SINs, Renamed to: Let's argue about SINs Options

[ProfGast]

So Bogert managed to touch on a lot of the stuff I was going to comment on but here's my continuation on your second point:

The second thing to consider is that, even if we only say that information roughly equal to what you can Google today is public, that's still a heck of a lot. I keep a very low profile, but if I Google myself and spend a bit poking around, I can find my past addresses, going all the way back to 2000. If someone were able to cross reference my Facebook or other social media, they could find out a lot more about me-- they might extrapolate that I'm a Brony, for example, or that I like RPG's, or so on. Heck, just looking at my Facebook likes can give up a lot of that information! To to that off, not only are my relatives on Facebook, but they're actually tagged as family members, so someone could put together a decent picture of my family dynamics, all from a contemporary Google search. A SIN would make collecting all that information easier.

All of the information you listed is public, put up by choice by you. You chose to place your information, your preferences and your social networking. SIN doesn't automatically put that information up for grabs, though it might document some of it in the Global SIN registry. Now if you have a P2.0 account and list your SIN publicly on it, a lot more of that information is available. Granted I think P2.0 and the LA shadows in general are a horrible, horrible self parody of a situation, but it is what it is. I kinda get the same reaction whenever I see shadowslang use omae as 'friend.'

Where our approaches disagree is that you feel you can simply search the SIN number and get all sorts of information pop up, while I feel that you have to search specifically for that information and then cross reference to the SIN. The SIN would add an additional way to search for the information, but it's just a starting point, not an instant-lookup. If anything it'd be like looking up a research paper in academic circles: Yes I can search, find a title and an abstract of the document. I can confirm that the document exists, but to actually view it I need access legitimate or otherwise. So to take that example further, with a SIN I might be able to confirm that the person has a MagicFridge™ account (but really, doesn't everyone?), but I'd need to get into the MagicFridge™ databases in order to get any further information on that subject.

[Smash]

Dude, I hope you're sitting down because I have some really big news for you:

Facial and gait recognition are real. Like now. Today. Perfect? No, but rapidly improving and they are actually used on a daily basis in the real world. I know this because I have dealt with installations (and I keep up with the tech press because hey, why not - I play Shadowrun). And given the corporate nature of the cops, they absolutely will go for jaywalkers - fines help justify their existence to the taxpaying overlords. Just like automated tollbooths and red light cameras today. And because Big Data is also a real thing, today, you bet your boots they will mine the ever-loving crap out of that data to improve their hit rate when it's prosecution time.

So yes, they know that John the John and Hettie the Hooker went around the corner, and came out five minutes later, smoking, and that financial records indicated that NY300 passed between them, and that this means that John can't have been the bank robber who kindasorta walks like him, who hit Horizon Employees Credit Union around the same time. Lucky John!

I think you've missed quite a few points I've made previously. Shadowrun is a game. It doesn't have to mirror reality in any way. It does, but it doesn't have to. You might have also seen where I stated 'Dreamed up for Shadowrun'. This constant need people have to make every new Shadowrun edition the future from our here and now rather than the previous editions of Shadowrun are quite frankly killing this game.

And regardless of that, Let's say my toon walks into a building with a camera and facial recognition software (/sigh). Explain to me how that doesn't immediately burn all my fake SINs? Even if they pass all the checks......... Of course I'm working on the assumption here that the fake SINS are part of a very real database so that they pass scrutiny. Maybe the rating 1 ones survive because they have the wrong picture?

[Cain]

You did, right in the section I quoted. From "Every datum associated with you (i.e., already non-anonymous) is underwritten with the SIN" to "the SIN does index and link every legal piece of information about you"

I don't recall saying "everything in underwritten". I did say that the SIN indexes and links every piece of data about you on the Matrix, but that isn't an assumption, that's basically a direct quote from p263 of SR5. How that plays out does involve assumptions, but that is how it's supposed to work.

More like back to page 2, where you already were told what different levels of SIN checks entail. Running a credit report would be an R4 check (though you were right in one regard, I was using the outdated PDF. Not that it changes any of those rules, just the location of the tables)

T tried to find the supporting rules for that table in the text, but they don't seem to ever reference that table-- it's there, but they don't actually make use of it. That's probably just poor editing and design, though. However, I can also see that the chart you're looking at might not be a listing on what various levels of SIN scans check. It could be that it's the level of information that a given rating of fake SIN can provide. That's consistent with what's listed above: a rating 1 fake SIN is, in the text, might give a ten foot troll the identity of a ten year old Nigerian girl, which means that SIN is only good for covering if you need an identity to walk across the street and buy a burrito.

I see where you get your point, but I also think it's possible that we're facing the poor editing issue again, with information that's confusingly labeled.

A SIN is broadcast at all times when in public spaces. That logically means that it can't be used to access anything meant to be secure.

That's not quite true.

Right now, your most commonly used piece of ID is your driver's license. In the last week, I had to use it at my bank, at my college to verify enrollment, at 7-11 to buy beer, at a store for a major purchase-- heck, I even needed it to be allowed to walk into a bar. There's lots of people who can demand to see my ID on a regular basis. By your assumption, that means that since so many people have access to my driver's license, it can't be used to access anything more secure. Unfortunately, that's not true-- with my driver's license, there;s a lot of my stuff they can get a hold of.

Let's say that the last time I went into Foot Locker, I bought Adidas sneakers. Foot Locker knows that. Now, every time I walk past a Foot Locker, I get ads for Adidas sneakers.

So, Foot Locker keeps an internal record of people's purchase history, indexed by SIN, and uses that to tailor ads. The SIN itself is all that's needed for tailored ads.

But if you gave John Q. Hacker my SIN, he can't tell what kind of shoes I've bought recently. If he thinks to hack the Foot Locker purchase history database, he'll be able to find it out, but without first getting illicit access to Foot Locker's servers, he has no idea.

According to the fluff, Foot Locker doesn't just get your purchases there. In 2070, they can access your entire purchase history, and target an ad based on your history of buying athletic shoes. And even if John Q Hacker can't access the Foot Locker database, there's other ways of getting that information. They might not be able to tell exactly how much I spent at Toys R Us, but they can tell I have a customer account there and Build a Bear, so it's not a huge leap to assume I have a young daughter.

