4.0.0 Hacking

The hacking rules for this game presume a largely hardwired world. Wifi connections are trivially cracked by modern cryptography and cyberdecks have field projection units that can penetrate computer housings or cyberware to reach the wires within. Important installations are kept on isolated local networks and connected to wide-area networks only at pre-arranged and unpredictable intervals. As a consequence, it is necessary for hackers to physically infiltrate most facilities in order to perform their duties.

4.1.0 Cyberspace Basics

Cyberspace exits as a VR-mediated digital world that appears in whatever idiom the system’s owner has selected. While a cyberdeck can reinterpret these idioms into a sensory experience more palatable to the user, most hackers prefer to see things “natively” when hacking a system due to the lower processing requirements.

Cyberspace exists in nodes, each one mirroring a particular network device or cluster of devices. A single camera might be its own node, or a set of factory machines, or a net-monitored minefield, or any other network “place”. Nodes are where programs and datafiles are kept and where hackers encounter guardian Demons and human watchdogs.

Nodes are linked by connections. To move from one node to another, a hacker needs to cross these connections, defeating any digital barriers that security may have erected. A hacker who jacks in to a security camera on the outside of a building might then hop its connection to the security panel where its output is being monitored. Without this long-distance travel, the hacker would have to physically reach the security panel in order to manipulate it.

Every human in cyberspace is represented by their avatar. Hackers tend to go to elaborate lengths to customize their avatars and the visual representations of the programs they use, but most corporate watchdogs are limited to corporation-approved brand icons. Most “civilian” users simply wear whatever digital disguise they’ve bought most recently.

4.1.1 Time in Cyberspace

Cyberspace actions take the same amount of time as physical actions; the code may be fast, but the human mind is only so agile. Hackers must split their available actions between cyberspace and any physical activities they want to perform while jacked in.

4.1.2 Connecting to Cyberspace

To connect to a node, a user has two choices.

Physically attach a self-adhering field modulation cable from your cyberdeck or cranial jack to the device housing. Even without a convenient plug socket, this will let you hack the device’s internals.

Wirelessly connect to the device with your cyberdeck. The target must be within 30 meters with an unobstructed line of sight. Wireless connections are much more tenuous than physical links; you’ll take a -2 penalty to any cyberspace skill checks you make and your avatar won’t be able to move out of the node.

In both cases, it’s assumed that you’re connecting to your cyberdeck with a cranial jack. VR crowns can be used as a makeshift link for those without a cranial jack, but they apply a -1 penalty to all cyberspace skill checks made with them.

Connections last until someone yanks your cable off the device housing or you voluntarily jack out of the system. Even if unconscious, your avatar remains until you’re jacked out. Crash disconnections are disorienting and will leave a hacker stunned, but sometimes an ally needs to cut the link before some watchdog boils a nerve-locked hacker’s brain.

Wireless connections have no cable to yank, but fail if the target moves out of range; once the link is established, the line of sight need not be unobstructed.

Hackers normally remain aware of their physical surroundings while jacked in. They can act in either the physical or virtual realm as they choose, spending their actions during the round as they wish.

4.1.3 Access

Access is the digital currency of control, representing a hacker’s array of countermeasures, zero-day hacks, fresh intrusion measures, and unsecured backdoors. It’s spent to run programs on a secured system. Access is a general pool, though sometimes a hacker may acquire specific data that gives them bonus Access against particular networks.

A hacker’s base Access is equal to their Intelligence modifier plus their Program skill plus their cyberdeck’s Bonus Access rating. To refresh this pool, they need to spend an hour reprogramming their deck and slotting in new exploits. Such a refresh can only happen once a day as it takes time for new security holes to open in newly-updated software.

Hackers can acquire bonus Access to a network through social engineering: inside information, moles, and backdoors they’ve been informed about through Contacts or field work. This information is perishable, and usually becomes useless within a few weeks.

4.1.4 Running Programs

Once a hacker has jacked into a node, they likely want to do some mischief. This is accomplished by using programs made up of two different kinds of code fragments stored in their deck’s Memory.

Verbs are what the hacker wants to do to the target: Glitch, Sabotage, Blind, Decrypt, Delude, or some other malfeasance. A full list of the most common Verbs is provided on page 98.

Subjects are what the hacker wants to do it to: Camera, Turret, Door, Barrier, Avatar, or something else. A hacker needs the right code libraries on hand to work their magic, and if they don’t have the data specs for a target in their deck’s Memory they can’t hit it.

