Matrix

• 1: Introduction to my Matrix houserules
• 2: Matrix basics
• 3: Spotting icons & hiding on the Matrix
• 4: Access, getting it, and protecting against hacking
• 5: Matrix damage and how to fix it
• 6: Matrix actions
• 7: Cyberdecks
• 8: Hosts & devices
• 9: Overwatch, GOD & convergence
• 10: Common Matrix actions & how to do them

1 - Introduction to my Matrix houserules

Note that these rules are intended to be used in conjunction with my re-written Matrix fluff.

tl;dr: comparing these rules to RAW

Some loose, probably incomplete notes on what I’ve changed and why.

Changes intended to make the fluff and mechanics align better:

• Splitting the Matrix into local mesh / the backbone: intended to justify why deckers have to get out into the field and can’t hide in a darkened, safe basement far from the action.
• Clarify how deckers mess with other people’s gear: for example, by clearly stating the limits of Send Command.
• Clarify exactly what a decker sees in AR: intended to resolve the long-standing “can deckers see through walls?” FAQ.
• Buff AR accessed via DNI to close the gap to cold-sim VR: intended to encourage/empower deckers to get out into the field without having to risk their meatbods by dipping into VR.

Changes intended to make play faster by either reducing steps to resolve outcomes or making the steps easier to remember:

• Streamlined action list: intended to make it easier to keep track of what deckers roll to Do The Thing without having to rely on cheat sheets. I have taken inspiration from the magic system in Shadowrun: a small number of standardised rolls but with the outcomes applied in different ways, as opposed to the RAW for Matrix actions, where there’s 40+ actions to choose from and each has a bespoke roll associated with it.
• Streamlined access levels to outsider/user/admin, inspired by SR 6e. Also, access levels now apply to everything in a PAN or WAN after one hacking roll.
• Remove data bombs: encouraging deckers to do Matrix perception to every file before they manipulate it significantly slows play down.
• Make Matrix perception work like meatspace perception: ie. the decker rolls once and applies the same result to everything they could potentially notice, rather than rolling once per target.

Changes intended to increase player flexibility or offer players hard choices between trade-offs:

• Included a variation on the Probe/Backdoor Actions from SR 6e to offer more variety between the stealthy and non-stealthy approaches. I have changed the exact mechanics of Probe/Backdoor to suit my own preferences, however.
• Reworked Overwatch Score and what happens when it reaches convergence; intended to reduce book-keeping but add a push-your-luck mechanic for brave deckers.

Acknowledgements

• u/cras_, who was always willing to subject his characters to my half-baked ideas
• u/Ingnimortis, who was kind enough to review drafts of these rules and offer comments and insight
• Banshee, who generously shared insights into his design process for the SR 6e Matrix rules
• Anyone who has ever shared Matrix houserules on r/shadowrun; I drew inspiration and ideas from many such sources. In particular, u/dezzmont and u/LeVentNoir. And to u/ReditXenon, who’s encyclopaedic knowledge of Matrix RAW kept me honest on numerous occasions.

2 - Matrix basics

Matrix basics

This is covered in more detail in Matrix fundamentals in my fluff writeup, but a quick summary:

• Devices (in the real world) have icons (in the Matrix).
• Commlinks/cyberdecks/RCCs being used by someone get a special type of icon called a persona.
• The Matrix comes in two parts:
  • the local mesh is a peer-to-peer network of devices routing traffic between themselves; typically extends a kilometre or so in an urban area (more in rural areas). It’s vulnerable to signal disruption and has limited range.
  • the backbone is a world-wide network of fibre cables, satellite links, and other high-tech stuff that carries data around at approximately infinite capacity and speed.
  • the local mesh and the backbone are bridged by uplink nodes, which are extremely well-guarded hosts.
  • devices co-operate to send traffic between each other until it reaches an uplink node, at which point it is whisked away to the backbone.
  • hence, deckers are masters of the local mesh, but are hampered by having to get within range of their hacking targets.
• Hosts are the “servers” of the Matrix
  • Some are “local hosts” - hosts that only work with devices within local grid range. These are smaller / cheaper.
  • Others are “cloud hosts.” These are connected to the backbone so are accessible world-wide. They are larger / more expensive.
  • There are whispered rumours of mysterious “foundation hosts”, strange and powerful, that somehow work without any connection to the backbone at all…

Matrix attributes

Unchanged from RAW; used as a combination of limits for tests and part of a dice pool for resisting tests done against you.