You need more than a SSN to get a credit report, at least in the US. You need a lot of info. And credit reports don't include bank balances, and I don't think they include major purchases either.

I decided to check this. There's a site approved by the US government that you can use to access your credit reports online, so I decided to see what information they required, and what they had on me.

To get to my information, you really only needed my full name, address, SSN, and birthdate. Honestly, the captcha was harder than that.

As for the information itself? It listed all my student loans, the date they were issued, and what cities they were from. So, it wouldn't be hard to track down my educational history based on that. It didn't list bank account numbers, but it did list open and closed bank accounts. Also, it listed every credit check for the last two years. That doesn't "prove" I made a major purchase, but it does give a strong inference at to what I bought or did. For example, one of the entries says "tenant screening", so even though it's not directly linked to the date I moved, it's not a big assumption to conclude that it was connected to a move.

I don't remember this example specifically, do you have a page number? But presumably, she chose to participate in this scheme. She set up the OkCupid account, linked it to her SIN, and now anyone with the same dating app on their commlink gets a little heart ARO over her head when they see her, if they click it they can access her profile.

It's in SR4, let me dig it up....

Example #1
Sketchy Alex heads to the mall with her
TekSense SP9 music player tucked behind her
ear and her Fabrique ALLIN1 commlink in her
jacket pocket. The two devices share a pair of
headphones and are aware of one another;
if the ALLIN1 needs attention, the TekSense
SP9 will temporarily mute itself. Her commlink
is her PAN’s core component and gives
her access to basic wireless services. Alex also
has a cheap pair of Tandy smartglasses, but
no datajack, so she controls the interface with
the scroll wheel on her commlink.
As she enters the mall, Alex accesses its
LAN, superimposing a map of the mall in
her vision. She quickly browses the directory
and adds the stores she wants to visit to her
hotlist, auto-highlighting them in blue on the
map. As she enters each store, her commlink
displays a list of today’s specials (tailored to
her personal purchasing profile) and a detailed
map. In Trendz Music, she instantly connects
to the store’s music library, sampling several
songs before buying them and downloading
them directly to her SP9. As she’s purchasing
the music, the system lets her know that
Ingrid Needstrom—one of the musicians she
bought songs from—is playing a gig downtown
next week. She calls her friend Rachel
via her commlink to let her know about the
concert. Rachel is interested in going, so Alex
buys two tickets online (still inside the store)
and zaps one of them over to Rachel.
As she’s leaving the mall, Alex receives
several anonymous text messages from some
sleazy guy who read her commlink’s social
profile and is trying to hit on her. She sets her
commlink to block all future messages from
that user.

So, every store she walks into had access to her personal shopping profile. On top of that, her commlink is only broadcasting her SIN, but it was enough for sleazy guy to read her social profile, and by default she was opt-in to random messaging. She can block individuals, but apparently the basic setting allows anyone to see her stuff, it wasn't just something she deliberately set up,.

Why do you think this is the case?

Because that's exactly what the text says:

A SIN identifies a
person in the global information system and is attached
to every piece of information associated with them in
the Matrix. No aspect of modern or legal life can function
without a SIN.

[Shev]

I'm siding with Redjack here. Your SIN "is attached to every piece of information associated..." doesn't mean necessarily that "every piece of information is attached to your SIN." That's almost like saying "all squares are rhombuses therefore it must follow that all rhombuses are squares."

"My SIN is attached to every piece of information about me, but not every piece of information about me is attached to my SIN" ?

I fell like there can be two interpretations:

1. If I have your bank account, I don't necessarily have your SIN. We assume that with some decking you could pull it easily (or not-so-easily) enough, but it's not something that's accessible by default. However, on the flip side, if I have your SIN, I do have your banking information.
2. If I have your bank account, your SIN is associated with it and I can find your SIN. If I have your SIN, I can get your bank account.

In both cases, I don't see a case against Cain's argument: that if I have your SIN, I have you.

[ProfGast]

"My SIN is attached to every piece of information about me, but not every piece of information about me is attached to my SIN" ?

I fell like there can be two interpretations:

1. If I have your bank account, I don't necessarily have your SIN. We assume that with some decking you could pull it easily (or not-so-easily) enough, but it's not something that's accessible by default. However, on the flip side, if I have your SIN, I do have your banking information.
2. If I have your bank account, your SIN is associated with it and I can find your SIN. If I have your SIN, I can get your bank account.

In both cases, I don't see a case against Cain's argument: that if I have your SIN, I have you.

Er... neither of your interpretations is what I was writing out at all. System Identification numbers are tracked with associated data in a Global SIN Registry. Your Bank Account, a piece of Matrix Data Associated with you, is tied to your SIN. It says <insert SIN here> owns this bank account. The only people with direct access to that bank account should be You, People You've put on the "Okay to access this account" list, and the Bank. If a hacker gets access to said account, then yes, they now have your SIN and can find who owns the account. The SIN is attached to the information.

Now what if someone picks up my SIN broadcasted from my commlink as I walk around the mall? They go "MUAHAHAHAHAHA, I HAVE YOUR SIN, NOW I SHALL FIND OUT WHAT YOUR BANK ACCOUNT NUMBER IS!" So they go look up my SIN on the GSR and.... find out that hey it's a valid SIN number. If he's got access to the information inside the registry, then he might know biometric data, registered residence or place of employment. If I'm a corp citizen well, he's SOL unless he can snag that data from the corp in question. Further data searches may find public domain stuff where I've tied my SIN to like a couple of social networks, or personal ads, but none of my actual transaction histories are gonna be featured just because you know my SIN. My information is not attached to my SIN, my SIN is attached to it.

Could knowing my SIN be used to track down the information eventually? Almost certainly. But so could knowing my name. So sorta like 2, but not at all including the second half.

[Koekepan]

I think you've missed quite a few points I've made previously. Shadowrun is a game. It doesn't have to mirror reality in any way. It does, but it doesn't have to. You might have also seen where I stated 'Dreamed up for Shadowrun'. This constant need people have to make every new Shadowrun edition the future from our here and now rather than the previous editions of Shadowrun are quite frankly killing this game.

