Sample Devices for Hacking

This will be of varying use, but this is how I’m going to stock locations with hackable devices. I’m using a Trav-style universal device profile so that I can just write the six-digit code onto whatever map or document I’m using. At the end I’ve written up some statblocks for some of the things you’d see constantly.

The Device Profile

A simple system to make it easier to keep track of devices when stocking a location:

A device’s security rating ranges from zero to fifteen, expressed in hexadecimal (0 to F). Rating-zero devices are the most secure, rating F devices are the least secure. Installations also have security ratings. If a device is marked with an I, its security rating is equal to the installation rating.

Devices are marked with a W if they are wireless-enabled, a lowercase w if they are only accessible wirelessly with prior knowledge or exploits , and with N if they cannot be accessed wirelessly.

Devices are then marked with two digits corresponding to the countermeasures present. Mark them as W if they contain white ice, which targets the hacker’s device, attempting to disconnect or damage it. Mark as B if they contain black ice, which targets the hacker’s brain. Then, mark with a number between 1 and 6, corresponding to the chance (out of 6) that the ice triggers when a hacker takes control of that device. Devices without ice are marked 00.

Mark a device with a capital D if it contains obvious data of import, and with a lowercase d if that data is hidden. If the data is encrypted, mark it with a letter E. If it is hidden and encrypted, with lowercase e. Mark it with a 0 if it contains no such data.

Finally, mark the device with a C if it is able to control a complex device, like a construction drone, heavy machinery, or fire sprinkler system. Mark it with a 0 if it has no such capabilities.

The final six-digit code serves as a shorthand for handling device security on the fly. For example, a device marked AwB400 has a Security of 10, is accessible wirelessly through an exploit, and has black ice at a 4 in 6 chance of triggering.

Sample Devices

Commuter Car - Bw000C

Can be driven. Wireless access is on a specific encrypted protocol for self-driving vehicles; a specific car can be opened wirelessly if its communications are monitored for 4 turns, or if its Vehicle Identification Address is found ahead of time.

I myself see the car crash as a tremendous sexual event really: a liberation of human and machine libido (if there is such a thing). –J.G. Ballard

Electronic Lock - 9N000C

Regardless of the intended mechanism of opening (keycard, pinpad, biometric), if the lock can be connected to, it offers little resistance. They have no data ports on the outside, but if the cables leading to them can be identified, they can be tapped with cheap tools.

Smarthome Node - AW00EC

Every security pro wishes people didn’t use these. Even when the owner is savvy enough to disable the wireless, they can be accessed by tapping into any of the external devices (cameras, air conditioners, internet routers). Contains records from those peripherals, with basic encryption so that “secure” can be printed on the box.

Security Camera - AN00D0

Once inside a security camera, it can be altered to send a false feed instead of the real one. If the feed is supposed to be convincing to a close observation, it should be forged ahead of time. Contains a few days’ records of its own feed; archives are always held elsewhere.

Corporate Dataterminal - IN0000

Thin client email-stations which are only useful as little avenues through which to access the installation’s more important devices.

Major Terminal - IN00D0

Terminals where important work is done which cannot or should not be offloaded to a distant server. Terminals used for research or programming would qualify; these tend to store data. Many missions involve searching for the correct one of these to find the work of a specific employee.

Mainframe - IN3WD0

Ice varies. Mainframes contain data relevant to the installation’s computer network, and all incoming and outgoing data traffic passes through the mainframe in most cases, so communications can be sniffed and decrypted from here.

Quarantine Router - IN6W00

These are layered with thick ice which boots and blacklists any device that triggers it. This ice cannot be broken through by brute force, you need specific exploit information to evade it (which can often be found on the black market, if you know enough about the device itself. Exploits can be used once before the ice adapts to them). These are used to prevent installations from being hacked over the open web. With clever spoofing, the ice can be tricked into targeting another device.

Trap Terminal - 7N4B00

These are virtual machines in corporate mainframes which are listed to appear like terminals elsewhere in the installation. Since they would never be used by a legitimate device, the security pros have no qualms about loading them with especially nasty countermeasures. Can be identified by monitoring traffic flows in the network, but this takes time.

Bottleneck Node - 5N3W00

Especially secure routers made for securing the deliberate ‘choke points’ of a network topology. Ice in these nodes is typically designed to trace back to the hacker’s physical location before booting them.

August 31, 2023

Hacking

Every electronic device can be hacked. Hack a device by rolling 2d6 below its Security rating. Each point in the Hacking skill adds 1 to the Security rating of the device. Each degree of success nets one Duration; each degree of failure means the hack takes one turn longer. Device access is a matter of time.