Each Verb or Subject takes up one unit of Memory in a cyberdeck. The hacker can mix and match these fragments as they wish to create programs. A deck with the Glitch, Blind, Datafile, Camera, and Drone fragments on it could Glitch Drone or Blind Camera or any combination of Verb and Subject the hacker wishes, determined at the time they run the program.

Verbs are flexible, but each has a limit on what type of Subjects they can use. The Glitch Verb is only usable on Device or Cyber types of Subjects. Drone is a Device Subject, so it’s valid, but Datafile is a Data Subject, so Glitch can’t operate on it.

Most Verbs require that the hacker beat the target network’s security difficulty with an Int/Program skill check. This difficulty varies with the quality of the network tech, usually ranging from 7 to 12, or even more.

Each failed execution against network security increases the network’s alertness. Each two failed attempts counts as one Alert the Network action, so no more than four botches will light up the facility. Opposed skill checks, such as in combat, don’t trigger this effect. Even networks without a Demon active can thus end up alerted by a sufficiently inept or unfortunate hacker.

4.1.5 Cyberspace Combat and Demons

While only well-funded networks will have a human “watchdog” jacked into the system to monitor it, all but the poorest network will have at least one Demon program positioned to deter intruders and raise alarms.

Demons are programs that usually remain stationary in a single node. When an intruder arrives, the Demon will carry out its programming. This usually entails raising a network alert to on-site security and launching Stun Avatar programs at the hacker. A Demon’s particular program loadout and directives will depend on what the network admins granted it.

Cyberspace combat is usually played out via Stun Avatar programs that inflict non-lethal hit point damage to hackers or Demons hit by them. These hit points are subtracted from the actual physical hit points of the hacker; if reduced to zero HP by Stun Avatar, a human goes unconscious, waking up ten minutes later with one hit point. Demons reduced to zero HP are fragged, and won’t reboot for another hour.

The specific procedures for cyberspace combat are detailed in a section below.

4.1.6 Noticing Hacking

A hacker generally needs to be plugged into their cyberdeck in order to hack, whether with a cranial jack or a VR crown. This is going to be enough to catch the attention of people around them, who may not know what the hacker is doing, but they’ll know that the hacker is prepared to do something. Decks with 0 Enc might be small enough to hide discreetly, if the user is wearing a head covering.

Hacking attempts on cyberware are always obvious to the target unless specified otherwise; the user’s cyberware will naturally ping the user that something is happening, even if the effect may not be obvious. Frisking someone for cyberware via hacking is generally considered a hostile act. A target might put up with it if they’re being checked for weapons as part of a security process, but running a Frisk on the street is likely to convince the target that they’re about to be attacked.

Hacking attempts on other hardware are obvious from within the device’s node, and any hacker, watchdog, or Demon in it is capable of detecting tampering automatically. An outside observer won’t necessarily notice anything wrong unless the device is behaving in some uncharacteristic way.

4.1.7 What Can Be Hacked?

Software-controlled devices can be hacked, such as drones, most electronic locks, cyberware, cameras, and other program Subjects listed in this section.

Mechanical or strictly electrical devices cannot be hacked. In the default setting, this includes most vehicles, dumb locks, household appliances, thermostats, and anything else that can do its job without talking to a computer. Security-minded corps have no reason to make life any easier for an intruder than they must.

4.2.0 Hacking Mechanics

The following procedures are used for hacking various types of targets and engaging in cyberspace combat.

4.2.1 Hacking a Device or Server

1. Check your deck’s CPU rating. Do you have a free point of CPU? If not, your deck doesn’t have the horsepower to run another program right now.
2. As a Move action, take the Jack In action to connect to the device if you aren’t already connected. It’s best to use the self-adhering field manipulation cable of your cyberdeck. Wireless connections are possible within 30 meters of unobstructed line-of-sight, but apply -2 to all cyberspace skill checks while connected that way. If you’re connecting to your deck with a VR crown instead of a cranial jack, take an additional -1 penalty.
3. As a Main action, run your program. Combine a Verb and a Subject stored in your deck’s Memory, pay any Access the Verb requires, and roll Int/Program versus the target’s Security difficulty, modified by any difficulty modifiers the Verb applies. On a success, the program has its effect. On a failure, you lose any Access you spent for no benefit, the program fails to run, and you potentially alarm the network. Every two failed skill checks against network Security count as one triggering of the Alert the Network action.
4. Is the program still running? If your program self-terminates after completion, it gives back its CPU slot. If you need to keep it running to maintain its effects or control, it keeps the CPU slot until you terminate it as an Instant action, your connection is cut, or you get knocked unconscious.

