Alt-History Technothriller Shadowrun

[Daddy Warpig]

New to the Den. A big Hi! to everybody.

I'm building Altered States, a Alt-History Technothriller Shadowrun. Let's break that down.

Alt-History: This doesn't occur in the canon Shadowrun timeline. Altered States has its own timeline, with many events that are similar to the canon (such as a VITAS plague) and many others that are wholly new. There are several differences, among them being:

The US still exists (but is almost Balkanized). NAN has collapsed (plus it had different boundaries in America, and never existed in Canada). There was no Resource Rush and no Seretech and Shiawase decisions, so no corporate extraterritoriality. Mexico, India, and Coastal China (the Republic of China) are the top three nations. UGE and Goblinization occurred at the same time in 2012 (an event called the Emergence). No Immortal Elves or "4th World" Great Dragons. No Toxic Shamans. And so forth.

Technothriller: Altered States is a technothriller campaign, described as "Shadowrun, as written by Tom Clancy". Technothrillers are military- and spy-oriented. They focus on national clashes, espionage, special forces units, and bleeding edge developments. James Bond, Jason Bourne, and Evelyn Salt (from Salt) are all inspirations (as well as Clancy novels, obviously).

Player characters are specially trained agents of the government, instead of criminals. Other than that, it's pure Shadowrun.

Stealing data, blackmail, wetworks, destroying facilities, infiltrating installations, extracting people, and all the other Shadowrun goodness we've come to know and love. Instead of breaking into a Renraku gene lab, you're breaking into an Aztlan air force base.

Many of the changes in the history of the campaign are to support the themes of the campaign (countries instead of corporations) and to develop some aspects of the setting more than in the official material (such as the alt-VITAS post, forthcoming).

Shadowrun: This is a cyberfantasy setting, just like Shadowrun's. It has hermetic mages and shamans, paranatural creatures, and Orks, Trolls, Dwarves, and Elves. It has hacking, rigging, and cyberware. It is still Man meets Magic and Machine.

It isn't a -punk setting, and draws inspiration from other sources. But it is definitely Shadowrun, though different than the canon.

As I finish materials, I hope to post them here. Comments or ideas are welcome.

Links to Altered States posts:

VITAS. An expanded writeup of the classic Shadowrun disease.
The Collapse. VITAS caused chaos. This tells what and how.
Africa in 2032. Tribal magic, markets for enchantments, techno-tribalism.

[Daddy Warpig]

###Classified###
“Mission Statement”
Task Group Aztlan
The Office for Strategic Analysis
24 June, 2032

The United State's current internal and external political and military crises are linked by a common chain of causes: VITAS - The Collapse - The Awakening - The NAN War - Defederalization - The Long Depression. The military dis-symmetry between Aztlan and the United States is a result of these events.

If the current ceasefire is broken (and projections indicate an 85% likelihood within the next 2 years), that vulnerability means the United States, in all probability, will not survive the ensuing war. Some parts will be annexed by Aztlan, the rest will become satellite states dominated by same.

Our purpose is to break this chain of events.

Task Group Aztlan has recently been restructured, to maximize our effectiveness in dealing with the looming threat. Task Group Archives has prepared a portfolio of various briefings related to the origins and nature of the challenges we face.

Members of the TG-AZ Central Committee, and invited guests, have provided annotations expanding on these briefings. Files to follow.

The Director

###Classified###

File List

File #001 - VITAS Pandemic (Annotated)
File #002 - The Collapse (Annotated)

[Korgan0]

This looks interesting, but without corporate extraterritoriality (and presumably super-powerful megacorps as a result of that) what kind role, if any, will megacorps play in this kind of alt-history?

[Daddy Warpig]

This looks interesting, but without corporate extraterritoriality (and presumably super-powerful megacorps as a result of that) what kind role, if any, will megacorps play in this kind of alt-history?

Corporations in Altered States are what they are in the real world: business entities, subject (in strong states) to local laws and taxation.

Microsoft, Apple, Google, Toyota: these are the businesses of the present, and the businesses of 2032 are pretty much exactly like them. (Though of the named companies, the American ones no longer exist.)

There are some de facto "extraterritorial" corporations, that operate in failed states (of which there are plenty) or tribal areas (places where modern States, in the political science sense, have ceased to exist). Because local government is weak or nonexistent in these areas, companies can subvert or avoid the rule of law. These are rarities, however, and are (as of now) not de jure extraterritorial entities.

One example of a company with its own "territories" (a series of towns) is the Thaumaturgical Acquisitions Corporation. It operates trading posts in tribal Africa, purchasing enchanting supplies (telesma, focuses, fetishes, material to make the same, and other magical items) from local tribes to export to world markets. TAC is a rare exception, however. (I have a long — at least for discussion boards — writeup of Central Africa, which I'll post later.)

Like most technothrillers or spy thrillers, this campaign revolves around national conflicts, not megacorporate intrigue. The primary opponent, in the first phase of the campaign, is the militaristic and expansionistic Aztlan (and the national corporation the government owns and operates, Aztechnology).

Shadowrun's extraterritorial megacorporate setting has a lot of advantages, in terms of gameplay, such as the ability to do runs against many targets, without leaving the same city. Switching to a spy thriller, nation-based model makes the campaign less focused on a locale, and more focused on world travel.

EDIT: Clarifying a minor point.

