Just wondering since an Admin and Security account can disable an alert what kind of action is it and what kind of test does it require? Related question: If the alert is turned off do the IC stand down?

The IC do what their scripting tell them to do. I would presume most would go through some kind of clean up process and then stand down. Turning off an alert would be a complex to the best of my knowledge.

Simple Action

However, as per Unwired 67, Alerts, a hacker will find it -extraordinarily- difficult to turn off an active alert on them.

Mostly because an alert strips all user rights, an alerted admin can't just turn the alarm off. They have to hack it back on. And the system gets the +4 firewall bonus against them.
And the rest of the nodes in the system still hate you too.

What he said, essentially once you trip an alarm you are no longer authorized and personally for most of my systems that particular jewel requires admin level access.

I've never liked how access rights were handled. "Some things require some access rights." What other regular commands can't you use anymore if the system identifies you as hostile? How exactly is this hostility determined? Could you, with hacked admin abilities, declare the legitimate admin hostile and watch him get kicked out? How is "ownership" of a system established or changed/stolen?

Most systems have these days have hard coded commands that can't be changed. Take a look at the hacking story in SRA4 between a hacker and techno and you see that the admin acounts are hard coded and can't be changed. I like that idea so there can be actual matrix combat not just I dump you then you dump me

They can be hacked and added though IIRC its on the same level as a long hack taking hours.

If an Alert is activated against your ID, then the account is frozen and ARC protocols come into effect. So long as the Alert hasn't come into effect or come into effect against you specifically, it can be canceled with a Simple Action. Hence the massive utility of the Mute option. If you get tagged it's an opposed Hacking test, which I suppose would be a Complex Action.

Here's a question though, since an Alert is based on the ID, could you load an Agent into the node, and have it turn off the alert? Provided that the Alert wasn't launched on the way in the door..