[ammulder]

I've looked at several Matrix FAQs but they seem to overlook IC in the included examples.

Let's say a hacker makes it into a host via Backdoor Entry.

My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.

If the host is running Patrol IC, I assume it would make its usual Matrix Perception check of 2xHost Rating, vs. the hacker's Willpower+Sleaze, just on the principle of "confirm all icons present here are really legit".  Since ties go to the acting party, does the IC need only a tie to identify the hacker, or does it require a net success?  I've seen it argued that matrix perception is just like regular perception, but I'm not clear that's really true: regular perception is not opposed but has thresholds based on how obvious the event is, and I'm not clear on how that could be applied to hacking events.  It seems like the opposed test is the relevant style here.

Anyway, if the IC fails, I guess it won't get around to try again on the hacker's icon for another minute.

Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked.  However, maybe it doesn't know the hacker is the one who hacked it?  I mean, the hacker might be the only icon that happens to have appeared just as the alarms starting going off, but maybe computers are stupid because this new icon does appear to be an administrator?

Then what?

I guess I'm not clear in the Brute Force case whether Patrol IC becomes redundant and serious IC should be released immediately, or whether the Patrol IC still needs to identify the attacker but maybe due to the alarm it attempts every round because it knows there's a hacker present?  Does the hacker need to run silent upon Brute Forcing in order to cause a check rather than be immediately subject to nastier IC?

There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.

(The bottom line is, I want a weakly-defended facility that leaves its defenses primarily to things like drones and IC rather than paying by the hour for meat bodies and matrix spiders.  And the key data in that facility will be in a tougher but offline host where no "on call" spider could reach it anyway.)

[Xenon]

Let's say a hacker makes it into a host via Backdoor Entry.

My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.

This was the case in previous edition. This have been deliberately changed.

In this edition it will be immediately obvious that an intruding hacker is not a legit user or admin. If you are not running silent then you will be automatically detected as an intruder when Patrol IC get around to take a perception test. If you are running silent then you get to oppose this test and hopefully you can remain undetected for awhile longer.

As soon as Patrol IC detect you, the Host will realize that you are an intruder, it will go on high alert and it will start to launch IC.

regular perception is not opposed but has thresholds based on how obvious the event is

When a physical adept physically infiltrate a facility his Stealth + Agility will be used to oppose (or set a threshold, same thing really) for potential observers (like Drones, Guards etc) to notice him.

When a technomancer virtually infiltrate a host her Willpower + Sleaze will be used to oppose (or set a threshold, same thing really) for potential observers (like Patrol IC, Spiders etc) to notice her.

Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked.  However, maybe it doesn't know the hacker is the one who hacked it? 

Brute Force is an action linked to the Attack attribute which mean it is immediately obvious. The Host is aware that it is under attack, it will go on high alert and it will start to launch IC. But it can't attack the hacker before its Patrol IC can spot it (unless the intruder for some reason is not running silent).

There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.

Even if host start to launch IC it can not attack the intruder before its Patrol IC manage to spot it (but if Patrol IC start to make perception tests every combat turn instead of every minute or so then it is typically just a matter of time before the hacker is eventually spotted).

[Michael Chandra]

Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.

[ammulder]

Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.

But there’s no disadvantage to a brute force over a back door if the Patrol IC isn’t going to switch to making checks against you every round (or at least much more often than per minute).  So even if it has just as many items to scan, I think for the game to work it has to get aggressive trying to perceive the hacker in particular following an attack action… and also presumably if their overwatch score causes other IC to deploy — because who cares what IC is running around if you’re safe for 20 rounds?

[Stainless Steel Devil Rat]

Here's my own take on your questions:

I've looked at several Matrix FAQs but they seem to overlook IC in the included examples.

Let's say a hacker makes it into a host via Backdoor Entry.

My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.

I'd say it's more of it being a non sequitur as to whether the hacker is running silent or not.  Since you didn't brute force your way in, you look like a legitimate matrix user... at first, anyway.