[sabs]

Did you call Toyota a named American Company?
Toyota is a Keiretsu, effectively a successor to the Toyota Zaibatsu. It's motor division by itself is 25th on the world list of largest companies.

Now I'm not saying it would still exist. But putting Toyota in the same grouping as Apple and Google, is just silly. Apple is 22nd on the list, and Google 102's.

[Daddy Warpig]

Did you call Toyota a named American Company?

No. I said that, of the companies named, the American ones no longer exist in Altered States.

I know Toyota is Japanese. I was just listing it as an example of a corporation.

EDIT: I went ahead and revised the original sentence to make it clearer.

[Daddy Warpig]

Note: The background documents for my campaign are fairly long, especially for forum posts. I am breaking each individual article up into several parts, each part short enough to comfortably read, then posting one part a day per thread. This means that people wanting to read individual posts can do so easily, and can keep up with a thread without a significant investment of time.

Coincidentally, this also makes commentary and feedback much easier: you only have a small piece of material to respond to, so don’t have to post a novel to give feedback or critiques. (Both of which I welcome, as that was the reason for posting this material.) This is today’s post.

Point of Divergence

I’m writing Altered States as an alternate history, which hews fairly close to real world institutions and people (again, see Technothriller). Alternate histories ask the question “Given event Y, what might happen?” (The unstated parenthetical being “…that makes a good story.”) For example, “What if John F. Kennedy was never assassinated?” The critical event is called the point of divergence.

In the case of Altered States, there are two: VITAS and the Awakening of Magic. The campaign background is built around deciding how the real world might react to those two events. (The unstated parenthetical being “…in such a way that it creates an interesting campaign setting.”)

The first point of divergence occurs in July 2010, when VITAS begins spreading. Up until that event, the campaign world and the real world are nearly identical.

I say “nearly” because I use fictional characters and organizations in building the background. Other than those, the background material uses real world elements and facts as much as possible.

For example, the number of troops on deployment outside the US in 2010 is taken from a Pentagon document, the size of the Strategic Petroleum Reserve in 2010 is factually accurate, and so forth. I’ve tried to research each of these topics (within the limits of my available resources) and cite them correctly.

If I’ve made any errors in terminology (such as military or medical procedures or jargon), I’d like people to point them out. I want to get each part as correct as possible. (Again, Technothriller.)

Thanks in advance to those who take the time to read and respond. It is appreciated.

EDIT: The "present day" of the campaign is 2032, 22 years after VITAS and 20 years after the Awakening.

[Korgan0]

Please, don't do the one posts a day thing. It does nothing for those of us who don't want to read all of it, and for those who have the time and who read fast enough it's just obnoxious. Go ahead and post all of it, and people can read it in their own time. I actually want to read this, and I'd rather skim through it in an hour or so than read paragraph-length stretches over a week.

[Daddy Warpig]

Please, don't do the one posts a day thing.

Well, this is a question I've asked on other forums, and never received an answer: what is a convenient amount of text to post?

I personally find my eyes glazing over if a post gets too long, and the more I post in one day (or one post), the fewer responses (and, I assume, readers) I get. (Plus, the more posts in a row from the same poster, the greater the chance earlier posts just get overlooked.) I definitely don't want that.

I really don't want to overwhelm people with walls of text, TL;DR is my own personal enemy. I understand why, we all have real lives, so I'd like to be as accommodating as possible.

Right now, my limit in one post is about 500 words. (Just over half the length of an average newspaper opinion column.) Most of the time, that's a pretty long post. I try and break up the text with section breaks and bolding/italics, so it's easier on the eyes, but that can only go so far.

There's a lot of material I could post, most of which is deep background and kind of dry. (With the in-game material, I'm emulating encyclopedia entries and federal reports, so a bit of dryness is necessary.)

But I really can't post it all at once (there's pages of info), so what length is "just enough to read to be satisfying, but not so much it stuns the reader"?

How much is too much?

EDIT: Although I do appreciate your interest. It's gratifying, I won't lie.

[Zaranthan]

Well, this is a question I've asked on other forums, and never received an answer: what is a convenient amount of text to post?

Internet Forum ProTip: Read the stickies.

http://www.tgdmb.com/viewtopic.php?t=34248
http://www.tgdmb.com/viewtopic.php?t=28828
http://www.tgdmb.com/viewtopic.php?t=28547
http://www.tgdmb.com/viewtopic.php?t=33294
http://www.tgdmb.com/viewtopic.php?t=35813

If you've got the material in a readable format already, just infodump it. We're smart people around here. We can pick out the bits we want to talk about.

Alternately, if you want more focused ideas, check out the various heartbreaker threads people post. Pick a chapter of your game, and infodump just that.

[Daddy Warpig]

Read the stickies.

http://www.tgdmb.com/viewtopic.php?t=34248

6,000 word posts?

Well, if that's the convention around here, I can keep up.

(Just FYI, I have been reading the "Cyberpunk Fantasy Heartbreaker" series, and most of Frank's posts were much shorter than those you linked to. They seemed more like what I have been used to posting. I took my cue from those posts.)

Right. Infodump coming up.

[Daddy Warpig]

The Office For Strategic Analysis

The Office for Strategic Analysis is an intelligence, research, and special operations directorate. In 2032, it is the only US intelligence service still functioning.

OSA was founded to predict future trends and develop plans to address them. Gradually it shifted to dealing with the predicted crises as well.