And here we come back to the central question of verisimilitude.

You don't have to run a game where verisimilitude matters. That's cool. You can have corps refusing to share any data because ... well, because you say so, and damn the reasons. Never mind that in the real world, they do, all the time, for excellent reasons. Sometimes even for money. You can have people refuse to employ verifiably, clearly valuable technical means to achieve clearly valuable goals ... because you say so.

It would be a hell of a lot easier for your view if you'd determined that you'd rather work out a milieu based on the Great Influenza Epidemic of 1918 was VITAS, and the Great Awakening happened at the opening of the Roaring Twenties. Now it's 1938, in the Shadows, there is no cyberware but these newfangled penicilliwhatsit thingies might just save you from the Troll Sickness. But of course, tonight you have to go into Chinatown, to broker a deal with the Tong leaders who, so rumour has it, have stashed a dragon away in a warehouse ... and what exactly is Comrade Stalin up to in central Asia?

Might even be an interesting game, but a lot of folks would miss their shiny chrome limbs.

And regardless of that, Let's say my toon walks into a building with a camera and facial recognition software (/sigh). Explain to me how that doesn't immediately burn all my fake SINs? Even if they pass all the checks......... Of course I'm working on the assumption here that the fake SINS are part of a very real database so that they pass scrutiny. Maybe the rating 1 ones survive because they have the wrong picture?

Depends how many of them are available for scrutiny at that time.

If the building finds a high confidence match between multiple SINs, it probably flags the event and results in greater scrutiny, possibly even an audit. If the immediate deeper checks reveal a high probability that Knight Errant wants a word or fifteen with you, you might find yourself staring down the barrel of a Roomsweeper. Good luck out there!

In practical terms, it's a safe assumption that each venue that gives a damn about tracking people doesn't have total insight into all recorded information concerning all SINs, but has a decent overview of primary data sources. If it's the City of Seattle, they're a government agency, so they probably have first-line access to a lot of official sources, including truncated data available from every megacorp (to foster interoperability, of course). And if the City ever got a peek at, say, Mitsuhama's data, the City took a copy of that data. Because they aren't idiots and it all goes into their data warehouse/data lake/whatever the cool kids are calling it now.

So every setup, down to retailers who share customer data (or a subset thereof), has the capability and the motivation to perform at least first-line data mining on everyone who shows up as well as to pass on a subset of their information. To assume that they wouldn't is insane, and means that you're not playing in the Shadowrun environment of people, but .... retarded lizard-things which vaguely look like people but in no meaningful way act like them.

Furthermore, you may find it terribly sad that this capability was extrapolated into something possible in the 2070s, but early forms of biometrics were being studied even in the 1980s, and so were things like monitoring of personnel movements (usually in secure military environments). It's actually hard to posit any advance in computing power, let alone the magnificent, glorious, epoch-shifting ones depicted in the rulebooks, where full advantage for people-tracking wouldn't have been taken.

In fact, I'd go so far as to say that if you want them not to do it, I'd want a stellar, detailed, specific, carefully cross-referenced explanation of precisely why all these companies, big and small, and governments, big and small, decide miraculously not to exploit computers the better to exploit people.

Because they do. And they are. Now. Today. Around you.

[Shev]

But so could knowing my name. So sorta like 2, but not at all including the second half.

Knowing your name would not lead me to your SIN, unless you had a name so unique that literally no one else with a SIN anywhere else in the world had the same one.

Now what if someone picks up my SIN broadcasted from my commlink as I walk around the mall?

Depends on who they are, but even low level Stuffer Shacks get your basic purchasing info. It's not exactly under lock and key.

Could knowing my SIN be used to track down the information eventually? Almost certainly.

Eventually? Knowing your SIN makes tracking down your information almost trivial. When you're looking for information, one of the critical difficulties isn't just getting past whatever firewalls it's stashed behind, but knowing where to find it in the first place. If you know someone's SIN, you have the unique number that all of their personal information is tied to. Even if you need to access different databases (one for the UCAS, one for Renrakau, etc.) to get at all the information, it's essentially "tagged" (to use Cain's terminology) with your SIN, making it easy to find assuming you can get access to the system it's stored in. And the amount of cyber security in place to protect John Q. Public is...well, about as impressive as the physical security.

[ProfGast]

Depends on who they are, but even low level Stuffer Shacks get your basic purchasing info. It's not exactly under lock and key.

Source?

Eventually? Knowing your SIN makes tracking down your information almost trivial.

And this is the point where I disagree on a fundamental level.

When you're looking for information, one of the critical difficulties isn't just getting past whatever firewalls it's stashed behind, but knowing where to find it in the first place. If you know someone's SIN, you have the unique number that all of their personal information is tied to. Even if you need to access different databases (one for the UCAS, one for Renrakau, etc.) to get at all the information, it's essentially "tagged" (to use Cain's terminology) with your SIN, making it easy to find assuming you can get access to the system it's stored in. And the amount of cyber security in place to protect John Q. Public is...well, about as impressive as the physical security.

Because the bolded sections are my point exactly. You know what you're looking for (data tagged with a specific SIN), but how exactly is that supposed to help you locate their bank account number? Are you gonna start at the top and hit the Zurich-Orbital host? Hack into the Pacific Prosperity Group's records? Sure you can hit the Stuffer Shack's transaction history but all that might give you is where to look next. When searching for information, simply knowing a SIN does not at all tell you "where to find it in the first place." It gives you a point to start your search but little else. All the other information has to be acquired through the appropriate legitimate or illegal channels. From systems you likely don't have immediate access to. Because while John Q Public's cybersecurity may be poor, but Megas care about the bottom line. And Financial information by definition impacts that bottom line.

[Bogert]

And regardless of that, Let's say my toon walks into a building with a camera and facial recognition software (/sigh). Explain to me how that doesn't immediately burn all my fake SINs? Even if they pass all the checks......... Of course I'm working on the assumption here that the fake SINS are part of a very real database so that they pass scrutiny. Maybe the rating 1 ones survive because they have the wrong picture?

