OK, here's the idea.
A decker gets into a system, creates an account, then bails.
He comes back 3 hours later, when he's sure the security is reset. Enters the system with his valid ID and PW. Finds the file he's looking for. But, you've got to be an admin to open the file. So it must be hacked.

Can he just try an edit test from there?
If he does try, does he get booted as soon as he gets any security tally?
Or, does he have to log off and hack his way back in before he can use any of his utilities?

I would think it would depend on if he triggered any alarms when he first hacked in. If he goes in and bells and whistles start going off then not only will he have ice coming at him lie tis cool, biut he will have Corp Deckers looking around looking to see what your decker monkied around with. So his account might not be there or, have some type of tracer program attached to it. Now if he slid in and didn't set off any bells and whistles then i would say why not? its a good plan

I though that when I decker did the Validate Account operation, he was setting himself up with a superuser account, is this not the case?

If that is how it works, then he would have access to just about anything.

No, superuser adds +6 to the TN. He's just creating an account that gets him in without hacking.

So, unless I hear otherwise, I'll run the above situation as if our decker were a classic "wolf in sheeps clothing". He hacks in, sets up the account and bails.
Then, comes back, and logs on with the new account. Builds up no security tally until he does something that the account isn't authorized to do.

Now, at that point, should he:
A. be forced to stay in pure decker mode,
B. go back to Joe user mode who can continue to operate without interference until the next operation that his account doesn't have rights to, but he keeps his security tally anyway, and the account gets disabled at some point

Even if he was using a "normal" account, I would say that he can deck around and do things the account couldn't do, he would just have to do it as normal. The only difference is that he doesn't have to make any checks to log in, he already has an account for that. Using the account wouldn't make it any easier to trace him either.

It's quite straigh-forward the way I see it. Assuming he's gone in and created an (ordinary) account using his validate utility, and is now coming back in some time later:

Just treat his run as a normal decking run, but any time he makes an operation that's on his list of automatic system tests (p38 Matrix) he succeeds without needing to roll, and thus generates no security tally for that particular operation.

So for example he can log on without needing to roll any dice, and also won't generate any security tally on that operation, although he will be in full illegal mode the whole time (i.e. masking on etc). Then from there he might decide to Analyze Host, which his hacked account doesn't have access for, so he just rolls that as normal and may or may not generage some security tally.

Basically the hacked account only works in his favour (assuming it's not discovered), making some tasks automatic, and others no harder than normal.

Also, if it comes to cybercombat, he'll be considered a legal user (at least for a while!...), so IC and the like will have a harder time hitting him on Orange and Red systems.


Validate is an excellent utility, and well worth having at a high rating. Remember though that the longer you leave the account up the more likely it is to be discovered and traps set for you etc, and also that it only applies to the particular host you set it up on, no use if you then find a back door and have to follow that out to some other host elsewhere.

echo ZDM's post. but one more thing, i would probably rule that i'd be easier for the dataforensics guys to see what the Decker did using the account, because it's most likely all logged rigorously.