NEWS

Talk to me about IC

  • 16 Replies
  • 554 Views
« on: (20:49:58/04-06-18) »
So I'd like to think out loud and get some opinions from other perspectives than my own.  Generally: How does IC know what Personae to attack after it's been deployed by the Host?

So from a meta standpoint, "obviously" the IC attacks the Player's hacker because the hacker is the protagonist and the IC is the cyber antagonist and opposing protagonists is what antagonists do.  GM omniscience is enough to direct the IC "NPC" to attack the PC Hacker from the meta perspective.

But in universe, it seems there are some holes in the lore and/or rules.  Something besides GM omniscience has to guide the IC to attack the hacker.  Patrol IC is described as being the first line of cyber defenses.. it performs matrix perception actions to find trouble.  But that's the rub... you can't even get into a host without having a mark on the host, which makes you for security purposes a legitimate user.  And that's a comment from the Patrol IC's own description!  So obviously there's no reason the Patrol IC to be looking at the hacker's persona.  It must be looking at marks on the host, which it can theoretically determine somehow as fraudulent.   There's really no guidance "fluff" or a hard mechanic for determining when the Patrol IC "sees" the Hacker's shenanigans.  It pretty much seems to boil down to the GM's whim.  "Yeah, this is bogging down.  You've been in the host long enough; alarm goes off because the Patrol IC finally sussed you out.  Here comes more IC..."

Now if the hacker fails a sleaze action and a Host mark gets put on his persona, it seems fairly obvious that the system should go on alert and start deploying further IC.  A failed attack action seems it should probably work the same way, although the host and its IC don't have the benefit of having a mark on the hacker's persona.

So let's say a failed attack action is the case.  Or a hacker having successfully erased the Host's mark after a failed sleaze action.  Without a Host's mark on the persona, how does the IC know who to attack in an in-universe sense?  Again the hacker appears to the Host to be a legit user, as his mark is still on the host.  It seems clear that the IC is willing to attack "legitimate" users, as it's mentioned in the Lore more than once.  Can a Host "remember" or designate a persona as a known/suspected problem icon, even if there is no mark upon it, and that's the in-universe basis for GM omniscience guiding the IC to target the PC hacker?

Marcus

  • *
  • Ace Runner
  • ****
  • Posts: 1600
  • Success always demands a greater effort.
« Reply #1 on: (22:53:02/04-06-18) »
So as soon as your character takes any illegal action on the matrix they get an Overwatch score. This is mostly likely to first occur when they jump to a corp grid they don't really have access too. As soon they get OS, the clock is ticking, unless there is a TM involved sooner or later they are going to be hunted down and booted out (Convergence). How quickly that occurs is based up on a list of things and I sure we all understand how that works.

But host are different when you enter a host, while your in it, your OS doesn't go away and it keeps climbing, probably accelerating as you do bad things in the host. But it won't converge on you in the host, (See Core 247, Host Convergence), but if your in host when you reach convergence, it does give the host 3 marks on you and begin launching IC, which clearly knows who to attack based upon your OS, and having 3 marks on you will make a lot easier to find you.

Gotta keep in mind the DemiGods will take you out as soon as you step outside that host as well. So you better just log ASAP.

Philosophically it works fine, IC is Intrusion Countermeasure. If the host starts getting monkeyed with then its programmed to start spawning IC.  You did something to start it, and as it connected to GOD your account is flagged as up to no good. It still may not be able to find you cause your so damn sneaky, but it's gonna try.


Lorebane24

  • *
  • Omae
  • ***
  • Posts: 268
« Reply #2 on: (22:56:15/04-06-18) »
This is a little off topic, but I feel like, while a potent deterent, the way demiGODs and GODs work is a little boring?  Does anyone else think it would be more fun to actually stat out corporate demiGODs, at least, and let PCs throw down with them when they're feeling gutsy?
The power of the Tri-Horse!

« Reply #3 on: (23:01:20/04-06-18) »
This is a little off topic, but I feel like, while a potent deterent, the way demiGODs and GODs work is a little boring?  Does anyone else think it would be more fun to actually stat out corporate demiGODs, at least, and let PCs throw down with them when they're feeling gutsy?

They are statted in Data Trails.  Their Drones are in Rigger 5, too.

Marcus

  • *
  • Ace Runner
  • ****
  • Posts: 1600
  • Success always demands a greater effort.
« Reply #4 on: (23:46:54/04-06-18) »
Given that the current vogue method of hacking is the sleaze stat swap lurker, we really haven't seen a lot in the way decking brawlers that we used to. The Dynasty Warriors method of hacking just isn't loved these days, a real part of that is of course is the deck price limitations.
My last decker build in the creation section, was a cyber combat build, and even I would admit, in terms of actual decking it's still not as effective as lurker builds.

