Hidding Matrix-Enabled Gear on a Run, Keeping the Spider from seeing your Sequencer. Options

[BlackJaw]

It's been noted that the new matrix rules, in particularly the rules on detecting and locating silent running icons, make it dangerous/foolish to use matrix enabled gear on a run in any kind of a secure facility. I've been thinking about it, and I suspect it's not as dangerous as people suspect.

1) Decker-Spiders defending a site are likely to remain inside the site's host system, defending it's devices and firewalls, at least until an alarm is raised. This takes them "off" the local grid space, so they actually won't see icons moving around their building unless they have a reason to leave the host and go look for them. They instead see icons moving in the host, which is not the same. They might notice a hidden icon (like a Hacker) has appeared in their host, but they can't make check for hidden icons in physical space without exiting the host system. Additionally, many Spiders are actually not physically present at the build they protect, as their job can be done from anywhere via the matrix. This means if they happen to jack out they may not even be within 100 miles of the site, let alone within 100 meters of the Runners.
For building security, tracking wireless devices in the building would largely be handled through Radio Signal Scanners.
What this means: Unless you set off an alarm, or unlucky enough to arrive during a coordinated bug-sweep, no one is probably actively looking for hidden icons in the building. Your primary concern would therefore need to be the security systems: The Signal Scanners.

2) Radio Signal Scanners and Bug Detectors have a range of 20 meters, and are limited to only a single activity: Spotting Icons. Any matrix enabled device within 20 meters of an active radio signal scanner is subject to being spotted by it. If it's running in public mode, it's spotted easily, but if it's in silent mode, then the sensor operator gets to make an Electronics warfare + Logic [Sensor Rating] check. If the device has it's wireless on, it's rating can replace the Electronic Warefare portion of the roll.
It's unclear if a signal scanner can be left operating on it's own, but in theory it should be possible for a set of signal scanners slaved to a building host to operate continuously and most autonomously using their own rating instead of the electronic warfare of the spider, but probably getting the spider's logic. The sensors would be set to trigger an alarm, or at least an alert, to the Spider if they spot icons of particular types: Such as weapons or B&E gear. Remember: Standard matrix rules state that a device's icon reports what it is, more or less. It's unlikely that a building's spider wants an alert every time a janitor moves a bin full of Diet-Double-Choco-Tarts packages (each with an RFID tag) past a sensor at night, nor does he want an endless supply of alerts during the day as employees, each a bundle of matrix active devices and RFID tags, move around the building.
What this means: Signal Scanners can not be used to determine if there are un-spotted hidden icons in a building. Nor are they able to make Matrix Perception checks to investigate spotted icons, like verifying the icon is valid.

3) Spotting a Hidden Device Icon is an opposed roll which is defended with Your Logic or it Device Rating + Sleaze. Most devices/icons won't have a Sleaze rating, but the roll is still a defensive roll, so Full Matrix Defense applies. Runners of any stripe that knows they are passing within 20m of a Signal Scanner can use the Full Matrix Defense Action to add their Willpower to the defensive roll, which for some runners may make a world of difference. If you have all your devices slaved to a Commlink or Cyberdeck being owned/operated by someone with a good Willpower it may easily make up for the lack of Sleaze, or greatly enhance the existing Sleaze.
What This Means: Even without a sleaze rating, it possible to conceal an icon from a basic radio signal scanner. If the team has all their gear slaved to the Decker's Cyberdeck and backup commlinks (because cyberdecks have low device ratings and therefore can take many slaved devices) and he's using Full Matrix Defense, it should be difficult for a radio signal scanner to pick up any of their gear without dedicated actions by a Spider... which is unlikely as long as you don't trip any other alarms.