• Attack
• Sleaze
• Data Processing
• Firewall

Icons

Every Matrix-enabled device - and in the Sixth World, that’s a lot - is represented in the Matrix by an icon.

Some of these are persona devices: these are the subset of devices that can let people get onto the Matrix, in the process creating a persona so they can interact with other devices. Examples include commlinks, cyberdecks, and RCCs.

• Commlinks are the everyday Matrix devices of the masses.
• Cyberdecks are like hot-rodded commlinks with the extra processors and software necessary to break the rules of the Matrix and bend it to your will
• RCCs are the rigger’s cousin to the cyberdeck, optimised to allow long-range signals for remote drone control.

Personas

When you sign into the Matrix via a commlink, cyberdeck, or RCC, the device gets a special icon called a persona. Personas are your own personal digital mirror image. Persona’s appearances are often very elaborately customised, particularly by wankers.

You cannot steal anyone else’s persona, nor can you have two personas at once. (More on why here.)

3 - Spotting icons & hiding on the Matrix

Spotting

“Spotting” is the process of your persona device becoming aware of some other device’s icon so it can show it to you.

Spotting is an automatic function of basic Matrix protocols within a short horizon; typically around 100 metres, although it can vary with network conditions (more noise = shorter range). Your device is constantly keeping track of these devices as it helps to route traffic around in the local mesh. To detect icons further out, you can instruct your commlink or cyberdeck to actively monitor local mesh connections. See Matrix Perception, below.

Cloud hosts are always spotted, from anywhere on the planet. Local hosts are spotted the same as any other device.

Once your persona has spotted an icon, it receives an approximate physical location and direction of travel for it, typically accurate to a couple of metres but can randomly vary. In AR, this positioning information is used by your commlink/deck/etc to decide where in your vision to place the icon. In VR, your device will probably play a little looser with reality, and icon positions will be optimised for usability (for example, overlapping icons will be spread out a bit to make them easier to see.)

For more information on the in-universe experience of spotting icons in AR and VR, see Spotting & Positioning.

Hiding

Once a persona has spotted an icon, they can keep track of it as long as it is within local mesh range. They will automatically get an approximate physical location and direction of travel, and if they also have (hacked or legitimate) access they can make that perfectly accurate via Trace Icon actions. If someone knows or suspects they are being tracked this way, they have a few options to escape:

• Try to shake the tail by moving to within range of a different uplink node, so as to break the local mesh range. The tracker can attempt to re-establish contact (via another Matrix perception action) if they can get back within range.
• Run a succesful Hide action (opposed test) to confuse the tracker and lose their attention.

Note that rebooting your device is not enough to break spotting, but the persona being tracked could turn all their devices off completely instead.

Running silent

Devices can choose to remove themselves from the local mesh, refusing incoming connections and effectively vanishing from sight. This is called running silent.

A naked device, outside of a PAN or WAN, cannot run silent. Any PAN or WAN can freely choose to run silent, however this setting applies simultaneously to all devices in the PAN or WAN. If the PAN controller is a commlink, without a Sleaze stat, it will remain very easy to detect.

Matrix Perception

TODO

4 - Access, getting it, and protecting against hacking

Networks

“Naked” devices - low-end things connected directly to the Matrix - are notoriously at risk of being hacked. Most people therefore protect their stuff by creating a Personal Area Network (PAN) and using their commlink as a shield against incoming hacking attempts.

PANs

Personal Area Networks - PANs - are local networks of devices all sheltered under a controller. The controller must be a device running a persona, so a commlink, cyberdeck, or RCC. The controller monitors all traffic within the PAN and between the PAN and the public Matrix, guarding against hack attacks.

PANs always run across the local mesh part of the Matrix, and have a restricted range to around 500 metres, depending on local network conditions (it gets smaller if the area is noisy). Devices that pass out of range will drop off the PAN. (Note that riggers can extend their PAN to greater ranges for drone control, as their RCCs have heavy-duty antennas. This also makes them physically bulky however.)