4.2.2 Hacking Cyberware or Drones

1. Check your deck’s CPU rating. Do you have a free point of CPU? If not, your deck doesn’t have the horsepower to run another program right now.
2. Can you reach them? While in theory you can stick your deck’s field cable on a target, in practice you’re usually going to be attacking wirelessly, with a 30 meter line-of-sight range and a -2 penalty on all cyberspace skill checks. You don’t have to connect to them beforehand with the Jack In action, however; you can launch your programs directly against the target. If you’re connecting to your deck with a VR crown instead of a cranial jack, take an additional -1 penalty to all cyberspace skill checks.
3. Do you know what cyberware you’re targeting? Cyber with a Sight obviousness rating can be recognized on sight. Otherwise, you need to either know of a cyber system’s existence beforehand, run the Frisk Cyber program, or launch your hack blindly and hope it hits a valid target.
4. As a Main Action, run your program, combining the desired Verb and applicable Subject from your deck’s Memory and spending the Access the Verb requires. If the target has no cyber, your effort is wasted. If the Subject you’re using doesn’t match any of their cyber, your effort is wasted. If the Subject you’re using matches multiple systems, like the generic Cyber Subject, and you didn’t specify which one beforehand, the GM picks a valid target randomly and tells you what you hit. Most Verbs require a skill check to successfully affect the cyber. The base difficulty for your Int/Program skill check is equal to 7 plus one-third of the target’s or the drone operator’s HD or level, rounded up. Drones without a connected operator are difficulty 8. Remember that you’re probably attacking wirelessly for a -2 penalty on your skill check, plus any roll bonus or penalty the Verb you’re using may apply.
5. Is the program still running? If your program self-terminates after completion, it gives back its CPU slot. If you need to keep it running to maintain its effects or control, it keeps the CPU slot until you terminate it as an Instant action, your target moves out of range, or you get knocked unconscious. Just moving behind cover is not enough to cut the connection; they need to get more than 30 meters away from you.

4.2.3 Cyberspace Combat

1. Be connected. If you lose your connection, you drop out of cyberspace and can’t interact with it.
2. Be in the same network node. All avatars or Demons involved in the fight have to be in the same network device.
3. Both sides roll initiative. If you’re already in meatspace combat, keep your original initiative.
4. Both sides take actions normally. Main or Move actions spent in cyberspace are consumed in meatspace as well; you don’t get two separate sets of actions. Those with the Hacker Edge, however, get a free Main Action each round to spend in cyberspace. Demons get the same Main and Move actions that any others do.
5. Attacks are usually made with the Stun Verb and the Avatar Subject, though Kill Avatar is used by some particularly vicious defenders. These Verbs inflict normal hit point damage on the target; at zero hit points, they fall unconscious if human or are fragged for an hour if a Demon program, though fragged demons still count for a node’s maximum Demon capacity. Kill Avatar can inflict lethal damage and Traumatic Hits; the victim’s Trauma Target is not modified by armor, but is by cyber or other sources.
6. Combat continues until one side flees, is disconnected, or otherwise ceases hostilities. Demons will follow their programming, while human watchdogs are more flexible. Both will likely put a high priority on the Alert the Network action, which must be performed twice to activate the network’s intruder alert.

4.2.4 Moving in Cyberspace

1. Be connected. Your avatar initially manifests in the network node corresponding to the device you connected to.
2. Look for node connections. Most connections to another node are obvious. Some may be hidden, however, and require a Main Action and a Wis/Program skill check to detect them at the security’s difficulty level.
3. Is there a barrier on the connection? If so, you need to successfully run the Unlock Barrier program on it to pop it open. Once unlocked, it remains so until the Lock Barrier program is run.
4. If there is no barrier or it has been unlocked, take a Move action to move to the connecting node. Hostile Demons or watchdogs who are present get to run a free program against you as you flee. ### 4.2.5 Common Cyberspace Security Levels

The levels below represent the usual difficulties for hacking skill checks in a given network. Individual networks may vary based on their importance and the competence of their guardians, however.

