[penllawen]

If SIN checks was not just used to validate if you are a legit citizen (as written) and instead also being used to validate that you are actually you (as you would like it to be)
...
This is the intent. And this is how the rules are written. And if works. Stop trying to "fix" it?

I've run out of ways to rephrase attempts to explain my goals, but you're still mis-stating them so I guess I still haven't made myself clear... I am formally giving up.

[0B]

You can't steal someone else's fingerprints.
But you can impersonate them (with a sleeve, SR5 p. 447)

Sure you can, there's even a knife in the gear section that'll let you do so. As long as the finger's fresh enough to still fool biometrics into being alive, you can do this.

"Rule Zero: Shadowrunners Exist" is a good gamemastering policy for ensuring players have a smooth game, but is largely irrelevant if you're just looking for information about the setting. There are plenty of things in play that are not in the fiction, and vice versa. RAW doesn't always account for rule zero, either.

This is the intent. And this is how the rules are written. And if works. Stop trying to "fix" it?

Not everyone plays RAI/RAW (And sometimes it's impossible to do both). Not everyone interprets RAI/RAW the same way.

Not everyone has to play the same way you do.

[Reaver]

We really need a new Lone Star book... (as that book covered some of this)

Since you are moving in the area of actual Security and Systems, I'll share some expertise....

Security and Business operate at polar opposites.

Businesses are about efficiency. Speed of action to complete a task in the shortest period of time, so you can compete as many tasks as possible. Be that assembling an item, filing a report, or generating data... The faster you can complete a task and move on to the next task, the more revenue you generate.

Security is about slowing down movement and access to and through your facility. There is no security system in the world that can keep people out if they really want in... all a Security system can do is slow them down, and alert you to the attempt to break in. (Hence the old addum of "A lock keeps an honest man, honest")
The biggest flaw in any security system is always the end user, and the more obtrusive a system, the move likely it is going to be disabled by the very users of said system! This is why Security systems are set up in at choke points, entrances, and portals.


Now for Shadowrun, its important to look at the big picture, and not just the Facility... (you'll see why, this comes up in RL security too)

 First off, its important to realize that Shadowrun and our World are different in many fundimental ways... The FIRST difference is that this (Shadowrun) is a failed Dystopian Society, barely hanging on. And with that Dystopia, has come some fundamental shifts and changes to society.

When you look at any City in Shadowrun, its easiest to think of them as a paper target of concentric rings... With the closest you get to the center, the more valuable to area.
Security in Shadowrun was/is (since they have not bothered to put out a new security book in 4 editions... I am going to assume it stayed the same) divided into Zones.... from best to worst, they are:
AAA
AA
A
B
C
Z
The outer ring of our city paper target would be the "zed Zone"...

Z Zones are areas where there is NO law enforcement of any type. Don't bother calling the Police, they are NOT coming, (Nor are they going to even answer!). And when they DO come to a Z Zone, they show up in citymasters, Armed in heavy security armor, packing fully automatic weapons... And they don't shout "Freeze! Police!"- they just shart shooting...
Z Zones genereally are absent of all the "little things" that make life worth living.. like clean water, electricity, Matrix, food... Sane people.... Its where the truely lost of society end up (before being turned into Ghoul or Devil Rat food)

Police response time: NEVER

The Deep Redmond Barrens are a Z zone...

C Zones are areas that the very poor working class usually inhabit. They are Slums by the very definition of the rules. But, at least they have  water and electricity (even if it is rationed).
Police patrol the areas,usually in packs of squad cars, and are usually armed in medium to heavy armor. The police will respond to calls in a C zone, but the response time usually means they are there after the fact.... and time allotted to solving the crime will be very limited. ("I really would like to continue this investigation into your B&E, but your 15 minutes of investigation time is over..")

Police response time: 30 to 60 Minutes.

B zones are where all the lower to middle class yuppies live. Usually nice lower to middle class apartments to condos, with supporting businesses for the masses of wageslaves....

B zones are regularly patrolled by police and drones. and will respond to calls in an "efficient" amount of time.

Police response time: 5 to 10 minutes...

A Zones are where we start seeing the wealthy live and their supporting businesses. Nice clean streets, well kept homes and businesses are the hallmark of A zones.
Police respond to calls quickly and with great zeal! (they know who butters their bread... and they start living HERE!)

