I'll try not to, but I'd like one more try.

One thing the new matrix does is track everything you do, and reports that information to nearly everyone. Stores not only know who you are, they know what your purchase history is, and can tailor AR ads based on both what you've bought, and how much you have in your accounts right now. Another example, straight from the books, is the smart fridge-- your fridge not only knows what you've eaten, it knows roughly how fast you go through certain foods, and will automatically order new food before you run out. All this is possible because of the SIN system, at least according to the bit in SR5.

What we see is that this information *is* combined, at least in part. Because you only broadcast your SIN when you go down the mall-- not your bank accounts and purchase history-- the store must have enough information to run that history, and come back with a set of tailored ads. That includes the ability to query your current balanced and presumably get your credit history. The smart fridge can do more than just predict when you'll run out of eggs, it can purchase more on your behalf, so it also has access to your bank information.

My idea is that your SIN is inextricably combined with all your official financial information. What matters is the level of transaction: in order to spend any money, you need to do a R1 check, to spend more than 100 nuyen, you need a R2 check, and so on. This is consistent with the rules that were started in Sr1 and sort of continued through Sr3.

How this would work in practice is like this: As you walk down the mall, your SIN is repeatedly queried, and your information accessed (Casual check). You stop for a soy-latte, quickly approving it by entering your PIN (R1 check) and your display comes back with a really great sale further down. You head down and buy several thousand nuyen of the latest consumer electronics-- maybe new music players and game consoles for the whole family, or maybe just a Macbook -- and run your balance. Now you have to do a biometric and PIN check, because your account won't approve that much without extra security.

So, for all intents and purposes, all your accounts *are* combined-- by accessing your SIN, I know every purchase you've ever made, how much is in all of your accounts, and so on. What I can't do is use it to buy stuff, at least not without verifying that the SIN is not just valid, but belongs to me.

It also works in my scenario, where the SIN is just a number used to look up data at the SIN registry: Cams at the store record the visitors height, sex, appropriate age, and facial biometrics and send the whole package to the GSR. If the GSR gives the go-ahead everything is fine, else raise an alert. Foolproof? No less than checking the signature on a credit card.

I'd like to add that Google (and facebook to a lesser degree) are quite good at putting adds up in my email, profile etc based on my browsing history without necessarily (I say 'necessarily' because I'm confident that Google doesn't have access to my tax returns and bank accounts, not 100% sure, and would be horrified if they do) having intimate details like my tax records, credit rating, bank accounts, etc.

That's not to say that this is how it works in Shadowrun as I'm a big proponent of 'realism be damned!' but this does say that perhaps it doesn't need to be as invasive as you suggest Cain for it to be logically consistent.

True, but the point is that the SIN and banking information have to be linked for that to work. If the only information you give off is your SIN, that has to be enough to access your purchase history and allow you to buy stuff.


Well, that's because nowadays, there isn't a single information point quite like a SIN. But even where things come close, we can get a lot of information.

Right now, the closest thing to a SIN is your social security number-- in theory, you can't get a job, have a bank account of credit card, or go to college without one. (In practice, it's somewhat different, but that *is* a derail.) Now, even though your SSN is distinct from your bank account and credit information, if I get a hold of your SSN I can track down a lot of that info. For example, I can use it to run your credit report, which not only tells me what accounts you have active, but every check made on you in the past. So, I can find out not only what accounts you have now, but what accounts you tried to open.

Now, let's extend it to Shadowrun. We know that a SIN links together every bit of data on you, so you can find everything all at once. So, at the very least, it skips a few steps: I wouldn't run your SIN and credit history separately, for starters, those would come as a package deal. Thus, I would not just know what accounts you have, I'd know every one you ever did have, and I'd have an idea of the standing of each. This is no different than today, since you can get a lot of this just by running a credit report. On top of that, just having your SIN is, in some cases, enough to handle money on your behalf. By using a combination of my SSN and checking account number, employers can direct deposit a paycheck, for example. Heck, with just your account number, anyone can deposit money to you. But the important part is that under some cases, you don't need your identity verified to purchase things, both today and in Shadowrun. The difference is, right now, that depends on what ID you do have. In Shadowrun, there's only one ID: your SIN.

Pretty apt, actually. The cash-only or forged SSN market for illegal immigrant labor today is pretty much exactly what the SINless' job prospects look like in the 2050's. Especially given that a lot of the things you want to buy today want a major corp-backed credit/debit card. Main difference being that social services in the 2050's demand a SIN as well.

OK, so in addition the store node has to query the visitor's commlink for his account number...also can be done automatically in the background, no biggie.

(This would obviously greatly profit from online authentication, so the commlink knows it's talking to an authorized node. I suggest assuming that SIN checks over the matrix and nodes identifying themselves simply work, real-life authentication and identification systems are extremely complex affairs and SR's lack of secure encryption would make it even worse. Unless you are aiming for a Turing Award, handwave it)


@BW: What are those "social services" you're talking about

What I'm getting at is that your SIN and bank account information would be so close, a distinction is meaningless. If I have your SIN, I have your account balances, purchase history, everything.

To an extent, this is true now. If I have your SSN, I can pull your credit report, which lists all your accounts, major credit purchases, addresses for the last 7 years, and so on. Since a SIN tags all that info, it actually saves a few steps, makes it easier.

I don't believe this is so according to the rules. If it were, everybody would have access to everything.

