Ok, so you hack Corporation X with Administrator access, and trip a system alert. How much control do you allow with your Admin access? Does your 'Legit' Admin/Security user have the adbility to cancel the alert? If not then who does? For that matter, who "controls" the IC's return/deployment into the system? User action or just programmed autonomy?

I know none of this is really explained in Core rules, but I am curious how much control you grant to your Admin/Security/Personal users in your various Matrix Systems. Obviously the more paranoid the system, the harder it tends to be for any one person to effect too much at once, but someone usually does weild that power.

Thanks for your opinions,

~GTT

The way I play it, any alerts would automatically send a message to the system administrator. The real one, directly to their commlink. Thus, while the intruder could cancel the alert and buy themselves a little time away from ice, they can no longer linger with immunity.

I agree with Geekkake on this one. I would even go so far as to having e-mails or whatnot sent to all admins, including the hacker that just gained that access. So, he could certainly be aware of what the alert really triggered, but he can't stop another admin from coming in and "dealing" with 'em.

Once an alert is triggered, the node is aware, IC may be called, but a ton of other notification is going to be sent out...so while the hacker may have admin access now, his time is certainly limited, so he better get out quick!

The way systems are designed are up to you.

If you've set things up so that if an Admin account is "hacked" or logged into during an Alert so that notifications are sent to other commlinks, then the difference between the "Real" admin and the "Hacked" is that the "Real" admin also has access to the other accounts and can react accordingly. The Hacker will have to go "Hack" the other account... after they find it, if they know to look for it. e.g. I'd have have to check security logs etc which all takes time.

Consider it from the point of view ofthe "REal" admin, if they are the ones who logged in during an alert, they will know full well when they receive the notification on their other system that it's no big deal. Whereas if they haven't logged in during the alert, when they get that notification, they most certanly might come looking.

I don't think there is a difference between hacked admin or "real". But really, if an alert is sent, that doesn't matter. If the hacker wanted to remove that notification they would have to a) find the script that sent the notification as well as the destination and b) hack into the destination node (likely a commlink) and remove the alert email. To have it completely removed, the hacker would have to hope that the other admins hadn't yet a chance to read the notification...

So, yeah, the hacker, now as an admin, can cancel the alert and edit the script, but the alert has already notified other admins...so, the hacker has the choice of hurrying up and finishing whatever he was doing, or start hacking more nodes to remove the notification, as well as any security logs...which most of the time, a hacker is not going to have the time to do...

Now, if we assume the hacking exploit gave the hacker access to a single existing admin account, then he really wouldn't get a notification, the account's owner would have...

I think the key to all of this is that the hacker would need to do some editing and research before an alert was raised, otherwise, while the hacker now has admin access, the other admins would have been made aware of the breach...as rarely is there only one admin account per host!

It still comes down to how the GM designs the system. I did allow my hacker, one time, to find an outbound notification in queue after he halted an alert. It was a home security system and he got lucky that the monitoring agency didn't get the notification, as was planning to cancel the alert as soon as he got access...so the timing just worked out. But that does show, he was expecting something to happen before the alert went up...if he didn't think about it, or if the alert was raised a turn or more before he actually broke in, the notification would have already been sent and all he could have done was be aware of it...

Indeed.

And there is often a difference between admin access, and root access.

There are currently things which can *only* be done from the actual computer, with root access. Were I designing a system, you can damn well bet that "disable notifications" would be one of them.

Back when I was doing system security, we also would do things like strip cabling so that a computer could receive commands, but not report. We used that on our logging machines, so that all the logs could be transmitted to them, but you couldn't log in to them remotely - they would return information along dead cables.

So yeah, I'm fine with saying that the notification in uncancellable, at least in systems with high security.