--- End quote ---

Whether this is hacking the secret facility itself, or some very involved pre-run legwork, keeping the action going across multiple SR worlds at once is the ultimate SR GM challenge.  All I can say is practice makes better.  You'll never be perfect, but the more practice you have in telling one player to "hold that thought, I'm gonna go to another player now" the more seamless it'll feel in play... and let's face it.  Leaving the sammie mid-scene while facing off with some machine gun drones to jump to the decker dogfighting with some IC, only to then switch to the astrally projecting mage hiding from the nasty spirit ghosting around... all are great cliffhangers.  That's how you keep players from yawning and falling into the oldest SR trap around: "decker's up!  Let's go get a pizza."


--- Quote ---So, if all that seems reasonable, I can't have Patrol IC in the offline host checking once per minute.  That would be one check for the entire 5-10 round offline-host-intrusion.  Rules or not, it has to check at least every couple rounds, and ideally find him just before he is decrypting the file so he has some IC to contend with there at the end as well.  Since a Rating 4 host at 8 dice of Matrix Perception will likely be outmatched by a few dice vs Willpower+Sleaze (depending on how the persona is configured), I think it will need to check every round or every other round.
--- End quote ---

Note that Patrol IC isn't your ticking clock mechanism to keep hackers from going unchecked... that's Overwatch Score. Particularly so if the hacker had to Brute Force their way in... OS just keeps cranking up and up inevitably.  Also note that a Spider can order a host to go on alert manually... you've got the tool in your pocket to just say "ok, it's on now" at any time and essentially for any reason.  Just use the old "a security guard thought he saw something suspicious and radio'd it in, and now the spider hit the big red button" excuse.


--- Quote ---I need to figure out exactly which IC to deploy for when he's found.  I'd like the major risk to be that he gets knocked out or ejected from the host before getting the information from the file, not risk either death or that he's identified and tracked such that opposition forces show up at his door.  Maybe the available options for the Rating 4 host can be Patrol, Crash, Acid, Blaster?  If he brute forces and it deploys these one per round, Crash/Acid/Blaster might all be there and waiting by the time the Patrol finds him.
--- End quote ---

Typically yes you'd decide all that ahead of time.  But, hey.  GMing on the fly is often required, and if you have to make up a host on the fly you'd have to make up what IC that host launches on the fly too, neh?  Who's gonna know the difference if you defer making up a launch schedule for a host you DID pre-write?


--- Quote ---Which leads to another question: while hacking, he can be sending updates to the team via Send Message minor actions, such that if they suddenly stop coming (e.g. he is unconscious and link-locked from Blaster), they can decide to physically pull the plug?  I assume that would end up causing him 3P damage from dumpshock, unresisted if he's already unconscious.  Better than leaving him behind, though.

--- End quote ---

Well, the hacker can just share biomonitor data with the team, it'd be much easier.  Or even just share a feed that each teammate can watch in an AR window to see what's going on with the hacker in VR.

Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

But, yes, I hear you, players are prone to saying "frag what people do in-universe.  I WOULDN'T DO THAT BECAUSE REAL WORLD THIS AND THAT AND YADA YADA YADA."  If you don't want to play the "doesn't matter if YOU would or wouldn't... because your character would!" card, and allow the player to try to game being link locked by using physical connections that can be physically unplugged, then yeah, go ahead and give them unresisted dump shock. 

ammulder:
Thanks for sharing your thoughts!  Just picking out a few bits here to reply to:


--- Quote from: Stainless Steel Devil Rat on ---My eyebrows go up a bit here.  Usually Mr J would be able to provide you with physical location data.  It's one thing to hold back information for security/deniability reasons, but if you're going to hire someone to do a job, presumably you want to at least give them the bare information they'll need to do it? Maybe this is one of those times where Mr J knows what he wants, but nothing about how it might be done?  Hence the need to hire professionals, I guess...
...
It's an awful lot of setup on what amounts to legwork, however.  If you want to represent digging around on the matrix for the site of the secret research lab, you COULD just call it an extended Matrix Search, giving a threshold appropriate to how long it should take to dig that info up.  While the corp won't publicly publish the address of their secret facility, presumably outsiders have some connection with it.  Subcontractors as you theorized, for example might bring in cleaning crews and office supplies.  County assessors' offices.  Construction records.  Whatever.  All of that and more can be searched by a savvy hacker.