There is a small amount of info in the SIN itself, and the system contains more information in their secure data stores. High-end SIN checkers can make random queries to externally verify that a piece of information in the GSINR data store matches something in another one. It does not logically follow that a person with the SIN can browse this information.

Even if some entities can do this, such as legal authorities or corporate merchants, it does not mean that all people are able to.

Sadly, it is.

According to Sr5, a SIN links together every bit of information about you on the Matrix. Every legal piece of data on you is connected via your SIN. So, at the very least, running your SIN will give them access to everything on you in one search. Unlike today, where you have to go digging in many different places, your SIN brings it all to one simple check.

Let's say someone-- maybe an employer?-- wants to look at your second grade report card. Assuming your grade school even has that information on a computer (if mine is, it's on ENIAC) and can be accessed on the web (my daughter's can), today you'd still need to go through a lot of hoops to get it. In Shadowrun? All you need is the SIN. If they can convince the system they have a right to that information (like some strange pre-employment check), it would be easy to track down, since it's all grouped together.


Presumably, a basic SIN check would produce all the public information on you, and some quasi-private information, like your credit history and banking information. Since you can purchase things with a SIN alone, it has to at least point to them.

My thought is that while non-classified information is wide open, actually manipulating it takes an identity check. So, purchases under, say, $25 can be authorized without a any check, kinda like how McDonalds won't check your PIN if you buy less than $25 of "food". A bigger purchase would require a PIN or other check, and a major purchase (like a car) would take even more verification.

A number of us have stated before and appear to be continually disagreeing with your interpretation. Please cease re-hashing the same argument.

It is not my interpretation. But, I will leave a quote, then drop it.

And I will end with quoting you and the way you twist the the quote from the book that many of us disagree with that you, that you simply won't acknowledge... which is why it is so frustrating to try have a conversation with you because once you get an interpretation into you head you only accept your interpretation.

No, you don't. Just because my bank account number is tied to my purchase history inside Amazon's data stores, you don't get my purchase history from just knowing my account number. It's a purely local association between two datums

There is something to the concept, the cops could just charge a SINless with vagrancy/squatting/etc since technically a SINless can't possess property/get a normal job/etc and in the process assign a Criminal SIN.

What usually stops this is paperwork and the cops inate hatred of doing extra paperwork of processing the poor slob through the system.

So unless the guy is really being a nuisance or straying into the nicer parts of town where they can be seen by Mr. Exec and his corpspawn, they rather just leave them in their dumps.

You're making a faulty assumption here that the Matrix circa 2070 works like the Internet circa 2014.

It doesn't. It is far, far more invasive. A more apt comparison is 'Just because Amazon (my employer) has my Amazon credit card number and is the issuing authority for both it and my pay doesn't mean they can see what I purchase with that card'. Which is patently incorrect.

I honestly don't see how he's "twisting" the quote. The quote makes it clear that the SIN is attached to EVERYTHING about you. It ties all that info about you into one neat little package to make it easier to scan and track you.

The underlying technology has nothing to do with it, my assumption is that the business where the association between purchase history and account number, or SIN and account number, does not feed this information into a global and publicly accessible database.

It kind of does right now. It's just that there's no central collection database to make it easy to get.

Let me try an example. My daughter is really into My Little Pony. A few years back, she got a couple hundred bucks for her birthday, so I took her to Toys R Us so she could go on a shopping spree. Because I'm from Oregon, I don't pay sales tax in Washington, so she had me pay for everything. They offered me a discount if I signed up for their rewards program and applied for one of their credit cards, so I did so. I didn't actually get the credit card, but it still went into the system. I did give them a spamcatcher email, but otherwise, my information was generally accurate.

Several years later, I still get ads from them in my email. Targeted ads, too-- they focus on sales on MLP and Monster High dolls, even though I've bought other things from them since. Because I listed my address, they don't send me sales from Seattle-- they only list sales from local stores. I also get credit card offers that are linked to them-- many list their partnered stores, and for some reason, Toys R Us is there most of the time.

Now, you're going to argue that this doesn't mean they'll share that information. And on the privacy policy, it even says in big bold letters: "We don't share this information with anyone!" Of course, I missed the fine print, that says something to the effect of: "Except as allowed by law and with our marketing partners". Basically, they can share that information with anyone if they feel like it: if someone wanted to buy their marketing list, that would make them a marketing partner, right? And "by law" is also really flexible-- anyone wanting to check my credit, for example, has a legal right to this information. I'm pretty sure that the explosion of spam in that email all traces back to that day.

Right now, anyone who checks my credit report (and there's a lot of reasons why that might happen) will be able to see that three years ago, I applied for a credit card at Toys R Us. If someone felt like investigating further, it wouldn't be too hard to get the detailed information, on every purchase I made since then. And that's today, without SINs to tie everything together and massive computers to correlate the information.

This information is all out there, right now. Using just servers that are public, or effectively public, I can track down tons of information on myself. And I keep a very low profile-- I can track down more on my daughter without trying, and she's too young to have a bank account! With a central indexing system, it all becomes much easier.

@Cain: That is a good point about the MLP and spam connection. But with the added centralization I imagine they also set up more fences around said information as knowledge is power.

It has to come down to levels of access.

If say I happen to subscribe to the 'Big Booty and Toothy Orc Cheerleaders' E-zine (what? They have many fine editorial articles... don't judge me) who exactly gets to see that information?

While this information is tied into my purchase history of my subscription, not every Tom, Dick and Harry probably can access this easily.