4.2.6 Cyberspace Actions

Cyberspace actions take the same amount of time as meat-space actions. Thus, if the PC takes a Main Action to run a program in cyberspace, they can’t then use that same Main Action to fire a weapon in reality, as the hacker needs to split their available action pool over both realms of being. The following actions are among the most common, but others may be allowed at the GM’s discretion.

Network Actions

• Alert the Network (Main): An action normally only taken by Demons and human watchdog hackers, this action will alert the whole network that there’s an intruder present in this particular cyberspace node. This action must be taken twice to trigger an alert; one Demon could use it on two different rounds or two Demons could both use it the same round. Up to an hour can elapse between the two uses of this action; if a defeated Demon still gets it off once, another enemy three nodes later can still complete the alert with their own action. These alerts usually are automatically messaged to at least some physical security staff.
• Jack In (Move): Attach a cyberdeck’s field manipulation cable to a device or initiate a wireless connection to a device within 30 meters with no significant obstacles to the user’s line of sight. The hacker’s avatar appears in the cyberspace node associated with the target device.
• Jack Out (Move): Safely disconnect a wireless connection or remove a cyberdeck’s field manipulation cable. Hostile assailants can do this with no real chance of failure if within melee range. If someone forcibly yanks a physical cable loose while a hacker is jacked in, the hacker is stunned and loses their next Main Action.
• Move Nodes (Move): Assuming there’s no barrier between the hacker’s current network node and an adjacent one, they can move one hop on the network. If they’re being engaged by an enemy Demon or human attacker, however, their foe may choose to run one program against them as a parting shot before they can complete the move.
• Send Message (On Turn): Send a brief message over the network to an avatar or device in a connected node, provided no barriers obstruct the path. Demons, watchdogs, and others with admin privileges can message any known avatar or device on the network regardless of active barriers.
• Crash Shutdown (Main): This action can only be taken by someone with admin privileges, usually the senior human watchdog hacker on duty for a given network. Once triggered, the entire network will shut down in 1d4+4 minutes, deactivating every connected device and booting every user out of the system as if forcibly disconnected. It will take 24 hours to bring the system back up and inflict 10% of the network’s total hardware costs in component damage. Corps reserve this action for dire emergencies, when it seems certain that a cyberspace intruder is soon to do something even worse than this. Impending shutdowns are obvious to everyone in the system.

Cyberdeck Actions

• Copy File (Move): Make a copy of a datafile located in your current node and store it in your deck’s Memory. The inevitable wrapper of anti-tamper code and log files makes almost all important datafiles take up one point of Memory, however small the actual contents.
• Delete Local File (Move): Erase one datafile, Verb, or Subject on your own cyberdeck, freeing up the Memory it occupied. Deleting files in a server node you don’t have admin rights for requires the Erase Verb, as the local network may not permit such tampering.
• Issue Command (Main): Verbs such as Hijack or Delude seize control of devices or provide some lasting influence over a system. Ordering a controlled target to do something takes a Main Action. A controlled but uncommanded target will continue doing whatever it was last told to do. If that’s impossible or impractical, it will do nothing until it gets a new command.
• Run a Program (Main): Run a program from the hacker’s cyberdeck or the watchdog’s server, combining a Verb with a Target to produce a desired effect.
• Terminate a Program (Instant): Shut down a program the hacker is running, freeing up CPU capacity. Programs are automatically terminated if the hacker gets dumped from the network, their wireless signal is blocked, or they’re otherwise cut off from their intended targets.

4.3.0 Programs

A program is made up of two parts: a Verb and a Subject. A hacker loads a selection of each into the memory of their cyberdeck, and as they need them, they pair any two to create the effects they need. While programs are flexible, they have some limitations.

Programs can only be run from cyberspace. If a hacker wants to blind a camera, they’ve got to jack into it first before they can run the Blind Verb with the Camera Subject. Programs with the Cyber, Drone or Transmission Subjects are an exception to this, and can be run directly to attack enemy cyberware or interact with local radio transmissions.

Most Verbs cost a point of Access to run. Some very subtle Verbs may function without this cost.

Most programs require a skill check against the Subject’s security difficulty. The more sophisticated and well-hardened the target, the harder it is to hack it, with difficulties given on the table in section 4.2.5. On a failure, the action and Access is wasted. Some Verbs are harder or easier to execute than others, and may apply a modifier to this skill check roll.

Programs take up one CPU slot while running. A cyberdeck with a CPU rating of 4, for example, can run no more than 4 programs at a time. Some Verbs auto-terminate after performing their task, while others are ongoing, and continue to have their effect as long as the program runs.

