Hi all

Without getting into the complexities of the run, the following situation occurred recently and we weren't sure how to proceed. There are 3 ways it could go as I see it so I'll outline the problem and then people can point me in the right direction.

We're stealing data from the CommLink of a media mogul. We've gotten close, and I've hacked in. Now I just need to find the file we're after. Some kind of incriminating video tape he's using to blackmail the client. So, I'm in and I've not been detected. I've had a look around and there are hundreds of protected files. How do I find the right one?

The only thing we could find in the rules was that a Matrix Perception test allows you to 'spot a target icon you're looking for'. But the GM said (and he has a point) If they're all protected how do you know what you're looking for? It's not labelled incriminating video evidence...

This is how I see it:

1) The Matrix perception allows me to find what I'm after
2) I'd have to individually crack and copy each file to find the one I want
3) The rules for this will be in an upcoming Matrix sourcebook - which isn't a lot of help

Also, is there a way I can crack and copy all of the files together (which I assume is an archive, which is again in an upcoming sourcebook)? What we decided to do was allow me to crack all the files in one go and then find what I was after, to keep the game flowing, but I'm wondering how others would have handled this, and how we should have.

Any help appreciated

Cheers

Josh

Granted, it's a sticky one.
The best way I can see through it is using the "default" matrix iconography descriptor along with the perception test. As you say he doesn't have it labeled as "incriminating video evidence" but the Icon with either be a "video" icon (granted, media mogul will still have lots of those) or it will be a modified / non-standard icon. Performing that kind of Matrix Perception test should all into the Icon you're looking for set and reduce the number to work with. Sadly once you've arrows the field you'll still have to go digging through the data that's left (an agent or two might be helpful here). Of course, you can always copy and bug out to decode at a more leisurely pace.

Ok, as a GM he is probably going for one of three possible things:

1) You will not be able to find it.
2) You will not be able to find it without a file name/identifying feature that you are supposed to discover in another part of the run
3) You can find it just by using Hacking.

If it is case 1 and 2, then your problem is solved, in that you were never supposed to find it, or you have to break into the guy's office, bribe someone, etc to find out which file to look for.

If he wants you to find the data using 5e Matrix rules, then it would be a Matrix Search action (probably using the same parameters of searching for something in a Host - base time =1 minute).

That should bring up the file you are looking for - or, one way he could do it would be to narrow it down to a couple of files, and make you mark and crack each one. (if he felt the Matrix Search narrowing it to one file was too easy).

Currently, there are no rules for cracking multiple files at once.

With our GM, enough marks on the device would give you access to the files. Remember that 3 marks is essentially "owner" status, so pulling the data down for cracking later shouldn't be a problem. A nice GM might even let you have some miscellaneous paydata out of the haul

3 marks is not owner status; there are many things you can do as an owner you cannot do with 3 marks.

In any case, I'd say it would be a Data Search to find it - if nothing else, to find a file with the right metadata and so on.

So cracking a protected file gives you the content, but can't you get a Name for the file/icon just by looking at it? You might be able to find pay data by looking for a file name that sounds useful, and then cracking it.

Note that because files are visible to anyone, to hide files on commlinks, many people make a protected folder, and put all their files in it... so anyone looking at the commlink can only see a protected folder icon instead of a pile of (protected or not) files. That means if you are looking for paydata on someone's commlink, you probably just need to crack the folder protection and get access to all the files inside: "These files are visible to people who can see your commlink in the Matrix, so most people keep all of their files in a protected folder." Page 222.

Whoops! Misremembered that one:



So I guess with Data Search and 3 marks on the node you're looking at a threshold 3 30 minute test with a -1 modifier (just going off the table on page 241)? Watch that overwatch score

Searching within a Host has a base time of 1 minute no matter the type of data you are looking for. This is from p241 'Matrix Search' text (above the Search Table).

Half that if you use a Browse program too.

"Paydata" has meant several things over time, so I think it depends on what you're thinking of.

If you're thinking of paydata as a specifically interesting file, you get quickly lost in the details of how you know where to look, what's in the file, whether it's worth it to crack the encryption, and so on.

If you're thinking of paydata as just "data someone will inevitably pay money for" then it doesn't matter what's in the files -- you find and crack them at random, or based on some criteria, having nothing to do with the expected contents. Once you get home, you figure out what the data is worth and fence it. Maybe it's junk, maybe it's a video of the CEO murdering 20 hookers.

