[SR4] Security Systems

[Archmage]

So recently the issue has come up in my Shadowrun group that effective stealth infiltration of any halfway-secure facility seems...almost impossible. Note that we use The Ends of the Matrix rules.

1) Every single person on the team has to be hidden from detection by physical observers, Matrix security sweeps, and astral observers (bound spirits or patrolling mages). The odds that at least one teammate is going to fail one of those three dimensions of stealth are good.

2) For a mere 400¥ a head, a corp can outfit every one of its guards with a biomonitor and security RFID, so even using quiet, non-lethal methods of incapacitating patrolling security teams will alert everyone to your presence, unless the first thing you do on any given mission is find some way to completely disable every electronic alarm system in the building.

3) With a Mage Sight Fiber Optic Security System (see Arsenal p66), a single security magician can effectively cover an entire building--not only can he cast spells on practically anyone anywhere inside, but he can see them in the first place, even if they're concealed with invisibility spells or if they've hacked the security cameras. Even if you assume the expense of 60¥ per meter is too high for the whole building to be appropriately wired, it's trivial to shove a mage in a box somewhere whose job is to stunbolt every unauthorized trespasser in a particular hallway through his mage-sight network.

I'm sure that there must be some explanation as to why every piece of corporate property isn't an impenetrable fortress, but the fact remains that a lot of common and highly-effective security measures are extremely cheap, and I can't really see why they wouldn't be ubiquitous. Considering that I'd like to continue playing the game and giving my players an opportunity to raid corp territory for valuables, what is it that I'm overlooking?

[sabs]

1) Mage Sight system
a) The mage has to be focusing on the right area. If every room is magesight linked, there's no way he's looking at every room.
b) Using small drones with spray paint to find and block the mage sight fiber optic system.
c) Use lasers to kill the mage
2) Matrix Security
a) You really do need to hack the system either before you get on board, or as you do it. Once your hacker is in the system, then he can start intercepting bio monitor information, communications, etc.
b) micro drones are great for this. Especially micro-tapper drones.
c) once you've hacked in that SRFID means that YOU now know where every guard is, and you can feed that info to your tacnet, giving you bonuses to stealthing, getting around them.
3) Physical Stealth
a) concealment powers
b) chameleon cloaks
c) infiltration
d) disguise (hidden by not being hidden)

There are many options. if you're playing Black Sunglasses, you need to give your pcs the tools they need. Let the hardware/hacker guy build special transmitters that your face can plant on a system that allows him to direct hack into the system without being in the building. Or some other useful gadgets. Maybe they have an rfid scrambler. Or a jammer to briefly jam the biomonitor.

jam signal, take out guard, slap a chip into the commlink, that spoofs the biomonitor.

[kzt]

Forge a work order for an after hours HVAC repair.

Deliver a new Pepsi Machine.

Plant a gas grenade in a van and become the people "cleaning the data center" tonight.

There are lots of ways to gain access to a secure site. Like the one where you set up an appointment with someone you know is not there, then just wave off the receptionist when she goes to call him. "I know where Jack's office is".

Some of them require a combination of approaches, like someone getting on site for a while so they can set up a later entry.

If you are trying to sneak into the National Military Command Center under the Pentagon these are unlikely to work, but they will for most commercial sites.

[Murtak]

I'm sure that there must be some explanation as to why every piece of corporate property isn't an impenetrable fortress, but the fact remains that a lot of common and highly-effective security measures are extremely cheap, and I can't really see why they wouldn't be ubiquitous. Considering that I'd like to continue playing the game and giving my players an opportunity to raid corp territory for valuables, what is it that I'm overlooking?

1 - Technology fails. Or rather: your security setup will have glitches. Biomonitors will go off for no reason, sensors will accidently trigger, watcher spirits will report a regular employee for not thinking happy thoughts, and so on. Triggering a full scale response for every little thing is simply not feasible. So there is quite a bit of leeway for the runners.