Lead by the enigmatic Director, the OSA has a small group of highly trained agents, divided into Special Task Squads, that travel the globe protecting the interests of the nearly-Balkanized United States of America. Though the agency's focus is world-wide, the most critical oncoming crisis is the looming war with Aztlan. The agency predicts a war with former Mexico within the next two years, a war the US cannot survive.

History

In 2010, just before the Red Days began, a Pentagon planning group met with the stated purpose of either preventing or recovering from the kind of chaos that followed VITAS as it spread across the globe. It was given the unwieldy name of the Emergency Military Supplies Acquisition Program (EMSAP). EMSAP developed the plan to restore military and civilian infrastructure after the Collapse, and the commodity rationing plan that provided much of America food, power, and warmth throughout the last few months of 2010 and nearly all of 2011.

Reclamation, as the effort became known, was transferred to state authority in early 2012, after the military became embroiled in fighting the NAN War. Anti-insurgency units, recalled from Afghanistan and Iraq, had been key in Reclamation, and those units formed the backbone of the Rocky Mountain and Great Plains assault forces. They also suffered the highest casualties.

During the conflict, EMSAP itself coordinated with various governors to keep the front-line troops supplied. As supplies of key parts ran low, they began the effort to retrieve stores from Diego Garcia, Germany, and surviving supply caches in Afghanistan and Iraq.

After the Night of Ghosts and Terror in late 2012, the President negotiated the Treaty of Wounded Knee, and the surrender to the NAN forces. In the aftermath, the impoverished Federal government was forced to demobilize the national military structure, gutted by the war. Responsibility for maintaining military forces fell on state governments, and many cashiered soldiers and officers joined the National Guard and state militias (as well as Private Military Companies and other mercenary organizations).

EMSAP transitioned into a purely predictive role, providing incredibly accurate strategic, economic, and political forecasts for governors and the President. It was during this time that the mysterious Director came to command EMSAP. Under his auspices it became the OSA, the Office for Strategic Analysis.

Mission and Organization

The OSA has a reputation for uncannily accurate predictions about the future. No one knows what precise methodologies its analysts use. Rumors variously cite Artificial Intelligences, powerful divination magics, or complex sociological algorithms. (Alternately, psychic visions and alien visitors are common node-talk.) Collectively, OSA analysts are referred to as “The Oracles”.

Though the OSA provides reports to state governors (through intermediary organizations), its primary focus is to serve as the long-term strategic planning office of the Federal government, tasked with identifying emerging threats and neutralizing them. The Director reports directly to the President, no other individual has jurisdiction or oversight of its operations.

The CIA collapsed in 2010, along with nearly all the Federal government. In 2016, OSA began a foreign intelligence program, to gather information from the most likely strategic threats, including Mexico, China, and India. It soon expanded those efforts world-wide. The first regional Task Groups (specialized think tanks focused on specific regions or tasks) were founded during this period. The OSA is the only foreign intelligence service of the defederalized United States, replacing the CIA entirely.

The OSA began working closely with DARPA in 2019, providing the fruits of its industrial espionage to the research directorate, and testing and deploying DARPA’s advanced tactical and intelligence concepts (such as the semi-autonomous Expert System Drones that patrol the NAN border). DARPA had transitioned into joint technological and magical research, and the OSA proved adept at identifying fruitful avenues of research and developing practical applications of same. The world’s first physical adept training program began at DARPA and came to fruition under OSA patronage.

OSA began deploying special forces units in 2021, using them to help shape events in many key hotspots. They served as advisors to the Eastern Alliance during its war with the Holy Islamic Caliphate, and were suspected of the assassinations of key HIC leaders, including Turk general Asil Kaya (called “The Demon of Athens”). OSA forces operated with Indian units in the anarchic Pushtun areas of former Pakistan, helped secure Kurdistan against deserting HIC units, and worked with Israeli forces in former Syria and Iran, during the breakup of the HIC.

After the conquest of the Pueblo-Navajo Coalition in 2029, Task Group Aztlan became the primary focus of the small agency. TG-Aztlan has developed and deployed technology unknown to the rest of the world, including the Direct Neural Interface and working cybernetic implants. Novel magical weapons and countermeasures are also a key focus for TG-AZ.

Within the last year (2031) TG-AZ has increased its recruitment efforts, bringing into the OSA skilled soldiers, police officers, magicians, and other prospects from across North America and forming them into small Special Task Squads, trained in espionage and special ops. The looming war with Aztlan has focused the efforts of the Office, and the Director is determined to win the war at all costs.

Funding

As with the rest of the greatly reduced Federal government, the OSA is funded by tariffs and fees (as the Federal Income Tax has proven difficult to reinstate). It receives a disproportionate share of Federal funds, something of a sore spot with surviving Federal agencies.

Each President has continued funding the agency despite complaints, as each has relied heavily on its accurate forecasts and effective and sparse use of force. No other agency could replace the OSA, and no President has ever tried. The Director has survived four Administrations, and looks likely to survive many more.

Note: The OSA is the primary patron for PC's in Altered States. All PC's are members of an OSA Special Task Squad. The Office assigns missions and provides intelligence and logistical support.

[Daddy Warpig]

North American History Summary, 2010-2032

VITAS kills 42% of the US. There's a general breakdown in society (something like the first season of Jericho). The economy vaporizes (5-digit inflation, companies out of business, banking system collapses) and most government agencies collapse. The US military is called in to restore order.