PANs can have dozens of devices attached to them; for most game purposes it isn’t worth keeping track of.

A device in a PAN can choose to roll the PAN controller’s device rating and the PAN controller’s ASDF stats instead of its own to defend against any Matrix action. However, it does not have to do so, eg. if it has a better Firewall stat than the controller does.

WANs

Wide Area Networks - WANs - are very similar to PANs, but the controlling device is a host instead.

Like PANs, WANs only work on the local mesh, so have a restricted range and must be controlled by a local host. Cloud hosts cannot be PAN controllers.

WANs have essentially no limit in how many devices can be attached to them.

It is common for WAN controller hosts used in wageslave offices to be running silent and also protected by RF-blocking building measures. See spotting for more information.

Access levels

Your persona can have three different access levels to any given device, host, PAN, or WAN on the Matrix:

• Guest: the default permission level for persons that are unknown. Sometimes this means you can’t access anything, sometimes it means you can go inside a host and interact with some of it. Depends on the host.
• User: a normal user’s access rights. Can usually read/write files, give standard/routine commands to attached devices. Occasionally very secure devices or files might require Admin access instead.
• Admin: full control, can order devices to do anything they can reasonably perform.

These access levels apply to an entire PAN or WAN at once. If you have User access to a PAN, you have User access to every device connected to that PAN. If your persona is running on a device controlling a PAN, then you have always have Admin access to everything in the PAN.

Direct connection hacking

If an attacker can achieve a direct, physical connection to a device that is part of a PAN or WAN, they can bypass most of the protections. The device must roll its own Device Rating against the hacking attempt, and it is treated as having a Firewall stat of 0.

This is doubly dangerous, as from that compromised device the attacker can move into the rest of the network. Any access levels obtained on the device apply to the entire PAN or WAN.

Direct connections are not always easy to obtain. For many secure devices that use wireless connections to their hosts (eg. an external camera or maglock), they may only be present as physical connection points on the internal mechanisms, hidden behind reinforced casing. These are difficult to jerry-rig.

Some secure devices use wired connections to their WANs instead. These devices are impossible to wirelessly hack, but the tradeoff is that it’s much harder to armour their controlling cables and hence a lot easier to attackers to get a physical backdoor.

To achieve a direct connection, roll Hardware + Logic:

• For wirelessly connected devices, use a threshold of (host rating ) / 2 to represent the physical security
• For wired devices, reduce the threshold by 1 (minimum 1) and add +4 to the attacker’s roll.

These are not hacking rolls, and there are no implications for OS tracking etc.

Hacking via Snoop

If a decker is listening in to an active connection (can be a voice call, a video stream, a text message chat, etc) via a Snoop action, they gain extra opportunities to hack remote targets by inserting hacking commands into the datastream.

Unlike other hacking attempts, they do not need to spot their target for this, so they can use this vector to hack one end of a phone call, then hack the device at the other end, even if it not within the decker’s local mesh.

• Roll Backdoor Entry or Brute Force (decker’s option) as usual.
  • Either action takes 10x longer to perform than usual, because of the need to carefully weave the hacking commands into the datastream; 10 combat turns / 30 seconds.
  • This counts as a directly connected hack, so the device rolls only its Device Rating against the hack attempt, with no Firewall.
  • It is very unlikely the decker will be able to arrange things to make Probe viable due to how long it takes. Remember that Backdoor Entry without Probe first takes a -6 penalty.
  • Brute Force, whether it succeeds or fails, is likely to alert the remote target and cause them to terminate the call.
• Once the decker gains User or Admin access, they can carry out commands as usual and at their usual speed.
  • Trace Icon is a good choice, or Edit File if the decker wants to look around the contents of the device.
• When the call/video stream/etc ends, the decker loses access immediately.

5 - Matrix damage and how to fix it

Matrix damage

• Each device has 8+(Device Rating / 2) boxes of Matrix damage track.
• Matrix damage is resisted with Device Rating + Firewall.
• Tests using the device take a -1 penalty per 3 boxes of incurred Matrix damage.
• If the Matrix damage track fills, the device is bricked, and is non-operable until repaired.