So if I go down to the local StufferShack for some soymilk, the owner probably should not automatically know my preference for Orcs w/ pompoms and massive underbites just from my stopping in for fresh squeezed soy.

There must be some sort of access levels assigned, for the StufferShack owner his level of access would include my current balance (showing I am good for the purchase), items relevant to my purchase and any items he is selling in his shop. He should not have access to information about items he doesn't carry as it is not relevant to his need to know.

If on the other hand I apply to work with a charity catering to young underprivileged orc children, a more thorough scan turning up my purchase history of said adult e-zine may disqualify me from the job as a possible predator in the making.

Obviously the higher up the ladder you go, or the better you are at getting into those systems, the more access they would have to you and your life, so a Cop on a routine check may pull up some details on a casual search, but could request a full rundown if there was a cause for suspicion (real or otherwise in their opinion)

Likewise a PI knows who to schmooze for details or a hacker could do some digging to get at the dirt, but this should again taking some work on their part to get that level of access.

Well, sorta.

The point is this sort of information is out there. Anyone who wants to bother will see I spent over $200 on My Little Pony stuff a few years ago. Rather or not they want to go that far is another question.

think thatthat than in Shadowrun, marketing programs have become much better than they are now. Even if they have access to my full purchase history, they don't necessarily need all of that, at least not at the store level. Right now, what I figure Toys R Us is doing with my info is, they're tracking what I spent the most money on, and targeting ads based on that. They don't seem to send me a lot on nerf guns, even though I occasionally buy them-- probably because I only bought one on sale for $14.99.

Let's move this to Shadowrun. I walk into Toys R Us in 2075, and they scan my SIN. They could theoretically look at every purchase I ever made, but they're going to center on toy purchases made fairly recently. Someone might notice that I have a subscription to "Hot Cheerleader Trollz!", but since it doesn't factor into the marketing program, they ignore it, and instead send me ads based on my family composition, my budget, and what toys I've bought recently. Same happens at the Stuffer Shack: their programs don't pay attention to that sort of thing, so it doesn't pop up.

However, if I apply for a pastor job at a local church? Yeah, then they'll be looking for that sort of thing, and it could easily pop up.


That's one of the flaws of the post-SR4 world. Everyone is living in a panopticon, and privacy is essentially a thing of the past. That's one of the *themes* they went for: only criminals and the very rich can afford privacy. I agree with you that living in such a world would be horrifying, but that appears to be the kind of world the developers wanted.

It would become easier, if such a central, public database fed with every association between any two datums (let's call it "Samaritan" for short...) existed. Your story actually points out one of the reasons why it does not, the knowledge of such associations is worth money...

Information sharing is worth more money, though, Right now, consumer data is a big industry-- people make a living gathering this sort on information on consumers, and reselling it to anyone willing to buy. Extending this to Shadowrun, corporations have learned to cooperate with each other more, so sharing this level of information would profit them all. Mitsuhama doesn't have to spend millions figuring out how to get data on Ares wageslaves, they just need to trade the info on their own.

Also, remember that the association does exist-- that's the stated purpose of a SIN in 5e. I can see an argument over rather or not a central database exists, but the SIN does index and link every legal piece of information about you. That might even be the exact quote. And honestly, with that, I don't see why a central database would even be needed.

I used the SSN/Credit Report example earlier. I was a little inexact, because there are three credit reporting agencies here, and their reports can vary somewhat. I don't think they share information, but they do draw off the same sources, and in order to do a full check you'd technically need to send a separate query to each of them. With my SSN, it's not too hard to run all three, it's just time consuming.

With that in mind, there are services out there who basically charge you for free information: they offer to run all three reports for you. You give up your personal details, like your SSN, and then all they do is run the reports. It's nothing you can't do yourself, but people *pay* them for the convenience of not sending in three requests. And that's on the consumer level-- on the corporate level, there are professional credit checking agencies, who basically do nothing but get paid to run all three reports and give the information to a company. This happens all the time, too-- when I moved into my current place, they ran a background check on me. I had to pay the rental company an application fee, and most of what they did was run the credit reports.

So, today, there are companies that make a profit off collecting the information from distributed databases. In Shadowrun, the megas cut out the middleman wherever possible, so they'd do more of that in-house. Add to that the tagging ability of a SIN, and getting all this information in one place would not only be easier, but more profitable, since it takes less effort. Combined with data sharing for consumer information, and it'd be really easy.

On top of that, remember that as of SR4, privacy is basically a thing of the past. There is literally no one defending your right to privacy, the system is designed to be as invasive as possible while still giving you bread and circuses. You can't say "no one would accept the loss of privacy", because that's actually an underlying premise of the wireless Matrix. That's what they built the system to do.

Why exactly would they do this again? Knowledge is power, and behaving as corporations do today by not correlating all the information their departments have on a person is a handicap the megas have no reason to abide by. Especially when they pay many of their employees in corpscrip, and have every reason to gather and correlate everything they can about their non-employees in order to assess their value as customers as well as their usefulness to rivals.

Hell, if you think that doesn't happen now, you're not paying attention to how Google decides what ads to send you based on your search results, amazon purchasing history, contents of your gmail messages...

May I remind you of the bolded word's meaning? Balkanisation and begrudging the competition even the tiniest advantage are the name of the game, so while Stuffer Shack will of course try to find out as much as they can about individual customers, they will not turn all that info over to Ares.