If the host is running Patrol IC, I assume it would make its usual Matrix Perception check of 2xHost Rating, vs. the hacker's Willpower+Sleaze, just on the principle of "confirm all icons present here are really legit".  Since ties go to the acting party, does the IC need only a tie to identify the hacker, or does it require a net success?  I've seen it argued that matrix perception is just like regular perception, but I'm not clear that's really true: regular perception is not opposed but has thresholds based on how obvious the event is, and I'm not clear on how that could be applied to hacking events.  It seems like the opposed test is the relevant style here.

1) yes, IC rolls Host Rating x 2 for its dice pools (pg. 186)
2) Patrol IC rolls Matrix Perception, and Matrix Perception is opposed by Willpower + Sleaze (pg. 182)
3) yes, Patrol IC should count as a "hostile" roll or an attack of sorts, so a tie should go to the attacker.
4) by my understanding, whether you're running silent or not you roll Willpower + Sleaze vs Patrol IC.  If it is successful, it knows you don't belong whether you were running silent or not.

Anyway, if the IC fails, I guess it won't get around to try again on the hacker's icon for another minute.

Yes, if the test fails, you've got another potential minute before getting spotted by the Patrol IC.  Note that:

5) Spiders or other users might notice you doing shenanigans, depending on the circumstances
6) If you bring in 5e assumptions, Patrol IC will scan you more or less often depending on the circumstances
7) I recommend you do NOT bring in 5e assumptions for variable scanning frequencies, and ignore 6).  Just go with 1 scan/minute.  Keeps it simple, keeps it consistent, and keeps it predictable.  All good things.

Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked.  However, maybe it doesn't know the hacker is the one who hacked it?  I mean, the hacker might be the only icon that happens to have appeared just as the alarms starting going off, but maybe computers are stupid because this new icon does appear to be an administrator?

Then what?

Yes, Brute Force your way in and the host is automatically on alert.  IC may be dumb, but generally it's smart enough to put 2 and 2 together to realize "the host has been breached" and "this persona just came in" are related.  Ergo, when Brute Forcing you DO want to come in running silent, whereas in Back Door-ing it doesn't matter.  Brute Force lets the target know it's under attack, but if you're running silent it doesn't mean it automatically spots you, too.

I guess I'm not clear in the Brute Force case whether Patrol IC becomes redundant and serious IC should be released immediately, or whether the Patrol IC still needs to identify the attacker but maybe due to the alarm it attempts every round because it knows there's a hacker present?  Does the hacker need to run silent upon Brute Forcing in order to cause a check rather than be immediately subject to nastier IC?

Patrol IC is the eyes of the Host.  If you Brute Force your way in, the host can launch a squadron of deadly IC but if they can't see you, what harm can they cause?  Still, better act fast when you Brute Force

There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.

It's not made very clear in the CRB examples, but you can see numerous examples of IC and Hosts in published material, I think.  To give you a basic primer on how they're written for published adventures:
Hosts have a binary alert state: Prior to going on alert (in effect, a de-facto "all clear" status) hosts are running some kind or kinds of IC, or none at all. 9 times out of 10, that's Patrol IC and nothing else.  Although, a host could be running with various combat IC launched 24/7.  This is not the norm however, as in theory combat IC will eventually attack legitimate users due to various mis-identifications, even though there's no accounting for that in the rules per se.  Most of the time, you have Patrol IC running by itself, and then when host goes on alert it launches a list of additional IC in some preset order. Once the host goes on alert, it can launch 1 IC per turn. Depending on how the host is written up, it will interrupt the launch sequence to re-launch IC that got defeated in cybercombat, or continue on with the sequence and then go back and re-launch defeated IC after the sequence is finished. Totally writer/GM fiat here on which way it works for a given Host.

(The bottom line is, I want a weakly-defended facility that leaves its defenses primarily to things like drones and IC rather than paying by the hour for meat bodies and matrix spiders.  And the key data in that facility will be in a tougher but offline host where no "on call" spider could reach it anyway.)

You probably want a host in the 2-4 rating range.  It'll run Patrol IC constant, and have a launch sequence of something like Track, Killer, then Marker once it goes on alert.  Think about what the various IC's capabilities are, and what order they should be launched in (is it more important to try to kill someone out of the gate? Probably inappropriate for a legal, above-board host... Track is a good 1st "escalated" option for those, imo). 