Police response times. 1 to 5 minutes.

AA Zones are where you are likely to find the VERY wealthy and some "AA" and "AAA" rated Corp headquarters.... This area is like an A zone... But even better..... Police and drones are all over the area, keeping tabs on every they can...

Police Response times. 1 to 3 minutes.

AAA Zones are the very heart of a city... The Financial districts, were the REAL  power players live, work and play... here the police do not fuck around, They are out in force with smiles on their faces, and always take the side of the person in the most expensive clothing....

Police response times: 30 seconds to 2 minutes.



SO, now that we know the zones... lets talk about how they interact....
Which is to say, they don't. 
AS one travels from the outside edge of the circle to the center, you encounter increasing levels of layered security, all designed to keep the undesirables out of one zone and in an other zone!

In a Zed Zone, you will never encounter a SIN scanner, or a vending machine... or a police officer! There are no services to speak of,nor any above board commerce. (No electricity makes it hard to run credstick reader... and the fact NO ONE will deliver supplies to you makes running a store difficult!).
And to be honest, if a massive fire was to raze the entire area, the rest of the city would probably throw a party!

Moving about in a Zed Zone is risky, as the over inhabitants are likely to jump you, just because you are a meal, or have more then they do... Getting into a Zed Zone is easy, as no one cares if you enter...

Moving OUT of a Zed Zone, well that will be trickier... IF you have a vehicle, you can just drive out. (and since you have a vehicle, you shouldn't be in a z zone to start with!) walking out is possible too.. into a "C" Zone.... But if there is a direct path to a better area, you can believe that it wil be walled off, and guarded with a check point filled with very nice, very heavily armed guards that ask one question only... "SIN Please".... Heaven help you if you don't have one.

C Zones are where you are going to encounter your first lines of real security....

The Simple, Humble, SIN scanner.

Really, first line of protection for the "Haves" of the city against the "have nots". AS the Simple SIN scanner keeps the SINless away... at least in theory. While automated vending machines selling everything from recycled paper clothing (yes, that is actually a thing!) to low grade electronics are everywhere, you need a SIN to purchase anything from them... Or a fake SIN. Sure the scanners are going to be the lowest rating possible, (after all, no one really cares beyond the simple question of "can you afford this?", the scanner is just going to check to see if you have money...And the banks don't care about the $50 theft if spoofed)

Travel around the zone is going to be public transit, or personal vehicle... (just don't rely on GridGuide! it shorts out a lot).. which means more SIN checks... (need a bus ticket, that means a SIN check... even if a low rating one) or a SIN (had to buy that car somewhere, and the license...)

Leaving a C zone is tricky... going lower is easy... Moving up into a B zone is going to be met with a checkpoint, be that a toll booth, or actual security....
Moving into a A or higher? Well that is definitely going to be a check point, with a live guard.... and many guns. Can't have the unwashed masses mucking up the clean streets.   

B zones means even more SIN checks, although usually hidden behind the wall of commerce, as every shop will have a SIN scanner to match the goods they are selling. AR and VR overlays are going to be everywhere, which means constant commlink pings.... (and tracking!). Drones will monitor traffic (and drivers!).... Cameras... Camera EVERYWHERE.

A Zones are always check pointed with live guards. which means you will be stopped and asked questions. Also, this is the point where SIN broadcast is starting to become mandatory. And also serves as an easy way of Police monitoring. IF someone isn't displaying a SIN, you question and fine them. (after all, they are breakling the LAW, and don't belong here, as displaying a SIN in these areas is like a flashy sports car, you WANT everyone to know who you are, and where you work! You're IMPORTANT dammnit!)

Police drones are all over every block, making sure the Yuppies are not bothered by the "working class".....

AA Zones are like A zones... only worse.

BUT, its AAA zones that are cat's ass....

"A Cop on every block" is not an understatement for AAA zones. And that is not even covering the constant Drone presence. From near constant SIN checks from every device know to man, all trying to sell you something ("HELLO MR. PATTERSON!!! Why be like every other man at the top? Dress to impress and intimidate with the latest in Zoe/Armate fashion! starting at only $15,000!")
To security drones scanning your SIN and making sure you have a reason to be there. (Why is a plumber walking down the street??? He has no business here! Does he have a work order?? For where? Why?)
Hell, the drones even have acoustic sensors designed to recognize, locate, and triangulate gun shots!!
IF there is a way to prevent even a single "Choosen One" from interacting with the "inferior". its taken.. Right down to "escorting" an undesirable out of the zone... and into a meat wagon... Broken legs means they don't come back quickly!


