An Introduction into the Matrix Rules, GM notes / Software Recommendation / Examples Options

[Ryu]

This writeup was created for the pre-SR4A matrix rules.
If you came here looking for SR5 rules help, try Redjack´s primer in the Data Haven section of this forum.


An Introduction into the Matrix Rules

Situation:
Lets assume most of your group does not really know the matrix rules. Shocking idea, I know. Now if you introduce all the rules you know at once (which is of course "all of them". Yeah, right.), they´ll go straight into information overload mode. Not nice. Hey, at least they got the part about comlink modes and augmented reality.

Solution:
You pretend you don´t know much about the matrix either. No, not the NPC solution this time. You introduce a limited ruleset, rules-as-written from the get-go. Whatever a player wants to look up has to be in the book. Once they´ve gotten the basics down, you sneakily build up to "full Unwired".


Approach
The matrix is mostly reduced to the interaction with matrix nodes, glossing over the network aspect:

• you need the rules for Matrix Perception and Data Search. Those are core functions within the matrix.
• hacking requires the options of spoofing orders and exploiting access to nodes.
• matrix combat may ensue from failed hacking attempts. I don´t bother with matrix combat in this writeup, as it is rather simple and follows usual mechanics. If you want that handy, too, go to
  Aarons Cheat Sheets and print the matrix combat one.

Rules that can wait, lowering the entry barrier:

• Program loads don´t matter much. Experienced matrix players using all rules will not suffer from program load often, and trying to figure out specific program loads takes way to long for unexperienced players. Reserve that complexity for later.
• Subscriptions limits are much the same. Yes, the game can benefit greatly from considering those, but ignoring subscription limits will not hurt that much.
• Networking tricks, because no group I´ve ever played with had a common starting point in RL knowledge. Better to build an understanding of SR nodes, and from that an understanding of SR networks (See post #17 when you remove this restriction).

This is my take on what can be done; thanks to those that helped me create it, with special mention for Aaron´s suggestions. If you use any of this, please report back with suggestions for improvement.

Structure:

1. Running the Matrix 101. A selected set of rules, focussed on the GM.
2. Programs and You. A players introduction to programs
3. Examples
   
   • Example 1: Sensor Networks
   • Example 2: Access Control
   • Example 3: Drones
4. Matrix Mechanics 101

1. Running the Matrix 101
The reduced ruleset, organised by activity. You´ll find a more detailed look at Exploit and Spoof below (Post #10).
Quick Matrix System Generation (Post #11) is a step-by-step guide to creating a matrix security concept for any kind of node.

[ Spoiler ]

Running the Matrix 101

Groundwork

On the matrix, each device is represented by a node.

• Multiple devices can be represented by one node (Clusters/Slaving, pg. 55, Unwired).
• Using a program on a node requires a subscription to that node, and therefore at least user access.

Each user is represented by a commlinks persona.

• A commlink provides both a node and a persona.
• A users persona is present in all nodes the user subscribed to, and in the originating node.
• You can only interact with another persona if your and your targets personae share a node.
  (Your targets persona will be present on your targets commlink node, maybe more).

Legitimate matrix users will:

• Search for Information. "Data Search."
• Locate specific nodes without knowing their accessID. "WiFi-Scan."
• Inspect other icons/nodes. "Matrix Perception."
• Use a device via the matrix. "Using a node."

Hackers will

• Fake commands from legitimate users. "Spoofing Orders."
• Take access rights they are not supposed to have. "Node Hacking."

Legitimate Use

Data Search (pg. 220 main book)
Extended Test, Data Search + Browse, threshold 2-16, search area determines base time: Device: one IP, Network: one turn, whole matrix: one minute
Use:
Think internet, but with a severe increase in available information. See the optional AR bonus you might gain for some actions by getting DIY-help from the matrix (AR modifiers, pg. 208 main book, +1 to +3 for any information-dependant task, ie: repairing your car)
GM Decisions:
Reward specific search terms and search areas with better information, but keep in mind that some opponents might be resourceful and matrix-savy enough to monitor specific search topics. Mechanically you can assume success, unless time is of essence, or the used dicepool is very small and you want to check for a glitch.