[Michael Chandra]

Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.

But there’s no disadvantage to a brute force over a back door if the Patrol IC isn’t going to switch to making checks against you every round (or at least much more often than per minute).  So even if it has just as many items to scan, I think for the game to work it has to get aggressive trying to perceive the hacker in particular following an attack action… and also presumably if their overwatch score causes other IC to deploy — because who cares what IC is running around if you’re safe for 20 rounds?

Because if the system knows it's under attack, a Spider may drop by and actively dig, plus they may order everyone to leave the Host, which will suddenly make the test intervals way shorter...

[ammulder]

OK, I'm going to give the long story, and you can pay attention or not as you please... any suggestions would be welcome.  I've never run the matrix for real before because I've never had a player/team who wanted to play it out before, so this is newer to me than, say, a gunfight.

The overall goal is to locate and infiltrate a small but important corporate facility.  We're on step 1: locate.  The corporation is too big and buff to hack their mainframe to figure it out -- the hacker would be well outmatched.  So instead, the runners will go after a subcontractor that provides services to the facility in question.  After all, if this subcontractor is providing services to the place, they must know where it is...

The team's goal is a data file on the computer with all the past business records for the subcontractor.  It's in their small office, and offline.  I'm thinking host rating 4.

Elsewhere in that office, there's a security computer controlling cameras, drones, and some physical security measures, a wireless doodad that the one actual guard on premises carries to control these various security measures, and etc.  It's a host behind a matrix-facing host for the business.  I'm thinking host rating 3 for these two.

• The hacker could go through the matrix facing host to get to the security host, but this is intended to be "the hard way" and I don't mind if it looks "not out of the question" but ends up defeating the hacker.  If the layered hosts themself aren't tough enough, I would consider having a spider on call who shows up in the security host just in time to cause real trouble.
• The hacker could go directly into the security host from on-site with a physical link.  I would like him to be able to control the cameras to erase evidence of their intrusion, or at a minimum to hide what they were looking for (to avoid alerting the ultimate target facility).  I don't especially want him to straight up disable all the physical security measures or take control of the drones (because then the rest of the team would be redundant), so in thinking this through, maybe I need them not to be controlled by this host, or I need that functionality to be hidden from him outside of exceptional circumstances (I let him find and disable things just to avoid a TPK or something, definitely not plan A). 
• The team could just ignore the online hosts, destroy the cameras or sneak past with Improved Invisibility/Physical Mask or something, overcome the physical security, etc.  Probably also not the easy way, but I'll have to see what they come up with.

I assume at some point they'll get the hacker to the offline host.  I will want to apply some time pressure here, so he can't take all day and retry at his leisure and etc.  I'm thinking the target file is encrypted and data bombed but is still visible on the host; the purpose of the host is to give access to these files, even if you need a password to access them.  So I think he'll need to get into the host, to perform a matrix search (not hash check) to find the right one, either detect and disarm the bomb or suffer the data bomb damage, decrypt (crack) the file, and edit the file (to search for the pertinent info within it or make a copy for himself to inspect later).  So 6-ish rounds, more if I want to extend the search a bit to find the right file (the subcontractor has done a lot of a projects and the team doesn't necessarily know what name they used for this one).  I believe all those are User-level (not Admin) actions.

But at the same time I want to have some pressure in the physical world -- either a wave of drones or incoming police/security responding to a gunfire alarm or something.  Both because I don't want the rest of the team to be twiddling their thumbs, and again because I'd rather have the hacker feel under the gun and use brute force and blow some edge rather than taking time to carefully sleaze around and etc.

So, if all that seems reasonable, I can't have Patrol IC in the offline host checking once per minute.  That would be one check for the entire 5-10 round offline-host-intrusion.  Rules or not, it has to check at least every couple rounds, and ideally find him just before he is decrypting the file so he has some IC to contend with there at the end as well.  Since a Rating 4 host at 8 dice of Matrix Perception will likely be outmatched by a few dice vs Willpower+Sleaze (depending on how the persona is configured), I think it will need to check every round or every other round.