And here we are going in cycles again, because keep insisting that just because because my bank account number is associated with purchases I make, everybody with that number magically knows all these associations.

Countries have balkanized. Corporations have organized under the Corporate Court. The megas aren't competing with each other as much as they're splitting the pie.


Now you're making a leap I didn't make. No, it doesn't mean everyone knows them all, but it *does* mean they're much easier to find.

I keep a low profile on the internet, and I have a very common name. So, if I google my name, it's not easy to find information specifically on me. There's too much to sort through for any person to figure out which is me, and which is someone else. However, not only does 4e presume we have more powerful search engines, it also supposes a lot more computing power to sort through those hits. On top of that, there's the SIN to consider: every SIN is a unique identifier, so I can easily pick out which John Smith I'm looking for.

Even though I try to be private, there is a lot of information about me on the web. Really, my only defense is that there is no one single identifier people can use to track me down. You'd need several pieces of key info to be sure you got me, and not someone else-- my SSN, mother's maiden name, my maiden name, phone number, past addresses, etc. However, in 2070, there *is* a single identifier. So, if someone does a credit check on John Smith, they don't have to figure out which of the six million John Smiths they want, they can go straight to that one.

Besides which, it can work that way today. Let's say someone wants to track my transaction history. They don't know where I do my banking, but they do have my real name and SSN. So, they run a credit check. Credit reports have a huge amount of information: mine reveals what colleges I've been to, the state of my student loans, every credit card I've applied for, and which banks I have accounts at. It doesn't give them my account number, but once they find my bank, it's not too hard to pose as a creditor and track down that information, as well as my current balances. (Actually removing money is a bit harder, but only a bit-- I got scammed by someone who got my account number, and I had to close the account to protect myself). A little more digging can turn up my statements, so they know everything I've purchased in the last month.

Back to 2070: according to what I see, running a SIN check is, at the very least, equal to running a credit report. So, they get your address, banks you work with, state of your home and student loans, major credit purchases, all that. On top of that, the SIN links to every other piece of information about you on the Matrix. It might not automatically give it to you, but it does point the way. Even if there isn't a central database for all this information, it is all cross-tagged, so it's very easy to track down the information you want.

Maybe the title of this thread should have been "How to make SIN rules workable".

This discussion seems kinda pointless at the moment. Let's say that we accepted Cain's premise about how everything is linking what's the game effect on that? Well to me it seems that I would need mindmap on a laptop showing which accounts, licences and lifestyles are connected to each SIN so that if one gets burned by a single lucky scan roll you don't lose all your assets.

That just sounds like work I don't want to do.

To me Shadowrun really needs to be sci-fi Noir. All the technology just gets in the way unless you're smashing someones head in with it. What's important is that you can go places and you can talk to people without having to have surgery every time, acquire a new SIN (and associated baggage) or having to hack every device in a 3 mile radius.

Am I the only one who thinks this way?

There's a reason I vastly prefer the 2050's to the 2070's. Per the way the setting's written, especially the SIN rules, I don't feel that Shadowrun is actually possible in the 2070's panopticon of all-online security apparatus. The tools required for a runner not to set off every alarm for city blocks the moment he walks into anyplace with a security rating above D are too expensive to justify with what the pay standards say he should be getting for his work.

That's kind of what I understood the purpose of the thread to be.

The discussion about Cains point was mostly whether everything is included into the SIN, or whether linked with it,
but as you point out, even if it is merely linked, it is an excessive amount of work.

I find it stupid that according to the core rules you 'can't walk down the street' without a SIN, while SINless is a pretty cheap flaw to buy at character creation.

As I said earlier,
in my opinion, either the SIN rules should be more complex,
and a more integral part of the game,
which I would like, as I said earlier. You can do a lot of things with that.
A SIN could, for example, give you investigative privileges which render you untouchable to a degree,
which License basically are, but it is not spelled out that way.

Or the rules need to be simplified,
because the way they are now, they may or may not be realistic,
but they would require too much micro-management,
and arguably take out a lot of fun out of the game.

I tend to agree. Someone mentioned that SR was "losing the dystopia feel" earlier in the thread, but honestly it drastically changed the kind of dystopia from 3rd to 4th. In 3rd, it was very much a crapsack world where the megas simply didn't care about the SINless beyond their use as deniable assets. In 3rd edition, you could walk down downtown without a SIN and so long as you minded yourself and didn't break any laws, no one gave a shit. You could go into a fancy restaurant and pay in certified cred, and that would work for meeting the Johnson. Of course, you had fake SINs just in case you got pulled over for speeding or to have licenses for the heat you were packing, but you didn't need them just to exist.

4th changed that uncaring, cold dystopia into Big Brother from 1984. Suddenly, you have to be constantly broadcasting information, and God help you if any number of interested parties see something they don't like.

It's not my premise. I showed the quote earlier, that's exactly how the fluff says it's supposed to work. The ramifications of that are up to each of us to interpret, but that is what a SIN does.

And while I agree with you that it's an annoyance, the examples actually make matters worse. IIRC, one example has someone walking down the mall in active mode. She's broadcasting her SIN, and in that example, not only does she get targeted spam, there's some automatic debits that happen, where she pays for things without having to approve the transaction. On top of that, a stranger scans her SIN and decides to hit on her-- apparently, random guy was able to access her OKCupid 2070 profile, and send her a message. All from scanning her SIN.