WiFi-Scan:
Electronic Warfare + WiFi-Scan, threshold variable, 1 turn
Active/passive node: threshold 1+ depending on number of nodes present
Hidden node, location known: threshold 4
Hidden node, general search: threshold 15+
Use:
WiFi-Scan is used to detect wireless nodes in a specific physical location - even if they are hidden (for hidden icons on the same node see matrix perception above).

Matrix Perception (pg. 218 main book)
Computer + Analyse, in case of hidden personae/nodes opposed by Hacking/Firewall + Stealth.
One piece of information per (net) hit
Use:
All these funny icons have a purpose. They may advertise said purpose, but those a hacker cares about are often blatantly lying.

• A hacker should figure out how strong a nodes matrix defenses are before attempting a fast hack. Some opponents have surprisingly good commlinks/nodes.
• Some security hackers, IC, and other users will run in hidden mode. You can find those with matrix perception. (Finding hidden nodes is handled with WiFi-Scan.)
• A legitimate users accessID is the basic requirement for spoofing orders, see below.

Using a node
Matrix Functions:
Gaining Information about a node is handled under "Matrix Perception", finding data under "Data Search".
Data can be edited (access logs, vid feeds, accounting data, you name it): Computer/Hacking + Edit, (pg. 219 main book)
Using a matrix function without associated program, that you want to have a test for anyway: Logic+Computer
Real-World Functions:
Relevant Skill + Command, should a test be required
Most device functions are just a question of the necessary access rights, so you´ll at most test for Spoofing the required order.


Basic Hacking

Spoofing Orders (pg. 224 main book)
Hacking + Spoof against Pilot/System + Firewall, complex action.
The basic requirement is a legitimate user ID for the (type of) node in question.
Use:
Making a device perform a simple order, one time only. Advantage: It ties someone elses accessID to the crime, Disadvantage: There is a risk of detection each time an order is given. Your player might want to run Stealth.
GM Decisions:
You will have MANY nodes that might come up in game, so take it easy and have identical access rights across nodes. You just need user groups with different access rights:

• separate all on-site nodes into public/work-related/security measures, and larger facilities into different areas
• determine what kind of access to those nodes any user group would have
• if your players manage to spoof the order, they can do whatever the user in question would have been able to.

Node Hacking (pg. 221 main book)
Extended test, Hacking + Exploit vs. Firewall +0/+3/+6, one turn. System rolls Firewall+Analyse vs. Stealth, also an extended test unless the player increases the base time to one hour.
Use:
Gaining access rights of a certain level (but not an account) to a matrix node. The disadvantage is a limit to the rating of nodes that a hacker can reliably beat without raising an alarm, which can only be circumvented with a massive increase in required time.
GM Decisions:

• Note that you can almost ensure detection on the second intruder detection test if you beef up Firewall and Analyse too much. Try running with analyse 1 and variable Firewall for starters, or a device rating of 3-4.
• Other users or IC programs get a matrix perception roll to detect the hacker

Some semi-random spice

Quick&Dirty:
A device that only has a unified device rating will mostly roll 2*device rating on tests.

Simplicity:
The Cluster rules of Unwired allow you to combine several devices into one matrix node. Within the simplification of this subset of the rules, you simply have one node that controls all functions of all devices, with the twist that the lowest Firewall and System are used, and that Response is averaged. Which does not require any calculation if all devices have the same device rating. Lower number of nodes = fewer matrix tests, less book-keeping.

Difficulty:
Minimal investments into hacking enable your players to defeat rating 3 nodes. Step it up too quickly and they´ll abandon the attempt of learning the matrix rules. Real hacker builds can take rating 4 nodes. Remember: Success is mostly a given in other areas, too. Try to mention that a little bit of hacking and a better comlink are way cheaper than the common investment into hardware skill. Not to speak of the "secondary" uses of hacking.