4) The Wrapper Cyberprogram can conceal an icon as something else, and can easily be run from a cheap Rigger Control Console. You could make your Chameleon Suit and Maglock Sequencer look like Choco-Tart wrappers: which are unlikely to trigger an alert if they are spotted by a Radio Signal Scanner. Net cost: $1650 ("Scatch Built Junk" RCC has a single program slot, + $250 for a single cyberprogram), every Hacker and probably infiltration expert should have one.
What This Means: Being spotted doesn't automatically ruin a run if you are concealing the icon as something else because the Radio Signal Scanner can't investigate, it only spots.

4) Radio Signal Scanners are just a security device on the site Host system. In much the same way you wouldn't walk in front of a security camera without the Hacker first looping it's feed, the team shouldn't wander around a complex with wireless devices before the decker has disabled or edited the alert setting for the radio signal scanners in the building. In most cases, I imagine the decker is gaining access to the building Host through a direct-connect hack, either on an accessible device in/on the building, or by getting a hold of a device slaved to the host that is more mobile (such as a smartgun brought home by the a security guard, against policy of course.) Once inside the host, the signal scanners are just as easy to hack as the security cameras.

[binarywraith]

I agree, if your team's Matrix support has already owned the building's host, then carrying around wirelessly active gear isn't much of a problem! (IMG:style_emoticons/default/biggrin.gif)

[Jaid]

except that a random security guard has everything needed to make a matrix perception test for the physical facility as well. if your gear is behind something that has a good sleaze rating, you're probably fine (since your pool is likely noticeably better than the guard's perception pool which is likely to be no higher than 6, and quite possibly lower), but if it isn't, then you can expect that every so often the security guards will get a prompt from their corp-issued commlinks that won't stop bothering them until they spend the ~1-3 seconds to do a matrix perception test.

[BlackJaw]

except that a random security guard has everything needed to make a matrix perception test for the physical facility as well. if your gear is behind something that has a good sleaze rating, you're probably fine (since your pool is likely noticeably better than the guard's perception pool which is likely to be no higher than 6, and quite possibly lower), but if it isn't, then you can expect that every so often the security guards will get a prompt from their corp-issued commlinks that won't stop bothering them until they spend the ~1-3 seconds to do a matrix perception test.

I disagree. The page 382 "Corporate Security Guard" Professional rating 2 NPC, is untrained in computers, has logic 2, and a device 3 Commlink... which means he's actually going to have a hard time looking to see if there are any hidden icons in the building as he defaults (-1?) with 2 Logic. While he may only need 1 hit to detect any hidden icons in the area, he won't succeed most of the time, and is likely to critically glitch a lot of the time. If he has an 8 hour shift, and runs the check once and hour, he's going to succeed maybe 2-3 times, and call in an unneeded High Threat Response team about once.

Add to that that most hidden icons turn out to be something like a diet-breaking Choco-Tart someone is hiding from their spouse in their desk drawer, and the security guard may have a hard time spotting it once he knows something is present meaning he has to call the spider out of his host to come check things out. I doubt that Spiders want to be bothered with security guards attempting such sweeps and distracting them from their "real" work. Network security is their bag, and I doubt they want security guards bumbling about in it.

[Sendaz]

I do sometimes wonder much much hardware is required for these icons to really exist.

I mean I have my Ares Predator and if running online it has the icon for an Ares Predator.

But so can the aforementioned Choco-Tart, granted more through RFID tags, but still...how much electronics are really needed to make up a functional icon for a device?

One idea I had to mess with deckers was rip the electronic 'guts' of a predator and mount it to my normal Predator. Not using a wrapper program to alter something, but rather the actual bits from a real Predator.

Attach a small power supply and a nominal computer chip or two to provide the necessary data going back and forth to the Matrix to make it to appear for all practical purposes as a functional Predator, I could even add a small motion sensor so when the gun fired it would reduce the mock Predator ammo count.

Now running both in Silent Running, a decker seeing this would be able to detect two hidden icons, since they pretty much occupy the same 'space' and both actually read as Predators, the decker would have to basically choose one to try IDing before he could take further actions, giving the decker a 50/50 shot of detecting the 'dummy' which will still be giving all the relevant bits as if it were a real Predator. Spiking the dummy will not hurt the real one, course if they get lucky and find the real one first well that's the chances one takes.