Repairing Matrix damage

• Base time of 60 minutes
• Hardware + Logic [Mental] test
• Split hits between reducing time and doing repair
  • Divide base time by number of hits spend to reduce time
  • Repair number of boxes of Matrix damage equal to hits spent doing repair

Biofeedback

• In AR via goggles/glasses/image link: no effect
• Stun damage if in AR with DNI or cold-sim VR
• Physical damage if in hot-sim VR
• Resisted with Willpower + Firewall

Dumpshock

• In AR via goggles/glasses/image link: no effect
• If in AR with DNI or in cold-sim VR: 6S
• If in hot-sim VR: 6P
• Resisted with Willpower+Firewall
  • If the deck just got bricked, Firewall will be 0
• -2 dice on all actions for next (10-Willpower) minutes

Link-locking

• Can affect any user in AR with DNI, cold-sim VR, or hot-sim VR
• While locked, cannot use Switch Interface, Enter/Exit Host, or Reboot
• Can take Jack Out action but with an opposed test
  • Hardware + Willpower [Firewall] vs Logic + Attack
  • Will take dumpshock if succeed

6 - Matrix actions

Dice pools for devices

All resistance rolls below are expressed as an Attribute plus one of the ASDF stats. However, this only applies when the defender is a persona. When it is a host or device, substitute values for the roll as follows:

• For the resistance Attribute: use the Host Rating or Device Rating.
• For the ASDF stat:
  • Naked/standalone device: use Rating for D/F, use 0 for A/S (unless it’s special)
    • Unattended vehicles with an active Gridlink subscription get +3 bonus Firewall, as Gridlink has some limited monitoring of Matrix traffic for devices under its purview.
  • Device in a PAN or WAN: use the PAN/WAN controller’s ASDF stat
  • Host: use (Rating+2) for D/F, use Rating for A/S (most Hosts are defensively configured, but this can vary if desired)

Just lookin'

• Roll: Computer + Intuition [Data Processing]
• Resist: Logic + Sleaze (for Perception) or against a threshold

Matrix search

Determine threshold and base time as below. Hits over threshold used to divide the base time. If the test fails, the character spends the full time looking before coming up empty-handed.

Suggested dice pool mods:

• -1 if information is intricate or specialised
• -2 if information is obscure

File search

When looking for specific files inside a host, use thresholds as above. The base time is always 1 minute.

Matrix perception

To spot nearby silent running icons on the local mesh: do an opposed test as above (ie against the icon’s Logic+Sleaze.) The decker rolls once against every silent running icon, and spots all the ones that fail the test in one go.

Repeated attempts within a short period of time take a cumulative -1 penalty, as usual.

To examine a device, roll a simple test. Each hit answers one question from CRB page 235.

Getting into places you shouldn’t be

Roll: Hacking + Logic [Attack] or [Sleaze] Resist: Willpower + Firewall

Brute Force (aggressively)

Roll: Hacking + Logic [Attack] Resist: Willpower + Firewall

• 1+ net hits gives User access.
• 3+ net hits allows Admin access at decker’s option. (Remember that Admin access accrues OS more quickly.)

Probe / Backdoor Entry (sneakily)

Roll: Hacking + Logic [Sleaze] Resist: Willpower + Firewall

Ideally, the decker first does Probe to scout the target for security vulnerabilities: roll as above, take net hits, split into two groups as decker wants.

• Base time is 60 minutes, divided by the however many hits the decker wants to use to reduce the time.
• Rest of net hits is recorded to use with the Backdoor action later.
• Probe results stay valid for (3d6-Host/Device Rating) hours (minimum 1), but persist if the decker logs out or reboots.

To actually hack the system the decker does Backdoor Entry to use the discovered vulnerabilities to get access. Same test as above.

• If the decker didn’t do Probe before Backdoor Entry, they take a -6 penalty.
• 1+ net hits gives User access.
• 3+ net hits allows Admin access at decker’s option. (Remember Admin access accrues OS more quickly.)
• Even after the decker trigger’s GOD’s interest, if they are only maintaining access to systems that was gained via Probe then OS does not start accruing for a number of combat turns equal to the hits left over from the Probe test. After that it accrues as normal.