Encryption: Encryption requires decryption on part of the attacker.
Response + Decryption vs. Encryption*2, extended test, 1 turn

Data Bombs: Certain data might be secured by a data bomb (find out with Matrix Perception)
Hacking + Defuse vs. Data Bomb*2, not an extended test. Can be used for plot protection.

2. Programs and You (Version 1.2)
Now the second part is ensuring that no hacker is ever surprised by the program requirements of the reduced ruleset. So those should be explicit. Ruleswise, one set of Aarons Hacker Cards per player is the recommended minimum. Don´t ever forget them. The Hacking cheat sheet from the same page will also come in handy.

[ Spoiler ]

Programs and You
Program Ratings
First things first: Program ratings are capped by System, which is in turn capped by Response.
Unwired introduces the Optimisation option, which permits programs to run on lower rated systems.

Advantage: Metahuman
While you may not want to play a hacker, you should consider some basic matrix skills.
Metahumans are not limited to a dicepool of 12 like any agents ultimately are. Dicepools are modified:

• by the hot-SIM bonus of +2 (Survival tip: No hot-SIM without Biofeedback-filters)
• by qualities (ie codeslinger)
• by augmentations
• by edge

Security Concerns
Firewall: Core requirement of a secure comlink
As high as you can get. You can get rating 6. `Nuff said. You are a runner, and while this may be a transhuman age, information is still king.
Stealth: core requirement of a runner comlink, required to enter hidden mode
As high as you can get. See your program cap. You want to hide your matrix self on the run, and stealth does exactly that.
Encryption: Core requirement of privacy
Decryption is easy. Really easy. Like in "listening in on the guards"-easy. Just saying.
The opposition might have an ear on the matrix, too. If you own Unwired, you want to run a tactical network. Any good guys hacking that one would get rather perfect targeting data, don´t you say?


Joe Average Utility
Analyse: You need it to get information about matrix nodes, and for some defensive rolls (against Spoof, Exploit).
At that price/benefit ratio, take what you can get.
Browse: Data Search
Free information on the matrix? Your connection charges, told you all information comes at a price?
Any rating will do, the test interval is rather short. Beware of glitch-heavy dp sizes.
Command: Used for controlling all kinds of real-world functions nodes might have, should they require a test.
Might or might not come up. It´s easy to justify rating 3.
Edit: Manipulation of all kinds of Data Formats
Must-buy at rating 3, take what you can get if you have any interest in tampering with files. Like security vid feeds.



Basic Hacking
There are basically two options to hacking a node: You can Exploit it to gain full access, or you can fake legitimate orders with Spoof.
Then there are two fundamentally different situations concerning the matrix:

• Due to the skills and planing of your group, you are still undetected. You want to avoid detection. The key to that is running a good Stealth program, and being careful with Exploit attempts. This calls for a stealthy hacker. Failure leads to a system on matrix alert.
• You already raised an alert, or the alert will be restricted to the matrix and you don´t care about that. Intrusion is a given at that point, but you will likely have to deal with active security measures. This situation often results in Matrix Combat. You can also try to be done before the active security measures take effect, or hide from IC while you finish your deeds (stealth rating should ideally be IC rating +2 for that strategy...)

Thus there are two approaches to hacking:

• The silent way is for true hackers, you need pretty good gear to avoid detection and good skill to take on better nodes and account types
• The combat way opens up with minimal investments - once the samurai have the lead flying, nobody cares about being found anymore, right? These types should be build for some physical action, too.

Spoof: Imitate a simple order from a legitimate user
A device resists faked orders with a dp of twice it´s rating, assuming it has Analyse running. You can beat that, and it doesn´t take time at all.
Seriously, the Hardware skill approach to opening a door is pretty obvious, and takes waaay longer than a complex action. The Hacking skill has better secondary uses, too.

Exploit: Gain access rights you are not supposed to have
Some big gains are to be made here. Often easy, this can get dangerous fast if you are hacking on the fly. Try being done after the first test, or take the slow approach.