The second example is the one where a runner gets harassed by an armed police drone, simply because their PAN is in hidden mode. That's bad enough, but what happens if someone forgets their commlink at home? Or drops it somewhere, and breaks it by accident? Or they just forgot to charge it, and now it's out of power? Would a police drone seriously call in the SWAT teams just because someone doesn't have a commlink on them? According that that example, yes.

I agree that if you actually played it out the way the examples describe, things would get out of hand. Honestly, I don't know anyone who actually is that strict about it, because I think it'd be unplayable. But that is how it's written.

I always likened 2e/3e SR city life to the setting of 'Do Androids Dream Of Electric Sheep'. Everyone worth being has moved into corporate enclaves to live the happy high life isolated from the plebs, and the rest of the lost and abandoned squat in the ruins of what was civilization and ape their betters in hope of having tasty scraps thrown their way, trying desperately to make themselves feel fulfilled.

My patience is now exhausted. Your quotes have been counter quoted and you have been shown that your interpretation is neither all knowing nor conclusive. At this point, continued arguing about it is really nothing more than trolling.

I like that feel. I also really like the way that places 'outside' of society were represented in "Children of Men".

Not only is that not what I said, it's not a true statement.

In post 61, I posted the quote:


That's a direct quote from the book. There's no fudging or out of context possible, that's what's written down.

Looking at every post from then on, nobody lists a single page reference or counter-quote. Not one. We're currently on post 84, so there's only 23 posts to look through and verify. There are no counter quotes since I posted my claim.

So, that much is an exact quote. The possible ramifications of what it means is open to interpretation, but then again, I never claimed otherwise:


So, I *have* acknowledged that my interpretation is not all-knowing nor absolutely conclusive. I've never claimed otherwise, and I have no idea where you think I did. There is room for how you read what it means, but the statement is there.

I hate to do this, but ....

I agree with Cain.

Why does it hurt to say that?

Anyway, his quote is real, correctly applied and analysed as written.

By the rules as written, the panopticon is real in 4th Ed, and 4AE. At least, in the nice bits of town.

This always bothered the hell out of me. You HAVE to constantly identify yourself, verifiably (or within a fair approximation thereof) to all comers, all the time, without exception, or the police services (or equivalent) lock and load?

Really?

Quite aside from kidnappers, stalkers, assassins and marketroids, what about people who ever want to do anything secret, regardless of how legal it is? A secret corporate joint venture? A dirty little weekend with the flavour of the month? Buy a gift for the wife to make up for all those dirty little weekends?

This is one place 3rd Ed has it all over 4th Ed. The writers didn't adequately think that through, or the milieu editorial team got it wrong. Sorry, guys.

So help me understand your position for thinking that this:


Leads to these:

I'm siding with Redjack here. Your SIN "is attached to every piece of information associated..." doesn't mean necessarily that "every piece of information is attached to your SIN." That's almost like saying "all squares are rhombuses therefore it must follow that all rhombuses are squares."

Say Wageslave McCorporation (SIN: 1234567) decides to swing by the Stuffer Shack™ on the way back from a hard day being a workdrone and pick up an umeboshi onigiri and two chalupas. Hackmaster O'Deckerson sleazes his way into the Stuffer Shack™ system later that day, and pulls the transaction history, finding the above purchase was made by SIN:1234567. He cross references the search and finds said SIN has made similar purchases every day for 2 months at this particular locale. He then runs the SIN across the SIN database and finds the owner is one Wageslave McCorporation and now has access to the information that is tracked by the SIN database. The way I look at it, the information tracked will likely be biometrics, corporation of origin, criminal history, and personal profile.

From there you can springboard your search, but you won't necessarily know that the SIN accessed funds in a Wuxing Banking subsidiary, unless they used that subsidiary to pay for their Stuffer Shack™ meal. And then you only know that because you pulled the Stuffer Shack™ transaction history, not because you pulled it off their SIN.

Think of the SIN as being the primary key in a logical database.

Now imagine it being the same primary key in every other database.

Just because you know someone's SIN doesn't mean you can make purchases on their account. That would be dumb. It would be like having your SSN (which is not meant to be a secret number, by the way, see: Structure of an SSN) as your bank account number. Simply knowing it would give you access to financial capital belonging to another person.

Not only that, but knowing the SIN would also give you every piece of identifying information for that person, allowing online identity theft to be trivial: if you have their SIN (which must be broadcast over public networks in order for society to function properly*) you know everything about them and can spoof it.

Hell, credit card numbers in the real world are practically public knowledge in order to function too: the business doing...business with a customer acquires said card number in order to process the transaction. It's pure capitalistic trust that the number is only used for the purchase authorized by the cardholder. Emphasis: Authorized by the cardholder. Because of the known insecurity with this fact, card numbers can be invalidated and reissued as needed. You can't do that with bank account numbers (at least, not easily) or broader identifiers, like SSN or SIN.

*I mean, seriously, "SIN:#89239834271 made a purchase at S² Store #23897." The SIN is the primary key in a logical database, it has to be public. The reason you don't need to show your credit card number in order to check out is because you preauthorized it and the store just stores that info under your SIN in their logical database. Can you, as a hacker, get access to this information? Yes. Yes you can.

Well, it is attached to everything about you in the Matrix. The question is, how easy is it to correlate all that information?

Nowadays, it's not too hard. Using me as an example again: there is a lot of information about me spread out over the internet. If someone really wanted to hack my information, my only real defense is that I have a very common name, so it'd take a lot of filtering to figure out which John Smith is me.