More fun to play in my opinion, but not as potentially effective.
« Last Edit: (23:49:23/04-06-18) by Marcus »

« Reply #5 on: (23:49:38/04-06-18) »
So barring a failed attack/sleaze action triggering the Host to deploy IC... what sorts of thing would trigger the Patrol IC to sound the alarm?  That's it's reason to be there in the first place after all..

Lorebane24

  • *
  • Omae
  • ***
  • Posts: 268
« Reply #6 on: (00:03:50/04-07-18) »
Honestly, I found the rules  a little vague as well.  I generally just treat blending in in the Matrix like I do blending in in meatspace, and any time they go somewhere they're not supposed to be or do something they're not supposed to do, I do a random check to see if any patrol IC was in that area at the time (with it becoming more likely as they do more shit, effectively creating a trail to follow), and if it was, it starts searching for the perpetrator with matrix perception and shit.  I know it's not RAW, but it's worked well in my games so far.
The power of the Tri-Horse!

« Reply #7 on: (00:13:15/04-07-18) »
You know I'm thinking you're on the right track.  I suspect the way Patrol IC is supposed to work is as a Ticking Clock device.  Its matrix perception checks only serve as theater... the GM hints that time is running out as the Patrol IC is "getting closer" to detecting the hacker, and sounds the alarm whenever the GM decides that time's up/it's time to Push The Envelope.

firebug

  • *
  • Errata Coordinator
  • Prime Runner
  • *****
  • Posts: 2788
  • Scraping the bottom of the Resonance Barrel
    • Moth's Mad Path
« Reply #8 on: (05:56:35/04-07-18) »
So I'd like to think out loud and get some opinions from other perspectives than my own.  Generally: How does IC know what Personae to attack after it's been deployed by the Host?

So from a meta standpoint, "obviously" the IC attacks the Player's hacker because the hacker is the protagonist and the IC is the cyber antagonist and opposing protagonists is what antagonists do.  GM omniscience is enough to direct the IC "NPC" to attack the PC Hacker from the meta perspective.

But in universe, it seems there are some holes in the lore and/or rules.  Something besides GM omniscience has to guide the IC to attack the hacker.  Patrol IC is described as being the first line of cyber defenses.. it performs matrix perception actions to find trouble.  But that's the rub... you can't even get into a host without having a mark on the host, which makes you for security purposes a legitimate user.  And that's a comment from the Patrol IC's own description!  So obviously there's no reason the Patrol IC to be looking at the hacker's persona.  It must be looking at marks on the host, which it can theoretically determine somehow as fraudulent.   There's really no guidance "fluff" or a hard mechanic for determining when the Patrol IC "sees" the Hacker's shenanigans.  It pretty much seems to boil down to the GM's whim.  "Yeah, this is bogging down.  You've been in the host long enough; alarm goes off because the Patrol IC finally sussed you out.  Here comes more IC..."

You make a very reasonable point, that a Patrol IC has no reason to simply go scan you immediately, as the point of a mark is that it makes you seem like an authentic user.  Luckily, I can answer this part for you and provide sources.

First, a Patrol IC goes around scanning basically everything.  On devices it would probably check for "the marks on an icon, but not their owners" as the number of marks on a device should not change without the Patrol IC being informed (such as scheduled maintenance for a specialist to come in and mark the device to alter its software).  On persona, it would presumably check "the last Matrix action an icon performed, and when".  This could potentially alert the IC to a hacker by finding out they have taken an illegal action (anything with Attack or Sleaze as the limit).  Both of these are options on the chart on page 235 of the core rulebook.  A Patrol IC would also presumably go for "if you are in a host, whether there is an icon running silent" as well.

As for how often they would check the player, in Data Trails on page 86 there is a chart for Patrol IC.  As per that chart, the number of combat turns inbetween the player getting scanned is rolled, modified by how high the host's rating is, ranging from Once Every Combat Turn (Rating 1-2) to once every 3d6 Combat Turns (Rating 11-12).  If the PC is silent, then I'd make these actions the "looking for silent icons" roll that the IC should be doing every so often, and then if the IC has spotted the hacker's icon, then when the time has passed, I would have it make "last matrix action" rolls.

As well, if there's a Security Spider on site, they are able to direct the IC, telling them what actions to take and on whom, meaning a hacker might trick the patrol IC but seem suspicious to the spider, and after a fight breaks out, the hacker needs to fool the spider first.

Quote
Now if the hacker fails a sleaze action and a Host mark gets put on his persona, it seems fairly obvious that the system should go on alert and start deploying further IC.  A failed attack action seems it should probably work the same way, although the host and its IC don't have the benefit of having a mark on the hacker's persona.

