I'm trying to build a complete, step-by-step list of how this works, to ease things for my GM, so the more detail, the better. We can't help but feel like we're missing something.

Okay, so Bob is this jerk who lives next door to me; he's a drone hobbyist, and I'm tired of his antics, so I'm going to steal his drone and park it a mile north of here.

Bob's drone is a Renraku Stormcloud, so it has a Device Rating of 3. It's currently on its own Pilot, and its orders are simple: "Stay floating 100 meters above Bob's house." Bob uses standard wireless frequencies. Bob is currently home, watering plants; he has an implanted commlink.

What happens next? Is there information I haven't given which is essential to determining my course of action?

Its way late for me to answer this question in full, but before I try, what is your level of matrix rules knowledge? Do you have access to unwired, and/or know it well?

Thank you in advance, by the way. This thread has one of the most interesting reply-to-view ratios on the board right now: everyone loves hacker rules.


Well, I thought it was pretty good, but it's becoming clear there are either gaps in my education, or gaps in the rules. I've read all of the matrix/vehicle rules in SR4a, Unwired, and Arsenal multiple times, anyhow, although apparently that only helps just so much.


Conveniently, the answer to that question is always yes, so even if your reference is obscure, that shouldn't present a problem.

Compiling a lengthier answer, but you should DEFINITELY pop your anniversary book open to page 212, and read the story Game, Set, Match there. The devs did a matrix play-by-play for that story, and you can find it here. I strongly recommend you read it side-by-side the story, as it covers a lot of mechanics you want to use.

Also, the FAQ has some decent questions involving intercept traffic and the like on this topic.

So if you want to hijack a drone, you have to knock the owner out first, right?

Lets see. There are two seperate branches of drone theft. One involves spoofing, the other hacking. I'll go over spoofing because its more complicated.

Spoofing
To spoof, you must fake commands from an authorized source. What this means, is to even BEGIN spoofing you need to have the access ID of the devices(in this case, a drone) owner/controller.
You can obtain this information in a few ways.
1) Intercept Traffic (Hacking+Sniffer, hits are the threshold for a Matrix Perception test to notice the eavesdropping). Must break Encryption first. Usually for wired networks only, but it does work for smaller wi-fi networks.
1) Capture Wireless Signal (4a 229. EW+sniffer 3). Requires you to be inside the target's Signal range. You then wait for a command to pass between the drone and the owner, and since you can see what it contains, you will have an access ID for the sender and reciever.
1) 4a 228: An Access ID is a valid piece of information you can ask for when you make a successful Matrix Perception test. This would require you to have an Icon in the same node as the drone's owner(bob), such as hacking his commlink first.
1) A Data Search test. This is getting into Unwired territory(page 65), but the Access Log for a given node shows established connections, and could potentially contain information about Access ID and accounts that you want. Performing such a data search would require hacking into either the drone or the owner first, however.
1) Trace User. 4a 232: You can use this action to trace a Subscription to its other end. Provided example is from a drone to its controlling rigger. Successfully completing a trace will give you an Access ID. However, the rules for SPOTTING an incoming trace are in Unwired(104). Its a matrix perception 1 test, unless you're running stealth, in which case it is Computer+analyze vs Track+stealth. Further complicating the matter is unwired's passive traces: You only get to roll to spot it if you're in the same node that the trace is launched from.
1a) A dogbrain test is lingo for the common-sense test a Pilot program must take when it encounters an ambigous situation it doesn't know what to do. 4a 245, pilot+response, variable threshold. If a drone finds a situation it can't handle, then it will contact its owner for further instructions. In the story game, set, match Slamm-o uses this method to gain access to the drone, by forcing it to alert its owner when he got the attention of its sensors.
2) Now that you have an access ID, you can Spoof commands from Bob to his drone.
2a) The Gm REALLY REALLY NEEDS to get a firm handle on Access Levels/Account levels. Public/User/Security/Admin user rights are things he needs to be able to decide on the fly for any given action.
2b: Beware the dangers. If you spoof commands from an UNauthorized source, the drone will ignore it, or even trigger a Restricted Alert.
2c: this is getting into stupid finicky unwired territory and user rights, but per unwired 99, its NOT possible to spoof a command with access rights the faked ID doesn't have. IE, if spoof from a basic user, you can't take admin access priviledges.
2d: Per the same paragraph, there is also a penalty for spoofing commands from Security privileges(-3) and Admin privileges(-6)
3: Hacking+Spoof vs System+Firewall (drones use Pilot for System). Keep in mind that Spoofing is fairly action inefficient, as it is a Complex Action to spoof a command, despite the intended action you want to fake the drone into doing. (4a 232).
3a: good actions: Reboot. Shut down. Land here. Possibly not in that order.