• Consider the price of all those hacker services, and that beating a device rating of 3 is ruleswise an easy challenge. If you determined that the node is not running Analyse (Matrix Perception), you can even take two tests. Outside help is always a security risk.
• If your group already raised an alert, all bets are off. Go in expecting trouble, and always for admin.

Things-went-bad-programs:
Attack, Armor, Biofeedback-Filters. You DO have Analyse, you MIGHT have Blackout / Black Hammer. Stealth is always-on.
Handling the matrix is about avoiding detection. If you failed at that, you´ll need to fight a retreating battle. Or win.

Hacker´s Little Helpers
WiFi-Scan: Can´t hack it if you can´t find it. Used to find hidden nodes, as Analyse only finds hidden users on a node.
Trace: Want to know where your target is? No problem, defense is almost impossible.
Decryption: Rating is not that important, but you need it to defeat encrypted nodes
Defuse: If someone set you up the (data) bomb, this is handy. Warning: This is not an extended test, but opposed by the Data Bomb rating*2. Maybe getting the password is safer?

3. Examples
Most of the nodes you encounter during an SR session should in some way be similar to the following examples:

Example 1:
A sensor network. This example can be adopted for many kinds of devices that are unified into one node, including industrial machinery. The functions of the devices are what determines the relative value of spoofing or hacking the node.

[ Spoiler ]

KE VSS
KnightErrant offers quite a list of security options for any customer who can pay the price. One very common feature is video surveilance. Everyone is doing it, but KE does it well.

Physical devices:
The VSS is made out of a number of both visible (deterrent) and hidden cameras.


Matrix Representation:
All cameras are combined into one node (see Clustering, Unwired: min of System/Firewall, average of Response). All devices have a device rating of the customers choice, in case of this example 3. Therfore the matrix node "VSS" has a device rating of 3.

Node Function:
The node controls all cameras (direction, used vision mode, on/off-state, intruder tracking, guard supervision, recipients of vid footage). You can access the node if you are in signal range of a single camera. Video feeds are stored, and can be manipulate with a successful computers/hacking+edit, usually extended test.

Uses for Matrix perception:
Take a second to figure out your dicepool. You get the visual representation (+ a bunch of other senses) for free, unless there are hard-to-notice details. If you want more info, you roll matrix perception. I´ll list the main book examples and possible uses:

• any ratings (the answer is 3 here, or "not present") The style of a node is only weakly correlated to the danger of hacking it. Find out you can´t before you fail.
• type. You want to hack the VSS, not the node of the coffeemaker next to one of the hidden cameras.
• alert state. Know if you´ve been noticed. Or someone else. If you fail a spoof attempt, the node will register an illicit command.
• find out if video evidence shows signs of tampering.
• each other relevant information: is any user looking at the video feed of the hidden camera you just found?
• Get a list of all active and passive personae and agents connected to the node, and of any hidden ones if you can beat their Firewall+Stealth test

What you can do by spoofing:
Switch a camera off (vid frozen), change camera direction, change the used vision system (ie to normal vision while wearing a chameleon suit).

What you can do with exploit:
Get a normal account to see footage of the "kosher" cameras, get a security account for seeing all footage, plus full control over all cameras, including an automatic tracking of any person you want. Track the guards and you are never surprised again. If you get admin access, you can revoke the accounts of the regular guards.

How do they compare?

• Spoof is simple and fast. A single short command, faked to come from a legitimate source. Getting a legitimate matrix ID can be simple. At the end of every shift, guards are leaving the facility. And any of those has likely a security account on the VSS. Getting into the Human Ressources Server of Knight Errant (a device rating of 4, but behind Chokepoint servers) is theoretically possible, but reserve that approach for weaker prey. Any guard (alive, and blissfully unaware of the runners) is likely broadcasting the ID over a load of game-servers.
• Exploit has some big gains. Take a slow approach during prep time, and you have stacked the deck in your favour. On the fly you´ll be facing 6 defending dice, so with a stealth of 5, the second test brings danger of detection. However with a bit of edge, and a solid Exploit program, and some hacking skill, blasting the barrier of 6 hits (device rating 3 + security account 3) is doable, and brings some immediate advantages.