Matrix attacks

Roll: Cybercombat + Logic [Attack] Resist: Willpower + Firewall

Ways to deal damage or crash software. These are all Complex actions.

• Data spike: does (net hits + Attack) boxes of Matrix damage, resisted by the target with Device Rating + Firewall.

• Popup (requires User access): Target must be a persona using AR. Flooded with Matrix spam. Takes (net hits) as a negative ongoing dice pool penalty to all tests until the end of the next turn.

• Denial of Service: Target is one or more specific devices. Target’s data streams are polluted with noise. Take 2*(net hits) as an ongoing penalty to all use of the device until the end of the next turn.

  If the decker has no access, this can only be used against a single device. If the decker has User access to a PAN or host, it can be used against up to 3 devices that are in that PAN/WAN. If the decker has Admin access, it can be used on 6 devices.

  “Devices” can include smartguns and cyberware. If a given action is affected by Denial of Service more than once - eg. if DoS is used against a character’s cybereyes, and cyberarm, and smartgun - then the penalties stack.

Manipulating icons

Roll: Computer + Logic [Data Processing] Resist: Willpower + Firewall

Once you have access on an icon (or the PAN/WAN that it is part of), you can do the following actions to it without any further tests.

If you have User level access:

• Edit file (no test, Complex action) - create, change, copy, delete, or protect any type of file.

  Note that some of these actions (particularly copy) may not complete instantly. The decker doesn’t need to spend any other actions, but they may need to wait.

  If the edit is particularly intricate or tricky, GM may call for a test of Computer + Logic [Data Processing] vs a threshold to determine how successful it was.

• Send message (Simple action) - send a message to a person or an order to a drone or other semi-smart device. Can be textual, audio, a picture, or a short video clip.

• Control device (Simple/Complex depending on what you’re doing) - may require a test depending on what the goal is eg. shooting a turret requires a Gunnery roll. Control Device cannot override the neural connections used control cyberware.

If you have Admin level access:

• Reboot device (Simple) - you cannot reboot cyberware. Rebooting weapons or vehicles disables their electronic features but they typically still work via manual controls.
• Trace icon (Complex) - see below.
• Snoop (Complex) - if you have Admin access on one of the devices, you can run Snoop without any further tests.
• Change icon (Simple action)

Some actions still need tests however. These both need User level access to the file in question:

• Encrypt file (Complex action) - roll Computer + Logic [Data Processing]. Number of hits is the protection rating on the file’s encryption.
• Crack file (Complex action) - roll Hacking + Logic [Attack] vs protection rating x 2.

Trace Icon

TBD

Manipulating datastreams

Roll: Electronic Warfare + Logic Resist: Willpower + Firewall

These are all Complex actions.

• Snoop (no access required): listen in on the link between any two or more devices. Can be used to monitor a video feed, listen to an audio call, intercept commands sent to drones, etc.

  Note that if you have Admin access to any device in the link, you can perform Snoop without any test being required. You only need to roll the above test if you do not have access to the devices.

  Once you have performed Snoop, you can also insert hacking commands into the datastream to hack the remote device. This can even be achieved if the remote device is outside of local mesh range. Roll Probe/Backdoor Entry/Brute Force as normal.

• Spoof Command (no access required): send a single command to a device, carefully constructed to look like it came from a legitimate source. See below for discussion.

• Subvert Infrastructure (requires User access): Take control of up to (net hits) simple infrastructure devices connected to the PAN/WAN. Control continues as long as the decker maintains access to the host. Examples of devices include traffic lights, vending machines, home appliances, desk lamps, etc. Different commands can be issued to multiple devices for a single Simple action.

• Squelch (no access required): prevents target device from calling or sending any messages for (net hits) number of minutes. If the target is a host subsystem, it prevents alerts leaving that subsystem and deploying IC in other subsystems for (net hits) combat turns.

