[Volker]

Oh, sorry. I completely forgot about that. Thanks for the reminder.

What exactly do you mean with AR hacking? Do you attempt to Hack on the Fly to put a mark on the host or what is the idea?

[gilga]

I always seem to be limited as you did not describe what kind of information system the clinc has.
AR - hacking - hacking in AR (in contrast to VR where your body goes limb and well it does not seem like a good idea in the middle of the street, despite the bonus dice it gives - and coolness factor)

Mark wants information about data-jacks/special cazy datajacks.
A lot of stuff can appear to be of relevance from orders/installations to medical records. Customer lists, suppliers - personal communications and so forth depending on what kind of things are there and what things Mark is skilled enough to access. If they got super strong IC and host rating of 10 for example I doubt Mark will even try to touch it.

[Volker]

I know what AR hacking is, gilge, but "AR hacking" is not a Matrix action and thus nothing you can roll on. You can roll on "Hacking on the Fly" to mark the host, e.g., without taking the bonus dice, but rolling on "AR hacking" is like rolling on "fighting" without describing which weapon you use against whom in which mode, and so on. I didn't even know whether you use Brute Force or the Sleath version before your IC post. Please try and describe the matrix actions more precise.

[gilga]

Volker - why is there an IC on my tail did I fail to download the file ? I entered with hack on the fly and was successful so the host should not be aware of me and have I done anything illegal? I used my mark to see the file and I did not understand, did I fail to use edit the file and triggered an alarm of some kind?

I do not mind to roll hack on the fly for the file - but if the file is stored in the host a mark on the host should allow me to perform this action. Same way that if it was on a comlink I'd need a mark on the comlink to do so.  Life is too short to argue - I just want a clearification as to what I need to do to get the file to my RCC. I am not even sure that there is a point in fighting the IC as the host can just respawn them so I am waiting for an explanation as to what to roll to get the file downloaded and what did Mark do to get IC locked on him. (just for my own meta knowledge because it was not clear from your post.)

[Volker]

ad 1: Mark wouldn't know, but since he's a more experienced decker than you are, he might guess. The hidden icon you saw - it was a patrol IC which has been monitoring you for quite a while. After it classified you as an illegal intruder, the host launched the IC.

 ad 2: I don't think so, but I'm not certain. As far as I know, you can mark a slave via the master, but never the other way round. You shouldn't have permission to access that file. I'll reread the rules, though. Maybe if you could point out the rule passage where it says that a mark on the host also counts as a mark on its files, that would be very kind.

[gilga]

the rules are very poorly wrriten so I am not going to try and piece it together I accept how you interperate them and we can move on.
About IC:

1. Sleaze actions when they are successful are unnoticed - this means that Mark appears to be a legitimate user. Any test that the system did to determine if Mark should be there indicates that he should.

2. Since entering the system with a successful sleaze operation, Mark has not yet done anything unusual he performed a computer search that is completely legal (if you have a mark on the system) he did not access unauthorized data (yet) and thus there is no reason why an IC will attack him.

3. The IC could not been watching Mark for quite some time because the IC is a program running on the host. Therefore before Mark entered the host the IC could not watch him. The host identifies Mark as a legitimate user and unless his overwatch is already at the point where the IC locks on him (that is very bad for us) Mark is not identified as a threat he need to get caught doing somthing illegal to do that the longest the IC could be watching Mark is 2 minutes where Mark did a perfectly legal search not different from the legitimate user.

4. note that Mark is under no threat from the IC as he is in AR, the worst that can happen is his RCC get bricked and Mark will have to spend several hours to fix it. I am worried about the IC because if IC attack mark it means that we lost stealth and that the hacking attempt is lost and it feels as if there was no way to make it successful.


About the file:
1. For Mark to find the file it either has to be on the host - or on a device that agrees to let Mark search it (extends Mark a mark). - the edit file action is the one used to access the file?

2. If the file is not on the host and Mark has no mark on the device - either from hacking or as it automatically extends a mark for basic usage than Mark simply cannot locate the file with a computer search as Mark can only search sources that he has access for.

About perception check:
1. If I roll a successful perception and all I get is 'there is an hidden icon' what do I need to do to find out what kind of icon? another perception check? Do we need to play 20 questions?