GM Decisions
Why rating 3? You could say that security devices have a device rating of 4. In this case I judged it to be 3 because a) these are no hidden sentry guns, just cameras, and b) it´s easy to frustrate people that are just learning the rules. (I would recommend to put dedicated hackers into the 12-16 dice bracket (all boni considered), and part-timers at 8-12 dice. Both should be able to beat the VSS, and the dedicated hacker can still be challenged with rating 4 or 5 nodes. Which fits the given examples for device ratings nicely.

Example 2:
A system for matrix-controlled doors, without central node.

[ Spoiler ]

Shiawase "Empress" Door System
Not everything has to be wireless. Shiawase has just the right choice of household doors for any user who is both security- and comfort-minded. In the future, any door will be open for those who have the necessary rights to open it, and closed to all others. Grounding your child is easy if you bought the system for every door.

Physical devices:
The system consists mostly of mag-locked doors, although some users invest into windows from the same catalogue.

Matrix Representation:
This upper-class system has a device rating of 4. Each door has it´s own matrix node. The individual doors offer skinlink functionality over their whole surface, wireless links are available for the garage only. All doors are linked via wired connection to the central household telekom.

Node Function:
Simple: Keeping anyone who may not enter out. Everyone, including guests and personell, get normal user accounts. The respective "room owners" have security accounts, and can lock everyone but other "room owners" and admins out. If you have an admin account, you can always open any door.
So if you want into the living room, any account will do. If you want into the master bedroom, better be close friends with an owner. The household telekom can be used (by those without skinlink) to relay orders to the doors as long as it is in active mode.

Uses for Matrix perception:
Not much really, as there are few functions.

• any ratings (the answer is either 4 or "none present") The style of a node is only weakly correlated to the danger of hacking it. Find out you can´t before you fail.
• alert state. Know if you´ve been noticed. If you fail a spoof attempt, the node will register an illicit command.
• each other relevant information: is the door locked normally or by security account?

What you can do by spoofing:
Open the door, if the person you are pretending to be could open the door. Lock the door.

What you can do with exploit:
Open the door any time you want and the account level permits. But only that single door.

How do they compare?

• Spoof is simple and fast. A single short command, faked to come from a legitimate source. Which is all you want in this case. You need to find someone with the right access ID, either someone with admin access, or a valid account for each door you need to pass, security access preferred. If you have only normal access, you´ll have to pray that the door is not owner-locked.
• Exploit is a fail here, unless you have to pass one door again and again and again, or can not have any risk of failure, at all (like on the fallback escape route). The simplicity of the necessary orders does not justify the effort and risk of exploit well.

GM decisions
There are of course cheaper variants of this system, on the other hand some important security chokepoints might easily have even better locks. The Spoof dicepool should be higher than 2*device rating, as single orders are rarely worth a point of edge. Exploit can be different.

Example 3:
Taking a look at vehicles, or more specifically, drones. Rigger adaption (default for drones) allows for nearly all vehicle functions to be matrix-controlled.

[ Spoiler ]

MCT FlySpy
The guards don´t want to die, and are too clumsy to sneak up on runners anyway. So they send out a scout drone.

MCT Rotordrone
The guards don´t want to die, and are too fragile to effectivly fight runners anyway. So they send out a remote-controlled firebase.

Physical device
The drone. Duh. The Rotordrone comes armed with an assault rifle that has both smartlink and underbarrel grenade launcher.

Matrix Representation:
A single node with device rating 3 (Flyspy) or 4 (Rotordrone).

Node Function:
Drone control. The drone node offers displays for all available sensor data, and controls for all functions like flight direction, speed etc. It also provides storage for any sensor data. The Rotordrone has an additional weapon control system, including virtual controls for all smartlink functions. Ammo count /current target/target priorities for autonomous mode...