The military starts an emergency program to secure supplies for itself, like food and fuel. When they have a surplus, they print ration coupons for their excess, and use it to pay people. These coupons become a de facto second currency, replacing the grossly inflated dollar.

The guerrilla war with NAN happens. The military fights back, and is being defeated. States are placed in charge of printing ration coupons; effectively each state prints its own money.

The NAN War is lost, the tax base no longer exists, and the Federal Government has almost no income. Government agencies remain shut down.

Plus, people are a bit peeved over being abandoned just after VITAS, so view the central government with great resentment and cynicism. They turn to their own states.

State governments take over many duties of the Federal Government. The US has become "de-federalized", reverting to the very weak government of the Articles of Confederation. (Effectively Balkanization, in all but name.)

As a result, 40 separate legal and regulatory schemes. 40 different dollars, all of which vary in value against each other. In effect, 40 separate countries. (Though currency blocs develop later.)

A global economic depression hits, but some countries come out of it. Usually, those who restored order quickly. One of whom is Mexico.

Mexico has one country, one currency, one legal and regulatory scheme. And a governing general who is harsh on crime and corruption. They emerge from the Depression in the late teens, and over the next 14 years become one of the top three countries in the world, in economic and military terms.

The US, due to "defederalization", stays mired in a depression until 2032. It is weak economically and militarily.

Awakened Yucatan rebels seize Mexico City and rename the country Aztlan. They nationalize... everything and combine the various companies into Aztechnology (a State-run industrial giant). They attack the NAN (and California and Texas), seizing New Mexico and Arizona (the Pueblo-Navajo Coalition).

The NAN and the California and Texas armed forces push back, and eject Aztlan forces from their territories. A cease fire is declared in 2029. In the wake of the war, the NAN collapses.

Aztlan turns its attentions south and conquers Central America, eventually seizing the Panama Canal. It begins to reinforce its North American borders with troops. Its hostile intentions are clear to everyone.

During the next three years, a lone government agency, the Office for Strategic Analysis (OSA), tries desperately to contrive a means for the US to survive.

Enter the PC's.

[Korgan0]

Read the stickies.

http://www.tgdmb.com/viewtopic.php?t=34248

6,000 word posts?

Well, if that's the convention around here, I can keep up.

(Just FYI, I have been reading the "Cyberpunk Fantasy Heartbreaker" series, and most of Frank's posts were much shorter than those you linked to. They seemed more like what I have been used to posting. I took my cue from those posts.)

Right. Infodump coming up.

In all fairness, Frank was basically brainstorming stuff for an RPG he's writing in his own spare time, not putting out fully realized material.

So, pretty much every edition of Shadowrun, as far as I know, has fucked up hacking. 4e was a clusterfuck (although Ends of the Matrix mostly fixes it), and, as I understand it, 3e and previous ended up with the decker playing their minigame while everyone else ate cheetos, or vice versa. Is this going to be the kind of game where you can have a hacker character with sufficient tools to do everything required of her, and if so, how will you avoid those problems?

[Daddy Warpig]

Is this going to be the kind of game where you can have a hacker character with sufficient tools to do everything required of her, and if so, how will you avoid those problems?

Starting with the easy questions, I see.

Hacking

Let's talk real-world hacking, for the moment. To simplify real-world hacking immensely, it boils down to this: hackers use their knowledge of computer systems and the organizations that run them, in order to illicitly gain access to computers.

Knowledge of computer systems means you know what to exploit. Man-in-the-middle, buffer overflow, default admin accounts/passwords on OS's: all these are real world hacking techniques, which require technical knowledge of the systems in question. (There's also phreaking, but with the effective death of modems, this is a mostly dead art.)

That's not all, however. Real world hackers are as much con men as they are computer specialists. Hence "social engineering", bluffing your way into getting people in organizations to give you access to manuals, passwords, or equipment you shouldn't have.

(There was a notable case of this recently, where a blogger had their Google account hijacked, their Twitter account compromised, and their computer wiped because a hacker "social engineered" Amazon and Apple. Policies are being rewritten at both companies as a result.)

Game Mechanics

On a very simple game mechanical basis, the above can be represented by a Hacking skill (representing knowledge of systems) and a Difficulty Number for the target system (representing how easy it is to exploit). Success means you can use the computer system, failure means you can't, critical failure means you get caught.

The hacker's skill roll can be augmented by data gained via social engineering (a Fast-Talk skill check giving you a bonus to the hack roll), or it can even be obviated: if you steal an admin's login, you don't need to hack to use their account.

(There are many other approaches one can take to this, mechanically speaking. This is just a simple one that matches the real world while also abstracting it.)

The above is a real-world friendly view of hacking, so far as I know. Bruce Sterling's "Hacker Crackdown" and articles on prominent hackers (many from Wired) constitute my applicable source material here.

State of the Art, 2032

Back to the campaign. It is 2032, and the world has only advanced about 10 years beyond "present day" technology. (Due to the Collapse and the Long Depression.) AR glasses, contact lenses, or goggles are new and exciting consumer technologies (like multi-touch tablets or phones today).

Mechanically speaking, hacking follows the real world pattern (the skill checks I talked about above), because the Internet of 2032 is essentially the same as the real world's, just more advanced (faster processors, fatter bandwidth, greater storage densities, etc.).

DNI (Direct Neural Interfaces) are skunkworks projects (in the Lockheed sense). They exist as experimental prototypes, and players can have them. They use the same rules as hacking, but you're faster and better at it.