But what if I can stick 2 dummies onto the weapon? 1 in 3 is not bad and favours the device having a good chance of not being 'it' the first time around... I can even add small fireworks that go off when the dummy gets bricked for aesthetic purposes. (IMG:style_emoticons/default/nyahnyah.gif)

Again we are not messing with the software (ala wrapper) so much as hacking the hardware so to speak (using multiples of the actual hardware bits doing the matrix icon thing).

[hermit]

One idea I had to mess with deckers was rip the electronic 'guts' of a predator and mount it to my normal Predator. Not using a wrapper program to alter something, but rather the actual bits from a real Predator.

But then it only gets the Diet-Double-Choco-Tarts' WiFi Bonus (probably additional nutrition). While it's nice to get a bit of food every time you shoot a guy, wouldn't you rather have two more dice?

[Sendaz]

But then it only gets the Diet-Double-Choco-Tarts' WiFi Bonus (probably additional nutrition). While it's nice to get a bit of food every time you shoot a guy, wouldn't you rather have two more dice?

??

I think you misread my post... I never said anything about making a dummy icon from choco tarts. The choco tart reference was about wondering how much hardware is really needed for making a feasible icon from.

I have a real predator getting real wifi bonus.

I rip out the electronic guts of another predator and cobble it together to mount on my real predator as a dummy device, generating data back and forth with the matrix as if it were a functional device.

Run both in Silent Running.

As they both occupy the same space someone detecting the two hidden icons is not going to be able to determine immediately which is a real predator as both technically are real, just that one is actually running a real gun, while the other is running a simulation.

[binarywraith]

I do sometimes wonder much much hardware is required for these icons to really exist.

I mean I have my Ares Predator and if running online it has the icon for an Ares Predator.

But so can the aforementioned Choco-Tart, granted more through RFID tags, but still...how much electronics are really needed to make up a functional icon for a device?

One idea I had to mess with deckers was rip the electronic 'guts' of a predator and mount it to my normal Predator. Not using a wrapper program to alter something, but rather the actual bits from a real Predator.

Attach a small power supply and a nominal computer chip or two to provide the necessary data going back and forth to the Matrix to make it to appear for all practical purposes as a functional Predator, I could even add a small motion sensor so when the gun fired it would reduce the mock Predator ammo count.

Now running both in Silent Running, a decker seeing this would be able to detect two hidden icons, since they pretty much occupy the same 'space' and both actually read as Predators, the decker would have to basically choose one to try IDing before he could take further actions, giving the decker a 50/50 shot of detecting the 'dummy' which will still be giving all the relevant bits as if it were a real Predator. Spiking the dummy will not hurt the real one, course if they get lucky and find the real one first well that's the chances one takes.

But what if I can stick 2 dummies onto the weapon? 1 in 3 is not bad and favours the device having a good chance of not being 'it' the first time around... I can even add small fireworks that go off when the dummy gets bricked for aesthetic purposes. (IMG:style_emoticons/default/nyahnyah.gif)

Again we are not messing with the software (ala wrapper) so much as hacking the hardware so to speak (using multiples of the actual hardware bits doing the matrix icon thing).

Honestly, this was one of the first things that was brought up when these rules were first read out.

'What's stopping me from carrying 250 identical RFID chips/2 (IMG:style_emoticons/default/nuyen.gif) electronic toys that all think they're a Predator?'

To date, we really don't have an answer beyond 'Don't do that.'

[hermit]

I think you misread my post... I never said anything about making a dummy icon from choco tarts. The choco tart reference was about wondering how much hardware is really needed for making a feasible icon from.

I have a real predator getting real wifi bonus.

I rip out the electronic guts of another predator and cobble it together to mount on my real predator as a dummy device, generating data back and forth with the matrix as if it were a functional device.

Run both in Silent Running.