2 - Crowds are cover. No one is forcing the runners to sneak into empty factories. Heck, there is no reason for pretty much any target of a run to not be up and running 24/7. There will be regular employees and around and they give cover in every way imaginable.

3 - Brute force can work. A group of cybered infiltrators can go from a site's perimeter to the entrance, blow the doors, shoot the guards, down the stairs, shoot more guards, disable the main generators and rip out the data backups in a couple of rounds, likely in under one minute in a small building. If they can just stay undetected for a little part of the way they can do it in 20 seconds. If there is no sizable security force at the very site that is being attacked, brute force can work. Seriously, have a look at how much ground a 15 dice athletics pool, 4 passes, sprint actions and a force 4 spirit's movement allow you to cover.

4 - Any one channel can be enough. You can do some runs entirely in the matrix, or at least set up the rest of the run to be a cakewalk by disabling or selectively blinding all other security. Pretending to be a legitimate visitor can bypass 90% of the security system. A single microdrone can give you direct access to an offline database.

5 - There is a countermeasure for everything. Pressure plates? Adepts can walk on air, mages can levitate, drones can fly. Patrols? Invisibility, stealth suits, bribes. Maglocks? Can be picked, blown up, materialized past.

6 - Diversions, both little and small. Guards have biomonitors? Great, shoot a guard at the rear of the site, then shoot the guard that checks on him. Then go in the front door. Site has tons of guards on site? Hire someone to shot the shit out of the site, or a nearby asset of the company. What are they going to do, not check it it out?

7 - Security is costly. A single biomonitor is cheap. A hundred biomonitors is still not expensive. A hundred biomonitors, maintenance contracts, maintenance scheduling, supervision, security training, setting up response plans, counterfeit countermeasures and jamming countermeasures are expensive.

8 - Low security is rational. Or rather, can be rational. Imagine you are an up-and-coming company, who is betting it's existence on getting a market breakthrough. You would think, tough security would be important, so your stuff does not get stolen or trashed. But security is costly. If there is just one direct competitor who invests less in security he is likely to corner the market first. Thus anyone new to the market is likely to have less security that you would think they should have at first glance.

9 - People are dumb. Security is complex. Every security setup is bound to have a dumb mistake somewhere, and most will have dozens.

10 - People are lazy. Someone will ignore security to save time.

11 - You don't need perfect security. You just need better security than (some of) your peers. If what you have can be obtained elsewhere then your security needs to be just good enough to make it easier to obtain it elsewhere.



In short, what you are overlooking is this: Any individual security measure seems simple and cheap. Security as a whole is complex, expensive and incredibly hard to get right.

And for most companies it does not make any sense at all to invest heavily in security. They will go with the basics, implement them badly, ignore half of them and call it a day and get on with earning money. And they will be right in doing it that way. They will have ample security to deal with street trash, which is the main threat anyway. And if they do get hit by a decent runner team, insurance will pick up the loss.

[UmaroVI]

The answer to your question is "the Concealment spirit power, and hack their security system."

The much bigger elephant in the room is why everyone seems to use incredibly inefficient onsite magical security. The much better way to do it, rather than nonsense like having a mage on-site for emergencies:

Pool all the mages contracted to one city together. It's fair to assume that by not having on-site security mages (you DO want on-site wards and bound spirits, of course) you can easily have 100 mages "free," probably more. Have them hang out in various (different!) locations on-call, and they can pretty much just chill out and watch simsense porn. Ideally, they keep an on-hand spirit with Movement active on them, but it isn't strictly necessary and low-force is fine.

As soon as there is an alert at any location that they are contracted to protect - or hell, pretty much any problem they are paid to solve, this could work for basically any emergency - the mages astrally project, rocket over at ridiculously fast speed, and summon spirits. The mages can't affect the physical world (unless anyone is dumb enough to turn on Astral Perception, in which case they'll get 100 stunbolts to the face), but their spirits can just manifest, and that many spirits will solve any problem. It will take, like, 12 seconds from "alarm sounded" to "100 spirits of man manifest and stunbolt the intruders into the ground."