(The same holds for cyberware. Why? Because Technothrillers always include an element of "cutting edge" or speculative technology, such as the caterpillar drive from The Hunt For Red October. That's where the "Techno" comes from. Cyberware/bioware and DNI are some of the cutting edge technology of the campaign. There are also magical innovations, such as physadept training, which fulfill the same role.)

So, a hacker's role (in this game) is much like a rogue or thief from D&D. You go along with the party and make skill checks when you need to breach a computer.

Face characters can help, because social engineering is kind of their thing. Bruiser characters can beat the truth out of people. Riggers can use their drones to spy (overhearing conversations, using electrosensing equipment to spy on keystrokes, watching as people type in passwords). Technical characters can help override or spoof biometric logins.

In other words, hacking can be a team effort, but if not it's a few skill rolls in play, not a separate mini-module.

Time Keeps Ticking...

Part of the structure of the campaign is time jumps. After the first series of modules, I'll advance the timeline 3-5 years. At that point, the Crash (or my version of it) has happened, and the Internet is replaced with the VR Matrix. An entirely different paradigm holds for that network, which I'll post about later.

Note: I'm not using the SR rules set (for various reasons). Right now, it's a toss-up between Savage Worlds and a house-ruled version of Torg. So no matter how bad SR20th fragged up the Matrix rules, it doesn't matter.

[zeruslord]

From a real-world perspective, there's a few different kinds of "hacking". I'm mostly going to be talking about the computer science side of things, rather than the social engineering aspects. There's a number of steps to the classic form of hacking, most of which are best done in the comfort of your own home, or better yet, a secret hideaway with whiteboards and mountain dew.

• Exploit Generation: finding security holes that you can exploit to run code on another machine, and then developing the exploit to the point where you can consistently escalate privilege instead of just crashing a browser. This is the part that takes serious skill in the real world, to the point where people who don't do it and instead use other people's prepackaged exploits are called "script kiddies". Once the developer of the software you're exploiting finds out about the exploit, they patch it and release an update, so they generally have a limited lifetime. This is really a downtime activity, and can be substituted by buying exploits or using vulnerabilities that are already known, but both of those are more likely to get patched.
• Packaging: writing the code that does the thing you're really after. This can be as simple as allowing remote access to a root shell or as complicated as changing motor settings on industrial controllers so that centrifuges self-destruct. This is also a downtime activity, although it tends to be much less researchy than exploit generation, and really only needs to be done once for each objective.
• Insertion: getting your attack into a system. The classic method is email, either containing an attack on the email client itself or a file with an attack on another program. The most common methods today are attacks on flash, the browser, and acrobat reader. Other ways include attacks on any network-connected program, auto-run stuff on CDs or flash drives, and pretending to be a legitimate program so users will just run your code. This can be either a preparation activity, where you put your hooks into a building's security system in advance, or be done during the run, especially with systems that are isolated from the network.
• Actual Use: many programs, especially the ones that you'd be using during an infiltration, first get access and install themselves and then lie dormant until activated from outside. Others just let you connect and give commands as though you were an administrator, which means you need to actually go through the motions to do what you wanted on the machine. This is usually going to be done during the run.

There's also some other things that don't fall into this workflow but are still primarily technically rather than socially based, mostly related to information rather than running programs.

• Dehashing: So, you got the password database, but you aren't done yet. Most password stores are hashed, reducing each password to a number through some algorithm, so that people who steal your list don't get the raw passwords that might be reused on other systems. There's still a way around this: there aren't nearly as many unique passwords as one might hope, so you can just hash every possible short password and likely long password, store the password-hash pairs to produce a "rainbow table", and then look up the hashes you got from the database. Rainbow tables can be partially prevented by using a "salt", adding a random but consistent string on to the beginning of the password before you hash it, so that a new table needs to be generated for each salt you use (Ideally, a different one for each password in the database). Generating a rainbow table is very slow, and storing it takes huge amounts of storage, so salting all the hashes with the same salt gives you a much longer window to notice the theft and get everybody to change their passwords. Giving each of them its own salt makes doing mass cracking totally infeasible, unless you use a very bad cryptographic hash (you want one fast enough that legitimate users don't have a significant added wait, but slow enough that producing a rainbow table isn't feasible). Even in 2012, not salting is incompetent, and by 2032, I wouldn't be surprised if it was considered criminally negligent, so whether you can do this is basically DM fiat.
• Decryption: You've got some encrypted data, but not the key, or possibly only part of the key. In order to break the encryption without the key, you need a huge advantage in knowledge, computing power, or both. At this point, your best move is to steal the key, be the NSA, or have incompetent enemies using out-of-date protocols.
• Man in the Middle: Any circumstance where you want to intercept and/or alter the contents of a message in flight. Now, if the message is encrypted, this can be really hard - see above. If it's not encrypted, this can be laughably easy - most communications between computers are passed through routers, modems, and other computers, and if you can get control of one of those, you can just lie about what the other side said, or pretend to be each side to the other one and tell them whatever you want. Even if it is encrypted, if a key isn't prenegotiated, or you have enough time to watch on a key-switching connection, there's still a chance you can break in.
• Denial of Service: when you want to simply prevent communication, rather than manipulate or listen to it, you can just send so many messages to one end that their local infrastructure can't handle them all. This requires that your local infrastructure be bigger than theirs, which makes you real easy to find, or that you are sending messages from a bunch of different points. Typically, the way this is accomplished is a botnet, a large group of computers that you control through a virus, although there have been some instances where people have volunteered to launch part of the attack from their own computer.
• Certificates: You know that little VeriSign checkbox that shows up when you download something? They're a for-profit private company. Also, they sold the certificate department to Symantec a couple years ago (also a for-profit company). They can only sign a key in two ways: "this certificate belongs to who it says it does", and "you should trust the holder of this certificate just as much as us, including letting them sign certificates like this". Finally, they aren't all that good at making sure people are who they say they are before giving them a certificate asserting that they are who they say they are.
• Physical Access: Unless the target has encrypted their files or their whole hard drive and the machine is off, getting physical access to the machine is a huge advantage. It's a lot easier to unplug a machine than to shut it off remotely, you can put whatever you want on the hard drive and lie about when it got added, you can install whatever you want, and you can put anything physical you want in, like a keylogger or a wireless connection. If you can take the machine with you, it's even better. You can get around hardware security devices by just taking them off the circuit board