You seem to be positing that the entity that owns the building/cameras in question has the ability to look up SINs quickly and easily, for all people that appear on camera, all day long, using nothing but the images from the cameras and some kind of automated facial recognition software. I don't think people in the Shadowrun universe have that capability.

(If they did, the requirement to broadcast your SIN would be a bit silly, wouldn't it? "Yes yes, we all already know who you are, we can see your face, can't we?")

Right now, your most commonly used piece of ID is your driver's license. In the last week, I had to use it at my bank, at my college to verify enrollment, at 7-11 to buy beer, at a store for a major purchase-- heck, I even needed it to be allowed to walk into a bar. There's lots of people who can demand to see my ID on a regular basis. By your assumption, that means that since so many people have access to my driver's license, it can't be used to access anything more secure. Unfortunately, that's not true-- with my driver's license, there;s a lot of my stuff they can get a hold of.

A driver's license is a physical object. A SIN is a number. I don't think this analogy is apt.

According to the fluff, Foot Locker doesn't just get your purchases there. In 2070, they can access your entire purchase history, and target an ad based on your history of buying athletic shoes.

Cite?

And even if John Q Hacker can't access the Foot Locker database, there's other ways of getting that information. They might not be able to tell exactly how much I spent at Toys R Us, but they can tell I have a customer account there and Build a Bear, so it's not a huge leap to assume I have a young daughter.

Why do they know you have a customer account at Toys R Us, just by looking at your SIN?

I decided to check this. There's a site approved by the US government that you can use to access your credit reports online, so I decided to see what information they required, and what they had on me.

To get to my information, you really only needed my full name, address, SSN, and birthdate. Honestly, the captcha was harder than that.

When I've done it they've asked me a bunch of additional questions. Which of the following was your address 3 years ago? Which of these is a make/model of car you owned 5 years ago? etc.

As for the information itself? It listed all my student loans, the date they were issued, and what cities they were from. So, it wouldn't be hard to track down my educational history based on that.

He's got student loans issued in New York City. So, let's hack into the servers of every college and university in New York, so we'll know where he went to school? Seems a bit baroque.

It's in SR4, let me dig it up....

So, every store she walks into had access to her personal shopping profile. On top of that, her commlink is only broadcasting her SIN, but it was enough for sleazy guy to read her social profile, and by default she was opt-in to random messaging.

Her shopping profile with that store, or with every store she's ever been in? There's no evidence (in that quote anyway) that Payless would have any idea what she's bought at Foot Locker. Also, the guy read the info on her "commlink's social profile". That sounds like something the commlink is set to broadcast, or at least give out in response to a query. She chose to configure her commlink like that, that's on her. Nothing about SINs mentioned there that I saw.

Because that's exactly what the text says:
"A SIN identifies a person in the global information system and is attached to every piece of information associated with them in the Matrix. No aspect of modern or legal life can function without a SIN.

So, my full name and date of birth are attached to just about every piece of information about me. They're on my elementary school disciplinary records, my dental records, everything. At the same time, if I gave you my full name and my date of birth, you wouldn't know anything about the time I got in trouble in 3rd grade English class, and you wouldn't know anything about the state of my teeth. You wouldn't even have a good way of figuring that stuff out. I just haven't seen anything that suggests that a SIN is fundamentally different.

"My SIN is attached to every piece of information about me, but not every piece of information about me is attached to my SIN" ?
...
2. If I have your bank account, your SIN is associated with it and I can find your SIN. If I have your SIN, I can get your bank account.
...

Emphasis added. That's the problem part.

[Koekepan]

Because the bolded sections are my point exactly. You know what you're looking for (data tagged with a specific SIN), but how exactly is that supposed to help you locate their bank account number?

Johnny Catatonic slides into the Stuffer Shack facing on to Pioneer Square. Because he doesn't want a date with a Predator muzzle today he has his commlink broadcasting his real SIN, which is clean enough for soykaf.

Stuffer Shack's standard electronics package is on the job, mostly because it's a sealed unit so that the shaved monkeys who run the place don't screw with it. Within two seconds his macrobiometrics are oversampled, aggregated, measured and recorded along with his electronic footprint. This information is naturally shared as quickly as the Matrix will carry it with the corporate Stuffer Shack chain, running all the way up to the Great Pyramid. However, it also moves laterally. A Pioneer Square Marketing Coalition knows that Johnny is there, who he is (after all, SIN data is pretty public), what he looks like, what he's doing in Stuffer Shack, and they can all correlate that with their own records on him.

Three doors down the line, Pioneering Pants is a Renraku subsidiary. They shuffle this information dutifully upstairs, not in any way aware of the fact that Johnny's gait sends signals of substantial urgency through Renraku's electronic systems. Renraku's subsidiaries in the area go on high alert, looking for Johnny in the minutest detail. Sure enough, not a million years later he leaves the Stuffer Shack and enjoys a little of the thin Seattle sunshine with his soykaf in hand. A City of Seattle camera has plenty of time to observe him, so biometric details which are shared locally amp up the Renraku urgency. Renraku dispatches a subcontractor's street cleaning drone to amble along nearby and collect additional data - probably a biochemical personal signature - and confirm their match.

Johnny Catatonic strolls on down towards King Street, little knowing that his ill-considered tour through downtown Seattle has Red Samurai piling into a couple of vans less than ten miles away.

[Shev]

Source?

Personalized ads are based on your purchasing history. I can't give a page number off the top of my head but unless that bit of fluff got removed in a later printing, it's in there.

Because the bolded sections are my point exactly. You know what you're looking for (data tagged with a specific SIN), but how exactly is that supposed to help you locate their bank account number?

Run a credit report. This tells me who they bank with. That narrows my search to transactions from said bank. Now I look for transactions that are linked to that SIN. Again, some of this data isn't even private: it has to be made available to retailers so their displays can customize your personalized ads. How hard do you think it is to convince their automated process that you're actually a department store?

Because while John Q Public's cybersecurity may be poor, but Megas care about the bottom line. And Financial information by definition impacts that bottom line.

I'm really having trouble seeing why a megacorp would care if John Q. Public was the victim of identity theft or similar. What are they going to do, lodge a complaint with the Better Business Bureau?