[Murtak]

It will take, like, 12 seconds from "alarm sounded" to "100 spirits of man manifest and stunbolt the intruders into the ground."

And how do the spirits know whom to attack?


On a somewhat smaller scale though, that is what I would expect the basic security model to be in all but the most protected sites. Have the very basics on-site: maglocks, wards, a rentacop or five, white ice, some sensors. And when an intruder is detected, pour in reinforcements. That is also how security works in many of the adventures and novels.

But I can't exactly see pooling remote security at the level you describe, for several reasons:
1 - A single site will always be vulnerable.
2 - Any given company may not want someone someone from a non-company firm on their grounds.
3 - Remote security is prone to errors, obfuscation and jamming.
4 - Pooled security can be easily baited. What happens if ten alerts are triggered in rapid succession?

For many potential targets sending in a hundred spirits (or mages, or helicopters, or drones, or security decker) will simply not work, because they don't trust them, because they don't want any of their personnel shot up, because runners are a fairly small issue overall and that much firepower is overkill for mere gangs and so on. A security pool for all Ares sites in Seattle makes sense to me. As does a security firm getting contracted by a dozen or even fifty small local companies. A city-wide cooperation though seems like it would be an unwieldy, error-prone nightmare.

[UmaroVI]

You can always split that force up, though. If 10 alarms go off, you have 10 mages go to each. You can't run from them, because they are so fucking fast. Most people will still lose a fight with 10 spirits, especially when killing a spirit just means the mage summons another one. Even if you can take 10 spirits, can you take 10 spirits and somehow escape before the other 90 mages finish checking out the false alarm and come back?

Sure, 100 mages spirit-spamming is overkill for a gang - but what's the drawback? There's 0 risk to the mages and it will take about 20 seconds of their time.

The issue is essentially "mages = instant, infinitely renewable reinforcements" and that's a huge problem.

I did however mean a pool for all sites shared by the same corporation, as you suggested. IE, Ares would have it's mage security squad, and Horizon would have its own separate one. Smaller places that would normally contract with (for example) Lone Star for magical security would, instead of getting 1 on-site security mage, get access to the mage security squad to come in and wreck anyone who causes problems.

Also, keep in mind that this doesn't solve ALL security problems. If you can avoid triggering the alarm and stay out of fights, yeah, you're fine. The problem is that as soon as you get caught, any fight you have with on-site security personnel should always have about a 12 second timer for "100 spirits suddenly materialize and own your team in the face."

[Murtak]

You can always split that force up, though. If 10 alarms go off, you have 10 mages go to each.

They don't. 10, one after another. How many spirits can you summon again? Oops.

Sure, 100 mages spirit-spamming is overkill for a gang - but what's the drawback? There's 0 risk to the mages and it will take about 20 seconds of their time.

Other than a small-but-not-zero chance of taking 10+ stun damage from summoning and having a rogue spirit following you home you mean?

The issue is essentially "mages = instant, infinitely renewable reinforcements" and that's a huge problem.

Riggers and drones, deckers and agents, heck, you can get a fucking hovertank on site real fast with a single movement power running. Mages on standby still need to project, travel to whereever the action is happening and then find the intruders. That last part is not remotely trivial. Do you picture a monolithic empty room with clear line of sight and nothing in it but the runners? If so, yes, a mage squad will totally fuck you up. Now imagine a busy office building, with hundreds of employees inside, three of them happening to be runners, and one of them has tripped a matrix-controlled alarm. What exactly are the mages going to do? Remember, walls block astral line of sight, as do bodies. And cubicles. And office plants. Oh, and the place is warded. How are they even going to find even the single guy who triggered the alarm, much less the rest of the team?

[Zak]

While your poorly thought out spirit issue is fun, it is only part of the basic issue with designing one of the archetypical shadowruns: B&E. The op lists alot of the problems. Even when using Ends of the Matrix rules instead of the normal clusterfuck.