Connection

The hacker needs to have some ability to transmit data to a device in order to be able to hack into it. The simplest is to plug in a cable.

Devices which use wireless communications may be hacked wirelessly so long as both devices are within range. Secure devices aren’t supposed to be wireless-enabled. In practice, they often are, whether out of negligence or convenience.

Devices which are connected to the internet may be hacked remotely. Again, the most important devices aren’t supposed to have internet connections, but they often do.

Once a device has been hacked, the hacker can then reach all devices which are directly connected to it.

Devices

Ideally, all of the useful bits of technology on a mission are kept track of as devices. Some generic, like cars and door locks, some hyper-specific, like a viral fabricator for the production of RNA strands.

Control Devices

If a device can perform an action (like a construction crane’s central computer being able to maneuver the crane itself), the hacker may perform that action on the turn in which they take control of the device.

Data and Encryption

A device might be holding data of use to the hacker. It is usually trivial to find and download. If it is hidden among the device’s files, they can make another Hacking roll (rolling under their skill+Intelligence) to discover it, once per turn. If the file is encrypted, it cannot be opened on the fly unless there is a major flaw in the encryption (a hacker may roll under the device’s Security to check for such flaws). If the encrypted file is copied and taken whole, it can be cracked by using a powerful computer; it takes 3d6 hours to crack.

Countermeasures

Any device can be loaded with ice, a slang term for a countermeasure which attempts to attack the hacker or their device. Ice has a rating between 1 and 6. When a hacker enters a device with ice in it, roll 1d6. If the result is below its Rating, the ice triggers. Ice counts as hidden data. A hacker can attempt to spot ice before entering the device. Roll a secret Hacking check versus the device’s Security to spot ice and disable it. The hacker can attempt this as many times as they would like, it just costs a turn each time.

The mechanism of these countermeasures is designed by the person in charge of security– it’s not one-size-fits-all. Create new mechanisms as you go, especially for installations with strong cybersecurity. They are traps in the electric dungeon, pitfalls and poison darts.

White ice is targeted at the hacker’s device. It might disable the device for a short time, trace back to the hacker’s physical location, or give them illusory inputs.

Black ice is targeted at the hacker’s body. It might attempt to kill them (roll to-hit and for damage as if they are shot), lull them to sleep, or install a virus in their datajack.

August 31, 2023

Cyberpunk: Hacking the Hazard Die

After hacking the Traveller Patron table into a cyberpunk context, I have one major skeletal component of what I suspect could become a little, hacked-together game system. I have a little recipe in my head: some basic gun combat, maybe Mothership or Trav, simple skill-based characters, and a bunch of grimy little procedures. A simple job, in and out.

The second bone in this skeleton is Strict Time Keeping. My usual preferred tool for this is Necropraxis’s Hazard System. I like having a flexible relationship between the game clock and the actual fictional minutes and seconds that are portrayed as having passed, such that the latter can be improvised or ignored¹. I also like having a consistent tool to turn to in order to handle time pressure, which I find especially important in the sundry heists and jobs that a cyberpunk game deals with.

A Hazard die for downtime or combat feels clumsier here, and I don’t expect to write one.

Mission Hazards

Roll on the Mission Hazard table once every turn, starting from the beginning of the infiltration.

Heat

Heat is a basic countdown ticker for simulating police response time. Each mission has its own Heat ticker, set ahead of time (the party can learn the Heat rating of the installation during legwork). The Heat which it represents depends on the police contracted to the installation in question. Typical or low-security installations will depend on the security of the district they’re based in. Other installations will contract private security. The following table serves as a rough guideline for Heat ratings. Heat ratings might be modified by circumstances such as blackouts, riots, strikes, acid rain, etc.

The amount of police response that comes down when the ticker hits zero should also vary according to the level of security of the installation.

August 19, 2023

Patrons for Cyberpunk Games

The setup, converted from Classic Trav: The party can seek a Patron by spending a week trawling bars, the hidden internet, phoning their contacts, etc.– this takes the whole party’s time, it skips any downtime actions or other big moves. They roll a die, and on 5+ they then get to roll on the Patron table to see what type of patron they’ve met. Fixers that trust the party can add in another roll on the party’s behalf, but if the job comes through them, the fixer takes their cut (results of Fixer on the patron table are jobs where the fixer hires the party directly– no cut is taken).