So let's say a failed attack action is the case.  Or a hacker having successfully erased the Host's mark after a failed sleaze action.  Without a Host's mark on the persona, how does the IC know who to attack in an in-universe sense?  Again the hacker appears to the Host to be a legit user, as his mark is still on the host.  It seems clear that the IC is willing to attack "legitimate" users, as it's mentioned in the Lore more than once.  Can a Host "remember" or designate a persona as a known/suspected problem icon, even if there is no mark upon it, and that's the in-universe basis for GM omniscience guiding the IC to target the PC hacker?

"Erase Mark" in the case of failing the Sleaze action wouldn't reset the alert; the matrix history of why you were being targeted is still active (the host remembers that it marked you, which is probably logged as the provoking action somewhere) and even though the mark is gone, the alert and attack have not been disabled by anyone, and you haven't even left.

If you left, reset, the host alert was disabled, and then you hacked your way in, the IC would probably not "remember" you.  Your temporary access would probably be seen as a random new account or something similar, or if you were granted a free level 1 mark, the public nature probably means the host does not save that data.

As for a failed attack action, they are not alerted.  Failed attack actions simply cause you damage.  On a successful attack action, they know they are being attacked--  I might cut down the time between the IC rolling against the player to represent a shift of priorities in the Patrol IC.  As well, any Spiders on site will be out for blood, and a security decker might be alerted.

So with this knowledge, hopefully you can see the logic and context the IC work in and see how it's not down to just GM omniscience.
I'm Madpath Moth on reddit (and other sites).
Firebug's VU93 Profile
Jeeze.  It would almost sound stupid until you realize we're talking about an immortal elf clown sword fighting a dragon ghost in a mall.

« Reply #9 on: (11:24:21/04-07-18) »
Thanks firebug!  As usual, I've learned something from your insight.  I had glossed over the actions on the matrix perception table, and indeed the answer was right there the whole time!  Indeed I also caught for the first time that the list of things you can learn from a matrix perception hit (pg 235) is explicitly descriptive rather than proscriptive.  Very wide open, indeed.

Ok so I don't have any thematic problems with how IC knows to home in on a hacker's icon when the host has no marks on that hacker.  You've also convinced me to turn on my ear on the topic of fail vs succeed on Attack actions.

Patrol IC is still a bit iffy for me though, at least when it comes to NOT running silent inside the host.  I had been viewing the rules dynamic of once you've got your mark on the host, you're legit in the eyes of IC and there's no reason to take the -2 dice for running silent unless there's spiders present.  So in light of being able to see what your last action was on a matrix perception test, maybe there is indeed reason to be running silent inside a host.  At least you get a chance to oppose the perception roll that way, in exchange for being "inherently suspicious".  While you can potentially avoid being perceived, once the Patrol IC has a single hit on its own host (which you can't control) it'll learn that someone is running silent, and that's bad for you as the gig is halfway up.  I like this dynamic as it's basically the matrix equivalent of sneaking around a corp facility wearing a chameleon suit: yeah you're harder to see, but you eventually WILL be seen and man when that happens there's no explaining your intentions away as harmless.

If you're not running silent, I suppose if the GM wants to preserve some agency for the player rather than just arbitrarily telling the player "Patrol IC sounds the alarm" after X turns, the GM could/should tell the player that the Patrol IC's attention is coming over your way and you're about to be scanned again at the end of this round/beginning of next round.  That gives the player the opportunity to perform an innocuous matrix action inside the host so as to remain looking innocuous, or to decide whether pressures in the physical world are more important than preserving the quiet inside the matrix world and to keep hacking despite the IC's impending scan.

I'm pretty happy with my synthesis of how Patrol IC works.  There's pros and cons to running silent or not silent as each strategy has advantages over the other.

firebug

  • *
  • Errata Coordinator
  • Prime Runner
  • *****
  • Posts: 2788
  • Scraping the bottom of the Resonance Barrel
    • Moth's Mad Path
« Reply #10 on: (06:34:04/04-08-18) »
If you're not running silent, I suppose if the GM wants to preserve some agency for the player rather than just arbitrarily telling the player "Patrol IC sounds the alarm" after X turns, the GM could/should tell the player that the Patrol IC's attention is coming over your way and you're about to be scanned again at the end of this round/beginning of next round.  That gives the player the opportunity to perform an innocuous matrix action inside the host so as to remain looking innocuous, or to decide whether pressures in the physical world are more important than preserving the quiet inside the matrix world and to keep hacking despite the IC's impending scan.

I would probably let the PC use the chart in Data Trails to have an idea of how long they have in-game.  As IC (and anyone on a host) don't have to specifically walk around and can basically just pop over to whatever they want to see depending on the host.  So basically, I wouldn't give the PC the information of "the IC is starting to get closer" as much as I'd say "you know it's 1d6+2 combat turns until it checks again, so try to play around that with the knowledge that everything after three combat turns is getting lucky and taking a risk".  Basically, if the character knows the host's rating, he can have an idea of how long the interval between checks could be.  That's how I'd GM it.