--- End quote ---

Two reasons:

* It's the first run, and I want to start with a softer target to let everyone figure out their characters and let me figure out if I can run a game with a decker :)  But if I reduced the whole thing to a Matrix Search we wouldn't accomplish that.
* It's the first run, and nobody could afford everything they wanted during character creation, so hey, I can throw a bit of cash and  karma at them for reaching a milestone.  Mr. J is going to offer a first payment for locating the target facility within 24 hours, and a second payment for retrieving the MacGuffin from the facility within the following 24 hours.  He figures he'll give this cheap team a swing and if they can do it, great, and if not, he'll take any progress they made and go to the more expensive/experienced teams.
* All right, if I'm going to be honest, the file they can find has full details on the plumbing and the on-call plumber.  My kids are playing, so naturally I expect them to use the information gleaned from this legwork mission to "control device" on the only devices in the facility they'll have remote access info for.  It may take a bit to narrate the scenes of exploding troll-sized toilets, but once the researchers call for emergency repairs, the team can follow the plumbers to the "secret" facility.  :)

--- Quote from: Stainless Steel Devil Rat on ---Note that Patrol IC isn't your ticking clock mechanism to keep hackers from going unchecked... that's Overwatch Score. Particularly so if the hacker had to Brute Force their way in... OS just keeps cranking up and up inevitably.  Also note that a Spider can order a host to go on alert manually... you've got the tool in your pocket to just say "ok, it's on now" at any time and essentially for any reason.  Just use the old "a security guard thought he saw something suspicious and radio'd it in, and now the spider hit the big red button" excuse.

--- End quote ---

Well, I can set the Host on alert... but the Brute Force entry would do that anyway... the point as I understand it is that no other IC can do anything until a Patrol IC actually locates the intruder.

And I don't have experience with Overwatch Score yet, but can't you reasonably expect to perform a 6-action hack under the budget of 40 OS before the hammer falls?  40 seemed low if you're leaving a trail through multiple hosts, but high if you're attacking a single host from a local connection.


--- Quote from: Stainless Steel Devil Rat on ---Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

--- End quote ---

Well... doesn't a Cyberdeck still have a power switch?  Or a battery compartment?  Even if you can't disrupt the network connection, I wouldn't expect someone to be unable to physically power it off.  (Especially if getting stuck in the Matrix involuntarily is a known risk.)  The decker has a Cyberjack, but an external Cyberdeck, and I had been thinking that the connection went Matrix -> Cyberdeck -> Cyberjack such that powering down the deck would sever the connection.  (The Matrix FAQ also suggests the deck should take damage before a Cyberjack, which I took to mean it's between the attacker and the Cyberjack.)

Stainless Steel Devil Rat:

--- Quote from: ammulder on ---.. the point as I understand it is that no other IC can do anything until a Patrol IC actually locates the intruder...
--- End quote ---

Patrol IC or a Spider, but essentially yes.  First thing that always has to happen for matrix stuff is the target must first be spotted.  Convergence is the only exception here that I can think of.


--- Quote ---And I don't have experience with Overwatch Score yet, but can't you reasonably expect to perform a 6-action hack under the budget of 40 OS before the hammer falls?  40 seemed low if you're leaving a trail through multiple hosts, but high if you're attacking a single host from a local connection.
--- End quote ---

Indeed, you can execute a quick hack before you hit 40 OS.  In fact, that's basically how the game is designed to work.  You have enough time to do something quick... or... if you act all subtle like, you can do some sustained action long enough to cover the team for some minutes or so.  But you don't want players setting up anything that can persist permanently via hacking.  You'll have the decker ordering some free Delta grade Wired Reflexes 3 for home delivery on behalf of the Street Samurai (and etc) once you open THAT door.

Frankly if this is a scenario for players and GM both to get a feel for playing the Matrix game, you WANT this hack to be a puffball pushover.  Once you put a Spider on duty, up the host ratings a bit, use nested architectures, and best of all start messing with the decker's die rolls by using edge against him to reroll hits... hacking is gonna be quite hard for the players :)


--- Quote ---
--- Quote from: Stainless Steel Devil Rat on ---Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

--- End quote ---

Well... doesn't a Cyberdeck still have a power switch?  Or a battery compartment?  Even if you can't disrupt the network connection, I wouldn't expect someone to be unable to physically power it off.  (Especially if getting stuck in the Matrix involuntarily is a known risk.)  The decker has a Cyberjack, but an external Cyberdeck, and I had been thinking that the connection went Matrix -> Cyberdeck -> Cyberjack such that powering down the deck would sever the connection.  (The Matrix FAQ also suggests the deck should take damage before a Cyberjack, which I took to mean it's between the attacker and the Cyberjack.)

--- End quote ---

Again, if you want "OMG the decker's in trouble, jack him out" to be a thing at your table, just go ahead and allow it then.  Just remember that dumpshock IS a stainless steel slitch.

Navigation

[0] Message Index

[#] Next page

[*] Previous page