I need to figure out exactly which IC to deploy for when he's found.  I'd like the major risk to be that he gets knocked out or ejected from the host before getting the information from the file, not risk either death or that he's identified and tracked such that opposition forces show up at his door.  Maybe the available options for the Rating 4 host can be Patrol, Crash, Acid, Blaster?  If he brute forces and it deploys these one per round, Crash/Acid/Blaster might all be there and waiting by the time the Patrol finds him.

Which leads to another question: while hacking, he can be sending updates to the team via Send Message minor actions, such that if they suddenly stop coming (e.g. he is unconscious and link-locked from Blaster), they can decide to physically pull the plug?  I assume that would end up causing him 3P damage from dumpshock, unresisted if he's already unconscious.  Better than leaving him behind, though.

[Stainless Steel Devil Rat]

OK, I'm going to give the long story, and you can pay attention or not as you please... any suggestions would be welcome.  I've never run the matrix for real before because I've never had a player/team who wanted to play it out before, so this is newer to me than, say, a gunfight.

Well, hopefully you'll get some quality tips from the forum here

The overall goal is to locate and infiltrate a small but important corporate facility.  We're on step 1: locate.  The corporation is too big and buff to hack their mainframe to figure it out -- the hacker would be well outmatched.  So instead, the runners will go after a subcontractor that provides services to the facility in question.  After all, if this subcontractor is providing services to the place, they must know where it is...

My eyebrows go up a bit here.  Usually Mr J would be able to provide you with physical location data.  It's one thing to hold back information for security/deniability reasons, but if you're going to hire someone to do a job, presumably you want to at least give them the bare information they'll need to do it? Maybe this is one of those times where Mr J knows what he wants, but nothing about how it might be done?  Hence the need to hire professionals, I guess...

The team's goal is a data file on the computer with all the past business records for the subcontractor.  It's in their small office, and offline.  I'm thinking host rating 4.

Elsewhere in that office, there's a security computer controlling cameras, drones, and some physical security measures, a wireless doodad that the one actual guard on premises carries to control these various security measures, and etc.  It's a host behind a matrix-facing host for the business.  I'm thinking host rating 3 for these two.

• The hacker could go through the matrix facing host to get to the security host, but this is intended to be "the hard way" and I don't mind if it looks "not out of the question" but ends up defeating the hacker.  If the layered hosts themself aren't tough enough, I would consider having a spider on call who shows up in the security host just in time to cause real trouble.
• The hacker could go directly into the security host from on-site with a physical link.  I would like him to be able to control the cameras to erase evidence of their intrusion, or at a minimum to hide what they were looking for (to avoid alerting the ultimate target facility).  I don't especially want him to straight up disable all the physical security measures or take control of the drones (because then the rest of the team would be redundant), so in thinking this through, maybe I need them not to be controlled by this host, or I need that functionality to be hidden from him outside of exceptional circumstances (I let him find and disable things just to avoid a TPK or something, definitely not plan A). 
• The team could just ignore the online hosts, destroy the cameras or sneak past with Improved Invisibility/Physical Mask or something, overcome the physical security, etc.  Probably also not the easy way, but I'll have to see what they come up with.

I assume at some point they'll get the hacker to the offline host.  I will want to apply some time pressure here, so he can't take all day and retry at his leisure and etc.  I'm thinking the target file is encrypted and data bombed but is still visible on the host; the purpose of the host is to give access to these files, even if you need a password to access them.  So I think he'll need to get into the host, to perform a matrix search (not hash check) to find the right one, either detect and disarm the bomb or suffer the data bomb damage, decrypt (crack) the file, and edit the file (to search for the pertinent info within it or make a copy for himself to inspect later).  So 6-ish rounds, more if I want to extend the search a bit to find the right file (the subcontractor has done a lot of a projects and the team doesn't necessarily know what name they used for this one).  I believe all those are User-level (not Admin) actions.