So why do I bring this up now?

Because for that Worker to arrive at his International corporation worksite (Remember, only AA and above issue their own SINs) he has had to pass through hundreds to thousands of SIN checks, and has had his progress tracked and logged by every camera, vending machine, and traffic light from the moment he left his door to the time he arrived that the facility. Often times passing through both passive and active security choke points.

The next issue is the time it takes to run a SIN check. Obviously the time it takes is dependent on the level of the check. from the lore, we know that a rating 1 check is also instant, but it only going to catch the weakest of fakes. We also know that a deep scan (rating 6+) can take hours (in the case of an arrest).

So, if we assume it takes just 5 seconds to do a "decent" check. (say, rating 3?) well, are you starting to see the problem? No?

Its 7 am, and B shift is getting ready to start their work day, All 2000 of them. So they line up, and queue in to the SIN check... and just under 3 hours later (10,000 seconds of SIN scans) the last worker has logged in... sure you can speed that up by having multiple scanners, but then you still have the bottle neck of the portal entrance. Which means more entrances.. which is a security flaw (and a structural flaw!!)

If an employee has to undergo say 30 checks a day as they move about the facility, that is 150 seconds a day,  320 days a year, is over a hour of lost production PER worker PER year. Or, Millions of lost man hours a year...

However, a pass/fail fob, it can be scanned while walking through an archway, and is instantaneous (well, ok... about half a second). You sill have the chokepoint of the portal, but that's the cost of a secure facility.

The other issue with security that everyone forgets, is that 99% of the time, its not about keeping people out, its about keeping unauthorized people away for safety.
Jane from accounting has no business in the transformer room, and her being there is a hazard. not only for her (electrocution) but for the entire building. (the human body goes from "mostly water" to "roman candle" in about 3 seconds when exposed to 3000+ amps....) So, put a maintenance FOB on the door, and Jane doesn't burn the building down with everyone inside!

FOB/key pass systems are easy to set up, are quick to use, hard to bypass (for the typical person), and are efficient.


Security systems that present an overly complex list of requirements generally end up getting shortcut by the very users they are meant to protect. Which leads to the defeat of the system by the very users of the system.

an NDA prevents me from giving too many details, but this is a RL example from a factory of their security, and how their own workers defeated it.


When you approached the building, you had to go through a check gate and push a button.. that button would flash RED or GREEN, if flash green go forward. If flash RED: drug test.
Next, as you go to the building you were greeted with three sets of doors, at the first door, you required a Fob to open. The next Door required a thumb print
, and depending on your thumb print, you either got access to Production, or to Operation.

Now, the workers would just WALK around the button station (no one used it that worked there, only contractors, EVEN THOUGH they were supposed to!), Then ONE person would fob the door, and everyone would file in... ONE person from Ops would thumb in, and everyone for OPs would file through the door, while someone from Production would do the same and the Producers would file in...

Which TOTALLY defeats the purpose of the door fob and thumb scanner! Not to mention the random drug checker...
 This was a system that cost millions of dollars to set up and install, hundreds of thousand of dollars to run, and the very users of the system defeated it through impatience.

The more checks and impediments you put in place, the more likely it is that the workers themselves will defeat the system.

A Fob on every door? Start leaving doors propped open...
A passcode required for every computer operation? Same passcode used through out the entire system.   


There is an old saying...
"The race is on between the Universe and Engineers. Engineers to build better idiot proof systems, and the Universe in making better Idiots. The Universe is winning"

The same could be said about security systems. The more you try to secure a facility, the more likely you are opening security flaws in your systems through operator indifference. Which means you have to invest more to security operations (from alarms, to live security). Which in turn means you have also increased your chances of operational indifference (as you now have more people interacting with the system).... to the point that you end up spending so much on security, as to render the facility non-profitable.



Most efficient security systems make due with a combination of passive and active security, as well as the local situation. Cameras are a great passive system as they can be mounted just about anywhere, require no interaction on the part of the user, and can operate 24 hours a days.
Check point systems (card readers, FOBs, scanners) are only used to secure areas from both hazards (like machine rooms, and electrical rooms) from the unqualified, and sensitive data (IP, records, operations, etc). and are mostly there to keep employees that don't belong there, out.