The table generates their general affiliation– you then throw together an NPC on the spot, run the meet, toss a final (relatively easy) reaction roll to make sure the meet goes well¹. The details of the mission are explained, and the party gets to accept or decline the mission. Only after this are the details of the mission determined (so that the party’s decline option doesn’t nuke your session)²

d66 Cyberpunk Patrons

note: the Rumor results on this table are intended to be specific leads the characters can use to ‘freelance’ a heist– info they can follow up on in order to score for themselves, without cutting in middlemen. Freely swap in other high-value results specific to your game: doubles should feel good on the Patron table. Matter of fact, swap in whatever you can think of.

First, some nuts and bolts, then I’ll explain myself: The table vaguely and generally gets Bigger as the numbers rise. A high result on either die should suggest greater risk and greater reward. This doesn’t really need to be there, it’s just for the dopamine. Roll it with casino dice³. The Snake Eyes result is an irresistible reference to the Tom Maddox short story. It means you’re marked, either by the law or someone you wronged or something else. Get out.

Also, this is gonna mean right about one in-game month per mission for the party, which I’m sure was the intention in Traveller– to simplify the bookkeeping. This means that the pay rates shouldn’t go lower than the party’s monthly spend. I would argue they should be a bit more than double it; this gives the party a month’s buffer they can use to decline a job next month, skip a month for non-job-hunting downtime, etc.

The lowest jobs on the table should probably be a touch below that two-month mark, and the highest jobs on the table probably hit near the six month marker. That’s my rough guide for how the remaining economics of the system can shake out. Assuming for a second that two-month mark is right about 5,000 credits (a number I absolutely just made up on the spot), I’d expect the pay to look about like the following:⁴

Finally, randomizing the final result would be done with another 2d6:

Pay Modifier Table

note: the Snake Eyes result here means the patron tries to screw you on pay. Roll again to determine the nominal price they’re offering; treat snake eyes on that roll as a result of 12.

I know what you’re about to ask: Why the fuck are you doing any of this?

Cyberpunk games are my ancient nemesis. I hate them fractally. If I look in detail at any given lore piece or mechanic, I invariably hate it, equal to my hatred of the system as a whole. These games– probably the ones you’re thinking of, maybe some of the ones you’re not– got me my start in the hobby, and so I’ve learned over time exactly what about them pains me.

Imagine it this way: if you were one of the prisoners in Plato’s cave, who knew only shadows, and after being dragged to the surface and after learning what cows and carts are, you returned to the cave and to the shadows before which you had spent your early life. You would look at that wall, and see the shadows crawling over it, but now, knowing the true shapes of cows and carts, you would instead perceive only the distortions caused by the roughness of the wall, its cracks and irregularities. And those features would represent more than the natural imperfection of the stone; they had been for all those years your deceivers. The faultless lies of the stone might engender a deep, irrational hatred– scar tissue from your old false beliefs.

The basic manner in which a session in Shadowrun or Cyberpunk 20XX begins is: someone in the party receives a phone call. The phone call then offers them all a job, and the party says “yes”. They always say “yes”, because to not accept the job would be throwing the GM’s session prep in the garbage. The games usually require and reward heavy prep, and so if all those NPCs, maps, and security systems are tossed after 30 seconds of play, nobody’s having fun. It’s a hostage situation. They might as well be soldiers receiving orders.

The dissonance here gets especially heavy when the party is betrayed, set up, or sent into a suicide mission. These then become things that the GM did to them, rather than consequences of the game. GMs usually avoid doing those things, because it feels unfair, because the game relies on the GM feeding discrete adventures to the party like a video-game level select screen.

The cyberpunk RPG wants to feel like a “social sandbox” where you navigate your contacts, allies and enemies, and make decisions on who to align with, who to help, who to save, who to screw. If a simple yes-no is enough of a variable to dismantle the entire illusion of player choice, how can it possibly earn consideration as a sandbox?

My answer to this dilemma is that the run shouldn’t exist until the players roll it. Basic jobs should be randomized and improvised, and should be simple enough that a GM can do this on the fly. These simpler missions should provide the bulk of the early gameplay– until the party builds enough contacts and reputation in play that the social environment can feel like a tactile and strategic environment for them to play in⁵.

August 18, 2023

Inevitability of Elision

I recently reread the excellent post by Jared Sinclair, Rules Elide, after it was linked in a discussion on Discord. The first time around, I had agreed with it in violent convulsions until it was over. I still, on the balance, agree with what Jared says here; when you roll a die to determine what happens, you are choosing not to play out the action. This is a narrower frame than Jared’s, a more cautious one (perhaps more cowardly). It is where I am left on reflection. And if I have a major concern with the framework, it is that to choose between a rule and a non-rule is a false choice. We choose between dictating a rule via text, and leaving the specifics of the rule to the table.