Mechanically, this plays out a lot like what you described. There's going to be some skill rolls made during the legwork phase to get some initial hacking done, and for the most part, things done during the run are mostly going to be time and pressure issues, not issues with doing it at all. I'd put in degrees of success for the legwork phase, with some ability for the player to trade off effectiveness with evidence left behind. I'd make the Hacking be an extended test or equivalent, so each unit of time spent can get you more effects on the security system and the like.
Virtual reality is certainly going to be a better way of hacking than augmented reality - in the worst case, you can have a VR simulation of your AR or physical interface. However, the version of the matrix UI used in most cyberpunk doesn't really make sense - the whole physical presence inter-node navigation metaphor is really bad, and expressing your attempts to deal with antivirus programs as melee combat and especially translating back from the metaphor to hacking is probably a challenge for human-scale AI. I'm not really a UI designer, so I can't tell you what it will really look like, but I'd expect something more like Minority Report's wall-screen or a freely variable collection of screens and interface devices.

[zeruslord]

The Hacker Crackdown seems to be a good sociological treatment of hacker culture in the late 80s for a lay audience, but not especially relevant to game mechanics. Most of the technology it talks about is obsolete, especially on the computer side of things. BBSes gave way to hosted forums when private hosting became common and various chat clients as costs came down.

You seem to be somewhat misunderstanding the way DARPA works - it's mostly about giving out research contracts to universities and private companies, not about doing research itself. Of course, deciding what contracts to seek bids on and who to award them to takes a significant amount of expertise.

As far as post length goes, the Den has a rather silly technical limit, and practical limits mostly based on how much of a pain it is to edit a multi-page post.

[Daddy Warpig]

The Hacker Crackdown seems to be a good sociological treatment of hacker culture in the late 80s for a lay audience, but not especially relevant to game mechanics.

It's not my sole reference, but (when abstracted) it does give a great insight into exactly what hacking is (my definition):

"Hackers use their knowledge of computer systems and the organizations that run them in order to illicitly gain access to computers. Hackers are as much con men as they are computer specialists. In addition to exploiting technical flaws in programming, they use 'social engineering' to bluff their way into getting people in organizations to grant them unauthorized access to information and equipment."

That definition is as relevant today, as it was in the late 1980's.

Most of the technology it talks about is obsolete, especially on the computer side of things.

Sure. The mainframe OS's common in Crackdown's time, specifically UNIX, now run our freaking phones (Android and iOS are both Unix OS's).

As for sources, I keep up with computer industry news (in Wired, Ars Technica, and other places), mostly as a hobby. I've read about the recent hijacking of the blogger's account, Stuxnet (which you referenced in your first post), buffer overflow exploits, Sony's rootkit DRM scheme, the recent certificate spoofing on the iPhone, poisoned DNS servers, the story behind the first viruses, wardriving, and many other topics. By reading these stories, I've learned about exploits and followed them in the news from the time they first appeared to the time they became obsolete. Been doing it for 15 or so years now.

I'm not a hacker, I'm not even a script kiddie, but I've read enough to formulate an abstract definition of what hacking is. That definition will continue to hold true, even in VR environments of the far future.

Hackers find loopholes in computer systems and exploit them. This will be as true in 2100 as it is today. So long as there are computers, there will always be exploits and people willing to use them. (And specialists dedicated to hardening systems against them.)

Using that definition, I came up with the mechanics in the first post. Speaking of which...

Mechanically, this plays out a lot like what you described. There's going to be some skill rolls made during the legwork phase to get some initial hacking done,

Which dovetails well with Shadowrun in general. Legwork is an integral phase in all runs. More, it also works for social engineering. While the hacker is brewing up his trouble, the team can scare up pieces of equipment or information that will make his life easier during the run. Or the hacker can break up his time between social engineering and tech prep. Ideally, he should do a bit of both.

And physical penetration of a facility is all about gaining access to the hardware of the computer systems in question.

So, yeah, I think those mechanics will work.

You seem to be somewhat misunderstanding the way DARPA works

Oh, I totally misunderstood. I'll have to do some research and rewrite that bit. Thanks for the info.

However, the version of the matrix UI used in most cyberpunk doesn't really make sense

Yeah. On another gaming board, I posted a whole rant about how silly the Tron metaphor is, and how it doesn't match what computers are and do, how it's fantasy, not science fiction. We then bruited about ways to make VR hacking work. I think I've hit on a model that's both plausible and gameable, but that's a topic for another post.