As they both occupy the same space someone detecting the two hidden icons is not going to be able to determine immediately which is a real predator as both technically are real, just that one is actually running a real gun, while the other is running a simulation.

Ah, you want a decoy predator icon that can be bricked and hacked and will not harm you in any way! Thought you wanted to make your pred appear a Choc-Tart in the Matrix by default. Yeah, my bad.

[Sendaz]

Honestly, this was one of the first things that was brought up when these rules were first read out.

'What's stopping me from carrying 250 identical RFID chips/2:nuyen: electronic toys that all think they're a Predator?'

To date, we really don't have an answer beyond 'Don't do that.'

Aye, I recall that, but wasn't one of the counterarguments to this also was someone saying that the stealth tags were basically using wrapper to project the fake predator icon, but would not stand up to closer scrutiny?

have to go back and dig around for the original comment.

That's why I was looking at the mocked up hardware so not just the id of one, but if someone did hack it, it would be showing things like ammo count changing and such so they would be more likely fooled by it.

Ah Thought you wanted to make your pred appear a Choc-Tart in the Matrix by default. Yeah, my bad.

No that is more like my Shotgun that fires slugs with embedded rfid tags in the rounds making them look like flaming skulls to AR when fired.

No real advantage but cool to watch with the goggles on.

[FuelDrop]

No that is more like my Shotgun that fires slugs with embedded rfid tags in the rounds making them look like flaming skulls to AR when fired.

No real advantage but cool to watch with the goggles on.

I like this. Unfortunately I'm fairly sure that shotgun slugs are going to travel too fast for anyone to get a good look at the skulls, but it's still really stylish.

[BlackJaw]

Aye, I recall that, but wasn't one of the counterarguments to this also was someone saying that the stealth tags were basically using wrapper to project the fake predator icon, but would not stand up to closer scrutiny?

have to go back and dig around for the original comment.

That's why I was looking at the mocked up hardware so not just the id of one, but if someone did hack it, it would be showing things like ammo count changing and such so they would be more likely fooled by it.

The icon would look like something else when spotted, like say an Ares Predator, but when using Matrix Perception to inspect it you could use one question to ask "what is this thing" and get "RFID" chip. The trick works fine if the person doesn't stop to inspect but instead just starts throwing dataspikes.

Honestly, the main argument against the RFID Wrapper trick is your average security system with a radio signal scanner is likely to pickup up at least one of the 250 stealth RFID tags, if not a dozen of them, and then it will start setting off alarms about "weapons." In other words, this trick isn't subtle.

Moreover, if the enemy decker can see you, and is using the AR overlay version of the Matrix, he may notice all those gun icons are in your backpack, not on the icon of the weapon in your hand. This trick was originally thought up for making the "randomly pick a hidden icon to spot" less effective, but the Matrix Perception chart notes you can attempt to spot a hidden icon directly if you know one thing about it, which some people (like me) argue would include "It's that gun over there" if you can see the object, making all the fake tags in your bag useless if the enemy can already see you.

The better trick is to run your guns in silent mode with icons altered by Wrapper to look harmless and integrated into your PAN, and stick a single RFID tag on each of the guns with Wrapper making them looks like the Guns. If you get in a fight with a Decker or security spider, he may try Dataspiking the obvious gun instead of your digitally concealed real one. Just make sure to switch the tags off when you are in a secure area, or they will set off alarms just like real guns... which again, limits the trick.

No that is more like my Shotgun that fires slugs with embedded rfid tags in the rounds making them look like flaming skulls to AR when fired.

No real advantage but cool to watch with the goggles on.

Sounds like a good use for the "Distinctive Style" negative quality to me.