But, with a SIN? It is a unique identifier, basically tagging all my info with my name. They can easily tell which John Smith is really me, so at the very least, correlating all the information is much easier.

The next question is, how easy is it to get all that information? Well, again comparing it to today, it's not that hard to get a lot. My credit report lists every address I've had for the last so many years, for starters. It also lists all my credit accounts-- not just major credit cards, but minor ones, like department stores-- if I had a Macy's or Toys R Us card, it'd show up as well. It also records every credit check done on me in the last so often, so in theory, they could also track everywhere that I requested credit at. They could also tell where I went to college, by looking at my student loans. It also references all my bank accounts, so if I had a mortgage, that'd be listed right alongside my checking and savings.

The next step, getting my purchase history, is a bit harder. Not impossible, though-- if you have my account number, you might use social engineering to get a copy of my statements. After all, banks mostly watch out for fraudulent transactions; a scam that doesn't steal any money is more likely to go through. So, really, my only defense is the sheer number of hoops a hacker would have to go through.

Let's postulate what'd happen in 2070. Given how easy it is to get a credit report on someone, and how commonplace they are, it stands to reason that credit report levels of information are easier to get. And your bank account is tied to your SIN, although I do agree that just knowing your account numbers would not equal access to them. Still, if running your credit report gives someone all your bank accounts, it's not a stretch to say that a SIN check also locates all your accounts and credit cards.

There seems to be an argument over rather or not it'd automatically give up your transaction history, so let's set that one aside for a moment. Something that is on your credit report is the name and date of every credit check done on you recently. Nowadays, that information goes away after a while, but since memory is so cheap in 2070, it might not ever go away. They could easily keep a record of every credit check ever run on you, since you were born.

So, while they might not know exactly what I bought, someone could easily tell that five years ago, Toys R Us made a purchase query via my SIN. It's not a big leap to assume I bought something there. If you search out the stores who ran checks on me most often, it wouldn't be much of a leap to assume those are the stores I buy the most at. There might be a lot of data to sift, but again, future computing and a SIN to tie it together makes it easier than today.

I think that Cain's position is a little exaggerated, but broadly correct.

Let me offer a more detailed explanation.

No, I don't think that instant knowledge of a SIN leads to utter availability of all related information. Obviously, as has been pointed out, the information needs to be retrieved. On the other hand, there are important implications in the 4th Ed wireless and cyber rules which make it a hell of a lot uglier.

Here follow a few mild illustrations.

Sweet Suzie goes wandering in a forest, all alone. Nobody but the hungry bear trailing her cares, nobody but the hungry bear and the local ticks infesting her daisy dukes knows.

Sweet Suzie goes wandering in Redmond. Anybody who lays eyes upon her supple but pneumatic form knows, and maybe some of them with fiscal balances in mind care.

Sweet Suzie goes wandering in an upscale area of Seattle, but forgets to grab her personal electronics before doing so. She's picked out in seconds by the static observation units, tracked by drones, and an armed response team immediately goes on high alert. As a matter of immediate priority, facial recognition, gait recognition, and identity databases come into play. Anyone walking around there with their AR up knows pretty darned quickly that the area around her is likely to go hot - not because they know anything about her SIN, but precisely because there's no data trail, so they scram ASAP. Shop doors clang shut, steel bars fly across entrances, until the Imminent Terrorist Threat passes. Poor Suzie, it was an honest mistake and assuming she cries and begs for mercy adequately she'll get off with a hefty fine. Best case, once the recognition systems pick out her identity based on best known last identifying factors, she's identified as low risk, and offered a chance to hold her arms behind her back and get into the kopkart on her own legs instead of getting her nose broken by a shotgun muzzle slammed into it before her knee is broken as a precautionary measure.

Sweet Suzie goes wandering in an upscale area of Seattle, but grabs her personal electronics this time. Everyone who has come across her before has further information (even a crummy commlink can contain a lot!) on her movements, and can automatically establish a more comprehensive personal dossier on her. This includes regular passers-by, the creepy stalker behind her, every shop she has entered (and to which she has provided payment information, and which shares, for a small fee, personal information with other shops), the municipal authorities (which engage in the same data sharing plan - to foster commerce and public safety of course) and of course to cap it all there's the barely pubescent 1337 h4xx0r on the corner who has just done unto her commlink what he fondly dreams he could do to her vulva, in the hopes of finding a 3D selfie, or planting spying tools in her commlink so as to better perv/stalk her at his leisure and after she leaves the shopping zone. Do all these fine samples of metahumanity have total global access to all information linked to her SIN? No. Does it matter? Not as much as you think. How much is available to bad actors? Enough. See below for more.

Sweet Suzie goes wandering in an upscale area of Seattle, but got paranoid for some reason. As long as nobody manages to pick out (improbable) the discrepancy between her physiological manifestation and her electronic presence, she can be (mostly) incognito, in the sense that she's flying under an assumed identity, presumably an identity which seems to be legit and will be every bit as closely tracked as any real identity (which is extremely closely, since the marginal cost of the necessary information technology services is near-nil) - which means that if she was ever around in her personal capacity she can almost certainly have her fictional identity correlated by physiological markers with her real identity with very high confidence, very quickly. Assuming THAT little nugget of information doesn't result in immediate deployment of heavy armament (because only terrorists, shadowrunners, and shadowrunning terrorists ever do that) she gets to wander around, falsely secure in her utterly failing to pull the wool over local monitoring's eyes. Except for the creepy stalker and the 1337 h4xx0r, who don't really care what the real identity of any of her is, so much as the immediate relative hotness of her daisy duke wearing ass.