That all seems reasonable.  It's an awful lot of setup on what amounts to legwork, however.  If you want to represent digging around on the matrix for the site of the secret research lab, you COULD just call it an extended Matrix Search, giving a threshold appropriate to how long it should take to dig that info up.  While the corp won't publicly publish the address of their secret facility, presumably outsiders have some connection with it.  Subcontractors as you theorized, for example might bring in cleaning crews and office supplies.  County assessors' offices.  Construction records.  Whatever.  All of that and more can be searched by a savvy hacker.

It boils down to how much table time do you want to devote to this legwork.

Also note that this legwork could feasibly be accomplished by non-matrix means as well.  People might ask contacts who could feasibly know the answer, or know someone who would.  Murphy's Law of GameMastering: the more effort you put into planning for the players' course of action, the less likely they are to take that course of action!

But at the same time I want to have some pressure in the physical world -- either a wave of drones or incoming police/security responding to a gunfire alarm or something.  Both because I don't want the rest of the team to be twiddling their thumbs, and again because I'd rather have the hacker feel under the gun and use brute force and blow some edge rather than taking time to carefully sleaze around and etc.

Whether this is hacking the secret facility itself, or some very involved pre-run legwork, keeping the action going across multiple SR worlds at once is the ultimate SR GM challenge.  All I can say is practice makes better.  You'll never be perfect, but the more practice you have in telling one player to "hold that thought, I'm gonna go to another player now" the more seamless it'll feel in play... and let's face it.  Leaving the sammie mid-scene while facing off with some machine gun drones to jump to the decker dogfighting with some IC, only to then switch to the astrally projecting mage hiding from the nasty spirit ghosting around... all are great cliffhangers.  That's how you keep players from yawning and falling into the oldest SR trap around: "decker's up!  Let's go get a pizza."

So, if all that seems reasonable, I can't have Patrol IC in the offline host checking once per minute.  That would be one check for the entire 5-10 round offline-host-intrusion.  Rules or not, it has to check at least every couple rounds, and ideally find him just before he is decrypting the file so he has some IC to contend with there at the end as well.  Since a Rating 4 host at 8 dice of Matrix Perception will likely be outmatched by a few dice vs Willpower+Sleaze (depending on how the persona is configured), I think it will need to check every round or every other round.

Note that Patrol IC isn't your ticking clock mechanism to keep hackers from going unchecked... that's Overwatch Score. Particularly so if the hacker had to Brute Force their way in... OS just keeps cranking up and up inevitably.  Also note that a Spider can order a host to go on alert manually... you've got the tool in your pocket to just say "ok, it's on now" at any time and essentially for any reason.  Just use the old "a security guard thought he saw something suspicious and radio'd it in, and now the spider hit the big red button" excuse.

I need to figure out exactly which IC to deploy for when he's found.  I'd like the major risk to be that he gets knocked out or ejected from the host before getting the information from the file, not risk either death or that he's identified and tracked such that opposition forces show up at his door.  Maybe the available options for the Rating 4 host can be Patrol, Crash, Acid, Blaster?  If he brute forces and it deploys these one per round, Crash/Acid/Blaster might all be there and waiting by the time the Patrol finds him.

Typically yes you'd decide all that ahead of time.  But, hey.  GMing on the fly is often required, and if you have to make up a host on the fly you'd have to make up what IC that host launches on the fly too, neh?  Who's gonna know the difference if you defer making up a launch schedule for a host you DID pre-write?

Which leads to another question: while hacking, he can be sending updates to the team via Send Message minor actions, such that if they suddenly stop coming (e.g. he is unconscious and link-locked from Blaster), they can decide to physically pull the plug?  I assume that would end up causing him 3P damage from dumpshock, unresisted if he's already unconscious.  Better than leaving him behind, though.

Well, the hacker can just share biomonitor data with the team, it'd be much easier.  Or even just share a feed that each teammate can watch in an AR window to see what's going on with the hacker in VR.

Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

But, yes, I hear you, players are prone to saying "frag what people do in-universe.  I WOULDN'T DO THAT BECAUSE REAL WORLD THIS AND THAT AND YADA YADA YADA."  If you don't want to play the "doesn't matter if YOU would or wouldn't... because your character would!" card, and allow the player to try to game being link locked by using physical connections that can be physically unplugged, then yeah, go ahead and give them unresisted dump shock. 