[Tanegar]

1) Decker-Spiders defending a site are likely to remain inside the site's host system, defending it's devices and firewalls, at least until an alarm is raised. This takes them "off" the local grid space, so they actually won't see icons moving around their building unless they have a reason to leave the host and go look for them. They instead see icons moving in the host, which is not the same. They might notice a hidden icon (like a Hacker) has appeared in their host, but they can't make check for hidden icons in physical space without exiting the host system. Additionally, many Spiders are actually not physically present at the build they protect, as their job can be done from anywhere via the matrix. This means if they happen to jack out they may not even be within 100 miles of the site, let alone within 100 meters of the Runners.
For building security, tracking wireless devices in the building would largely be handled through Radio Signal Scanners.
What this means: Unless you set off an alarm, or unlucky enough to arrive during a coordinated bug-sweep, no one is probably actively looking for hidden icons in the building. Your primary concern would therefore need to be the security systems: The Signal Scanners.

While it may be RAW, I think it is setting-breakingly stupid to assume that a spider sitting in his host cannot see what's going on in the physical building. He's not just sitting in VR twiddling his thumbs, he should be actively monitoring sensor feeds, radio communications, Matrix diagnostics, and any number of other indicators. His job is to help secure the building against intruders, so he should be actively looking for intruders.

[Sendaz]

I like this. Unfortunately I'm fairly sure that shotgun slugs are going to travel too fast for anyone to get a good look at the skulls, but it's still really stylish.

aye, most of your audience will not be able to fully appreciate it, though those with enhancements to their reflexes are usually more apt to see this as their time-sense is ratcheted up and most of the world looks like slow motion.

[hermit]

While it may be RAW, I think it is setting-breakingly stupid to assume that a spider sitting in his host cannot see what's going on in the physical building.

Given how grids and hosts work, it makes a lot of sense. Space in the Matrix outside the host is the domain of grid demiGODs, inside the host it's host demiGODs. It's a question of juristictions. A spider attacking devices on a grid actually is acting illegally. GOD might well come down on the spider, because he has no right to just brick icons on the grid any more than anyone else has ... of course, corps surely can arrange for temporary licenses and stuff, but not proactively and immediately, at least not in a standard scenario.

Of course, if you hack an MCT host while on MCT's grid, you just fucked yourself real hard.

[Tanegar]

Given how grids and hosts work, it makes a lot of sense. Space in the Matrix outside the host is the domain of grid demiGODs, inside the host it's host demiGODs. It's a question of juristictions. A spider attacking devices on a grid actually is acting illegally. GOD might well come down on the spider, because he has no right to just brick icons on the grid any more than anyone else has ... of course, corps surely can arrange for temporary licenses and stuff, but not proactively and immediately, at least not in a standard scenario.

Of course, if you hack an MCT host while on MCT's grid, you just fucked yourself real hard.

That only raises more problems, particularly regarding the way Matrix space is mapped onto real space. If Sammy Samurai, Micky Mage, and Howie Hacker are on MCT property in the real world, but on Pacific Bell's grid, the MCT spider is basically crippled in his ability to do his job; and I can't think of a reason why any AAA megacorp would accept that state of affairs. IMO, this is just one more example of the writing process commonly known as "pulling it out of your ass:" the writers tried to create a fictitious legal system without knowing anything about the law or how laws work, and they broke the setting as a result.

[RHat]

Of course, GOD might actually have a licencing scheme based on things like physical jurisdiction and thus the physical location of the device...

[Smash]

Honestly, this was one of the first things that was brought up when these rules were first read out.

'What's stopping me from carrying 250 identical RFID chips/2 (IMG:style_emoticons/default/nuyen.gif) electronic toys that all think they're a Predator?'

To date, we really don't have an answer beyond 'Don't do that.'

It was never hard to to break a system by thinking outside the box. I'm amazed that people seem to derive some pleasure out of it like it proves that they're better than those who choose not to.

It was so easy to make hackers redundant in 4th ed by nesting nodes within nodes within nodes that people just didn't play them. This was on top of the fact that trying to decipher the 4th Ed rules was about as easy of deciphering Welsh when you've never even heard of the language..... or the country.

While we all might have been comfortable just handwaving hacking in 4th Ed, I welcome at least a system them is fairly easy to implement and if you are capable of suspending some disbelief, stands up to scrutiny.