Programs terminate once the hacker jacks out or is knocked out. Once the cable gets pulled or the hacker goes unconscious, any program that the hacker was running automatically ends. If they’re connecting wirelessly to the target, as with programs affecting cyber or radio transmissions, their programs only terminate on unconsciousness, the Terminate Program Instant action, or if the target goes out of range.

Each Verb or Subject takes up one point of deck Memory, and can be combined arbitrarily to make up a program. Programs can be used as often as the user wishes, so long as they have the CPU and Access needed to run them; the same Blind and Camera elements can be used to blind three different cameras at the same time so long as the deck has at least a CPU of 3 and the hacker takes three separate actions to run the program at different targets. Swapping utility choices requires an hour of recompiling.

4.3.1 Acquiring Programs

Getting a new Verb or Subject isn’t as simple as buying it off the rack or copying it from a friend. The programs that hackers use are profoundly illicit, programmed to sneak under corporate security barriers and ignore corporate spyware requirements. Each one is a work of digital art that relies on secret corporate database taps, spoofed security certificates, and unpatched exploit lists. If such a program was simply copied, the doubled hit on those resources would instantly flag both programs as threats and ruin them for any practical use.

As such, these programs are painstakingly designed one-by-one by expert criminal codesmiths and sold and traded among the hackers of a city. The prices given on the chart for Verbs and Subjects reflect the usual fees charged for such things; any competent hacker will know where to buy them.

4.3.2 Writing Programs

Crafting a constant stream of usable Verbs and Subjects for sale is impractical for most PCs. The work requires contacts with a host of insider moles in corporate databases, criminal data launderers, and subject-field specialists in hardware security subversion.

While few hackers have the time or resources to write illicit programs as a business, most can manage to keep a few of their most important needs satisfied through their own coding prowess. A sufficiently talented hacker skill can maintain a few usable Verbs and Subjects, keeping them up-to-date and concealed from ubiquitous corporate DRM.

Writing a Verb or Subject takes at least Program-1 skill and one week, less one day per level of Program skill. Two such programs can be maintained at once per level of Program skill, so a PC with Program-2 can maintain up to four total Verbs and Subjects at once. They might choose to keep Glitch, Blind, Cyber, and Camera available this way, after a few weeks of work to write the code. Code that is abandoned in favor of a new program must be rewritten from scratch if the hacker needs it once again, as entirely new security bypasses must be researched and implemented.

Characters with the Hacker Edge gain eight Verbs or Subjects at the start of the game. These do not count against their programming limits and can be re-written if erased at the usual time requirements. They cannot be changed once selected, however.

Hackers can also write specialized or unique Subjects, often in preparation for a mission. If a hacker can find out the exact model of camera or electronic lock their target is using, they can write a unique Subject aimed at that specific device, gaining a +2 bonus on their skill checks to overcome its security difficulty.

4.3.3 Program Subjects

The Subjects listed below are the ones most often relevant to an operator. Other Subjects do exist, as do more specialized, specific utilities that aim at specific types of devices or particular models of hardware.

• Avatar: A cyberspace avatar, whether one adopted by a hacker who’s jacked into the network or a Demon program standing guard there.
• Barrier: A network node barrier that blocks avatars from passing through a network connection.
• Camera: Any device that transmits audiovisual information. Some defensive hardware has its own onboard camera, which is susceptible to this target, while others rely on a separate device’s input.
• Cyber: A cybernetic system in a visible subject within 30 meters with no significant obstacles to line of sight. Unlike most Subjects, it’s not necessary for a hacker to manifest an avatar inside the target node to affect cyber systems; they can launch their program directly at it, and the system itself need not be visible on the target’s body. Given the difficulty of affecting cyber wirelessly, many hackers prefer to use more specific Subjects for a +1 bonus, such as Nerve Cyber or Limb Cyber.
• Datafile: A datafile stored within a cyberspace location. While individual files may have very little actual data in them, the autoencryption functions and anti-tamper code they’re wrapped in almost always take up a full unit of Memory per file .
• Door: A physical door, shutter, hatch, or other barrier with an electronic lock or opening mechanism.
• Drone: A remote-controlled drone. The base difficulty is equal to 7 plus the operator’s level or HD/3, rounded up, or 8 if it’s not actively controlled. Like the Cyber Subject, it is not necessary to manifest in a drone’s node to hack it wirelessly.
• Machine: Security panels, factory machinery, electronic minefields, or any other hackable device not covered under an existing Subject. Its generality applies a +1 penalty to the security difficulty.
• Program: A hostile program, used most often with the Terminate verb to end the effects of an enemy hacker’s programs prematurely.
• Sensor: Similar to the Camera element, this code block handles sensors of any kind, regardless of what they are intended to detect. The generality of the element decreases its efficiency, however, and it applies a +1 security difficulty penalty.
• Transmission: Ambient radio transmissions can be affected with this element, most often for the purpose of tampering with local comms. A hacker need not be jacked into a cyberspace node to target local radio transmissions, but the usual -2 check penalty for wireless hacking applies.
• Turret: A security turret, emplaced gun, or other fixed automated weapon.