Now, as to why the total availability of her SIN's global information is less relevant than you think:

4th Ed made it crystal clear that there is no encryption which cannot be cracked. And there is no system which cannot be cracked. None. You have enough time, enough dice, enough toys? You have total ownership of effectively anything. Renraku puts their most sensitive data on their studliest machine? Irresponsible. That machine is vulnerable, per rules as written. And once data genies get out, stuffing them back into bottles is - well, it's a challenge. And given that it is absolutely canon that there are numerous crackers who can get their way into SIN databases, linking them with identities as well as accounts and other highly sensitive personal information, there's no reason per the rules to believe that there's anything fundamentally trustworthy or inviolable about the systems underpinning this data.

Got that? Canon, in multiple ways, makes it very clear that if you have a SIN, someone, somewhere, can get damn near anything linked to it, and if someone, somewhere, has enough money they can pay the people who can get that data to hand it over, and that megacorps are sufficiently many-tentacled and influential to have, should they choose, open access to a very large subset of that information.

So, let's do a little review:

According to 4th Ed rules as written, anyone who goes into any moderately surveilled or monitored area should fully expect:
their physical and electronic footprint to be monitored for the duration
their physical and electronic footprint to be correlated with a substantial subset of prior data
their physical and electronic footprint to be available to authorities for multiple reasons
their accumulated personal data to be effectively public knowledge to anyone who really gives a damn

These are the direct, technical outcomes of the rules as written.

Does it mean that everyone always knows everything about everybody? No.
Does it mean that it is universal? No.
Does it mean that megacorps and governments afford each other total insight? No, although cracking teams mitigate that difference anyway.
Is the data available instantly? No.

It doesn't really matter. The data can be available in ten minutes (soon enough), and cover 90% of what's available concerning her movements in the area (complete enough) that the difference is not worth discussing.

The difference between the omniscient panopticon and the partially informed panopticon are, from Suzie's point of view, minor at best. She's still their bitch.

I gotta be honest, you've neither defended Cain's ludicrous position nor really, IMO, provided any commentary that is opposed to most of the posts in this thread...

Well Cain, I see where your'e coming from, I really do. And I understand given the premises you're extrapolating, your reasoning is sound.

However my fundamental disagreement with your stance comes from not at all agreeing on how the Sixth World works. Given today's internet, and computing systems, sure that's logical… so long as all traces, credit histories etc etc are conducted with data governed by a single system. Where I think your argument is flawed is that you don't at all account for the sheer amount of Data Balkanization that is inherent to the world.

This world has deviated from our own in such a way that Corporations are their own nation. Remember that. The Business Recognition Accords grant extraterritoriality to any AA or AAA company, which means they have their own systems and their own registries and data networks (represented by Grids in 5e at least). And even if you don't look at that my way, ask yourself "Why did Captain Chaos create Shadowland?" As a Neo-Anarchist, what was his motto? The entire premise of much of early Shadowrun and Neo-Anarchist ideology is that "information should be free." At its base, this implies that the information is not in fact free. Even today, there are discussions about internet balkanization, with various countries considering cutting off data sharing completely. In the dystopian Sixth World, it's a reality, and I don't think it's nearly as easy to pull the records you're giving examples of, if even they exist in those forms in the Shadowrun As We Know It. If it does work like you've laid out then sure, but like I said, I don't believe the world structure is like that.

If that wasn't enough I have some examples:

Text from the SINner quality 5e states in regards to a Corporate Born SIN

In regards to a National SIN it says

Both of these blurbs imply that though you can be looked up on a Global Sin Registry™, even the information registered with the SIN is not universally available. SOMEONE has access to it, and could be convinced to sell or distribute the information, but is it readily available? I think not.

Now could someone with the know-how and mental fortitude find out a lot about you from your SIN? Certainly. Of Such things are Shadowruns made of. But it wouldn't necessarily be easy, nor would it be fast.

I think though that perhaps we all kind of agree with one thing: Whether the system works the way Cain thinks or the way Redjack thinks it's not really conducive to good storytelling? Am I correct in assuming this?

So perhaps the discussion should swing to how SINs should work, rather than debating the finer points of how they do in RAW.



I hate this with a passion. I hate it to it's core. It makes the game utterly unplayable or a book-keeping nightmare at best AND it's boring. Whoever dreamed up facial/gait recognition software in Shadowrun needs to die in a fire (nah, but I hate it heaps )! Not only that, but I think it's 4th ed kind of mis-interpretting the point of SIN checks. People without SINS usually aren't dangerous, it's just that they're smelly and poor. So the SIN check is really just there to keep poor people out of rich areas. Gated estates if you will. In mygames the above might happen if you walk into a court or a police station, parliament, something like that. Not for j-walking.

But besides that it's just bad game design. Here's what I care about with Shadowrun: Guns and cool stories. What I don't want is book-keeping. SIN scans aside the whole SIN/licence system is a drag on the game. My character has a whole column of his character sheet dedicated to fake SINS. What the ID is, what licenses I have, what lifestyle it's attached to, whether it has been compromised or not.

Here's what I want it to be: Fake SIN(R4) Malcolm Switchback: Security consultant.