Blackjaw is to be commended for at least giving it a go and not inventing scenarios to break it just to have fodder to use in hating the system.

[Smash]

Of course, GOD might actually have a licencing scheme based on things like physical jurisdiction and thus the physical location of the device...

I've never once envisaged that corporate hackers were not already sanctioned by GOD.

At the very most they might have to explain their actions after the fact, which I'd say regulates their day-to-day activities.

[BlackJaw]

While it may be RAW, I think it is setting-breakingly stupid to assume that a spider sitting in his host cannot see what's going on in the physical building. He's not just sitting in VR twiddling his thumbs, he should be actively monitoring sensor feeds, radio communications, Matrix diagnostics, and any number of other indicators. His job is to help secure the building against intruders, so he should be actively looking for intruders.

A few things:
1) The Decker-Spider's job is primarily to protect the Host he's in, which generally contains all the systems of the building, along with all the files. Having him leave the host without good reason would be like having the guards station at the front door wander around the parking lot. They'll do it if they think something is going on out there, but they won't do it without reason.
2) The Host system is a virtual environment that only contains the icons of files in the Host system, devices slaved to it, or personas that have entered it. It's not a model of the building and does not include devices that are not slaved to it, nor users that have not entered the host... like the Choco-tart packages, or personal devices of employees, etc. Remember: each device slaved to the host is a potential vulnerability, so generally only devices of importance and that can be controlled in physical space (like how sensors are attached to a wall) end up in the host WAN. The Local grid contains all those details not in host, arranged loosely to their physical world location when in VR, or more directly attached when viewed in AR overlay. The inside of the host, on the other hand, is where the corporate employees and customers do their business. While it does help provide security, it's also a tool for getting things done and therefore may make concessions between useability and security.
3) The spider absolutely can view the details coming out of a security system as long as those security sensors are slaved to the host and therefore part of the WAN and thus in the Host. Rigger-Spiders are all about this (and less on matrix defense.) Doing this, however, limits the Spider to the capabilities of the Sensors in the building. If the players are being sneaky and concealing their actions as they go, a GM could reasonably call for a Profession: Security roll by the Spider to see if he gets suspicious about the way Chocotarts keep showing up in the signal scanner logs. My point was that the spider is likely to remain in the host where all the important devices and files are "secured" rather than wandering around the grid-space for his building. In particular, if you imagine the hundreds or thousands of icons that are probably on the grid for that section of building, spotting the ones that don't belong when (IE: that aren't appearing as Running gear like maglock sequencers, Ingram Smart SMGs, or Chameleon Armor)

That only raises more problems, particularly regarding the way Matrix space is mapped onto real space. If Sammy Samurai, Micky Mage, and Howie Hacker are on MCT property in the real world, but on Pacific Bell's grid, the MCT spider is basically crippled in his ability to do his job; and I can't think of a reason why any AAA megacorp would accept that state of affairs.

Each of the AAA Big Ten have their own Global Grid, so it's less of an issue for them... unless the facility in question is a secrete facility, in which case they may be intentionally using a local grid instead of their own corp grid in order to disguise their connection. For everyone smaller than a AAA it could be an issue, and I agree it gets a little odd into borderline absurd. I hope it gets some clarifications in a Matrix book.

[Jaid]

I disagree. The page 382 "Corporate Security Guard" Professional rating 2 NPC, is untrained in computers, has logic 2, and a device 3 Commlink... which means he's actually going to have a hard time looking to see if there are any hidden icons in the building as he defaults (-1?) with 2 Logic. While he may only need 1 hit to detect any hidden icons in the area, he won't succeed most of the time, and is likely to critically glitch a lot of the time. If he has an 8 hour shift, and runs the check once and hour, he's going to succeed maybe 2-3 times, and call in an unneeded High Threat Response team about once.