[ammulder]

Thanks for sharing your thoughts!  Just picking out a few bits here to reply to:

My eyebrows go up a bit here.  Usually Mr J would be able to provide you with physical location data.  It's one thing to hold back information for security/deniability reasons, but if you're going to hire someone to do a job, presumably you want to at least give them the bare information they'll need to do it? Maybe this is one of those times where Mr J knows what he wants, but nothing about how it might be done?  Hence the need to hire professionals, I guess...
...
It's an awful lot of setup on what amounts to legwork, however.  If you want to represent digging around on the matrix for the site of the secret research lab, you COULD just call it an extended Matrix Search, giving a threshold appropriate to how long it should take to dig that info up.  While the corp won't publicly publish the address of their secret facility, presumably outsiders have some connection with it.  Subcontractors as you theorized, for example might bring in cleaning crews and office supplies.  County assessors' offices.  Construction records.  Whatever.  All of that and more can be searched by a savvy hacker.

Two reasons:

• It's the first run, and I want to start with a softer target to let everyone figure out their characters and let me figure out if I can run a game with a decker   But if I reduced the whole thing to a Matrix Search we wouldn't accomplish that.
• It's the first run, and nobody could afford everything they wanted during character creation, so hey, I can throw a bit of cash and  karma at them for reaching a milestone.  Mr. J is going to offer a first payment for locating the target facility within 24 hours, and a second payment for retrieving the MacGuffin from the facility within the following 24 hours.  He figures he'll give this cheap team a swing and if they can do it, great, and if not, he'll take any progress they made and go to the more expensive/experienced teams.
• All right, if I'm going to be honest, the file they can find has full details on the plumbing and the on-call plumber.  My kids are playing, so naturally I expect them to use the information gleaned from this legwork mission to "control device" on the only devices in the facility they'll have remote access info for.  It may take a bit to narrate the scenes of exploding troll-sized toilets, but once the researchers call for emergency repairs, the team can follow the plumbers to the "secret" facility. 

Note that Patrol IC isn't your ticking clock mechanism to keep hackers from going unchecked... that's Overwatch Score. Particularly so if the hacker had to Brute Force their way in... OS just keeps cranking up and up inevitably.  Also note that a Spider can order a host to go on alert manually... you've got the tool in your pocket to just say "ok, it's on now" at any time and essentially for any reason.  Just use the old "a security guard thought he saw something suspicious and radio'd it in, and now the spider hit the big red button" excuse.

Well, I can set the Host on alert... but the Brute Force entry would do that anyway... the point as I understand it is that no other IC can do anything until a Patrol IC actually locates the intruder.

And I don't have experience with Overwatch Score yet, but can't you reasonably expect to perform a 6-action hack under the budget of 40 OS before the hammer falls?  40 seemed low if you're leaving a trail through multiple hosts, but high if you're attacking a single host from a local connection.

Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

Well... doesn't a Cyberdeck still have a power switch?  Or a battery compartment?  Even if you can't disrupt the network connection, I wouldn't expect someone to be unable to physically power it off.  (Especially if getting stuck in the Matrix involuntarily is a known risk.)  The decker has a Cyberjack, but an external Cyberdeck, and I had been thinking that the connection went Matrix -> Cyberdeck -> Cyberjack such that powering down the deck would sever the connection.  (The Matrix FAQ also suggests the deck should take damage before a Cyberjack, which I took to mean it's between the attacker and the Cyberjack.)

[Stainless Steel Devil Rat]

.. the point as I understand it is that no other IC can do anything until a Patrol IC actually locates the intruder...

Patrol IC or a Spider, but essentially yes.  First thing that always has to happen for matrix stuff is the target must first be spotted.  Convergence is the only exception here that I can think of.

And I don't have experience with Overwatch Score yet, but can't you reasonably expect to perform a 6-action hack under the budget of 40 OS before the hammer falls?  40 seemed low if you're leaving a trail through multiple hosts, but high if you're attacking a single host from a local connection.