Spoof Command

Spoofed commands are considered to have User level access, not Admin. This causes some limitations in what you can do with Spoof Command, such as:

• Lock or unlock electronic doors and maglocks
• Tell a camera to replay its last footage endlessly, creating a camera loop
• Tell a drone to target a specific person, as long as that person is not specifically tagged as a friendly
• Tell a drone to cease firing (although its controlling host or rigger will likely tell it to start again soon afterwards)

But some things you cannot do with Spoof Command:

• Interfere with cyberware - the neural interface used by cyberware overrides commands sent from the Matrix
• Reboot, format, or shut down devices completely - these need Admin level access
• Change a drone’s friend-or-foe identifier

Manipulating yourself (mostly no tests)

• Switch AR/VR mode
• Jack out
  • Opposed test if link locked
• Reconfigure deck
• Matrix defence / counterhacking (something like counterspelling?)

7 - Cyberdecks

Stats are unchanged from RAW; Cyberdecks have an attribute array that can be allocated across the four Matrix stats. Takes a Free action to swap any two stats. Remember you can only do one Free action per turn. If you want to do more reconfiguring than that, you can use Matrix Simple Actions.

Cyberdecks are reduced in price to 25% of RAW. See the gear houserules for more information and statblocks.

Programs

Maybe

• decrease to ((Deck Rating) / 2) slots?
• add a few more impactful ones?
• add a one-shot +2 dice boosts that burn out after use? (like trinkets) (deckers craft these with Software in downtime?)

Hacking programs

• Chaff: any attempt to Trace Icon against the persona will be inaccurate by (1d6 * 10) metres; if the direction matters, use the scatter rules. This also applies to the tracing that happens after convergence from GOD. (Replaces Cry Wolf.)

Agents

• Deck can only run agents of a rating equal to or less than the deck rating.
• Agents take a program slot while active.
• Agents have a hardware module with embedded memory chips and co-processors. As such, they cannot be swapped in and out of a deck like other programs. They take a few minutes to connect or disconnect.
• Agent stats are equal to the deck rating, agents use the deck’s ASDF, and agent skills are equal to its rating. Hence agents are typically rolling ((agent rating) + (deck rating) [Deck stat]) as a dice pool.
• If used to assist the decker on an action, it takes a Simple Action to order the agent to help. Then it rolls its dice pool as a teamwork test. It then takes another Simple Action to order the agent to resume whatever it was doing before, if the decker desires.
• Agents running the same task over and over (eg Matrix perception to watch for nearby icons that are running silent) are not subject to the -1 penalty per repeated attempt as other characters. However, any tests required are always resolved by buying hits on both sides of the test.

8 - Hosts & devices

Device ratings

• Local hosts (rating 3-8), cloud hosts (rating 6-12)
  • A/S = (Host Rating)
  • D/F = (Host Rating)+2
• Commlinks (rating 1-7)
  • A/S = 0
  • D/F = (Device Rating)
• Other devices (1-6)
  • A/S = 0
  • D/F = (Device Rating)/2

Typical device ratings:

1. Vending machines
2. Public terminals, entertainment machines
3. Standard personal electronics
4. Basic/alpha cyberware, basic vehicles
5. Beta/delta cyberware, expensive vehicles
6. (and up) Milspec

Devices from rating 4 up might run additional protection software that grants a further +2 to +4 to its Firewall stat.

Unattended vehicles with active GridLink subscriptions automatically connect to a GridLink firewall service, giving them +2 to Firewall.

Pre-calculated defence pools and bought hits

First number is the dice pool, second number the bought hits.

Hosts

Host types

• Cloud hosts are planet-scale servers attached directly to the backbone. They can be accessed from anywhere on the planet. They are close to unhackable, not only because of their own defences, but also because of the security on uplink nodes and the backbone itself prevents hacking traffic from ever reaching them.
• Local hosts are hosts that only work in the context of the local mesh. Most corp facilities will have a local host that runs the office, provides security to wageslave’s devices, and keeps all their files and work. Corporate local hosts are often combined with RF-blocking buildings to further reduce their range to inside an office. Local hosts can connect to cloud hosts for backup etc, either via the backbone or via dark fibre.
• Rumours abound of secret, powerful, arcane Foundation hosts, that are somehow tied to the mysterious force of power used by Technomancers and somehow function without any connection to the backbone at all. But ‘runners are sometimes overly fond of tall tales about the dangers they faced. Who can tell if there’s any truth in this…?