A Hard point (active security) is usually only used at a portal entrance, and is usually set up in such a way as to allow the most rapid, yet efficient check of personnel possible, and often make use of additional technology. (Millimetre wave form scanners for full body searches, MAD scanners, etc)   


In the case of Shadowrun. Corps also use location. Locating your facility deep inside an high rated security zone provides you with FREE security in the form of Police that patrol the zone, and act as your first line of defense. (And this is where your SIN check comes in... HUNDREDS to THOUSANDS of them... as the employee goes to work).
you don't need an active security guard to walk the floors of your building if you are located in a "AAA" zone, as anyone who approached said building has already been challenged by the police a few dozen times both actively and passively...

Also, the point has to be made that not every Corp facility needs security of any great quality or quantity.... only buildings with operational and IP property would warrant complex systems of security.

After all, how many people are going to break into a Soy processing facility? Does Aztlan really need a $40 million dollar system, with hundreds of thousands of dollars of overhead to protect $1.99 soy cakes?
however, that might be a small investment to protect your IP office...

[Reaver]

You can't steal someone else's fingerprints.
But you can impersonate them (with a sleeve, SR5 p. 447)

Sure you can, there's even a knife in the gear section that'll let you do so. As long as the finger's fresh enough to still fool biometrics into being alive, you can do this.

Sadly, that doesn't work well on high end systems....

It's the conductive charge of the finger that activates the reader and fires the camera that reads the print... Body temperature is not (usually) a factor.

And severed body parts don't generate a conductive field, as that requires the movement of hemoglobin...



(food for thought before you get any wild, messy ideas)

[Michael Chandra]

@Reaver: We introduced extra security restrictions to a web portal, and now we're getting feature requests for slackening the restrictions in certain spots because it suddenly takes way too much effort to perform what used to be a few clicks.

[Reaver]

@Reaver: We introduced extra security restrictions to a web portal, and now we're getting feature requests for slackening the restrictions in certain spots because it suddenly takes way too much effort to perform what used to be a few clicks.

Pretty much my point
.
More 'security' usually means 'more delay'.... and heaven help you if you hold up a person's valuable seconds

Trust me, i have spent countless hours talking to bean counters and suits all about 'the need for better security'.... and talked to the actual boots on the ground.... HUGE disconnect.

Suits and bean counters "we need FOBs! And passcards!! Cameras! Roving patrols!

Boots on the ground: "we are 150km away from the nearest town, on a mountain, accessible by a single service road... why not just put a guard shack at the turn in? Maybe a FOB gate, and cameras?"

I price out both options, present both options to the bean counters and suits.
Sit back, watch the blood bath, and deal with whoever won the Boardroom Battle Royal...

[Michael Chandra]

Fortunately, we have a decent solution in the making: Grabbing extra rights real quick leaves a big papertrail, plus you can only do so if you could have seized the permanent rights anyway. But yeah, you really have to weigh security to usability...

[penllawen]

"Rule Zero: Shadowrunners Exist" is a good gamemastering policy for ensuring players have a smooth game, but is largely irrelevant if you're just looking for information about the setting. There are plenty of things in play that are not in the fiction, and vice versa. RAW doesn't always account for rule zero, either.

Yes. Thank you.

I would go a stage further than this. Why do we need a rule that says "no, [X] can't be true, because Shadowrunners exist"? A rule which is invoked so frequently that in SR communities you can just mutter "rule zero" and everyone will know what you mean? Does D&D have a "rule zero: heroes exist"?

The fact we need an explicit rule to invoke when some aspect of the setting implies Shadowrunners can't exist is a bug, not a feature. Every time we find ourselves leaning on rule zero, we should take a step back, look at whatever piece of the game we are handwaving around, and ask ourselves: why is this here if it doesn't support the game's premise?

If Shadowrun was the best version of itself, rule zero wouldn't be needed, because nothing in the setting would imply Shadowrunners didn't exist. The fiction would align with the mechanics, and both would align with the premise.