4.3.3.1 Specialized Subjects

The Subject elements for sale in most underworld circles are intentionally generic in nature. They’re packed with basic intrusion profiles for dozens or hundreds of different targets of that type, with a host of generic exploits and cracks stored in their database. Even if the specific target model isn’t on their list, there are enough generic resources to give the hacker a chance.

A specialized Subject is more focused, however. Instead of being a Cyber Subject, for example, it might be a Nerve Cyber Subject. These specialized Subjects are useless against more generic systems, but against their specific target, they grant a +1 bonus to any skill checks the program may require. Thus, the Nerve Cyber Subject would be worthless against a cyberleg, but could affect an Enhanced Reflexes I system.

A unique Subject is focused on a single system, device model, or specific make of target. Instead of being a Nerve Cyber Subject, it might be an Enhanced Reflexes I Subject, or instead of a Flying Drone Target, it might be a Xiaowen Phoenix Subject. It’s useless against anything but that specific target, but grants a +2 bonus to any relevant skill checks.

Specialized Subjects are sometimes available on the black market. Unique Subjects are almost never to be found for casual purchase, and either require hand-development by the hacker who might need them or a specific Contact who can get them.

4.3.4 Program Verbs

The Verbs listed here are simply the most common ones available on the black market. Specialized alternatives do exist to produce non-standard effects in their targets, but these bespoke Verbs are usually custom-coded by those who need them.

Verbs are listed with the valid Subject types they function against. A Verb cannot be run with an invalid target; you can’t Blind a data file or Delude an avatar

*: These verbs are self-terminating, and return their CPU slot immediately after the program is run.