For more information, see Matrix fundamentals.

Entering hosts

xxx

Local vs cloud hosts

Why don’t the corps put all their valuable secrets on impregnable cloud hosts, outside of the grasp of shadowrunners? Sadly for the corps, it’s not that easy.

• Highly rated cloud hosts are staggeringly expensive, and department directors and VPs are forever looking for ways to make themselves look good by cutting budget items. They’re too short-sighted to realise they are leaving themselves vulnerable to espionage until too late.
• Cloud hosts are very powerful, but they still don’t have enough data processing capability to run vast chunks of a megacorp’s infrastructure.
• Cloud hosts cannot form WANs, as the latency becomes too great. So corp facilities always require local hosts to run their physical security infrastructure (locks, cameras, drones, guards with guns), as well as less exciting stuff like the building’s AC and the egghead’s research terminals.
• The corps do not completely trust GOD, and GOD has complete dominion over traffic on the backbone. Megacorps worry their rivals will have demi-GODs in their pocket, stealing their secrets. Smaller corps worry the megacorps will steal everything. So for the most valuable secrets, the most important R&D data, the darkest paydata, there is still a need for guarded data storage in anonymous facilities and data couriers with wetware storage to move it around.

Wired vs wireless for security PANs

xxx

Subsystems

Many larger local hosts are internally divided into different subsystems. Each subsystem has a different purpose and different access levels.

For example, a corp R&D facility might have:

• general host: the lowest security level, and the first subsystem users attach to when they log in. Low-security users like admin staff might never go deeper than this.
• industrial control: runs all the obscure tech junk the eggheads are using to do their jobs
• secure file storage: where the eggheads keep their juicy data
• security: runs the cameras, doorlocks, turrets, etc. Also runs the WAN that hosts the security personnel’s guns and gear.

In game terms, each subsystem is treated as a separate host in terms of hacking rolls. Access levels are per-subsystem. Completing a hack on the general host doesn’t give access to the security subsystem, and so the invading decker needs to complete a second round of hacking. However, for the purposes of Overwatch Score accumulation, the entire host is tracked as one value. For example, if a decker has Admin access to the secure file storage subsystem and User access to the general host, it’s still only +2 OS per turn.

Note that there is no “map” of these hosts; the internal architecture is flat. Any user can see all the subsystems at once and move between them with ease.

IC

When most hosts are not in an alert state, they are only running patrol IC (see below.)

Once a host is in an alert state (same conditions as tracking OS - a failed sleaze action or any attempted attack action), it starts deploying attack IC:

• Host launches 1 IC of its choosing (or randomly selected) per combat turn (at top of turn).
• The host can have (host rating) IC running at once, but can only run one copy of a given IC.
• If IC take full Matrix damage, they crash, but can be re-loaded as usual by the host.

IC stats:

• Each IC has its own Matrix damage track.
• Each IC gets one Complex action on each action phase, and all IC actions are Complex ones.
• Each IC rolls ((host rating) * 2) + 4d6 for initiative, and for ease of tracking this is usually one roll (although it can be one per IC program).
• All IC rolls (host rating) * 2 [Attack] to carry out its actions against a persona. For most hosts, Attack is (host rating).

IC types

• Patrol - see below.
• Degrader - targets the persona’s weakest ASDF stat.
  • Persona resists with Willpower + the targeted stat.
  • The persona stat is reduced by the number of net hits.
  • If the stat hits zero, it prevents the deck from carrying out any actions that use that stat as a limit.
  • Persona stats are reset when the device reboots.
  • If the persona reconfigures their deck, the penalty stays with the lowest number eg. if their Attack score is reduced to 2 and they swap Attack and Sleaze, their Sleaze stat is now 2.
• Blaster / Grey IC / Black IC - damage-dealers
  • resisted with Willpower + Firewall
  • does (net hits) matrix damage to the persona
  • Grey IC also does stun biofeedback
  • Black IC also does physical biofeedback
  • Any given host will only have one of these programs; which one depends on how secure it is / how paranoid its owners are.
• Track & Trace
  • Resisted with Willpower + Firewall
  • Any net hits linklocks the decker
  • Any net hits on a decker who is already linklocked does an automatic Trace Icon test without any further chance to resist

Patrol IC

TODO

9 - Overwatch, GOD & convergence

The Grid Overwatch Division is the Matrix police. TODO: MORE

Overwatch

Overwatch is a 12-segment clock. This clock is public, ie. the decker player can see it. (Delete: baby monitor program, check OS action.)