Now I'm assuming you want to actaully STEAL the drone. This means physically getting your hands on it, and preventing it from being recovered. There's a few problems with that.
1) RFID paranoia. Per the fluff, there's identifying rfid's in nearly anything, and its very hard to make sure you got them all. Technomancers with E-sensing are one of the only guaranteed ways to spot all RFID tags.
1: the Tag Eraser, while necessary, is actually pretty limited. It can't burnout security tags, and stealth tags are nearly impossible to find. If your gm is a dick, there will be devices you actually cant get it within a centimeter of. However, there are options..
1: Per the description of RFID tags(4a 329) a radio signal scanner can be used to find the physical location of a tag, but...
1b: Your best bet is actually a Cyberware scanner. They can detect a ridulous number of things, as long as their database supports what they are looking for. A Datasoft 6(they are cheap) can be used to represent an RFID database that it knows to look for.
1c: EMP. Emp grenades and HERF guns can reduce or burn out Signal while leaving optical electronics intact. This is the quick and dirty method. RFID tags without signal aren't going to be able to transmit the location of their stolen goods very well at all.
1d: Hardware tests. This is slightly houserule territory, but removing tags that you know the location of should be a Hardware test. Supported by arsenal, per the weapon mod Tracker.
1e: Jammers work too. Most people dont think to run ECCM on rfid tags, and they have a terrible signal of 1. Just don't trust a jammer 6 to do the job for you ALL the time. Its auto-jam will work pretty consistently, but Clever people can run an Optimized 3 ECCM 6 on an RFID tag with a device rating of 3, which gives it an effective signal of 7, meaning you need a strength 8 jammer to beat it. Luckily, they go up to 10.
1f: Faraday cages (arsenal vehicle mod. They may also be available in square meters in RC) are basically the only surefire way to make sure that you're not transmitting a signal to the owner while you de-tag a stolen vehicle.
2: Digital Security: Now that you've physically secured a vehicle, you have to make sure its electronics don't have any hidden surprises either. The best thing you can do is install a new Pilot(expensive). The next best thing is to use Unwired's rules to spot backdoors and hidden logins to make sure the owner doesn't have a failsafe account in case of theft - or even viruses to destroy the drone if he doesn't check in.
2a: Don't forget to check peripheral nodes. Its possible, though unlikely, that a drone with a smartlink on its camera or a smartgun enabled weapon could have nasties on it too, or even be setup to work like an RFID tag in case of a theft.



Situational Considerations: Does the house have any sort of electronic defenses? Most Homes with decent Security/Necessities(advanced lifestyle stuff) have IC and patrolling spiders on the Central Home Network.
Wi-fi blocking wallpaper may be another consideration. Possible implications include making a physical network link across the paper(laser comms to a spy/relay drone inside are popular).

Thats what i have so far. Questions? Comments? Concerns? I'll field questions about the Hacking(as opposed to spoofing) side of things later.

This is excellent, thank you. Let me parse this, and see where I stand.

No. But its a good idea. You will almost certainly want to mess with the owners electronics in some form to make stealing the drone easier.
It also guarantees access to his other devices - for example, if your target is a runner with a public/private commlink setup, hacking the visible public one won't give you the information you need to spoof/access the more restricted stuff tied to the private(and probably implanted) link.

Okay, I've finally had the mental fortitude to sort through all of this, and I think I have Spoofing pretty well down. A couple of questions:


My GM's idea of "administrative access" is a hammer he uses to open the computer case when Paint crashes as he's making a map. Is there a simple list somewhere of the types of actions that should require a given Access Level?


Well, not actually, although that information is useful, as well. Mostly it's just that the hacking rules - particularly as they pertain to hijacking someone else's vehicles - are currently somewhat frustratingly opaque to us, and that's the simplest concrete example I could think of.

The above definitely helped; I think we could do Spoofing without too much trouble now. So, how about Hacking?

Huh? Where did that come from?

Edit: ah, i see now. I keep confusing traffic interception and wireless signal capture. I swear, if the rules had separated hardware layer from logical/matrix layer, it would have been much easier to keep up with everything.

There is some murky bits here, as one could potentially do a matrix perception on the users AR data transmissions in active mode. Yep, active mode is basically the same as tossing a facebook profile to anyone within signal range.

This had been a REALLY helpful thread folks! ... Hoping you guys will cover the hacking option too!!

I will admit I expected this topic to be dead after two weeks of no posting.

Yeah, sorry about that. Single father with an always-on-call job and a house full of puppies and kittens: not enough time for background Shadowrun research.