Cyberspace Basics

Cyberspace exits as a VR-mediated digital world that appears in whatever idiom the system’s owner has selected. While a cyberdeck can reinterpret these idioms into a sensory experience more palatable to the user, most hackers prefer to see things “natively” when hacking a system due to the lower processing requirements.

Cyberspace exists in nodes, each one mirroring a particular network device or cluster of devices. A single camera might be its own node, or a set of factory machines, or a net-monitored minefield, or any other network “place”. Nodes are where programs and datafiles are kept and where hackers encounter guardian Demons and human watchdogs.

Nodes are linked by connections. To move from one node to another, a hacker needs to cross these connections, defeating any digital barriers that security may have erected. A hacker who jacks in to a security camera on the outside of a building might then hop its connection to the security panel where its output is being monitored. Without this long-distance travel, the hacker would have to physically reach the security panel in order to manipulate it.

Every human in cyberspace is represented by their avatar. Hackers tend to go to elaborate lengths to customize their avatars and the visual representations of the programs they use, but most corporate watchdogs are limited to corporation-approved brand icons. Most “civilian” users simply wear whatever digital disguise they’ve bought most recently.

Time in Cyberspace

Cyberspace actions take the same amount of time as physical actions; the code may be fast, but the human mind is only so agile. Hackers must split their available actions between cyberspace and any physical activities they want to perform while jacked in.

Connecting to Cyberspace

To connect to a node, a user has two choices.

Physically attach a self-adhering field modulation cable from your cyberdeck or cranial jack to the device housing. Even without a convenient plug socket, this will let you hack the device’s internals.

Wirelessly connect to the device with your cyberdeck. The target must be within 30 meters with an unobstructed line of sight. Wireless connections are much more tenuous than physical links; you’ll take a -2 penalty to any cyberspace skill checks you make and your avatar won’t be able to move out of the node.

In both cases, it’s assumed that you’re connecting to your cyberdeck with a cranial jack. VR crowns can be used as a makeshift link for those without a cranial jack, but they apply a -1 penalty to all cyberspace skill checks made with them.

Connections last until someone yanks your cable off the device housing or you voluntarily jack out of the system. Even if unconscious, your avatar remains until you’re jacked out. Crash disconnections are disorienting and will leave a hacker stunned, but sometimes an ally needs to cut the link before some watchdog boils a nerve-locked hacker’s brain.

Wireless connections have no cable to yank, but fail if the target moves out of range; once the link is established, the line of sight need not be unobstructed.

Hackers normally remain aware of their physical surroundings while jacked in. They can act in either the physical or virtual realm as they choose, spending their actions during the round as they wish.

Access

Access is the digital currency of control, representing a hacker’s array of countermeasures, zero-day hacks, fresh intrusion measures, and unsecured backdoors. It’s spent to run programs on a secured system. Access is a general pool, though sometimes a hacker may acquire specific data that gives them bonus Access against particular networks.

A hacker’s base Access is equal to their Intelligence modifier plus their Program skill plus their cyberdeck’s Bonus Access rating. To refresh this pool, they need to spend an hour reprogramming their deck and slotting in new exploits. Such a refresh can only happen once a day as it takes time for new security holes to open in newly-updated software.

Hackers can acquire bonus Access to a network through social engineering: inside information, moles, and backdoors they’ve been informed about through Contacts or field work. This information is perishable, and usually becomes useless within a few weeks.

Running Programs

Once a hacker has jacked into a node, they likely want to do some mischief. This is accomplished by using programs made up of two different kinds of code fragments stored in their deck’s Memory.

Verbs are what the hacker wants to do to the target: Glitch, Sabotage, Blind, Decrypt, Delude, or some other malfeasance. A full list of the most common Verbs is provided on page 98.

Subjects are what the hacker wants to do it to: Camera, Turret, Door, Barrier, Avatar, or something else. A hacker needs the right code libraries on hand to work their magic, and if they don’t have the data specs for a target in their deck’s Memory they can’t hit it.

Each Verb or Subject takes up one unit of Memory in a cyberdeck. The hacker can mix and match these fragments as they wish to create programs. A deck with the Glitch, Blind, Datafile, Camera, and Drone fragments on it could Glitch Drone or Blind Camera or any combination of Verb and Subject the hacker wishes, determined at the time they run the program.

Verbs are flexible, but each has a limit on what type of Subjects they can use. The Glitch Verb is only usable on Device or Cyber types of Subjects. Drone is a Device Subject, so it’s valid, but Datafile is a Data Subject, so Glitch can’t operate on it.

Most Verbs require that the hacker beat the target network’s security difficulty with an Int/Program skill check. This difficulty varies with the quality of the network tech, usually ranging from 7 to 12, or even more.

Each failed execution against network security increases the network’s alertness. Each two failed attempts counts as one Alert the Network action, so no more than four botches will light up the facility. Opposed skill checks, such as in combat, don’t trigger this effect. Even networks without a Demon active can thus end up alerted by a sufficiently inept or unfortunate hacker.

Cyberspace Combat and Demons

While only well-funded networks will have a human “watchdog” jacked into the system to monitor it, all but the poorest network will have at least one Demon program positioned to deter intruders and raise alarms.

Demons are programs that usually remain stationary in a single node. When an intruder arrives, the Demon will carry out its programming. This usually entails raising a network alert to on-site security and launching Stun Avatar programs at the hacker. A Demon’s particular program loadout and directives will depend on what the network admins granted it.

Cyberspace combat is usually played out via Stun Avatar programs that inflict non-lethal hit point damage to hackers or Demons hit by them. These hit points are subtracted from the actual physical hit points of the hacker; if reduced to zero HP by Stun Avatar, a human goes unconscious, waking up ten minutes later with one hit point. Demons reduced to zero HP are fragged, and won’t reboot for another hour.

The specific procedures for cyberspace combat are detailed in a section below.

Noticing Hacking

A hacker generally needs to be plugged into their cyberdeck in order to hack, whether with a cranial jack or a VR crown. This is going to be enough to catch the attention of people around them, who may not know what the hacker is doing, but they’ll know that the hacker is prepared to do something. Decks with 0 Enc might be small enough to hide discreetly, if the user is wearing a head covering.

Hacking attempts on cyberware are always obvious to the target unless specified otherwise; the user’s cyberware will naturally ping the user that something is happening, even if the effect may not be obvious. Frisking someone for cyberware via hacking is generally considered a hostile act. A target might put up with it if they’re being checked for weapons as part of a security process, but running a Frisk on the street is likely to convince the target that they’re about to be attacked.

Hacking attempts on other hardware are obvious from within the device’s node, and any hacker, watchdog, or Demon in it is capable of detecting tampering automatically. An outside observer won’t necessarily notice anything wrong unless the device is behaving in some uncharacteristic way.

What Can Be Hacked?

Software-controlled devices can be hacked, such as drones, most electronic locks, cyberware, cameras, and other program Subjects listed in this section.

Mechanical or strictly electrical devices cannot be hacked. In the default setting, this includes most vehicles, dumb locks, household appliances, thermostats, and anything else that can do its job without talking to a computer. Security-minded corps have no reason to make life any easier for an intruder than they must.