[Annoch]

Ok, so maybe I am dense but I just don't seem to be able to wrap my head around the Matrix portion, but I don't want to give up just yet.  I think that maybe I learn by example, so hopefully someone will take the time to read this scenario and see if they can answer my questions.  Here goes...

Mr. Johnson hires your team to get physical evidence which would ruin the clients reputation from a shady lawyers office before it can be leaked to the press. You do your legwork and recon and find the following:

• The evidence is at a lawyers office downtown, and he is rumored to be a Mob lawyer.
• The office is located downtown, near both businesses and bars and restaurants.  This means the area is busy at all times.  Worse, there is a Lone Star precinct across the street.
• The only way into the building is through the front door.  There are no exterior windows and no back door or other ingress.
• The door is hardened and is locked with a DR 7 biometric maglock.  Clients wishing to enter during business hours must ring the buzzer to be let in.
• The front of the building is covered by two cameras mounted approx 10 feet off the ground.  One sweeps the front of the building and the other is pointed at the door to allow identification when people buzz the door.
• The inside of the office consists of a reception area and five offices for the lawyers along with one secured file room.  The reception area has a computer for the receptionist along with the door controls and video feed monitors.  The lawyers offices and file room are locked with the same biometric maglocks as the outside door.  There is no one in the office after it is closed and no security guard
• The business has three hosts.  The outside host that connects to the matrix is rating 2 and exists for general reception, scheduling, client contact, etc.  Two hosts are attached to that; one is a rating 7 security host that controls all of the maglocks and cameras, the other is a rating 7 data host that has all of the secure files, etc.  The receptionists computer connects only to the outside host while the data host can be accessed via the attorney's computers.  Only the owner and the security firm (Lone Star) have access to the security host.  A security spider only comes on after an intrusion is detected
• You do not know where the file is located, but suspect that it is in the owners office

Ok, probably more than necessary, but I figured I would try to provide a scenario which might happen in game.  I am assuming that the team determine that the only way to get in quietly is to have the decker do his thing to get them in. 

My questions:

• 1.)First, does this seem like a reasonable set up to the more experienced folks?
• 2.)If the decker is standing outside of this office, what does he see in AR/VR?  What icons are visible, if any?  Does he see any of the hosts, the cameras, the maglocks, the computers?  My reading of the rules says that the only thing he would see is the outside host...
• 3.)Could the decker access the outside maglock or camera even though (i assume) he cannot see their icons?
• 3a.)Would a spoof command work?  If a spoof command would work does it matter what the device rating of the maglock (for example) is?
• 3b.)From other threads, it appears that it was decided that all devices (no matter what they are) have easily accessible, universal ports that an on site hacker can use to access a device regardless of any other factors.  Is this correct?
• 4.)The decker could gain access to the security host via the outside host and then probe/backdoor or brute forcing into the security host, correct?  If he is able to plug directly into the maglock (lets say) from Q 3b, his probe or bruteforce would be directly into the security host, ignoring the outside host completely, correct?
• 5.)Other than possible noise penalties, is there anything which would change if the hacker was not on site other than the fact that he would not be able to directly connect (3b)
• 5a.) {ignore if the answer to 3a is no} Would the hacker still be able to spoof the cameras/maglocks if he was chilling at his apartment a few km away?
• 5b.)Would the hacker a few km away be able to see the same things that the on site hacker would by just 'going there' in VR?  It seems to me that the Matrix has a sort of geographic side where if you are living in Desden, Germany and you were looking for this attorneys's office in Washington, DC to hack you would just 'travel' to the part of the matrix that represents that geographic location and look around to see the same things that the local hacker does?

Ok, that covers my basic questions for now.  Thank you in advance for anyone who takes the time to actually answer any of this.

[Stainless Steel Devil Rat]

1) a few observations on your premise:
a building with no windows, no fire escapes or other emergency exits... only ONE way in and out sounds inherently implausible.  And even if it DID exist, it'd have to be on some sort of extraterritorial corp grounds where they don't have to answer to fire safety codes.