Let me explain. I have picked a couple of locks before, so when the first two examples come up, I can at least picture a lock in my head. There are a few basic ways that picking this lock can fail. Improper or inconsistent tension, too much or too little force on the pick itself, skipping or missing pins. Most of it is physical in the manner that combat is physical. You rely on an instinctive feel for the correct amount of tension on the lock, the force of moving the pick, and feeling for the click that represents a set pin. Failing to feel or execute these things will make you fail, or at least waste your time. I know this, because my practice locks have wasted plenty of my time, and opened for me relatively little.

Return to the example of the pure, verbal adjudication of lockpicking. The GM lets the player find the pins, then they go through them one at a time, waiting for the one that binds, and set it, before returning to the hunt for the binding pin. Finally, all pins are set and the lock opens.

I would refer to this example as a system, with rules. The GM knows the specific order in which the pins will bind. The GM then chooses to describe the action of each pin as the picking tools move it– whether it binds or not. After the binding pin is found, the GM says that it’s the right pin, and allows it to be set. All of the physical aspects of picking this lock are elided in favor of a loop: you try each pin, and succeed when a pin binds. Upon success you gain 1 pin point, when you reach (total pins) pin points, the lock opens. This is not a lack of rules¹.

A player attempts a difficult three-pointer in a basketball RPG: she narrates herself making a jab step, waits for the GM to state that the defender appears to bite on it, says that she converts her dribble into a step-back before rotating her posture square to the basket, jumping off of both legs, and with textbook form– smooth, Diana Taurasi shooting form, she sends it toward the basket. A thought exercise left to the reader: should the ball go in the basket? Taurasi herself is a career 36% three-point shooter², approximately a 14-or-above on a d20. It’s a difficult shot. Do you roll dice? If so, what do you elide?

Frames of Reference

The framing here puts the GM-player conversation on a plane separate from and above the rules, but the GM-player conversation itself is comprised of rules. Banal ones, like speaking in turn and collaborating to the game environment, but also meaningful and practical ones, such as choosing the frame in which a task is discussed, and confining the conversation to that frame. Are we discussing the door in terms of its lock? Or the lock in terms of its pins? Our fractal universe gives no hint as to which is truer: they all elide, they all oversimplify, they are all as much a waste of our time as the others– as much as playing any game is ever a ‘waste’ of time.

Jared gets to this same place: the combat example discusses the subsystem’s frame of reference, the arbitrary choice between randomizing the battle and randomizing the strike. The post itself becomes a meditation upon frames of reference– a good one, an elucidating one. I hesitate to draw a chalk line between rules and conversations here, though. The same discussion of frames of reference can be pointed at conversation, too. The GM in the lockpicking example could, for all it matters, ask the player which muscles in their fingers they’d like to twitch, and how far (and when the GM does choose a frame of reference, they choose it by its utility as a game mechanic!).

But this is not to say that rules elide any longer. It is to say that the choice of frame of reference gives us the opportunity to elide. Much of this leads to the same destination: that elision comprises an editorial stroke on the part of the game designer, or the GM, whichever chose the frame. That editorial stroke determines the shape of the action being adjudicated, which parts are emphasized (the pins and their order) or elided (the tension on the lock core). It helps determine whether we seek violence or fear it. What Jared describes here is important.

Where I find a substantiative difference is that I don’t see a decision for the game designer to make regarding whether to elide, or even whether to rule. They only choose to set a frame of reference, or to leave that choice to others. It calls us to the broader question about lacunae and which things a game designer should hesitate to design, that the final say can be left to the table.

August 16, 2023

Triangle Alignment

I have one of the planet’s most specific pet peeves: Displays of information which rely on two independent axes bother me greatly. Political compasses, personality tests, many of the “we promise we’re not implying causation” graphs you see in bad posts. They never can promise that their variables are actually separate from one another, only a certain agnosticism toward their relationship. The biaxial alignment system which has remained with D&D since 1977, then, is naturally going to irk me. By my nature I cannot ever be happy with it. I’ve lived with it, off and on, and in most cases it does little damage, but more often than not it sloughs from the flesh of the campaign and is forgotten. I readily admit that this one is on me. I’m sure that for most people, a system of two axes which create nine possible alignments is fine and probably doesn’t need significant overhaul, unless you disagree with the concept of alignment in the first place (such as its resistance to change or circumstance, its claim at being innate).