My opinion on the "silent or not-silent" strategy is that if you know you have multiple combat turns between being scanned, going non-silent is easy.  Just do a basic Matrix Perception test before you get scanned and take your time with the handful of actions you can safely take.  However, this only applies while doing Sleaze actions.

The moment you do an Attack action, you need to be Silent, as if you're not, the Spider and IC may begin to immediately analyze you to find out if you did it.  At that point, running silent is basically your timer before shit hits the fan.  It's the yellow streetlight of hacking, if you catch my meaning.
« Last Edit: (06:39:12/04-08-18) by firebug »
I'm Madpath Moth on reddit (and other sites).
Firebug's VU93 Profile
Jeeze.  It would almost sound stupid until you realize we're talking about an immortal elf clown sword fighting a dragon ghost in a mall.

Senko

  • *
  • Ace Runner
  • ****
  • Posts: 2468
« Reply #11 on: (01:15:20/04-11-18) »
Personally I always tend to view the automated IC as a low level agent program so its running quietly in the background checking everything is going well. Picture a cop constantly stopping the hacker and asking to see their papers "marks" if they're in the wrong place, doing the wrong thing those wont matter and the alarm gets tripped. If they're where they meant to be and doing what they're meant to be they're still operating with a forged passport and each time it gets checked the IC has a chance to notice the discrepancies.

Theres's also some short stories that seem to indicate there's also a certain degree of environmental effects to consider as well i.e. you alter what your in. However those get confusing.

Xenon

  • *
  • Prime Runner
  • *****
  • Posts: 4734
« Reply #12 on: (14:54:36/04-17-18) »
it performs matrix perception actions to find trouble.

One of the things it can find out with a Matrix Perception test is: "The last Matrix action an icon performed, and when". If the last action was an illegal matrix action then.....

how does the IC know who to attack in an in-universe sense? 

Patrol IC is trying to spot the icon that attack the host. If the icon is not running silent then the icon will be spotted automatically. If not then it is resolved as an opposed Matrix Perception test.

First, a Patrol IC goes around scanning basically everything.  On devices it would probably check for...

I don't think IC can interact with Device Icons out on the grid, even if they happen to be slaved to the Host...
« Last Edit: (14:59:31/04-17-18) by Xenon »

firebug

  • *
  • Errata Coordinator
  • Prime Runner
  • *****
  • Posts: 2788
  • Scraping the bottom of the Resonance Barrel
    • Moth's Mad Path
« Reply #13 on: (18:02:19/04-17-18) »
I don't think IC can interact with Device Icons out on the grid, even if they happen to be slaved to the Host...

If the IC can't interact with those device icons, how do you do any hacking of icons slaved to the host while inside the host?  One of the points of hacking into a host in the first place is for the Direct Connection to all the devices in the WAN.

I'm absolutely certain a device slaved to a host may have its icon accessed from inside the host.  In fact, it's the only way, as when you’re outside of a host you can’t interact directly with icons inside it.  That's part of why hosts actually do make things more secure.

However...  It's possible I'm wrong, and that it's possible for a device to be slaved to a host without the icon being in the host.  If someone can show me where the book says I'm right or wrong (before I find it), then I appreciate it.  If not, then I'll bring this to the errata team.
« Last Edit: (18:09:53/04-17-18) by firebug »
I'm Madpath Moth on reddit (and other sites).
Firebug's VU93 Profile
Jeeze.  It would almost sound stupid until you realize we're talking about an immortal elf clown sword fighting a dragon ghost in a mall.

Xenon

  • *
  • Prime Runner
  • *****
  • Posts: 4734
« Reply #14 on: (23:13:59/04-17-18) »
If the IC can't interact with those device icons

Maybe it can. I just have not read anything to support that it is something that IC normally do.

However...  It's possible I'm wrong, and that it's possible for a device to be slaved to a host without the icon being in the host.  If someone can show me where the book says I'm right or wrong (before I find it), then I appreciate it.  If not, then I'll bring this to the errata team.

If you attack a slaved device out on the grid it get to defend with master ratings, but there is nothing really to stop you from attacking it out on the Grid (except GOD). You can also always spot it out on the Grid no matter how far away you are (but noise might become an issue). You don't have to enter the host. And you can't be attacked by IC when messing around with the device no matter if it is not slaved, part of a PAN or part of a WAN - unless you happen to do it from within a the Host it is slaved to.

You can avoid fighting master ratings by establishing a direct connection. Either by physically connecting to the device or by being inside the Host it is slaved to. This will cut down the distance to 0 meters. But the icon will still be out on a Grid, never inside the Host.

We had a very good discussion about this when I was active on this forum back in '14 or '15.