Please explain what we see differently because when I perform matrix actions it is a risk/reward thing if I can get caught and smashed despite succeeding the rolls I need to know and understand it because the way I saw it Mark needed to fail in some action - or to accumulate a lot of over-watch to get to the point where he fights for his life and we obviously do not see eye to eye on this thing.

So I need to understand - is getting caught and needing to fight IC depands at all at Mark's skill or these things can happen regardless of skill as part of the story. I am honestly okay on any interpertation you want and the last thing I want is to start an endless rules debate but I need to understand what the consequences of Mark's actions before I take something that has much higher cost of catastrophic faliure as you describe IC banging him and system administrator notifies of the security breach. The way I read that this is a lot worse than mentioning special data jacks to some supplier that might alert the temple this is getting caught with the hand in the cookie jar, and it feel that so far mark managed to do so well as he even extended edge to spare himself the consequences of  a roll that have gone bad.

[gilga]

Initiative: 9+4d6 17

[Volker]

Whew.
Before I begin the explanation, I better start with an apology. While I don't

agree rulewise, you are absolutely right with your last comment. When you

said you looked for hidden actions, I should have assumed the whole process a

decker would usually undergo, instead of just continuing. I usually only GM

in real-life meetings where such a thing can't happen. Since I didn't get

what you meant in the first post, it felt like a lot of time had passed and

you had not reacted. But, of course, from the moment where I told you that

there is a hidden icon, you (as a player) didn't even have time to react. My

apologies for that. Let's fast-backward to the point where Mark inspected the

hidden icon more closely and realized that it was a patrol IC. You can react

in any way you like and you have not yet been discovered or attacked.

Still, there's a positive side this happened. Obviously, we have a different

interpretation about what patrol ICs do, and in order to roleplay this

realistically and without any more hitches, we should have the same

interpretation.

Having a mark on the host and doing only Matrix search actions prevents you

from being found by GOD or demiGODs, but is pretty useless against patrol

ICs. This is the very reason patrol ICs have been invented in the first

place. Check out the example in CRB 224, 225. Although BK has only entered

the host and searched for a file, the author worte: "A patrol IC is checking

out every icon, looking for users that don't belong. BK is running silent,

and the IC misses him ... this time." What a patrol IC does, he checks out

every single icon and compares it to, say, a data base listing legal icons.

Since you're not in a public but in a private host, you are not going to be

listed there, and thus will be considered an intruder. Since you are not even

running silent, the IC can spot you immediately. By all rights, you could be

identified and attacked as an illegal user from the second combat round on.

But let's assume that Harka is a little bit less paranoid and will have his

programs do some double-checking before he attacks anybody. Still, time is

running out on you, since you have been spotted and you are an illegal

intruder, having a mark or no.

In response to your comments:
 ad 1) Right. They are unnoticed by the icon you are performing the action

against. This doesn't mean you are invisible to icons actively searching for

you.

 ad 2) You have. You are in a place you don't belong.

 ad 3) The IC only need one CR or two. You need minutes.

 ad 4) You're right about that.

About the file:
It is on the host. That's why you are able to find it. Still, in order to break the protection and read the file, you need one mark at the file, which you don't have (yet). You have only marked the host, not any icons inside the host. Unless I am wrong (again), you can only mark a host if you mark its icons, not the other way round.

So, let's go back to the moment where you realize that you are under observation and time is running short. I grant you one Complex action headstart (or more if you don't search the file but react to the patrol IC instead). I hope this is fine for you.

[gilga]

Rules. 
1. This is the description of a patrol IC:
Attack: n/a
Patrol IC acts more like an agent than other intrusion
countermeasures. Its job is to patrol a host, scanning
people’s marks and looking for illegal activity using the
Matrix Perception action on all targets in the host. While
the act of placing a mark is an illegal activity, the act of
simply having a mark is not. Once you have the mark,
you are considered a legitimate user. Patrol IC has no
attack, but it shares its information with its parent host.
Since the Patrol IC doesn’t use Attack actions, it doesn’t
take Matrix damage when it fails. Most hosts have Patrol
IC and keep it running all the time.

This is why I think that while if the patrol IC had noticed Mark perform hack on the fly - it would have alerted the system. Once Mark accepted a Mark he DOES belong there. There is no alternative hacker proof list of authorized users - Mark's device is part of the list of authorized user and any security protocol has authenticated that Mark is allowed to enter the host. The patrol IC after all enforces the host's policy and Mark was granted access.