I'm not saying handwaving isn't a useful technique; I don't think we should drive ourselves mad writing a perfect fictional setting down to the atomic level. Rule zero will always be around, if only implicit and unspoken. But every time we invoke it, we should be concious of the fact it's nothing to be proud of. Rule zero is a compromise, not an achievement. Clearly, other people in this thread have a higher rule zero tolerance level than I do, and that's fine. There is no right and wrong level of that, it is just different tastes.

[penllawen]

Businesses are about efficiency. Speed of action to complete a task in the shortest period of time, so you can compete as many tasks as possible. Be that assembling an item, filing a report, or generating data... The faster you can complete a task and move on to the next task, the more revenue you generate.

This, for me, is a lynchpin of the setting. Corps are forever penny-wise and pound-foolish; there's always some VP trying to make themselves look good by cutting corners on security so they can plump up their quarterly numbers. And our 'runners gethired when the competition gets wind of the holes in security. In the wake of the run, the VP ends up demoted/fired/executed (delete as appropriate for the corp in question.) But there's always more VPs, and they're always short-sighted in the same way, because the corps may be powerful but they're also a monoculture that's incapable of thinking outside the boxes it puts people in.

Also, the point has to be made that not every Corp facility needs security of any great quality or quantity.... only buildings with operational and IP property would warrant complex systems of security.

Absolutely, although by extension, the PCs are rarely interested (but not never...) in the less secure places.

[Xenon]

It seem as if you think of SIN as a passport or identification papers, complete with photo, length, weight etc. With this mindset you will constantly run into situations where the rules are not aligned. And this is why I think you are desperately trying to find ways to "fix" the rules (so they fit this mindset of yours).

But this does not seem to be what a SIN in shadowrun is used for. A SIN in shadowrun seem to be used as proof that you are a legit citizen. A SIN verification seem to be there to make sure your SIN is not fake. With this mindset instead you will never run into situations where the rules are not aligned.

Rather than accepting this you seem to keep challenging this.
You keep asking WHY it doesn't work as you imagine it.

Reaver just gave you a perfectly fine reason from a fluff point of view why a SIN verification work the way they do. And I gave you a perfectly fine reason from a game mechanical point of view.

Still... you seem to be be on this crusade on rewriting both the fluff in crunch until it fit your way of thinking. And you don't seem to stop anytime soon ;-)



So, let's do just that.

Let us assume that your SIN verification now still check the integrity of the SIN (is it fake yes/no), but in addition to this it now also check who you really are (operator will see your name is Wally your age is 42 and there will be a photo and your length and weight will be on display as well as your nationality and your employer and the verification unit itself will no longer just check the integrity of the system identification number - it will also include support for voice recognition, facial recognition, fingerprint scanning, palmprint scanning and DNA scanning) and that you actually belong (the system will know if you are authorized to enter the checkpoint/restricted area or not).

Now having a SIN is actually your identity rather than just proof that you are a legit citizen and SIN verification actually work the way you seem to be picturing it.


We can now pretty much replace all security devices with a SIN verification unit (since it support voice recognition, facial recognition, fingerprint scanning, palmprint scanning and DNA scanning etc).

But this also mean that whenever anyone use a fake SIN they also need to disguise themselves to fool the facial recognition and match the photo connected to the fake SIN they are currently using. They need a sleeve with matching fingerprints (or several sleeves, one for each fake SIN they own). And matching DNA samples. And a voice modulator.

And what about infiltration?

You need to change the rules so that it is now support different ways to duplicate, fake, borrow and/or temporarily steal someone else's SIN (and risks / consequences of using someone else's SIN). And when walking through a SIN verification you not only need a random fake SIN, you now need a copy of the SIN of the target you are impersonating and you also need to disguise yourself to fool the facial recognition by matching the mark. You need a sleeve with the mark's fingerprints. And DNA samples. And sound samples of your mark for your voice modulator.




Or... you know... you just use Reaver's explanation why a SIN verification will just check that you are a legit citizen (and if you need to fake being a legit citizen you just get a fake SIN, no need for disguise or any of that other stuff) and if you are impersonating someone else and a corporation need to verify that You are actually You and that You actually Belong the corporation would use other security devices (such as separate voice recognition-, facial recognition-, fingerprint-, palmprint- or DNA- scanners.... that an infiltrator would beat with voice modulator, disguise, sleeve, DNA samples etc in accordance to regular rules).

[penllawen]

I swear to god, this is my last attempt to explain myself. If this doesn't work, I concede defeat.