[Daddy Warpig]

Cyberpunk VR

Let’s be brutally honest: the computers and interfaces in Cyberpunk fiction are bogus. They simply don’t match the real world at all. Contra Nueromancer, Snow Crash, or Tron, the Internet is not a dungeon, accessing data from another system isn’t a dungeon crawl, complete with wondering monsters, and trying to subvert security measures doesn’t involve a “cybercombat”, complete with sword fights or disk wars.

Tablets have made clear what I’ve been claiming for 17 years: from the POV of the user, the Internet isn’t a dungeon crawl, and accessing a site doesn’t mean you “go” there in a physical, spatial sense. Browsing the Internet is like reading a magical book with infinite pages, many of which are linked to each other. “Magic” because it’s a book that plays music, shows movies, and lets you edit and create information. A book, because the information appears on your screen, like characters on a printed page, and clicking a link loads up a new page.

Cyberpunk RPG's tend to harken back to the 80's, and present a version of hacking that is, in essence, fantasy. (The "WebMage" novel series makes this explicit.) Tron-style battles in a virtual world have nothing to do with real hacking, and RPG systems built around those concepts only work if you don't look to closely at the link between the computer hardware and the software virtual world. Tron-style hacking may as well be Astral Projection, for all it has to do with the real world.

A Technothriller game needs something more plausible, more explicable. It needs something more tied to the nature of real computers.

Hacking in 2032

In 2032, the starting year of the campaign, the most advanced consumer computing technology is AR: Augmented Reality. I'm sure the concept is familiar to everyone — the user wears goggles, glasses, or contact lenses, which serves as the “screen” of their own local computer. Documents and programs appear on this screen, and user gestures (tracked with gloves, special fingernail polish, or eye movement) control the computer. AR provides a translucent overlay onto reality, tool-tips for the real world, so looking at a 7-11 can tell you its address and phone number, customer reviews, or whatever. (Play Deus Ex: Human Revolution if you're not familiar with the idea.)

These devices can also present an opaque overlay, so you can watch a movie on the train without seeing the jerk across the way. This opaque overlay can also be used to browse the Internet, using a 3-D VR interface, or play 3-D games. It can even provide a VR interface into a system.

Your “home” is a graphical depiction of a room or series of rooms (called “nodes”), each decorated to taste. (People sell objects to decorate your home with, and games give object rewards. It’s like Second Life, in that way.) You access these objects with physical gestures: you pick them up, manipulate them, put them down. Documents, for example, appear as pieces of paper and you compose them using a virtual keyboard and gestures.

A collection of nodes is called a system. Hyperlinks are "teleporters", taking you to a new "node”, in this system or another.

This VR interface is how people in 2032 think of the Internet. Not as webpages, not as command line access to Archie, but a VR psuedo-space.

This VR interface is just another UI. We started with a command line User Interface, progressed to WIMP (Windows, Icon, Mouse, Pointer) GUI’S, thence to multi-touch devices, the Spatial User Interface is just the next step.

But underneath this all, the Internet is still the same. DNS servers, routers, web servers, ports, the hosts.txt file, and so forth. People who hack don’t fight in the VR, they use programs, edit text files, compile code, and all that.

But that’s in 2032. What about further into the future?

The (Shadowrun) Matrix

In 2032, DNI (Direct Neural Interfaces) are classified, rare, and limited to a few military personnel (like the OSA). You hack with them the same way you do without, only faster.

Again, underlying all of this is the same file-directory-permissions structure as before. Backwards compatibility mandates this.

But what if backwards compatibility wasn’t an issue? What if some kind of super-worm or virus burned down the Internet (in an event called “The Crash”), trashed the hardware, and forced people to start over?

Enter the Matrix, a ground-up redesign of computer OS’s and UI’s. Running on beefy hardware, the Matrix OS is based around a 3-D, Sensory VR interface. All of the old assumptions have been swept away (forcibly), and what’s left is the successor to the SUI.

This Crash happens in 2033, and by 2035 these Matrix systems are state of the art. DNI units are available to anyone who wishes them. Some are trodes, some datajacks. But people can buy them, and can use the NSUI, the Neural-Spatial User Interface.

The Neural-Spatial User Interface

The NSUI is a true “4D” SpS (space plus senses) interface. Nothing of the old Command Line, WIMP, or multi-touch UI’s are present. There are no files, no directories, no icons representing either. Instead, it’s pure sensory VR.

Computing appears as a series of rooms or zones (a single one called a “node”), a 3D space. The user can see, feel, and interact with objects or scenery in these nodes.

Each node is a scene, each “document” a prop in that scene. The laws of physics limit how the user can interact with the scenery and props.

There are no directories, no files. A spreadsheet on the demographic of VITAS survivors might appear as a sheet of paper, sitting on a desk. The computer tracks the scenery and the location and contents of the sheet of paper in that scene. The paper is where it appears to be: on the desk. The user can move it to a desk drawer, drop it in the wastebasket, or carry it with them to another node. It’s “real” location isn’t a directory, it’s wherever it happened to be in the space built by the OS.

To the common user, this appears to be exactly the same as the VR/AR Spatial User Interfaces. Users familiar with them, will be familiar with the NSUI. But internally, it’s an entirely different beast.