[Bogert]

...Johnny Catatonic strolls on down towards King Street, little knowing that his ill-considered tour through downtown Seattle has Red Samurai piling into a couple of vans less than ten miles away.

Leaving aside the question of whether your example has more verisimilitude than normal Shadowrun fiction, nothing in it seems to hinge on SINs. The story would have worked out exactly the same in a world with just names, and no SINs, right? Not sure about how it's relevant to the thread topic.

[Koekepan]

Leaving aside the question of whether your example has more verisimilitude than normal Shadowrun fiction, nothing in it seems to hinge on SINs. The story would have worked out exactly the same in a world with just names, and no SINs, right? Not sure about how it's relevant to the thread topic.

OK, I admit I didn't spell it out quite as clearly as I might have, but the fact is that the analogy works just as well as if the only thing Renraku had on a suspected intruder was some element of an electronic signature, such as a broadcast SIN which went dark right outside a Renraku compound right before it was hit. Maybe the intruders were capable of evading or compromising or disabling the internal monitoring systems which may have picked out biometrics, but were sloppy when it came to management of electronics. Maybe they wanted to get through a high security area without being fingered for not having SINs being broadcast.

So when you break it all down, the SIN is one more metric which happens to have massive relevance for cross-referencing data. Renraku might use SIN activity to track movements without being in a position to necessarily fix on a given person's biology, or they might use it to determine that Johnny Catatonic recently changed his appearance (whether out of paranoia or cybernetic upgrades, perhaps) by a process of correlation of known habits, electronic presence, or what-have you. That was his new body with a new gait and new face becomes an effective AKA in their tracking database.

In the end, the SIN is just a detail. A useful, commonly available, generally understood detail. The databases don't all have to be shared - some sharing of ostensibly harmless information is enough.

[Bogert]

OK, I admit I didn't spell it out quite as clearly as I might have, but the fact is that the analogy works just as well as if the only thing Renraku had on a suspected intruder was some element of an electronic signature, such as a broadcast SIN which went dark right outside a Renraku compound right before it was hit...

Ok, so, if I understand you, now we're looking at a new hypothetical. Last night, Johnny got sloppy, and a fake SIN of his can be somehow linked to a run. Today, he's walking around downtown Seattle, using his real SIN, or a different fake, and somehow, Renraku uses the fake SIN to easily find real Johnny.

How do you picture that working exactly? What's the point of using fake SINs if they can easily be traced to real people?

[ProfGast]

Personalized ads are based on your purchasing history. I can't give a page number off the top of my head but unless that bit of fluff got removed in a later printing, it's in there.

Is this based your history on all purchases you've ever made ever? All purchases you've made on that SIN? or All purchases you've made on that SIN with that company? To me, the last is the most realistic, and since the company should keep their own records, the most feasible.

Run a credit report. This tells me who they bank with. That narrows my search to transactions from said bank. Now I look for transactions that are linked to that SIN. Again, some of this data isn't even private: it has to be made available to retailers so their displays can customize your personalized ads. How hard do you think it is to convince their automated process that you're actually a department store?

So again here is where I disagree fundamentally that "SIN-linked" data is by definition "easily obtainable."

I'm really having trouble seeing why a megacorp would care if John Q. Public was the victim of identity theft or similar. What are they going to do, lodge a complaint with the Better Business Bureau?

I can think of many reasons why a finance-based subsidiary of a Megacorporation would want to compete for clientele, and many reasons why they wouldn't want to have a financial system that could be viewed or spun as inherently worse, weaker or easier to perform identity theft on. After all if you have a flaw in your system that allows such easy identity theft, why would anyone take it over the better alternative owned by a competing mega? They'd keep their system tight if for no other reason than to keep other Megas from being able to exploit similar weaknesses.

@Koekepan:
Your example and interpretation are predicated on the fact that the Sixth World has an ubiquitous automated network of shared biometric information, complete with software flags discerning enough to collate and sort relevant data without metahuman input. I don't find that particularly realistic since such widespread sharing of information would mean that information would be relatively easily intercepted and obtained by all sources, not just the corporations. The Megacorporations stand for many things but "Free Information" is not one of them. That's more the Neo-Anarchists' schtick. If that's the way your Shadowrun works, and you can work with it, more power to you, but I don't see that sort of "we are always watching everything and anything" reflected in the Shadowrun works that I've read.

[Koekepan]

Ok, so, if I understand you, now we're looking at a new hypothetical. Last night, Johnny got sloppy, and a fake SIN of his can be somehow linked to a run. Today, he's walking around downtown Seattle, using his real SIN, or a different fake, and somehow, Renraku uses the fake SIN to find real Johnny.

How do you picture that working exactly? What's the point of using fake SINs if they can easily be traced to real people?

The goal at this stage is to stay one step ahead in a game of cat and mouse. I forget the military slang for it (I'm not a veteran) but it's something like persec - i.e. personal information security.

The fake SIN can be used, for example, for an alibi. Let's say he didn't want to be hassled on the way to a run. He loads up a fresh fake SIN, and stays as far out of sight as he can in a stolen burner vehicle. As far as Renraku is concerned on the night of the run, someone in an unknown (or apparently innocent) vehicle, of no particular interest to them, wandered up and then went out of Matrix sight. Nothing in particular to worry about - happens all the time.

Renraku gets hit, their monitoring is compromised around the same time, they don't have good fixes on the biometrics of the invaders, and the invaders observed good information secrecy (effective radio silence and voice distortion during their raid, since they know full well all electronics can be hacked and all codes cracked) throughout. That fake SIN and the burner vehicle and the commlinks worn during the raid all turn into so much scrap, while Johnny Catatonic's real SIN was being safely paraded inside a shagging wagon which rocked back and forth to the sound of muffled ecstatic moans (Johnny has an ego and a reputation to protect) fifteen miles away.

As far as Renraku is concerned, they're frantically hunting Rudeboy Wallis, a globetrotting mercenary from the Caribbean League.

[Cain]

Because the bolded sections are my point exactly. You know what you're looking for (data tagged with a specific SIN), but how exactly is that supposed to help you locate their bank account number?