But this does not seem to be what a SIN in shadowrun is used for. A SIN in shadowrun seem to be used as proof that you are a legit citizen. A SIN verification seem to be there to make sure your SIN is not fake. With this mindset instead you will never run into situations where the rules are not aligned.

If this is true, there's no reason for a SIN to have biometrics (by which I mean DNA samples, fingerprint scans, and/or retina scans) associated with it. Yet we know that they do. And there's no reason for fake SINs to have those. Yet we know that they do.

SR5 pg 363/4:

"A set of biometric data including DNA, retinal scan, and fingerprints will also be taken and logged into the system, associated with the newly created SIN. All of this information is then registered with two master databases: one maintained by the country that issued the SIN, and the Global SIN Registry (GSINR) controlled by the Corporate Court. These datastores are among the most secure on the planet, with multiple off-line backups for each"

"The amount of time and care taken in creating a fake SIN is represented by its Rating. A low Rating SIN consists of only the most basic information—such as the SIN number itself. Related information such as biometric data will likely be missing or obviously false if checked (“Hey, this is the DNA of a chicken ...”). Biometric data associated with a high-Rating SIN will be from a real person with the same sex and nationality as the purchaser with (if the extra fee is paid) matching organic samples available (blood, skin cells, hair—just don’t ask where they came from)."

Fake SIN rating 5: "Good fit; all statistics match; valid biometrics for another person (with samples); some supporting data and history)"
Fake SIN rating 6: "Alternate life; all statistics match; valid biometrics with samples; complete and entirely believable history"

SIN verification R5: "Full verification and consistency check; biometrics tested against sample"
SIN verification R6: "All possible verification; multiple biometric samples must match; random supporting data verified externally"

If, as you keep insisting, SIN verification never, at any level, involves gathering biometrics from the person carrying the SIN and checking they match the ones on file, then none of the above makes any sense. It's all entirely superfluous. There's no point gathering biometrics if they're never checked against anything. There's no point faking biometrics if they're never checked against anything.

I'm not "asking WHY it doesn't work as (I) imagine it", I'm asking why it doesn't work the way it says it works.

[Lormyr]

You have a lot more patience than me Penllawen, I will say that much.

It is crystal clear that a SIN is both a means of determining that the holder is a legal citizen, as well as a means of determining that the holder is the legal citizen the SIN claims they are, as your last post points out in language that cannot be contested with anything resembling logic.

If that logic is too much for someone at this point just leave them to their own devices bro lol, it's not worth the headache.

[Xenon]

• A low rated fake SIN will not have DNA logged in the DNA database at all.
• A medium rated fake SIN will some DNA logged in the DNA database, but it might be chicken DNA, and there will be no sample DNA in the sample database.
• A high rated fake SIN Will have DNA logged in the DNA database from a real person and matching sample DNA from the same person in the sample database.

• A low rated SIN verification will not check if the SIN have DNA logged in the DNA database and will also not check if the SIN have sample DNA in the sample database
• A medium rated SIN verification will check that the SIN have DNA logged in the DNA database but it will not check that the SIN have sample DNA in the sample database
• A high rated SIN verification will check if the SIN have a real person's DNA logged in the DNA database and cross reference this with samples of the DNA in the sample database

If you have a low rated fake SIN with no DNA logged in the DNA database then it will probably be burned when a medium rated SIN verification finds out that there is no DNA logged for this SIN in the DNA database.

If you have a medium rated fake SIN with chicken DNA logged in the DNA database then it will probably be burned when a high rated SIN verification finds out that the DNA logged for this SIN is not from a real person.

All this is cross referencing of the various databases is abstracted into a Simple Device Rating x 2 Test with a threshold equal to the rating of the fake SIN (SR5 p. 367).

There is no mentioning about a disguise test here. Or that you need to use a sleeve. Or that you need to have fake sample DNA at hand or any of the things you are implying.


Can the DNA on file be used in some way other than a simple SIN verification?
Yes, probably.
For example.... Perhaps if you get arrested?
Or perhaps if an investigation is cross-referencing blood samples from a crime scene?

But is the SIN verification unit at Stuffer Shack drawing blood and checking that against logged samples in the sample database? No, it isn't!