• Activate: Turn a device or piece of cyberware on. You can’t control it or direct its function, but if it’s programmed to do something when activated, such as grant a bonus action in exchange for System Strain, it does it for one round or one action. The spasmodic activation of cyber outside of the wearer’s turn is unlikely to do anything useful, but it eats System Strain as usual if relevant.
• Analyze: Identify the specific functionality of a device or the general topics of local datafiles. Hackers get a general idea of what kind of device a cyberspace node represents, but Analyze is needed to give specific details of where a device is in reality.
• Append: Add a new entry or new data into a file. These new entries can’t overwrite or erase any existing data, however.
• Blind: Deactivate a device’s sensory input or make cyberware temporarily unable to get any input from anything but the wearer’s nervous system. Cybereyes are blind, cameras sense nothing, and laser tripwires don’t register the beam. Blind characters can’t effectively attack at range, their movement rate is halved, and they suffer a -4 penalty to both AC and melee hit rolls.
• Deactivate: Turn a device or piece of cyberware off. Most devices and cyber can be rebooted by the network or the user, but it’ll take a Main Action and a round to do so. If a network alert hasn’t been issued, the network may not notice a deactivated device until someone spots the problem.
• Decrypt: Decrypt a data file or radio transmission. This is often automatic for civilian encoding, though some files take Int/Program checks.
• Defend: A special Verb that can only be targeted at a friendly device or allied cyberware user within range, and costs no Access to use. While the program remains running, any hostile hacking attempts aimed at that device or any of the target’s cyber systems must first beat the user in an opposed Int/Program skill check before they can attempt their hack. This Verb cannot negate programs that are already running on the target.
• Delude: Spoof a device with false sensor input. A camera can be made to record nonexistent scenes, a minefield can be made to see phantom intrusions, a drone can feed the operator false visuals, and a turret can be made to mistake friends for foes. This Verb can’t control a device directly, however, and must rely on feeding it false sensor data.
• Erase: Erase a data file. This Verb is extremely thorough, and any on-site backups can be expected to be nuked as well, either immediately or as soon as the automatic backup protocols expose them.
• Frisk: A Frisk Cyber program can give a list of all the cyber implanted in a specific human target within 30 meters, assuming the hacker’s skill check beats the cyber user’s security difficulty.
• Ghost: Renders the targeted friendly avatar or Demon “invisible” until they take some cyberspace action other than Move Nodes. Observers in a node get an automatic opposed Int/Program check to detect a ghosted avatar’s presence, ending the program.
• Glitch: Temporarily deactivate a device or cyberware system while the program remains running, for no more than one round per Program skill level plus two. A device can be targeted by a particular hacker’s Glitch only once a day, successful or not.
• Hijack: Seize control of a device, operating it as you wish within the limits of its functionality for as long as the program remains running. One command is free with the program’s successful execution; others take a Main Action to issue.
• Kill: Through forced autonomic feedback and out-of-bounds electrical current parameters, inflict lethal damage to an enemy avatar equal to 1d10 per Program skill level, to a minimum of 1d10 on a successful opposed Int/Program skill check. This damage has a Trauma Die of 1d8 and a x3 Trauma Rating. The victim’s Trauma Target is not modified by armor, but it is by cyber or other modifiers. Unconscious hackers cannot resist this Verb and will be instantly killed by it. This Verb has no effect on Demons.
• Lock: Lock a physical device that has some sort of electronic locking mechanism or a currently-unlocked cyberspace node barrier.
• Paralyze: On a successful opposed Int/Program skill check against the target, render a Demon or avatar incapable of moving out of a node or using the Alert the Network or Send Message actions while the program is running. Other cyberspace actions can be taken normally. Human hackers are also physically paralyzed while the program runs, incapable of moving in meatspace until the connection is cut or the program ends.
• Replace: Edit a data file, changing one piece of data in it into another of the hacker’s choice. It cannot erase or add data outright, only alter it.
• Sabotage: Cause a physical device or cyberware system to damage itself through violent movement or self-destructive current surges. Devices smaller than a car will usually be disabled until repaired. Cyberware users do not take damage, but must make two Physical saves to resist the effect; if they fail both, the targeted system is disabled until the next maintenance, and if they fail one, it’s frozen for one round. A device or cyber can be targeted by this Verb only once per scene.
• Sense: Piggyback on the sensory feed of a device or piece of cyber. Anything the device senses or records, the hacker can sense. Swapping focus from cyberspace to reality is an On Turn action.
• Siege: If a Device is successfully Sieged, its network connections are severed for everyone but the hacker, blocking transit, data, or drone control. Defenders can run Terminate Program against it from any adjacent node.
• Silence: The affected avatar or Demon is unable to use the Send Message cyberspace action while this program runs. Alert the Network can still be done.
• Stun: Disrupt an avatar or Demon with sensory glitching, non-lethal current surges, and code corruption. Make an Int/Program skill check; beat an opposed Int/Program check for a human target, or a static 8+skill bonus target for a Demon. The target takes 1d10 non-lethal damage per Program level, to a minimum of 1d10.
• Terminate: Prematurely end an undesired program. Any damage or changes the program already inflicted are unaffected.
• Unlock: Unlock a physical device with an electronic lock or a network’s cyberspace node barrier.

4.4.0 Demons and Watchdogs

Corporate systems almost always have some sort of active defenses. Without a vigilant Demon or two in the system to alert security guards, occupants of a facility might never realize that their network is under attack. In the same fashion, human watchdog hackers are often plugged into the more important networks, maintaining a 24/7 human presence within it.

4.4.1 Demons

Demons are autonomous programs supported by a network’s server hardware. Demons have avatars much as human hackers do, but operate based on a list of prioritized command lines, carrying out their duties according to their programmed behavior.

Demons are smart enough to prioritize commands intelligently; they won’t try to perform an obviously-impossible task in preference to an action that actually is possible. They are not intelligent, however, and can’t make choices unrelated to their program.

Demon programming is expressed in command lines, each line representing one action or purpose. Demons prioritize their command list from top to bottom, skipping commands that aren’t applicable. Every demon has a limit in the number of command lines they can process. Lists more lengthy than this are too complicated for the program’s logic to handle effectively.

Demon programs can use the Verbs and Subjects loaded into the network server they are operating on.

Demons have hit points which are depleted by the Stun Avatar program or other effects that damage code integrity. When HP reach zero, the Demon is fragged, and can do nothing until it reboots itself in an hour. It still counts for maximum-demons-per-node, however.