It's not that hard today. Armed with your SSN, real name, and birthdate, I can find your credit report. Your credit report lists everyone you bank with. Now that I know your bank, tracking your number is just a matter of time.

Now the real question isn't tracking your bank account number, it's actually *doing* anything with it. Last job I had, they had my Direct Deposit application in a file cabinet somewhere. Anyone could flip through it and copy it down. But even so, my employers couldn't take my number and withdraw money, they could only add it.

A driver's license is a physical object. A SIN is a number.

The key information on a drivers license is the number. In theory, if they want to verify if the other information is correct, they can just call in the number.

Why do they know you have a customer account at Toys R Us, just by looking at your SIN?

It's in my credit report. My credit report lists all credit inquiries and why they were made, so applying for credit cards at either is tracked on my report.

When I've done it they've asked me a bunch of additional questions. Which of the following was your address 3 years ago? Which of these is a make/model of car you owned 5 years ago?

They didn't this time, the official site just asked me for my real name, DOB, SSN and address.

There are other sites out there, and some give a full credit score plus report, so that might explain the difference.

So, my full name and date of birth are attached to just about every piece of information about me. They're on my elementary school disciplinary records, my dental records, everything. At the same time, if I gave you my full name and my date of birth, you wouldn't know anything about the time I got in trouble in 3rd grade English class, and you wouldn't know anything about the state of my teeth. You wouldn't even have a good way of figuring that stuff out. I just haven't seen anything that suggests that a SIN is fundamentally different.

Today? Not immediately, no. It'd take a lot of time and effort to hunt down all your records, although it could be done if someone wanted to spend enough time doing it.

In 2070? A SIN indexes and links all that information, to make searching it easier. In fact, that's the whole stated purpose of a SIN. It's from a bit above that quote I keep using....

Modern society
in 2075 produces a staggering amount of information
every second of every day: where you are, what you
buy, and what you do. With the system producing all of
these pieces of information, there needs to be an easy
way to store, track, and correlate it. All of that information
needs to be associated with a person somehow.
That’s where the SIN comes in.

So, your SIN's entire purpose is to make correlating and tracking information on you easier. If you can track down my second grade report cards today, and correlate it with my dental records from last year (both of which are theoretically possible, although my second grade report cards are likely not on a computer, but rather inscribed on vellum (IMG:style_emoticons/default/nyahnyah.gif) ) , and do it all today... in Shadowrun, the SIN just makes it a whole lot easier.

Emphasis added. That's the problem part.

Okay, I see a possible disconnect.

Right now, finding the bank you use isn't hard. Even tracking down your account number isn't that difficult.

However, just having your bank account number does not mean I have your bank account.

I've had my account number stolen before. It was annoying, but it was caught quickly. They couldn't withdraw money from the ATM without my debit card and PIN, they couldn't send money online without my password, and they couldn't be money from a branch because I have a rider that won't allow it unless I show my license. So, just having your information doesn't mean they control everything.

That said, in Shadowrun, getting that information is easy. Using is is much harder, though. I've always played it that there are tiers of access. Small purchases can be handled aoutomatically, without any extra verification. Like how Mcdonalds doesn't require a PIN for small debit card purchases. Slightly bigger purchases require your PIN or signature, even bigger ones might add a retinal scan, and major purchases might even require a genetic test.

But in all those cases, before you can do any of that, the vendor has to be able to access your account number, and verify that you have the funds.

I can think of many reasons why a finance-based subsidiary of a Megacorporation would want to compete for clientele, and many reasons why they wouldn't want to have a financial system that could be viewed or spun as inherently worse, weaker or easier to perform identity theft on. After all if you have a flaw in your system that allows such easy identity theft, why would anyone take it over the better alternative owned by a competing mega? They'd keep their system tight if for no other reason than to keep other Megas from being able to exploit similar weaknesses.

In order for the Shadowrun economy to function, the megas have to have a minimum level of cooperation in many areas. They need to have a shared currency, a joint banking system, common data tracking standards, etc. It also has to be compatible with the remaining national government systems-- ideally, built by them, so the megas don't actually have to pay for the infrastructure.

So, if they have to accept a free system built by the lowest bidder, they will do so. Or if they have to share an easily exploitable system, then they can exploit the other megas just as easily, so a porous system would benefit them in the long run.

[ProfGast]

Cain, I'm finding your stance more reasonable now given some of the qualifiers you've listed but I still disagree that it is as simple in the Sixth world as an extrapolation of today's process is. Like I mentioned before, the entire megacorporate culture necessitates MORE borders than exist even today. Just look at North America, it's split between CalFree, Tir Tairngire, Salish-Sidhe, Tsimshian, UCAS, CAS, Aztlan, PCC, Sioux Nation, Athabascan Council… Not to mention that since present day there has been at least one instance of near complete mortality of internet databases. This doesn't even account for the different AA or AAA Megas that also have their own systems which means to me that information in the Sixth World is not necssarily as free as it is today, or would be if the current internets had unimpeded progress.

In order for the Shadowrun economy to function, the megas have to have a minimum level of cooperation in many areas. They need to have a shared currency, a joint banking system, common data tracking standards, etc. It also has to be compatible with the remaining national government systems-- ideally, built by them, so the megas don't actually have to pay for the infrastructure.

So, if they have to accept a free system built by the lowest bidder, they will do so. Or if they have to share an easily exploitable system, then they can exploit the other megas just as easily, so a porous system would benefit them in the long run.

And as I mentioned earlier, this already exists. The primary unit of international trade in Shadowrun is the ¥(Nuyen) which was adopted by Japan in 2012. Control over the Nuyen was transferred to the Zurich-Orbital Gemeinschaft Bank in 2036, which is equally owned by all 10 AAA Megacorporations and overseen by the Corporate Court. In addition to regulating the buying power of the Nuyen, the Z-O bank also owns most of the debts owed by the Megas. The entire Zurich-Orbital Habitat is the "neutral ground" of the Megas. Wilhelmina Graff-Beloit lived out the rest of her life there because it was the only safe place left to conduct her vendetta against Lofwyr.

[Koekepan]

Sorry, missed this comment last time around.