Fake SIN rating 6: "Alternate life; all statistics match; valid biometrics with samples; complete and entirely believable history"

This SIN have your biometrics logged in the DNA database.
And it also have samples from your body logged in the sample database.
Very much like a legit SIN.

SR5 p. 367 Issuing a SIN
A set of biometric data including DNA, retinal scan, and fingerprints will also be taken and logged into the system, associated with the newly created SIN.

"with samples" as they say here is NOT a set of samples you get in a bag to show for SIN verification units. Its your DNA. Why would YOU need samples of your own body? ;-)

[Reaver]

Right,

So I did a little research into the SINs....
The first make their appearance in 2e, and the language around SINs hasn't really changed that much... (its been a basic copy-pasta for the last 4 editions, but with words moved around, things taken out, and things added in...

BUT:

There is some pieces of info that have been lost, deleted, omitted or forgotten over the editions. This is especially true with the jump in 4e, the wireless matrix, and the way the new rules system worked, and how they omitted this.

Originally, SINs were tied to Credsticks, and Credsticks came with a rating, That rating not only determined how much you load onto a credstick, BUT also determined the level of the scanner needed to read a credstick... WHICH IN TURN, dictated the level of SIN you also needed to fool the scanner!
Using a rating 1 SIN with a rating 1 credstick was fine, BUT you where limited to the max funds of a rating 1 credstick (which was around $500...)

If you tried to use say a rating 6 credstick, well you had to defeat a rating 6 SIN check... (so make sure you have a good SIN!)

ALSO snipped from the rules, was how the GSINR is run. As of 2047, SINs are controlled at 2 master points (the GSINR, and the original Country) with multiple backs ups everywhere. And their use, protocols for checks, record keeping and accessibility are dictated by the Corporate Court...


But WHY System Identification Numbers?
Why use this? what is it for? why have all this info if they are not going to check this shit for "security" as you say?

Because its NOT about security. Its about population and expenditure control.

Governments are limited in their revenue streams to a few major sources. The chief among them are Taxes and Royalties.  However, governments also have huge expendatures. From the Civil Services, to infrastructure, to debits of yesteryear....

In shadowrun, Several court decisions have destroyed countries' ability to generate said Tax and Royalties from biggest payers.. Corporations. (and eventually, their Citizens).
But, that did nothing for the expenses of Government, as those remained unchanged.  In the end, Governments were left with (some speculate) as much as a 60% lost in revenue, while a 0% reduction in expenditures. This collapse pretty quickly when the money runs out... (I have seen this first hand.. Mali, Pakistan, Greece, Spain)

The UCAS (the original creators of SINs in 2036) came up with an evil, yet brilliant idea. "If there are less citizens, there is less capital expenditures!".... And, not only that, but if you can control who is a citizen and who is not, you can control and manipulate the ebbs and flows of politics and reshape the country!

So, what does "Citizen" mean?? WELL... that's a contentious issue Especially right now in the world But, being a citizen of a country gives you some rights, and responsibilities....

Rights                                                                                              
Freedom to express yourself.
Freedom to worship as you wish.
Right to a prompt, fair trial by jury.
Right to vote in elections for public officials.
Right to apply for federal employment requiring U.S. citizenship.
Right to run for elected office.
Freedom to pursue “life, liberty, and the pursuit of happiness.”

(taken right from the US immigration website)

Lots of big words, and ideas that boil down to "you get to live your life as you choose".... But what happens when they are taken away?
You lose your right to ask for aid from the city and the government. You lose your right to shape the country through the power of your vote. You can't own property, you can't get a job, no healthcare, no social security, no old age.....

Take the SIN to the next bureaucratic level.. (Everyone who is born is issued a SIN. Thus, if you don't have a SIN, you where never born. Thus you don't exist.) Throw in a collapse of the economy, Social upheaval, and abandonment of rights, and you have all the marking of a Genocide in the waiting... And now a target, the SINless.

By redefining what constitutes a "citizen", Governments are free to play fast and loose with their grants of funds to the local level, as many of those grants are determined by population. As well as the services that have to be provided, and thus control the costs of said services.