Uses for Matrix perception:
Some basic ideas:

• any ratings (the answer is either 3 or 4 here, or "not present").
• type. You want to hack the drone, not the tactical network of the assaulting KE team.
• alert state. You care only if your presence is not well-known anyway.
• find out if the drone is in independant mode (as in: not piloted by the security rigger).

What you can do by spoofing:
Send GOTO orders, disarm a weapon system, disable all recording functions, put "target" on friendly list, reboot (sometimes very efficient, as it takes time), change sensor mode (only useful for patrolling drones, as scout drones are usually monitored, and modes switched right back), dump ammo of smartlinked weapons, including the coveted "dump grenade clip"

What you can do with exploit:
Get full access to the drone, including the ability to jump in. Rigging is a story for another time.

How do they compare?

• Spoof is simple and fast. But you need the matrix ID of the controller first, and if the drone is not in autonomous mode, any falsified orders are immediately revoked. (Unless the damage is already done, see dumping ammo)
• Exploit has some big gains. Not that interesting in the case of scout drones (bring your own), but very interesting in case of combat drones. Mind the security rigger! Shutting down a drone works for both sides, as does matrix combat.

4. Matrix Mechanics 101

[ Spoiler ]

Matrix Mechanics 101
Data Search (pg. 220 main book)
Extended Test, Data Search + Browse, threshold 2-16, search area determines base time: Device: one IP, Network: one turn, whole matrix: one minute

WiFi-Scan (pg. 225 main book)
Electronic Warfare + WiFi-Scan, threshold variable, 1 turn
Active/passive node: threshold 1+ depending on number of nodes present
Hidden node, location known: threshold 4
Hidden node, general search: threshold 15+

Matrix Perception (pg. 218 main book)
Computer + Analyse, in case of hidden personae/nodes opposed by Hacking/Firewall + Stealth.
One piece of information per (net) hit

Spoofing Orders (pg. 224 main book)
Hacking + Spoof against Pilot/System + Firewall, complex action.
The basic requirement is a legitimate user ID for the (type of) node in question.

Node Hacking (pg. 221 main book)
Extended test, Hacking + Exploit vs. Firewall +0/+3/+6, one turn. System rolls Firewall+Analyse vs. Stealth, also an extended test unless the player increases the base time to one hour.

Using a Node
Mind the access log!

Matrix Functions:
• Gaining Information about a node is handled under "Matrix Perception", finding data under "Data Search".
• Data can be edited (access logs, vid feeds, accounting data, you name it): Computer/Hacking + Edit, (pg. 219 main book)
• Using a matrix function without associated program, that you want to have a test for anyway: Logic+Computer
  Real-World Functions:
• Relevant Skill + Command, should a test be required

Encryption:
Response + Decryption vs. Encryption*2, extended test, 1 turn

Data Bombs (pg. 223 main book)
Hacking + Defuse vs. Data Bomb*2, not an extended test. Detect Databombs with Matrix Perception

Matrix Combat (pg. 231 main book)

Initiative
• Metahumans: AR: Physical Initiative/IPs
• Metahumans: cold VR: Response + Intuition / 2 IPs
• Metahumans: hot VR: Response + Intuition +1 / 3 IPs
• Agents/IC/Sprites: Response + Rating + 2 / 4 IPs
  Attack
• Matrix Combat (agents/IC: rating) + program rating, (program rating) base DV, complex action
  Defend
• Response + Firewall
• Full Defense: +Hacking (agents/IC: rating)
  Soak
• Matrix Damage Monitor: 8 + System/2, round up
• Matrix Damage (Attack): System + Armor; VR users take 5S (cold) or 5P (hot) dumpshock, should their icon crash, and suffer desorientation (-2 to all pools) for (10-willpower) minutes)
• Stun/Physical Damage (Blackout/Black Hammer): Willpower + Biofeedback Filters