Indeed, you can execute a quick hack before you hit 40 OS.  In fact, that's basically how the game is designed to work.  You have enough time to do something quick... or... if you act all subtle like, you can do some sustained action long enough to cover the team for some minutes or so.  But you don't want players setting up anything that can persist permanently via hacking.  You'll have the decker ordering some free Delta grade Wired Reflexes 3 for home delivery on behalf of the Street Samurai (and etc) once you open THAT door.

Frankly if this is a scenario for players and GM both to get a feel for playing the Matrix game, you WANT this hack to be a puffball pushover.  Once you put a Spider on duty, up the host ratings a bit, use nested architectures, and best of all start messing with the decker's die rolls by using edge against him to reroll hits... hacking is gonna be quite hard for the players

Note that "unplugging" the hacker isn't normally something someone else can do.  It's all wireless... no physical data cable to physically unplug!  And if it's an implanted cyberjack, they can't even just physically smash the hardware to break the connection.  I mean, even if you did use a physical cable between datajack (or cyberjack) and an exterior device, unplugging that cable should presumably just jump the comms to wireless.  Everything's supposed to run wireless.

Well... doesn't a Cyberdeck still have a power switch?  Or a battery compartment?  Even if you can't disrupt the network connection, I wouldn't expect someone to be unable to physically power it off.  (Especially if getting stuck in the Matrix involuntarily is a known risk.)  The decker has a Cyberjack, but an external Cyberdeck, and I had been thinking that the connection went Matrix -> Cyberdeck -> Cyberjack such that powering down the deck would sever the connection.  (The Matrix FAQ also suggests the deck should take damage before a Cyberjack, which I took to mean it's between the attacker and the Cyberjack.)

Again, if you want "OMG the decker's in trouble, jack him out" to be a thing at your table, just go ahead and allow it then.  Just remember that dumpshock IS a stainless steel slitch.

[Odsh]

About that "one scan of the patrol IC per minute", when exactly do you perform the first scan?

Right after the hacker enters the host?
One full minute after he enters the host?
A random time between 0 and 1 minutes after entering the host (e.g. 1d20 combat rounds)?

When it is activated, make a Matrix Perception roll for the Patrol IC; that serves as hits on Matrix Perception actions it takes every in-game minute it is active. That means one of the Patrol IC’s Minor Actions is always given over to Matrix Perception. Reroll the Matrix Perception test once per minute.

The way I understand it is that the Patrol IC is constantly scanning every round, but the amount of successes on its perception test remains the same for a full minute. In which case, the hacker would be scanned right off the bat when entering the host. Then technically again every round after that, but the result would remain the same for one minute until the Patrol IC re-rolls its perception test.

In case of nested hosts, I assume each one has its own Patrol IC? So each time the hacker enters a nested host, he is immediately scanned by a new Patrol IC?

[ammulder]

Again, if you want "OMG the decker's in trouble, jack him out" to be a thing at your table, just go ahead and allow it then.  Just remember that dumpshock IS a stainless steel slitch.

I'm sorry, I just can't get past this.

Let's turn it around.  The decker is knocked unconscious and link-locked, and there's no "jack him out" at the table in question.  This means what?  Do you imagine the IC and any spiders they summon will just kill the PC?  Keep him in a permanent coma?  Trace Icon and keep him under until a meat team takes his body into custody?  What's supposed to happen here?  (I now read elsewhere that maybe the team is supposed to activate a jammer strong enough to block the Matrix signal?  Weird if the hacker has to carry a jammer for safety, but OK.)

Though, now I'm thinking this doesn't apply to my case at all.  A regular decker who is taken out by data bombs and Blaster or Killer IC is just going to have their deck bricked and get dumped, but will still be conscious (unless the dumpshock says otherwise).  The link-lock accomplishes nothing except to prevent them from escaping before the deck is bricked.  So there's no "unconscious and stuck in the Matrix."  It seems like the only way to get into that situation is with Sparky/Black IC in Cold Sim (where they do biofeedback damage and it's stun), or to be a Technomancer (for whom I guess all Matrix damage is stun).