Add to that that most hidden icons turn out to be something like a diet-breaking Choco-Tart someone is hiding from their spouse in their desk drawer, and the security guard may have a hard time spotting it once he knows something is present meaning he has to call the spider out of his host to come check things out. I doubt that Spiders want to be bothered with security guards attempting such sweeps and distracting them from their "real" work. Network security is their bag, and I doubt they want security guards bumbling about in it.

the choco-tarts are not going to be in hidden mode. at least, not unless they are for some reason illegal and the security guards are smuggling them in for lunch and risking their job to satisfy their sweet tooth.

so no, the odds of detecting a choco-tart when you scan for hidden icons is relatively slim...

also, detecting a hidden icon doesn't mean you call an HTRT in. it means the information gets forwarded to someone who's in charge, most likely, and can do a better job of looking into it. in other words, this is the thing that might get that spider to take a look outside of the host.

plus, you can also have one or more drones roaming the region making periodic matrix perception tests as well. they're considerably more likely to make their check, and also considerably less likely to be too lazy to push it off. of course, they are also far more easily subverted as well, so, you gotta pick your poison (IMG:style_emoticons/default/nyahnyah.gif)

[binarywraith]

It was never hard to to break a system by thinking outside the box. I'm amazed that people seem to derive some pleasure out of it like it proves that they're better than those who choose not to.

It was so easy to make hackers redundant in 4th ed by nesting nodes within nodes within nodes that people just didn't play them. This was on top of the fact that trying to decipher the 4th Ed rules was about as easy of deciphering Welsh when you've never even heard of the language..... or the country.

While we all might have been comfortable just handwaving hacking in 4th Ed, I welcome at least a system them is fairly easy to implement and if you are capable of suspending some disbelief, stands up to scrutiny.

Blackjaw is to be commended for at least giving it a go and not inventing scenarios to break it just to have fodder to use in hating the system.

That's not even thinking outside the box, it's the most utterly basic spoofing tool that some skript-kiddie hacker in middle school would think of. If the system as written can have game-breaking examples of common activity generated in five minutes offhand thought, then it's something that was waaaaay underthought at the design and writing stages.

I think we're agreeing on that, though. (IMG:style_emoticons/default/smile.gif)

[psychophipps]

While it may be RAW, I think it is setting-breakingly stupid to assume that a spider sitting in his host cannot see what's going on in the physical building. He's not just sitting in VR twiddling his thumbs, he should be actively monitoring sensor feeds, radio communications, Matrix diagnostics, and any number of other indicators. His job is to help secure the building against intruders, so he should be actively looking for intruders.

Preaching to the choir, my friend. Screw looking for icons, just look for the signal that isn't pinging todays encryption code, localize, call the big bad men with the big black shotguns to go there, and go back to your latte'.

[BlackJaw]

the choco-tarts are not going to be in hidden mode. at least, not unless they are for some reason illegal and the security guards are smuggling them in for lunch and risking their job to satisfy their sweet tooth.

so no, the odds of detecting a choco-tart when you scan for hidden icons is relatively slim...

Anyone can put any device they own into hidden mode. It's not just for runners with illegal gear, so it's likely that most hidden icons found in a building are false positives, assuming you even look for hidden icons instead of just letting Signal Scanners spot the icon (at which point it's no longer hidden.) I suspect your average wage slave might put all sorts of devices into hidden mode that are ridiculously odd to a runner. The RFID Tag in a Chocotart package being put into hidden mode after the wageslave buys it to keep anyone from knowing they're breaking their diet was just an example, albeit maybe not the best one. You do have a good point that it's considered illegal in many places to be running icons in hidden mode, but I still suspect false positives aren't that uncommon.

also, detecting a hidden icon doesn't mean you call an HTRT in. it means the information gets forwarded to someone who's in charge, most likely, and can do a better job of looking into it. in other words, this is the thing that might get that spider to take a look outside of the host.