A rating 7 maglock on the front door also sounds a bit over the top.  It'd be like saying the hallways are patrolled by Red Samurai!  Also note that a biometric lock for the FRONT door is implausible.  How are potential clients supposed to even walk in?  Now, a biometric lock on the lawyer's personal office makes perfect sense.  But the front door for an office building?  It shouldn't be locked at all during business hours (fire codes!) and after hours something more on the level of a rating 2 or 3 (at most) maglock is what'd be appropriate for a mundane office building.  Probably a keypad or card reader would be more appropriate, but if you have other reasons to want a biometric reader it's still certainly plausible that the night staff's fingerprints could be on file.

Host architecture: rating 7 hosts are pretty chunky.  many corp sites don't even have that.  Now it's not outside the realm of possibility for the Mob to throw a bunch of resources at this guy, but it'd be less eyebrow raising if he had hosts more on par with what legit businesses have.  2 for the public host sounds about right, but I wouldn't go beyond 4 or 5 for the secure hosts.  Well, unless you have PCs who need big hosts to be challenged by.  But for someone throwing 12-14 dice, rating 4 or 5 Hosts is gonna be hard enough.

The spider not coming in until after trouble is started:  Nope, a terrible idea in 6e.  Hosts can't roll mental stats, so they need spiders to lend to defense pools.  Unless you're trying to throw a puffball to the hackers, you need spiders on duty.  (and if you're trying to throw puffballs... what's with the rating 7 hosts? )

2) what the decker sees from outside: Any AROs advertising the lawyer's services that the laywers want the public to see.  Surely their public host would be prominent to anyone who cares to look. Any devices controlled by hosts are usually not visible from outside the host, but exceptions are possible.  And it makes perfect sense for things like vending machines to be directly accessible to random traffic.  Maglocks, too, because you don't necessarily need (or want) everyone who has access to go through the door to also have access to your host that controls said maglock.  For example, do you think the lawyers want the secretary to have permissions to use the security host?  Probably not.  So her ID badge can talk to the card reader without her needing to log into the security host first!  OTOH, security devices that the public and general employees have no business messing with (security cameras, motion sensors, etc) will probably not have this courtesy extended.

3) Short answer: No.
Longer answer: Yes, but only after you've hacked into the Security Host that controls said devices.
3a) It depends.  See my comments in 2).
3b) yes, but getting physical access to devices can be very tricky.  For example, you might see the black dome that you know a camera is located behind, but to get at the camera you have to get that covering off first...   I strongly recommend reading the Sensors and Scanners section on pgs 241-242 SR6W.  It also covers how to "hack" a maglock via non-matrix means.

4) It depends on the host architecture you're establishing.  If the Public Host interfaces with the matrix, and the Security and the Secure Files hosts, while the Security and Secure file hosts only interface with the Public Host, then the decker must first hack into/through the Public host before being able to get to the other hosts.  EXCEPTION: if you DO establish a direct connection to a device controlled by say the Security host, then you can start hacking the Security host via that direct connection.

5) Noise would be the issue.  If the lawyers are security conscious, they might employ wireless negation (see pg. 177 SR6W) and that would mess with any hackers not inside the building/room as the device being hacked.
5a) Yes when 3a) is yes, No when 3a) is no.
5b) No.  VR is not a perfect parallel of Astral Space (though it'd be cool if it were).  The "space" inside hosts has absolutely no correlation to the space inside physical buildings they serve.  Even in VR, you can't just "float" around physical locations... you can only go to digital locations (i.e. Hosts).  CAVEAT: In very specific examples (not the norm), you CAN "ghost" around physical locations in VR. See the examples for the Neo-Tokyo Visitor's Bureau (pg. 232 sidebar, SR5)  and Dante's Inferno (pg. 220 sidebar, SR5) in 5e for examples of how a digital avatar can remotely interact with real people/places BUT ONLY WHEN THOSE PLACES DELIBERATELY want this to occur (they set up holographic projectors, etc).  Maybe a lawyer might want the capability to meet virutally with clients, sure.  But 99.9999% of the time it's better to just set up a secure meeting room on their host rather than going to the bother of setting up the machinery to holographically render a VR persona.

[Stainless Steel Devil Rat]

Also: I'd recommend checking out this thread.  I bet some info there will be useful to you!

[Xenon]

You typically only use one single host, but nestled hosts can also be used if you want to challenge the team's hacker a bit extra...