Corporations got in of the Gig of SINs for much the same reason as Countries.. Expenditure control. Being an extraterritorial entity is all well and good... and comes with some amazing benefits! like not having to pay taxes, or obey a countries laws! But it also comes with some pretty hefty responsibility as well.   You can offset some of those costs by extending SINs to your workers (and thus gain the ability to tax them as well!) but you have to provide something to people as well if they are going to switch nationalities...
But again, Corps get to write their own rules... And job descriptions.. like how Renraku has "Pharma consultants, Relaxation Managers, and Comfort Specialists"... Really fancy names for "Drug Dealer, Pimp, Prostitute"...
And with those Rules... comes the ability to REVOKE SINs... which they do. ("Hey Jon! happy retirement day! 30 years in janitorial, and hallways have never been cleaner! IT was a great pleasure working with you. Oh, make sure you are off the Corp ground and out of your house by noon tomorrow. That housing was only for Employees and citizens... and you SIN has been cancelled....")

YES but that doesn't answer WHY they don't use SINs for security!

Yes it does. But not in the way you want to....

SINs don't behave that way because the Corporate Court doesn't want the to behave that way, as there is no advantage to the corps for them to act that way, and the increase in expenditures for the increase in SIN checks just open a fucking door, are frankly, asinine.

YES but SINs are hack proof!!! we could have Total INVULNERABLE SECURITY!!!!!

And that is an advantage to the Corporate Court how?

No, seriously. How is that an advantage to the Corporate Court? Its an advantage to the individual AA and AAA megacorps (of which there are dozens!)... But it offers no advantage to the Big 10 of the Corporate Court.
Industrial Espionage is business that ALL corporations play at, and the target of said Espionage is other Corporations....

By hoisting the costs of security checks to the  GSINR just increases the expense of the CC, while raising the security of their competitors for a minimal (or worse, a REBATE!) cost to the Corporations. (If the cost of a private system of FOBs costs $1 million a year to run, but all the GSINR invoices for the "SIN system" you want is $200,000... WIN FOR THE COMPANY!).

So, Why do it?

By Forcing a Company to pay for their own security systems, you are denying them resources that they could have spent on R&D on their new project... A Project they may allow them to unseat a member of the CC!!  But, how would you know THIS if you can't infiltrate their facility?


*****

Sadly, it looks like this is an confusion caused by the change to the wireless matrix, and the poor matrix planning that went into 4e....
(I mean really.... under 4e rules, a lobotomized potato can be a master hacker... just needs the cash to buy the program  and the 'link.... how did they think that was going to work out??) 

[0B]

SR5 p. 367 Issuing a SIN
A set of biometric data including DNA, retinal scan, and fingerprints will also be taken and logged into the system, associated with the newly created SIN.

"with samples" as they say here is NOT a set of samples you get in a bag to show for SIN verification units. Its your DNA. Why would YOU need samples of your own body? ;-)

You might not be giving them a bag, but fake fingerprints are possible at this point. This video shows how you can copy fingerprints using supplies from a craft store. Presumably someone could develop a method with materials that don't look as obvious as craft store glue.

Retinal scans are error-prone: they're too precise. Being pregnant, having the flu, and aging will all change your scans. So, even if your retinal scans don't match what's on the SIN, if the other data matches up then you will be in business.

As for DNA- that depends on how they're getting it. If it's a blood sample, you're going to have a hard time passing fake information. If it's a cheek swab, people are already faking that today.

It troubles me when people think of biometrics as impenetrable: they're either easily fooled, can match up to many different people, or are so precise that they return "false negatives" a lot just due to human growth.

Granted, this is all with modern biometrics. But if we accept that biometric technology will improve, we must also accept that countermeasures to this technology will improve.

By hoisting the costs of security checks to the  GSINR just increases the expense of the CC, while raising the security of their competitors for a minimal (or worse, a REBATE!) cost to the Corporations. (If the cost of a private system of FOBs costs $1 million a year to run, but all the GSINR invoices for the "SIN system" you want is $200,000... WIN FOR THE COMPANY!).

So, Why do it?

By Forcing a Company to pay for their own security systems, you are denying them resources that they could have spent on R&D on their new project... A Project they may allow them to unseat a member of the CC!!  But, how would you know THIS if you can't infiltrate their facility?

Reaver makes a good point, but I would posit that even if the front door is just a simple keypad, the door to the room holding that secret squirrel extra-special hot sauce R&D project might make use of full biometric security. At that point, it's a question of- is it cheaper to maintain our own biometrics database? Or to pay an invoice for someone else providing the service?