Under the Hood

Many OS's today are highly modular. A skilled user can alter config files, stored as text, then logout and log back in and something changes, maybe something critical. People can even recompile a rewritten part of the OS, kill and relaunch the daemon, and things in the OS just change.

Back to the past.

The classic MacOS was different. Once it booted, the OS had a specific set of rules governing look and feel, commands available, etc. These rules were stored in "resource forks", which could be edited (while booted from another drive. Trying to edit them live crashed the computer). To activate the changes, you had to reboot the computer.

The same is true for NSUI systems. They are virtual spaces, in effect office buildings with infinite space. The user jacks in, and is inside a space with its own laws of physics, its own appearance, its own "presentation". He himself has a presentation, what he looks, sounds, smells, and feels like in the simulation.

The OS boots, and it sets the laws of physics. It sets the appearance. It sets the presentation. And this cannot be altered. (Not without rebooting the whole system.)

Why VR? It's a User Interface. It exists to allow users to accomplish tasks, to utilize the computing resources of a system. And physical laws that match the meat world, allow people to use what they already know how to do. Walk. Open a door. Unlock or lock a door.

Users already know how to operate the system, because they know how to live. But so do intruders, including the player characters.

VR-as-Space offers some ease for admins and owners. You can build vaults, work spaces, virtual labs, whatever you need for your employees.

It also offers some weaknesses. If a door can be unlocked by guards, it can be unlocked by intruders. If a wall keeps low-level employees from seeing into a lab, it keeps security guards from seeing into the same room.

This changes hacking. No longer is it a matter of sitting in a room, coding programs that insinuate themselves into the target. Instead, hacking becomes burglary. You literally break into the target system (spoofing, stealing, or bypassing security) and walk around it as if it were a real building. In such a scenario, Everybody Hacks.

Everybody Hacks

"Everybody drops, everybody fights."
- Johnny Rico, Starship Troopers.

VR Hacking shouldn't be a solo dungeon crawl. What it can be, and should be, is a cooperative endeavor.

Everybody hacks.

Not "everybody knows how to bypass computer security" but "everybody goes along". Hacking a system is like breaking into a building. Everyone has a chance to participate, everyone's skill set can be useful.

Sneaking? Useful. Shooting a gun? Useful. Picking a lock? Useful.

Everybody hacks.

Why? People see and hear their environment in a node. If it's an office-node, it has walls, cubicles, desks, and chairs. Depending on the physics of the system, these act just like objects in the real world.

Bump into a wall? You make a noise. Kick a wastebasket? You make a noise. People can hear you, people can see you, and you can get caught.

A Sneak skill (or the equivalent skill/ability in your preferred game system) involves moving quietly. Walking in VR is exactly the same as walking in the real world. Hence sneaking in VR is exactly the same as sneaking in the real world. Hence the applicability of a Sneak skill. Other skills are useful for just the same reason.

Systems are a place, with laws of physics. Your skills, even as a non-hacker, are applicable. But hackers have an edge.

The expertise of hackers is in exploiting the laws of physics in a VR system. They take advantage of oddities. They do things normal users can't. And if the system is set up so certain people have superuser accounts... the hacker can hijack said account and gain its privileges.

Suppose the LoP is "guards have glasses that can see through walls." Well, the hacker can hack up a set of those glasses, and hand them out to his mates. Whatever users can do, the hacker can hijack, duplicate, or fake.

The converse is also true. Whatever users cannot do, the hacker cannot hijack, duplicate, or fake. The laws of physics in a system are set, and cannot be altered by anything short of a reboot.

But they can be finessed. And that's what a hacker does.

Hackers are the tricksters and gremlins in a system (or vandals and wreckers), hijacking it for illicit uses. Which is, in the real world, what hackers actually do.

Conclusion

This, I think, solves the “separate hacking mini-module” question. Under the “Everybody Hacks” model, breaking into systems is a group endeavor.

Because the UI mimics a real place, real-world skills can play a part. Everybody has a role they can play. People can even break in without a hacker. They’re just more limited by the physics than they would otherwise be.

But hackers have a special affinity for the virtual world. Their knowledge and skills let them finesse the physics of a system.

In the Matrix, hackers are wizards. They get to do things no one else can. But other PC's can still help.

That’s a plausible and gameable approach to the Matrix.

[Daddy Warpig]

File #002 - The Collapse (Annotated) has been added to the forum. It covers the immediate after-effects of the VITAS plague.

[Daddy Warpig]

Africa in 2032 has been posted. It's a broad description of Central Africa, during the campaign's timeframe.

[Neurosis]

Dude, this is fucking amazing, and you are fucking amazing.

This is so similar to something I have been wanting to do for like the longest time.

[Daddy Warpig]

Dude, this is fucking amazing, and you are fucking amazing.

This is so similar to something I have been wanting to do for like the longest time.

Thank you very much. That's very flattering.

I hope the setting, when finished, will provide inspiration or material for your own game.

If you have any comments or criticisms, I welcome them. Please feel free to chime in.

[Neurosis]

I definitely will when I can get around to it, and I'm sure I'll find plenty of nitpicks.

There's a ton of material to read, and I'm really wrapped up in my own many, many ongoing game design projects.

I just wanted to pop in, give a quick skim, and say that I liked the overall idea.

[CatharzGodfoot]

History-wise, why is it that Mexico invades NAN, gets expelled, NAN collapses, and Mexico doesn't re-invade and 'restore order'?