I think I got thrown by that paragraph in the link lock section discussing going unconscious... without realizing it doesn't normally apply.  My error. 

[Stainless Steel Devil Rat]

Again, if you want "OMG the decker's in trouble, jack him out" to be a thing at your table, just go ahead and allow it then.  Just remember that dumpshock IS a stainless steel slitch.

I'm sorry, I just can't get past this.

Let's turn it around.  The decker is knocked unconscious and link-locked, and there's no "jack him out" at the table in question.  This means what?  Do you imagine the IC and any spiders they summon will just kill the PC?  Keep him in a permanent coma?  Trace Icon and keep him under until a meat team takes his body into custody?  What's supposed to happen here?  (I now read elsewhere that maybe the team is supposed to activate a jammer strong enough to block the Matrix signal?  Weird if the hacker has to carry a jammer for safety, but OK.)

Though, now I'm thinking this doesn't apply to my case at all.  A regular decker who is taken out by data bombs and Blaster or Killer IC is just going to have their deck bricked and get dumped, but will still be conscious (unless the dumpshock says otherwise).  The link-lock accomplishes nothing except to prevent them from escaping before the deck is bricked.  So there's no "unconscious and stuck in the Matrix."  It seems like the only way to get into that situation is with Sparky/Black IC in Cold Sim (where they do biofeedback damage and it's stun), or to be a Technomancer (for whom I guess all Matrix damage is stun).

I think I got thrown by that paragraph in the link lock section discussing going unconscious... without realizing it doesn't normally apply.  My error. 

The reason link-lock is supposed to be scary is that you can't escape.  Now, yes, being link-locked might can mean you can't jack out from a fight that you're going to lose.

That's not why corps link-lock you, though.

They link-lock you so that you're still stuck in VR when their mooks (or the cops) arrive at your physical location.  if they want to take some physical, literal retaliation on someone who hacked their host, they'll link-lock, knock your ass out, and trace you.

Of course, if the decker has accomplices they have all the incentive AND time in the world to break the connection.  It's fairly hostile GMing to tell the teammates "sorry, that's not how the game works, you just have to deal with it lul!" so yes I do understand and even support having a 3rd party sever the connection on behalf of an unconscious decker.  A couple of potential trouble points tho:

Ok, what if it's a Technomancer PC instead of a decker PC?  How are you going to power off a Living Persona?

It's one thing to allow a teammate to save an unconscious and link-locked decker.  It starts to get hazy when you have the player of a fully conscious decker rely on teammates to bail them out when they push the envelope rather than jacking out, themselves.

[Banshee]

FYI ... on the Patrol IC time interval between checks. The 1 minute is just the standard suggested time for standard security settings... if for some reason you want or need to apply pressure you can always change that. Especially if the system is one alert and know it's is "under attack" it can absolutely scan for intruders on every action until it finds them. Or if it's a paranoid security setup maybe they scan every couple of rounds etc. Basically feel free to adjust to whatever it takes to tell the story you want.

[Multifish2]

Some great discussion here, Patrol IC is an important part of hacking hosts, but I also found it quite confusing in the rules. I see above many points boil down to GM discretion/choice, which is fine, but I did notice a contradiction in the rules/example that suggest there is a correct way of doing things, no explicit explanation and no errata for these at the moment.

Matrix Perception is shown as Electronics + Intuition vs Willpower + Sleaze and we know for IC the dice pool are twice the host rating so that seems clear enough on what to roll, but...

1. Example on p.188 "Patrol IC rolls the host Device Rating of 4 x2 and gets a surprising 8 hits. This more than beats Mungo's Sleaze rating of 4..."
This suggests the hacker's sleaze rating was used as a threshold for the Patrol IC rather than getting a roll of Willpower + Sleaze in an opposed test.

2. Technomancer Functions last sentence (p.189) "they are difficult to spot in the Matrix, typically requiring 5 hits on a Matrix Perception test to be seen"
Again suggesting some threshold for a simple test for Matrix perception rather than opposed.

Do we know if any plans to fix these in the next errata?