How can this work in the usual frame of Shadowrun without assuming complete ignorance of security risks (which of course can be argued for looking at certain 'high-security' zones today).

I have yet to see someone come up with a satisfying solution. And until then I will not run B&E in my Shadowrun games.

On Concealment: it is utterly broken vs mundane targets, but it is a purely 'P' power, so it does not help you against any form of magical spotting.

[UmaroVI]

Actually, it is true that you need to invest a bit of effort into being able to contact the astrally-projecting mages. It isn't THAT hard but yeah, otherwise you have issues. Assuming that they aren't cut off from communication, if another alarm goes off then 50 of them just fly away with their 50 spirits to the second site.

You don't need to summon big spirits. Even 10 force 3 spirits of man with Stunbolt is more than a match for the vast majority of threats. 100 force 3 spirits of man with Stunbolt will flatten any opposition. At worst, you take 6S from summoning, and on average an all-3s mage takes nothing.

As for finding the intruders - yes, this is what you need mundane security for. "The guys who are shooting at the security guards" are not going to be terribly hard to find. And if you have trouble, you have 100 people who can fly through walls to hunt for them.

There are deep problems with B&E, and most of them are best solved by brushing it under the rug and just acting like nobody has figured out how to run security properly in the grim darkness of the future.

[Murtak]

Seriously, I fail to see the issue. Or rather, I think everyone who believes security is too powerful is deluded.

"Then 100 mages go where the cameras show the action and summon 100 spirits" is bullshit. All of those mages are first going to have to find the alert site. This is already hard. They are supposed to be guarding hundreds of sites, remember? Then, arriving at the site, they have to pass the wards we already established are going to be present. Not trivial, but given time, assured. Good. Now they have to find the exact spot the alarm was triggered from. Where finding a building you might at least have seen before and can navigate to on a grid was merely hard, finding an unknown person in an unknown building is next to impossible, even if you can go through walls. And then, once you have found them, you need to identify them as the guys you saw on a camera - if you saw them at all that is. And that is nigh impossible to do from the astral. And this is just the astral part of it. A single mage with astral static can and will fuck up your entire plan without doing anything but keeping the spell going. As will background count. Or living walls. Or paranormal guard animals. As will a compromised matrix (on site or at the mage central) or sensor. As will anyone fucking with the system just for shits and giggles.

I can possibly see the mage squad working when you are guarding a site without personel, with relatively few walls and no anti-magic measures besides wards. Barely. But even then you will have a response time of minutes, not seconds. And a single mage will still shut you down. And with that response time, you better have a huge site or at least open ground to catch the intruders. So, a huge site, without magic security, the intruders have no mage, fuck up. Oh, and it only works at night, or you end up stunbolting your own employees. Brilliant.

If you want to be concerned, worry about something simple: blast doors fall into place and a SWAT team or five show up in a matter of minutes. Cheaper, no risk to your employees, might actually work. And all that is assuming the runners actually do fuck up. There may be a lot of options for security, but if you actually use all of them you are bankrupt and can't get any work done. Not only will every security system be more expensive than listed, it will actually fuck with your company getting anything done. And you will need security from mages, spirits, brute force, infiltrated killers, hackers, microdrones, faces, invisible flying people, burglars and con-men. Plus all the ways to steal stuff I just missed. And odds are, if one of them fails, everything does.

Bottom line, security is hard. If no one fucks up, I'd expect a run to go smooth and quietly. Basically site security can not keep the runners out, or even reliably detect them. Security will keep out the rabble. Severe security will keep out mediocre runners. But anything past that, you are looking at profiting from mistakes the runners make.

[Neurosis]

Not as in depth as some of these answers, but:

The truth is, the players will not remember everything. Neither will the GM. And normally, it will balance out so that a successful run is difficult...but not impossible. If the players are really trying and coming up with good ideas, there is no reason to fuck them out of some slavish loyalty to verisimilitude/genre realism.