Demons and Watchdogs
Corporate systems almost always have some sort of active defenses. Without a vigilant Demon or two in the system to alert security guards, occupants of a facility might never realize that their network is under attack. In the same fashion, human watchdog hackers are often plugged into the more important networks, maintaining a 24/7 human presence within it.
Demons
Demons are autonomous programs supported by a network’s server hardware. Demons have avatars much as human hackers do, but operate based on a list of prioritized command lines, carrying out their duties according to their programmed behavior.
Demons are smart enough to prioritize commands intelligently; they won’t try to perform an obviously-impossible task in preference to an action that actually is possible. They are not intelligent, however, and can’t make choices unrelated to their program.
Demon programming is expressed in command lines, each line representing one action or purpose. Demons prioritize their command list from top to bottom, skipping commands that aren’t applicable. Every demon has a limit in the number of command lines they can process. Lists more lengthy than this are too complicated for the program’s logic to handle effectively.
Demon programs can use the Verbs and Subjects loaded into the network server they are operating on.
Demons have hit points which are depleted by the Stun Avatar program or other effects that damage code integrity. When HP reach zero, the Demon is fragged, and can do nothing until it reboots itself in an hour. It still counts for maximum-demons-per-node, however.
Demons also have a skill bonus. This bonus is applied to any cyberspace-related skill checks they may need to make, and counts as their skill level for the damage done by Stun or Kill Avatar.
Demons are located in a network based on the owner’s preferences. Sensitive nodes are often guarded by a Demon, as are network chokepoints. Some Demons are set to patrol the network, either in a regular pattern or as a random walk through connected nodes. Demons can ignore network barriers and do not need to spend Access to run programs, as they are assumed to have admin privileges.
A given network can support only so many Demons, based on the power of the network server. The network server lists both the maximum number of Demons that the network can support and the maximum number of Demons that can effectively act in the same node. If more than this number of Demons are crowded into the same node, the newest arrivals can do nothing but Move Nodes.
| Demon | Cost | Lines | HP | Skill Bonus |
|---|---|---|---|---|
| Tripwire | $5,000 | 2 | 3 | +1 |
| Mastiff | $10,000 | 4 | 5 | +2 |
| Siren | $15,000 | 2 | 8 | +3 |
| Cataphract | $25,000 | 3 | 20 | +3 |
| Ogre | $50,000 | 4 | 25 | +2 |
| Headsman | $100,000 | 4 | 30 | +3 |
| Hydra | $200,000 | 7 | 40 | +4 |
| Nemesis | $500,000 | 5 | 50 | +5 |
Demon Command Lines
The following command lines are examples of some of the instructions that can be given to a Demon. A given Demon can be programmed with as many of these lines as their capabilities allow, and will follow them in order of priority from top to bottom. Demons are intelligent enough not to waste time trying to do impossible things.
Example Command Lines
- Perform the Alert the Network action when an intruder is sighted, if it isn’t already alerted.
- Reboot deactivated devices on the node and message any watchdogs who may be on duty.
- Run Stun Avatar against any intruders until they have been knocked unconscious or offline.
- Run Lock Barrier on an unlocked node barriers you encounter and message any watchdogs who may be on duty.
- Move through the network in a specific patrol or random wander.
- Run Kill Avatar against any unconscious intruders until they are dead.
- Pursue intruders through the network, choosing randomly if multiple intruders are encountered.
- Run Erase Program against an intruder’s Stun Verb if they have used it in your presence before.
- Run Terminate Program against any active Hijack programs currently running in your presence.
- Run Paralyze Avatar against an intruder to physically lock them down before further countermeasures.
- Message security with the Send Message action whenever you execute a line action in response to some anomaly.
- Reserve a Main Action to run Defend Device in response to any attempts to hack devices in the node you’re in.
Watchdogs
Demons are tireless, vigilant, and require no wages. Human hackers, despite being deficient in these regards, are substantially more flexible and intelligent. Watchdog hackers are usually hired in 24/7 shifts in order to maintain round-the-clock observation of important networks that can afford their considerable expense, though some poorer facilities hire them only during working hours.
Watchdogs use the same hacking rules as PCs do, albeit they can ignore network barriers and do not need to pay Access to run their programs. To avoid a single point of failure, the vast majority use personal cyberdecks and their own programs rather than relying on the facility’s server computing power.
As watchdogs are intelligent, they can and will maintain full communications with the facility’s physical security staff. PCs who alert them to their presence can expect local security to come running to the physical location of any compromised device nodes.
Below are statistics for some of the common types of watchdogs encountered by PC hackers. Minor corps or gangs might be able to hire only minimally-competent hackers, but major black sites and important corporate facilities will have the best talent money can buy, with hacking cyber and decks to match.
| Watchdog Program | Skill | Int Mod. | Monthly Salary |
|---|---|---|---|
| Code Drone (1 HD) | Level-0 | +1 | $2,000 |
| Veteran Tech (2 HD) | Level-1 | +1 | $5,000 |
| Talented Pro (4 HD) | Level-2 | +1 | $10,000 |
| Big Name (6 HD) | Level-3 | +2 | $50,000 |
| Dire Legend (9 HD) | Level-4 | +2 | N/A |
Network Servers and Architecture
The server classes listed here are some of the most common, and a corporation can be relied upon to use the smallest iron they can get away with. There can only be one primary server on a single network; others might be connected to it, but only the primary server counts for determining node connection limits, barriers, or active demons.
Servers have node connection limits. This is the maximum number of nodes that can be connected to the server. If you want to connect 4 cameras, 3 doors, a security panel, and the server itself, you need to have at least 9 connections available.
Hackable devices without a connection to the server can’t communicate with it, but still function normally. An electronically-locked door with no connection can still be hacked, and PCs can still jack in to its cyberspace node, but there’s no way for the server to monitor the door or control its status.
Servers have barrier limits. This is the maximum number of barriers that the network can support. Barriers can be bidirectional or only work one-way as the network architect desires.
Servers have Demon limits. A given server can only support so many Demons, and only so many of those can be active in one node at a time. The table adjacent lists both maximum total Demons and, parenthetically, how many can act in one node at a time.
Servers have effectively unlimited Memory. Even the smallest, simplest server can contain as many Verbs, Subjects, or datafiles as a user needs. Any Demons supported by the server can use its Verbs and Subjects. As a result, prudent network architects try to keep invading hackers out of the primary server node; a well placed Erase Datafile execution can erase critical Verbs from the server and defang the network’s Demons. Human watchdogs use their own cyberdecks, so are not subject to this risk.
| Server | Cost | Max. Nodes | Max. Barriers | Max. Demons |
|---|---|---|---|---|
| Databank | $2,000 | 0 | 0 | 0 |
| Alpha | $10,000 | 10 | 1 | 2(1) |
| Beta | $50,000 | 15 | 2 | 3(2) |
| Gamma | $100K | 20 | 4 | 5(2) |
| Delta | $500K | 25 | 6 | 8(2) |
| Epsilon | $1M | 30 | 10 | 12(3) |