Sure Mark faked it all and this is why he is gaining overwatch as time passes and his ruse becomes more apparent. But a combat with IC should not happen before Mark is cauhgt or his overwatch climbs too high. If there is a combat - it will not be with a patrol IC because they are just doing perception checks.

2. Is a search even possible with a host if Mark illegally hacked his way inside?
The reason I am asking is that a search takes minutes and a combat turn is 3 second and in that turn a patrol IC can perform multiple scans. Mark and any other decker has limited dice for avoiding matrix perception when running silent - if the patrol scan's Mark 1000 times there is no need to roll, Mark will be discovered  - and the patrol IC just knows that Mark should not be there.  So Mark raises all the red flags, if in this game it is impossible to break in a host and remain there for several minutes without raising alarms then Mark's goal is unattainable and we need to talk about what kind of things can and can't be done with decking.

What I had in mind was enter the host and search it legally - then steal the file while running silent and hiding from IC and so forth. Because the way I read these things - I can be inside the host for a while as long as I am not caught doing illegal matrix actions. It is not how you do it so Mark's behavior should fit the way the matrix is in your game.
 
So the question asked: Is a matrix search inside a host an attainable goal?
Because it require Mark to be undetected for several long minutes where just spotting him causes the IC to fight him. Mark or any other decker can only successfully avoid matrix perception so many times - if you roll 100 times you'll find Mark. 

3. Is there a list of matrix actions/configurations that result in Mark's getting the paydata without fighting IC? What sequence of actions do you see Mark doing to get that thing done? Because we seem to see things differently.

To the obvious problem of a program spotting Mark and calling the alarm if Mark is spotted there is a solution: 
Hide: 12d6t5 6
Since I assume that the next op of the patrol IC will be to try and spot Mark:
Defend from matrix perception: 13d6t5 4

But I still feel odd that Mark is so quickly in troubles. So Perhaps with your interpretation Mark need to run silently ? I was thinking that running silently is only needed when performing illegal stuff (like stealing a file) rather then browsing around - this is why Mark is hiding in plain sight not doing anything illegal instead of raising suspicion by running silent.  (How long can you remain undetected while doing somthing illegal like running silent - that obviously means I SHOULD NOT BE HERE - so I assumed I'll do what legal actions I do and then switch to silent, steal the file and get out preferably without suffering 100 of matrix perception attempts.

This is not how you see it - as we ended up in combat before Mark even touched the file.  So please I need to understand how it can be done correctly according to the way you want the matrix to be.


5. The patrol IC text I quoted say that they cannot attack - so if Mark is fighting somthing it is other IC's summoned by the patrol IC.

The way I see it:
The good result is: 
1. Mark get data undetected.
So So results:
2. Mark leave undetected - without data.
2. Mark is detected and get data.  ** Taking the data will cause problems but at least we have it.
The worst that can possibly happen:
4. Mark is detected and leaves without data.


Somehow it feels like we reached 4 - even tough Mark had a very good hack on the fly roll and successfully marked the host. We rolled back so this is the only action Mark did so far, that and matrix perception.

Now did you intend for Mark to switch to silent running after marking the host?
It seems reasonable (providing that searching the host - is even feasible)
In that case why didn't Mark run silent ? - I'll need some help here as we see things differently about the matrix so I am not sure what the 'comon sense' is.

So please to avoid confusion: A list of actions of how an ace decker get to the host, search and get the file without setting off alarms. (Then I can check if Mark is an ace decker or not.)

[Volker]

ad 1)

The thing you are confusing is: The IC are not attacking you because you do some illegal. They are attacking you because you're in a place you don't belong. This is not a straight-and-honest commercial host where everybody is invited to stroll around as they please. It is the private host of one evil son of a bitch who is ready to kill for a piece of privacy and gives a damn about whether you are breaking a law, protected by the law or basically anything else that has to do with legal stuff. In this host, there are only one or two legal users, and the IC knows them. If you are identified as "not Harka", it will launch a warning.
Please read the example in CRB 245. It describes perfectly how patrol IC is intended to work by the authors of Shadowrun. It does exactly the same Harka's patrol IC does.