The clock ticks up when:

• +1 on any Attack roll, success or failure
• +1 on any failed Sleaze roll
• +1 per combat turn if maintaining user access to any PANs or hosts after rolling any attack action or failing any sleaze action
  • increase to +2 if maintaining admin access
  • if the intrusion was via a successful Probe / Backdoor Entry, there is an additional grace period before the clock starts incrementing; see Matrix actions

The clock resets only when the deck reboots and the decker’s persona logs off entirely. The decker loses all access to systems at that time, although any vulnerabilities discovered through Probe and not yet used for Backdoor Entry remain active.

Once the clock fills, GOD is alerted to the decker. A demi-GOD agent starts hunting them.

At the end of each turn, the demi-GOD rolls a number of dice equal to the clock vs a resistance from the decker of Intuition + Sleaze. If there are any net hits, the decker suffers convergence immediately. If there aren’t, the number of hits rolled (not the net hits) are added to the clock, and the demi-GOD will roll again at the end of the next turn.

Convergence

Same as RAW:

1. Persona’s deck receives 12 DV of Matrix damage, resisted with Firewall + Device Rating
2. Persona is rebooted, erasing all access levels and inflicting dumpshock (6S or 6P; resisted with Willpower+Firewall; Firewall will be 0 if the <atrix damage bricked the deck)
3. Decker’s physical location is traced and reported to authorities (including owners of the Host they were in, if any)

Convergence does not change if the persona is in a host or not when it happens.

GOD & the megacorps

GOD is run by the Corporate Court and staffed by loaned headcount from all the AAA megacorps. Despite that, the corps do not completely trust it. They worry about a demi-GOD who is loyal to their parent corp using their position to leak information back to them. (Of course, they also attempt to convince their own demi-GOD agents to do the same. In practice, GOD keeps its deckers on very short leashes, so this rarely works - but not never.)

As such, the corps sometimes take measures to keep their darkest secrets outside of GOD’s purview. This can include:

• Use of dark fibre connections to send traffic between sites that GOD cannot intercept or inspect. Can be used if the data itself is top secret, or simply to hide the location or existence of a secure facility that would otherwise be betrayed by its present on the Matrix.
• Refusal to alert GOD to hostile decker activity. In game terms, this means the decker does not accumulate OS for hacking attempts in the system. This is not good news for the decker in question, however. It means they are on dangerous ground that will be ruthlessly patrolled by novahot spiders and the blackest of IC.

10 - Common Matrix actions & how to do them

• Spy on phone calls: run Snoop while you have spotted one or more personas on the call. Once you run Snoop, you automatically spot all personas on the call, regardless of where they are.
• Trace phone calls even if you haven’t spotted the icon on the other end of the call:
  1. have Admin access on one of the devices on the call or place the call from one of your own devices or have successfully Snooped the call
  2. Probe or Brute Force the device at the other end to get Admin access to it
  3. Trace Icon (no test required)
• Mess with people’s cyberware or weapons: Spoof/Send Command doesn’t work against cyberware, as the user’s neural commands override any commands send from the Matrix. See instead the options under Matrix Attacks.
• Disable security cameras if they are wirelessly connected:
  • With Outsider access: Spoof Command
  • With User access: Send Command to loop them
  • With Admin access: Send Command to shut them down
• Bypass a host’s firewall via a device that is hardwired to the host:
  • Find the port on the device (might be armoured/hidden and require a Hardware roll to open it up)
  • Roll Hacking against the device’s own rating, with no Firewall from the Host
  • Any access levels you get from this test are applied to the entire Host WAN
• Spot icons inside a host: By default, most personas connected to a secure Host (eg for work) will run silent, so drop off the public grid. Run Matrix Perception test as usual to spot them and initiate a hack.