Demons also have a skill bonus. This bonus is applied to any cyberspace-related skill checks they may need to make, and counts as their skill level for the damage done by Stun or Kill Avatar.

Demons are located in a network based on the owner’s preferences. Sensitive nodes are often guarded by a Demon, as are network chokepoints. Some Demons are set to patrol the network, either in a regular pattern or as a random walk through connected nodes. Demons can ignore network barriers and do not need to spend Access to run programs, as they are assumed to have admin privileges.

A given network can support only so many Demons, based on the power of the network server. The network server lists both the maximum number of Demons that the network can support and the maximum number of Demons that can effectively act in the same node. If more than this number of Demons are crowded into the same node, the newest arrivals can do nothing but Move Nodes.

4.4.1.1 Demon Command Lines

The following command lines are examples of some of the instructions that can be given to a Demon. A given Demon can be programmed with as many of these lines as their capabilities allow, and will follow them in order of priority from top to bottom. Demons are intelligent enough not to waste time trying to do impossible things.

Example Command Lines

• Perform the Alert the Network action when an intruder is sighted, if it isn’t already alerted.
• Reboot deactivated devices on the node and message any watchdogs who may be on duty.
• Run Stun Avatar against any intruders until they have been knocked unconscious or offline.
• Run Lock Barrier on an unlocked node barriers you encounter and message any watchdogs who may be on duty.
• Move through the network in a specific patrol or random wander.
• Run Kill Avatar against any unconscious intruders until they are dead.
• Pursue intruders through the network, choosing randomly if multiple intruders are encountered.
• Run Erase Program against an intruder’s Stun Verb if they have used it in your presence before.
• Run Terminate Program against any active Hijack programs currently running in your presence.
• Run Paralyze Avatar against an intruder to physically lock them down before further countermeasures.
• Message security with the Send Message action whenever you execute a line action in response to some anomaly.
• Reserve a Main Action to run Defend Device in response to any attempts to hack devices in the node you’re in.

4.4.2 Watchdogs

Demons are tireless, vigilant, and require no wages. Human hackers, despite being deficient in these regards, are substantially more flexible and intelligent. Watchdog hackers are usually hired in 24/7 shifts in order to maintain round-the-clock observation of important networks that can afford their considerable expense, though some poorer facilities hire them only during working hours.

Watchdogs use the same hacking rules as PCs do, albeit they can ignore network barriers and do not need to pay Access to run their programs. To avoid a single point of failure, the vast majority use personal cyberdecks and their own programs rather than relying on the facility’s server computing power.

As watchdogs are intelligent, they can and will maintain full communications with the facility’s physical security staff. PCs who alert them to their presence can expect local security to come running to the physical location of any compromised device nodes.

Below are statistics for some of the common types of watchdogs encountered by PC hackers. Minor corps or gangs might be able to hire only minimally-competent hackers, but major black sites and important corporate facilities will have the best talent money can buy, with hacking cyber and decks to match.

4.5.0 Network Servers and Architecture

The server classes listed here are some of the most common, and a corporation can be relied upon to use the smallest iron they can get away with. There can only be one primary server on a single network; others might be connected to it, but only the primary server counts for determining node connection limits, barriers, or active demons.

Servers have node connection limits. This is the maximum number of nodes that can be connected to the server. If you want to connect 4 cameras, 3 doors, a security panel, and the server itself, you need to have at least 9 connections available.

Hackable devices without a connection to the server can’t communicate with it, but still function normally. An electronically-locked door with no connection can still be hacked, and PCs can still jack in to its cyberspace node, but there’s no way for the server to monitor the door or control its status.

Servers have barrier limits. This is the maximum number of barriers that the network can support. Barriers can be bidirectional or only work one-way as the network architect desires.

Servers have Demon limits. A given server can only support so many Demons, and only so many of those can be active in one node at a time. The table adjacent lists both maximum total Demons and, parenthetically, how many can act in one node at a time.

Servers have effectively unlimited Memory. Even the smallest, simplest server can contain as many Verbs, Subjects, or datafiles as a user needs. Any Demons supported by the server can use its Verbs and Subjects. As a result, prudent network architects try to keep invading hackers out of the primary server node; a well placed Erase Datafile execution can erase critical Verbs from the server and defang the network’s Demons. Human watchdogs use their own cyberdecks, so are not subject to this risk.