Could the decker access the outside maglock or camera even though (i assume) he cannot see their icons?

Since the Edit File action (to edit out yourself from the security camera) require User Access, the hacker would need to gain access on the Security Host (and and with it all the devices that are part of that network) anyway, no matter if cameras are on the matrix facing side, on the 'inside' of a host, part of a 'nestled host' or part of a PAN etc.

To hack the Security Host you would typically first enter the public Host (which probably allow Outsiders) and then from there hack the security Host.

Would a spoof command work?

Once you got yourself User access on the network you might as well take the Control Device action instead (as it doesn't risk generating additional overwatch score), but yes, Spoof Command can also be taken with User access.....

If you just want to get inside the building and have no desire to hack the cameras (perhaps because the team's magician is sustaining an improved invisibility spell on you) then you could also just walk up to the maglock to establish a direct connecion and then spoof a command to it. This doesn't require any access at all (but the Spoof Command attempt would still be opposed by both Data Processing and Firewall of the Host).

If a spoof command would work does it matter what the device rating of the maglock (for example) is?

Not really. No.

When it comes to devices typically only commlinks, RCC's and cyberjacks provide Data Processing and Firewall attributes. And typically only cyberdecks provide Attack and Sleaze attributes. Other devices typically don't provide any matrix attributes and instead depend on matrix attributes of the network they are part of.

Different matrix actions are resisted by different combination of attributes.

Any device that is part of the Security Host would defend against a Spoof Command attempt with the Data Processing attribute of the Security Host and the Firewall attribute of the Security Host.

The decker could gain access to the security host via the outside host and then probe/backdoor or brute forcing into the security host, correct?

Correct.

If he is able to plug directly into the maglock (lets say) from Q 3b, his probe or bruteforce would be directly into the security host, ignoring the outside host completely, correct?

Correct.

Other than possible noise penalties, is there anything which would change if the hacker was not on site other than the fact that he would not be able to directly connect

No.

Would the hacker still be able to spoof the cameras/maglocks if he was chilling at his apartment a few km away?

If their icons are inside the host and the hacker does not have access on the host and does not have a direct connection? Then No. Otherwise Yes.

Note that Spoof Command can also be taken if you have User or Admin access...

Would the hacker a few km away be able to see the same things that the on site hacker would by just 'going there' in VR?

The on site hacker would obviously see actual walls and furniture etc which a remote decker would not (unless your infiltration team share their video feeds from their scopes and firearms etc).

But as I understand it there is no game mechanical difference between AR and VR when it comes to device icons and hosts etc. (the only thing the extra distance seem to affect is the added noise).

[Stainless Steel Devil Rat]

You typically only use one single host, but nestled hosts can also be used if you want to challenge the team's hacker a bit extra...

In 5e, that was true.

In 6e, a network of hosts is more the norm.  See examples of Host Architectures on pgs 185-186.  In particular the example on pg 186 is exactly the arrangement the OP postulated.  Although I'd change it up a bit, and say the Security and Secure Files hosts should probably be able to talk to each other directly without having to go thru the weak link of the Public Host.

[Annoch]

Thank you guys.  I really appreciate it.

I suppose that I am just having a really hard time getting this system right in my head.  Everytime I think I have it, it turns out I still have a ways to go.  I really want to be able to GM this for my group, but if I cannot explain what the decker is seeing and what he can interact with, I will probably just have to give up.

The last time I GM'ed Shadowrun was in High School with 2E, and while there are loads of problems with those matrix rules I could very definitely explain they system set up and knew exactly what they would see, etc.  In 6E the lack of examples for someone who is a lapsed player makes it nearly impossible to wrap my head around.

Also, thank you for the critique.  I just sort of randomly picked some security values, since the rulebook gives the range but doesn't really give any examples of what those numbers might mean; other than that one is the weakest and 12 is the strongest.  It would have been wonderful to have a chart that told me which value is usually used by my grocery store or library and which one was used by an Ares Black Ops site in Bolivia...

[Xenon]

In 6e, a network of hosts is more the norm.

Yes ... nested Hosts are not the standard and should be used only when the GM wants that added layer of complexity and/or security.