Let's compare a patrol IC's work with an analogy. It's like a soldier patroulling around. What Mark did with his hacking is opening the maglock. The system (that is, the door) recognized your activity as legal, opened the 'lock and let you in. The soldier, however, will realize that you are here without permission, and raise alarm.
There is no combat yet. The combat will come if you fail to prevent the patrol IC from raising alarm. Then a more nasty IC will be loaded in order to get rid of you.

ad 2)

Of course it is possible. Just run silent and not get seen, same way as in a real infiltration. In Shadowrun, if you fail a check and retry, you lose one die. So all you have to do is hide long enough for the IC to lose its dice. Since your rolls are defense rolls and hence don't lose dice, there would only be three or four dangerous rolls. If you hide in a real place and a guardsman is looking for you, he too won't find you automatically by just rerolling his perception checks.

ad 3)

Of course not. This would be ridiculous. This is like asking "Is there a list of skills I can use while intruding a building that does not rise suspicion?" Again, exactly this is the reason why patrol IC was invented. If the regular security measures (that is, a firewall) would be sufficient, why bother buying patrol IC? If creating a mark would shield you from a patrol IC, it would be pointless. In your interpretation, a patrol IC couldn't do anything helpful. Just the opposite, almost every host runs a patrol IC because it can detect intruders that were missed by the system and GOD.

I can understand that it sucks if you managed all your rolls and yet are in trouble. But this is life. This is Shadowrun. If the group infiltrates a building, manages all their sneak and Locksmith rolls and is then detected by a spirit, that sucks as well. The enemy is never sleeping, and they are not restricted to passively react or wait till you're done with them.

ad 4)

There is no 4...

ad 5)

Opposed roll: 11d6t5 1
Right now, Hiding is a very clever idea. So if you do, you are hidden again and running silently. You can now either attack the patrol IC or continue your search and hope it won't find you again.


I hope, everything is clear now. Just think of a patrol IC as a watchman. Mark opened the maglock succesfully and then headed inside without concealing himself from suspicious eyes.
Anyway, no harm is done. You have hidden succesfully and I take it that you switch into running silent.

[gilga]

A spider hits Slamm-0! (who is of course using
hot-sim) for a total of 8 Matrix damage. Slamm-0!
(or rather his deck) resists this damage with Device
Rating + Firewall, getting 4 hits. That means his deck
takes 4 boxes of damage. The spider is running Biofeedback, so Slamm-0! (not his deck) must now use
his Willpower + Firewall to resist 4P damage. Any unresisted damage sinks right into Slamm-0!’s brain, and
he marks it off his condition monitor.

this is the example in page 245 of my crb.

Mark will switch to running silent he is hidden - what happens now? was alarm raised? I still think he should have entered in silent but whatever. Should I roll a new search? more avoid perception rolls?

[Volker]

lol crap
I meant 224 and 225. My bad.

I agree that he should have done it in the first place, only you didn't ^^
If anything bad would have happened, we could of course assume that he never underwent this glitch. Anyhow, nothing happened except that your OS raised by 1 point. No alarm was raised since the patrol IC didn't have the time to observe you.

Matrix perception: 5#11d6t5 4 4 3 1 1
Since it looses dice, the actual result is: 4 (for which you already rolled), 3, 3, 1, 1.
If you don't mind, please roll these 4 rolls. After this, we can assume that the IC gives up on you.

[EDIT: After that, you of course found and inspected the file. You can now continue with hacking a mark on the thing, breaking the protection and copying it.]

[gilga]

4#14d6t5: 4 #
9 [14d6t5=3, 5, 6, 5, 4, 2, 3, 6, 2, 6, 5, 6, 6, 6]
1 [14d6t5=4, 1, 4, 3, 1, 2, 5, 2, 3, 3, 1, 3, 4, 1]
6 [14d6t5=2, 3, 1, 5, 6, 4, 6, 3, 3, 5, 6, 2, 5, 1]
4 [14d6t5=1, 6, 2, 5, 5, 2, 2, 4, 4, 3, 5, 3, 3, 2]

Mark will disconnect as soon he is discovered again - I think this host is too strong for his skills. Especially with -2 from running silent and in AR. We'll have to find some other way.

[Volker]

you don't get the -2 penalty for the discovery check.
If I see this correctly, there's only 1 hit in 1 roll you'd need. Do you want to spend Edge in order to avoid the patrol IC?

[gilga]

just disconnect and give up.