I think you misunderstood some things. Corrections inline.

@Koekepan:
Your example and interpretation are predicated on the fact that the Sixth World has an ubiquitous automated network of shared biometric information, complete with software flags discerning enough to collate and sort relevant data without metahuman input.

No. It doesn't have to be ubiquitous. In fact, I'm quite specific about it being very localised. It sure as hell isn't operational in Puyallup or Redmond, for example.

The software flags, in terms of biometric standards, already exist to some extent today - a useful extent, to be specific. Further addition of detail and standardisation of biometric characteristics is only reasonable to expect.

Collation and sorting is precisely what computers do very, very well. Given the jaw-droppingly, physics-violatingly generous assumptions around Matrix communications in 4th Ed (full sim over wireless? Pull the other one!) a few heads-ups between collaborating small businesses is completely on the cards. Hell, we have cooperative customer information sharing online and in physical locations today. This is nothing new, just improved automation and integration.

I don't find that particularly realistic since such widespread sharing of information would mean that information would be relatively easily intercepted and obtained by all sources, not just the corporations.

The government shares out a lot of that information today on a routine basis, for various purposes. Want to hire somebody? You can get right on a government website to determine their employment eligibility right now. That's just one example. Increasing integration with megacorps is only to be expected, because now they're governments too - just the way the US and Canada share all sorts of goodies.

Of course, it doesn't mean all records are always available everywhere, but in terms of simple loss prevention (theft) and loss prevention (arson) and loss prevention (vandalism) and loss prevention (people deciding their money is better in their account than the company's) there's every reason for enough information to be regularly available to make tracking people a snap, even if you don't know when their last colonoscopy was. Renraku doesn't care how Johnny Catatonic's polyps are doing. I know for a fact that we have substantial information sharing right now between two large corporations in my area - and that's just in terms of a comarketing strategy based on loyalty discount cards. Expecting this to happen less when the bar keeps lowering is ... well, how is the weather on your planet, spaceman?

The Megacorporations stand for many things but "Free Information" is not one of them. That's more the Neo-Anarchists' schtick. If that's the way your Shadowrun works, and you can work with it, more power to you, but I don't see that sort of "we are always watching everything and anything" reflected in the Shadowrun works that I've read.

Oh no. Not free information. No, sirree!

Highly remunerative information shared for mutual benefit in the interests of building a safe, harmonious, open and deeply profitable society. Probably open comarketing information will be held by a joint venture, which gives free access to some governments and some megas, and smaller corps pay exactly what the market will bear (in both money and data) for access to it.

You need to stop thinking of the megas as always hating each other everywhere at once. If they for one instant believe there's a profitable rationale for cooperation you couldn't stop them from doing it with all the anti-collusion laws at your disposal. And this makes commercial and social engineering sense.

[Bogert]

It's not that hard today. Armed with your SSN, real name, and birthdate, I can find your credit report. Your credit report lists everyone you bank with. Now that I know your bank, tracking your number is just a matter of time.

How easy is it to get a "credit report" in 2075? I still haven't seen any convincing evidence that a SIN, alone, is enough. What information is on this hypothetical future credit report? Will it have the name of the bank you use? Assume it does, how exactly do you go from a bank name and a SIN to an account number? Do you hack the bank's servers? How easy is that?

In 2070? A SIN indexes and links all that information, to make searching it easier. In fact, that's the whole stated purpose of a SIN. It's from a bit above that quote I keep using....

So, at my dentist, when they store and later look up my patient file, they just use my SIN. It's easy, it's a unique identifier, it never changes, I'm broadcasting it when I walk in the door. Same story at my elementary school. Definitely easier, from an administrator's point of view, from indexing based on names. Names aren't unique, they change, sometimes people write their middle name(s) sometimes they omit them, etc.

Sure, SINs are used as indexes everywhere. Sure, they make things easier. But, if you want to find my dental records in 2075, it's still a royal pain in the ass, as far as I can tell.

That said, in Shadowrun, getting that information is easy.

Cite?

Using is is much harder, though. I've always played it that there are tiers of access. Small purchases can be handled aoutomatically, without any extra verification. Like how Mcdonalds doesn't require a PIN for small debit card purchases. Slightly bigger purchases require your PIN or signature, even bigger ones might add a retinal scan, and major purchases might even require a genetic test.

This entire construct is only necessary if you start from the idea that a SIN is like a bank account number, or credit card number. That idea strains credulity, and isn't well supported by the text, at least, not by the examples you've posted in this thread.

[binarywraith]

How easy is it to get a "credit report" in 2075? I still haven't seen any convincing evidence that a SIN, alone, is enough. What information is on this hypothetical future credit report? Will it have the name of the bank you use? Assume it does, how exactly do you go from a bank name and a SIN to an account number? Do you hack the bank's servers? How easy is that?

You're being absurdly, and apparently intentionally, obtuse here. What part of 'Storing, tracking, and correlating' all publicly available personal and financial information are you disputing? All I'm seeing here is bitching about how they don't explicitly list every detail ad nauseum, and therefore the ones you don't want to be on the list must not be.

Purchasing information, by its nature, includes the financial institution and account that the transaction was funded by. Hacking the bank is going to be difficult, but not impossibly so as SR4+ has established that by the RAW absolutely nothing is secure.

[ProfGast]

Collation and sorting is precisely what computers do very, very well. Given the jaw-droppingly, physics-violatingly generous assumptions around Matrix communications in 4th Ed (full sim over wireless? Pull the other one!) a few heads-ups between collaborating small businesses is completely on the cards. Hell, we have cooperative customer information sharing online and in physical locations today. This is nothing new, just improved automation and integration.

Well if your'e going to argue the absurdity of SR4's Matrix you won't get that much argument from me. Was never a huge fan thereof, which is why despite it's somewhat contrived nature I much favor 5e's take on it. That said, given that as far as I know the only proper AIs that exist in the SR world are accidental or Emerged beings, and that currently one of the problems with AI recognition is graphics in CAPTCHAs, understand why I'm a little bit skeptical on how well an automated non-AI system will be at flagging and identifying something without an absurd amount of false positive alerts. Without metahuman input and analysis I feel the feedback from a system that flags alerts would be clunky at best.