But here’s the other thing. Good and evil are concepts that actively resist fun. They require a sort of hall-monitor moral policing that does nothing for anybody, because they suddenly assert that your character is the type that would never do the evil thing. Or the good thing. Whatever. And if your party is of mixed alignments, are you supposed to performatively disagree over whether to slow-roast the village children with barbecue sauce? I understand the basic purpose of good and evil alignments– it’s to pre-emptively absolve the party of any pangs of guilt they might feel after using the flammable organics of 1.5 tons of bat guano to incinerate a small society of goblins that had lived in the cave network¹. But I think we can aspire to more.

I know. My last post set upon the gates of Truth with torch and pitchfork; now I’m trying to go beyond good and evil. I promise I didn’t plan it this way.

Of course, prior to Good and Evil, the alignment system for OD&D was simply: Lawful, Neutral, Chaotic. Back then, Good and Evil were sort of rolled into these– selfishness was rolled into Chaos, selflessness into Law. Some creatures of nature, like dryads and fae, were Neutral, implying that even in this simplistic format, there was a hint of the later druidic justification of Neutrality actively seeking a balance between the alignments, rather than it simply being a lack of one.

It just can’t decide how normative it wants to be about all of this. Law is kind of the good guys, Chaos is definitely the bad guys. Law ultimately represents a very judeo-christian standard, because of the Cleric’s existence, and Chaos by virtue of its partnership with Law in the binary myth, has little choice but to be a teensy bit satanic. Neutrality is somehow kinda pagan.

In a game of medieval fantasy, where you’re likely to end up involved with Churchlike entities, you likely will have Evil (or Evil) enemies, and the roping-in of mythology and Tolkien necessitates a treatment of Celtic paganism, it does well to have something like* Alignment. Alignment languages are ultimately a cool idea, it just doesn’t add up if the alignments are poorly-defined (the language of neutrality stands out as especially hilarious). I’m not ready to roll the whole thing up and put it in the garbage.

Neutrality is split between a few categories. You have the nature-beings that seem to believe in some Neutral Positivism. You have things which are basically incapable of being aligned with anything, like animals. You also have things which are categorized elsewhere but are also allowed into neutrality to show that they’re not all good/bad. And you have humans (and lycanthropes), which can be whatever they want to be.

Chaos in OD&D was basically just all the evil stuff. But if we rope in the later post-hoc Chaos, it becomes split between things which have a sort of Chaotic Positivism, and stuff that just can’t really exist elsewhere.

Law, by contrast, is easy. It’s civilized medieval Christian Europe and the things it likes.

Toward A New Alignment

My play here is to split the chart in three: Law, Nature, and Death. You could keep Chaos instead of Death, but frankly, Chaos was only ever defined as an antipode to Law, and I don’t want Nature to be a third wheel, here. They should all be orthogonal to one another. Independent things that creatures might worship or align with.

Nature takes the pagan thematic of the dryad side of Neutrality and makes it explicit. Law vs. Nature is an awesome conflict, and doesn’t even do a terrible job when it’s painted onto the actual church conflicts with European paganism. It takes the most interesting positive aspects of the Neutral alignment, and gets to amplify them because they’re no longer lashed to a middle-fence between two opposites.

Death gets to do all of the evil stuff of Chaos, and of Evil itself, because it’s Death. But unlike Evil, it has a point: You are going to die, death is what provides life with meaning, death unites all things. You can imagine worshippers who might have a healthy relationship with death. Animal sacrifices, grim but florid poetry. I also find it easier to define and imagine than Chaos, which is such an abstract concept that it becomes difficult to imagine yourself worshipping it². As a bonus, it has precedent in Caverns of Thracia, where death-worship is used beautifully. And, just as important as the above: Death is metal.

Finally, Law remains Law: authoritarian, civilized, colonial. Of the three, to me, it represents perhaps a purer villain than Death! But it retains a certain necessity, and not just a necessity for some law: a necessity for some of those who obsess with law and with authority.

These three feel as if they do all of the same things as Law-Neutral-Chaos, but by making the system trinary, they’re able to cover more ground in addition.

Ranked-Choice Alignment

Since alignment is no longer a placement along a single axis (or two axes), it becomes possible to consider more than one selection. You could have, for example, a primary and a secondary, with the third acting as an ‘opposition’. I might characterize stereotypical Christianity as being Law primary, Nature secondary, and against Death. You’d probably note this as L(n). This would turn it into a bit more of a Fantasy Horoscope, which I think is fun, but probably not for me– I don’t prefer to think of these things in degrees so much as in directions.

August 13, 2023