The latter is probably better with respect to game flow. With no system in place it's tricky -- the GM needs to come up with some simple way to produce values for files. Refer to the Matrix book in SR3. They added a program that would sift for paydata and generate "paydata points" that fed through a table or two and produced a value. Something like that may be in order.

In this case, Paydata was referring to a specific data file we were tasked to recover that was stored along with a load of other possibly interesting files.

What we did in the end sounds like what BlackJaw suggested further down and had a protected 'folder' with all the files inside, and I cracked the folder protection to allow me to copy the files.

I thought about the Data Search within a Host thing, but I weren't sure if a single commlink counts as a 'Host' in that regard, or if the action was even possible within a commlink (as a search is typically performed in a host or in the general wider Grid, I think)

Honestly the only problem I’ve seen so far with the SR5 matrix is that you can not steal data without alerting the host. There is no more “in and out undetected”. Protecting a file is a Data Processing action and is legal to do (and even a novice user should be able to buy 1 hit on the test) there is no reason that any file of interest shouldn’t be protected. Removing that protection is an Attack action which automatically alerts the system as soon as it succeeds. So it is impossible to get data undetected.

We have created a house rule that allows for a Sleaze action to remove file protection without alerting the host, and so far it has worked pretty well. We are still play-testing the house rule though.

I'd obviously skipped over that part... ...so I may just keep ignoring it

File Protection a little bit worse than that if you want to play RAW.

Page 239 notes that: "A protected file cannot be read, changed, deleted, or copied until its protection is broken." You'll note that there is no exception for the owner, nor is there any listing for how a person can legitimately remove the protection, like there is for a Data Bomb. By RAW, once a file is protected, no one can access it again until it's been cracked, which is an illegal action that only someone with an Attack rating can try.

I doubt this is how the game was intended to be played, and is another example of the Matrix section having been written with the perspective of hacking, and not much thought towards "legitimate" use.

The question then, is how does protection work for normal people, and how does that effect how hackers encounter it?
A) A Protected file can be accessed by it's owner (4 marks). If this is the case, then files on a host that are protected and still owned by the host would only be accessible by the Security Spider... which is extremely limiting. Files still owned by a user could not be accessed by anyone else, which makes it hard for team projects or shared files to be protected as only one person could open them. It also means that a Protected file owned by a user would alert the user, not the host, when the protection is cracked. Note that a file still needs to be re-protected when a user is done using it, as protection, unlike a data bomb, is removed to access the file.
B) Protection carries a password like Databomb does. Anyone with the password can remove the protection without setting off any alerts. This makes it possible to grab a file if you can get the password first. It also still limits the amount of protection you're likely to encounter for a simple use reason: Every time you access or edit a protected file, you have to take the Protect File action again to re-protect it once you're done. That extra step of effort is enough to keep the average user from protecting everything they have (because it will require them to memorize a password for every file, and take the extra time to unlock and relock files every time they use one.) You'd probably only see important files being protected.

I do still agree that Crack File Protection should have a Sleaze option, but I'll suggest that fewer files, especially on a Host, are protected. The Host itself protects the files inside from access by hackers on the outside, and the standard system of MARKs limits what legitimate users can do with a file inside the host. The Average wage slave can not edit a file if he lacks a mark on it, and if the file is running silent, he would have a hard time even knowing it's there. Meanwhile the users with permission to use the file have a mark on it, and you can always see an icon you have marked.

Really, however, I wish they had put better details into how marks and file icons work. Something like: 1 mark to view a file, 2 marks to edit it, 3 marks to delete or copy it. In fact, at the moment, there is no "open file" action. Actually viewing a file isn't defined anywhere and may or may not even require a mark.

@BlackJaw I don't think all of the files on a host will be protected, just all of the files that a hacker might actually want. The lunch schedule for the cafeteria will likely not be protected, but the research data for the latest hot project will be as will lists of names and addresses, schedules (at least ones with details) or anything else of real value to a hacker or their team.

I also do agree that there is a large chunk of the rules missing about legitimate access to protected files, but as a house rule it's easy to gloss over. As a house rule (until they fix the RAW) we simply use if a user has legitimate access they can (un)protect files as needed. Which I’m sure is RAI even though it isn’t RAW.