The government shares out a lot of that information today on a routine basis, for various purposes. Want to hire somebody? You can get right on a government website to determine their employment eligibility right now. That's just one example. Increasing integration with megacorps is only to be expected, because now they're governments too - just the way the US and Canada share all sorts of goodies.

The two countries you cited are staunch allies and neighbors, who have over 100 years of cooperation, and over 2 decades of history being tied together economically through NAFTA. US-Russia relations might be a better example though relations have been somewhat better since the Cold War era. Or US-China relations, where China purposefully does not use a number of US companies in order to keep information sovereignty.

Oh no. Not free information. No, sirree!

Highly remunerative information shared for mutual benefit in the interests of building a safe, harmonious, open and deeply profitable society. Probably open comarketing information will be held by a joint venture, which gives free access to some governments and some megas, and smaller corps pay exactly what the market will bear (in both money and data) for access to it.

You need to stop thinking of the megas as always hating each other everywhere at once. If they for one instant believe there's a profitable rationale for cooperation you couldn't stop them from doing it with all the anti-collusion laws at your disposal. And this makes commercial and social engineering sense.

… I get where you're coming from, but I don't buy it in Shadowrun. Some other cyberpunk dystopian society, but not Shadowrun. I mean take the whole Credit Report example we've been throwing around: Immigrants to the US are required to re-establish their credit scores, regardless of what their employment was overseas. A major problem of many immigrants is the inability to apply for credit cards or mortgages because of a lack of credit history, due to that information not transferring across borders. How this translates in a world where corporations aren't dictated by a government, but are actually governments in and of themselves is anybody's guess.

[Cain]

How easy is it to get a "credit report" in 2075? I still haven't seen any convincing evidence that a SIN, alone, is enough. What information is on this hypothetical future credit report? Will it have the name of the bank you use? Assume it does, how exactly do you go from a bank name and a SIN to an account number?

Well, first of all, a SIN links together all the data on you. So instead of having to search a hundred different databases, all I need is your SIN. That's pretty much exactly what the SR5 book says it's used for, so at the very minimum, there's that.

If we extrapolate from today, anybody can run my credit report if they have my SSN, date of birth, and real name. In 2070, they wouldn't need all that, my SIN alone would work. And people run credit checks on you all the time, sometimes even without your knowledge. According to my current credit report, sleazy credit card companies have check my credit, presumably so they can send me scamlike credit card offers.

Anyway, though: today, if you read my credit report, it says what accounts I have open. So, if I were tracking down information on me, I could take the info I have and pose as either a bill collector or any employer conducting a background check. I run a check to "confirm the banking information", and in a second, I can confirm that my account is active, and possibly even get the account number.

In Shadowrun? It's even easier. People use their SIN to buy stuff all the time, which means it's closely linked to their banking info. Locating your accounts would be trivial. (To be fair: Like I said to ProfGast, actually doing anything useful with that info is trickier-- I probably couldn't spend your money at this level. But the information itself is easy to get.)

Sure, SINs are used as indexes everywhere. Sure, they make things easier. But, if you want to find my dental records in 2075, it's still a royal pain in the ass, as far as I can tell.

It's actually much easier.

Between megacorps and SIN's, a lot more information is accessible than before. Today, if I want to get your dental records, I can approach it in several ways. The easiest would be to track it through your insurance. So, first I need to find what insurance company you use. That's not hard, but it is time consuming, as I have to filter through their entire member list and figure out which is you. Then, I need to gain access-- difficult, but not impossible, especially if I'm only going to look at data. Being able to actually change things would require more access. Then, I just need to read the payment history, and that's that.

A SIN doesn't change it, but it does make it easier. Your SIN links to emergency medical information, so it'd include your insurance company-- if you're hurt and need medical help, they have to know who to bill. Once I know that, finding your records within the company is easy, since your SIN is a positive ID. Just run a patient record check using that, and your records pop right up.

See, here's the thing about medical and dental records. Current laws don't provide much privacy. Basically, anyone who provides you with medical care can request your records, so if you pose as another clinic, it's easy to get them. Also, your insurance company frequently gets copies of your medical records, so you can pose as them as well.

This entire construct is only necessary if you start from the idea that a SIN is like a bank account number, or credit card number. That idea strains credulity, and isn't well supported by the text, at least, not by the examples you've posted in this thread.

The SIN is the key to all that information. That *is* supported by the text-- the whole point of a SIN is to index and tag your information, to make info searching on you easier.

So, while the SIN itself might not be exactly the same as your bank account number, it does make getting to that number much easier. Remember, if you have my SSN, it's not too hard to find all that info on me, nowadays. Postulating SIN technology and a panopticon, it'd be even easier to locate all that.

[Cain]

… I get where you're coming from, but I don't buy it in Shadowrun. Some other cyberpunk dystopian society, but not Shadowrun. I mean take the whole Credit Report example we've been throwing around: Immigrants to the US are required to re-establish their credit scores, regardless of what their employment was overseas. A major problem of many immigrants is the inability to apply for credit cards or mortgages because of a lack of credit history, due to that information not transferring across borders. How this translates in a world where corporations aren't dictated by a government, but are actually governments in and of themselves is anybody's guess.

Oh, that'd be easy.

I believe you were the one who pointed out that Z-O would be enforcing a universal banking standards for everyone. In order for that to work, they'd need a universal identity system, to prevent ID theft and other tricks. They don't need a perfect one, especially if the cost of perfection is too much, in comparison with a functional system. If settling with a few disgruntled consumers is less than the cost of fixing or improving the entire system, then they won't fix the system.

[ProfGast]

Cain, i'm starting to think we're arguing the same thing but with different magnitudes of possibility. By tweaking an assumption here, or an inference there a situation jumps between possible, plausible, and probable. Where our approaches differ is that you are looking at the problem as "This is how they say a SIN Works, but it couldn't possibly work out in the setting based on what I know" whereas my approach is more "The setting has SINs, and thus would have to make these assumptions to work properly."

They're not really reconcilable approaches since our basic assumptions are different, and I really don't see a way we'll convince the other to accept the others' assumption.