I didn't say they'd call HTRT for detecting there are Hidden Icons. I said he'd do that when he critically glitches. If your security guard is rolling a dice pool 1 (defaulting on Logic 2), then he has a very real chance of Critically glitching an hourly Matrix Perception test nightly. I agree that should that guard succeeds on a matrix perception check and detects hidden icons, he'll kick the can up the chain of command. I'm arguing the standard security guards aren't really trained to handle even looking for the existence of hidden icons.

plus, you can also have one or more drones roaming the region making periodic matrix perception tests as well. they're considerably more likely to make their check, and also considerably less likely to be too lazy to push it off. of course, they are also far more easily subverted as well, so, you gotta pick your poison :P

Can an autonomous Drone make a Computer check for Matrix Perception? They are fairly limited "dog brain" devices and they lack a Persona.
Clearly a Rigger jumped into a drone could use it to look for hidden icons, which makes Rigger-Spiders even more useful.
Also, a Drone with the Electronic Warfare Autosoft and a Signal Scanner in it's Sensor Array can attempt to detect icons, but again you're limited to the capabilities of the signal scanner sensor: spotting icons within 20m.

[Tanegar]

A few things:
1) The Decker-Spider's job is primarily to protect the Host he's in, which generally contains all the systems of the building, along with all the files. Having him leave the host without good reason would be like having the guards station at the front door wander around the parking lot. They'll do it if they think something is going on out there, but they won't do it without reason.

The guards in the security station don't need to patrol the parking lot. There are other guards that do that. To assume that the spider inside the host is alone and doesn't have assets (other spiders if possible, agents otherwise) patrolling the local grid is incredibly ill-thought-out. The corp is not going to hire fifty guards to protect the physical building, and just one guy to handle Matrix defense.

2) The Host system is a virtual environment that only contains the icons of files in the Host system, devices slaved to it, or personas that have entered it. It's not a model of the building and does not include devices that are not slaved to it, nor users that have not entered the host... like the Choco-tart packages, or personal devices of employees, etc. Remember: each device slaved to the host is a potential vulnerability, so generally only devices of importance and that can be controlled in physical space (like how sensors are attached to a wall) end up in the host WAN. The Local grid contains all those details not in host, arranged loosely to their physical world location when in VR, or more directly attached when viewed in AR overlay. The inside of the host, on the other hand, is where the corporate employees and customers do their business. While it does help provide security, it's also a tool for getting things done and therefore may make concessions between useability and security.

I think the assumption that there is only one host in a building, while possibly RAW, is also breathtakingly dumb. If the facility is of any size, there will be a dedicated security host, separate from the regular host where business is conducted. The security host will be as camouflaged as possible and as hardened as possible, and will form the C3 hub of the security team(s). All sensor feeds will be routed there, regardless of whether the sensors themselves are slaved to it, for the benefit of the spider whose job it is to monitor those very feeds.

3) The spider absolutely can view the details coming out of a security system as long as those security sensors are slaved to the host and therefore part of the WAN and thus in the Host. Rigger-Spiders are all about this (and less on matrix defense.) Doing this, however, limits the Spider to the capabilities of the Sensors in the building. If the players are being sneaky and concealing their actions as they go, a GM could reasonably call for a Profession: Security roll by the Spider to see if he gets suspicious about the way Chocotarts keep showing up in the signal scanner logs. My point was that the spider is likely to remain in the host where all the important devices and files are "secured" rather than wandering around the grid-space for his building. In particular, if you imagine the hundreds or thousands of icons that are probably on the grid for that section of building, spotting the ones that don't belong when (IE: that aren't appearing as Running gear like maglock sequencers, Ingram Smart SMGs, or Chameleon Armor)

This is another area where the "EVREYTIHNG SI ONLIEN!!!!!!11ONE" conceit falls down: icon overload. If there are thousands of icons floating around in local AR, Matrix useability goes in the toilet. If a customer has to spend five minutes sifting through an avalanche of icons to find the one he wants... he won't. Most people will not put up with that level of inconvenience, and will simply go do something else. When icon spam both compromises security and costs the corp business, you can bet your bottom dollar the corps will find a way to do away with icon spam.