That's it. No fraggin licences, no caring about the lifestyle, and an assumption that cops are too stupid to put 2 and 2 together. You've got a gun? Of course you do, you're a frackin security consultant. Then common sense applies to item restriction. If your fake SIN is that of a baker, then there's no justifying that rocket launcher, whether you bought a licence or not. The SINgets burned when you rock up to somewhere and use it to get in and then shoot someone in the face. Otherwise the investigation is too much effort for corrupt officials.

As I said earlier: Scifi Noir. Shadowrunners have a mission, they cruise around and talk to people, investigate, maybe rough a few douchebags up, bribe a few cops, whatever. The sci-fi is just window dressing. It should matter when you start doing the illegal stuff, but not before.

That's my dream for 6th edition.

Honestly, I more and more miss 2e, because there's no way concepts like the Rocker or slumming Megacorp kid work in 4/4A/5E. Too many ways for them to be easily caught by anyone with half a brain.

Hell, Distinctive Style is a death sentence if you play the security rules by pure RAW, because you've introduced a common factor to all your identities that's easily correlated.

I admit, I'm taking a heavier approach than others. Still, I don't think even a lighter approach is any better.

In order for the wireless matrix to work the way it does, there has to be a lot of data sharing going on. And since SINs do index all your data, it means it's easier to retrieve and collate. So, even if you dial back my premises some, there's still an awful lot of information about you that's readily available.

I'm not an expert on search engines, but I have a few friends who work in Search Engine Optimization. As i understand it, modern search engines work on a tagging concept-- information has identifiers that are compared to your search string, and displayed in that order. It's very possible to mess with this, and make it so certain bits of information are placed more highly than others, that's basically what SEO is. So, if you put "Shadowrun" into Google, you'll get the CGL pages before you get Dumpshock.

So, when you run a SIN in 2070, you basically get everything tied to that SIN on the matrix, the same as if you googled yourself today. Because a SIN is apparently a perfect tag, there's no mistaking it for someone else's, all that data is really yours.

As I understand it, your point is that not all that data would be publicly available on the Matrix. I kinda see your point, some would require a higher level of access than others. The SIN would mean there are pointers to that information, you just couldn't actually get to it without permission, trickery, or hacking.

There are several catches. First is the fact that there is a ton of legal information out there, stuff that would have to be publicly shared to make the matrix work the way they say it does. If a store reads your SIN, they're going to check your credit rating and account balances, so they can target advertising to your budget (and preferably transaction history). So, they can locate your bank accounts, and have a decent idea as to your balances, and how much credit you have available. They might not be able to withdraw any money without more authorization, but they can at least look at the data. (It really isn't that different now-- if I have someone's account number, I can walk into a bank and ask to see the balance without showing ID. I'd get into trouble if I tried to make a withdrawal, though.)

The second thing to consider is that, even if we only say that information roughly equal to what you can Google today is public, that's still a heck of a lot. I keep a very low profile, but if I Google myself and spend a bit poking around, I can find my past addresses, going all the way back to 2000. If someone were able to cross reference my Facebook or other social media, they could find out a lot more about me-- they might extrapolate that I'm a Brony, for example, or that I like RPG's, or so on. Heck, just looking at my Facebook likes can give up a lot of that information! To to that off, not only are my relatives on Facebook, but they're actually tagged as family members, so someone could put together a decent picture of my family dynamics, all from a contemporary Google search. A SIN would make collecting all that information easier.

The third thing to consider is that, in order for the 2070 economy to work, the megacorps need a reasonable level of cooperation. The Ares wageslave bank has to be able to work with the Evo Credit Union, even if they're complete business rivals. So, if an Ares employee wants to buy something from an Evo store, they need to have some sort of mutual protocol in place, a data sharing plan. That means there's some sort of standard policy, where they all agree to share X amount of information on their customers with one another. Even if the parent companies hate each other, that level of transaction would be protected by all parties, because without it, everything would come to a screeching halt.

What if I am a SINner and break into a corporate stronghold?

The security system can access my Link, does that mean it gets my SIN?
Do I have to disable 'SIN display'?

Btw, I agree with Cain as well, for the most part.
The degree of corporation cooperation is the big factor here imho.

I'm not saying it's necessarily 100% believable Cain. Unfortunately, it's a wee bit too late for me to go point-by-point on your post at the moment since I'm about to crash. I'll touch on what I have immediate issue with here and try to catch the rest of your post when I'm more awake but here goes:
This isn't necessarily true…
but this is true enough. It just so happens there IS a centralized unit, run by the Corporate Court, which is equally shared roughly between all AAA Megacorporations. It's called the Zurich-Orbital Gemeinschaft Bank. For better or worse it controls the purchasing power of the . The Corporate Court keeps the peace politically while the Z-O keeps the pieces financially. In many ways they're the two sides of the same coin.

Again, apologies but it's too late for me to to fully answer the rest.

Nation states have organized in the UN, and the League of Nations before that. None of that stops them from hating each others guts, or being in a state of perpetual low-intensity warfare against each other -- again, you should remember what the activity which gave this game its name entails.


You did, right in the section I quoted. From "Every datum associated with you (i.e., already non-anonymous) is underwritten with the SIN" to "the SIN does index and link every legal piece of information about you"


More like back to page 2, where you already were told what different levels of SIN checks entail. Running a credit report would be an R4 check (though you were right in one regard, I was using the outdated PDF. Not that it changes any of those rules, just the location of the tables)

Not necessarily - it means that some careful thinking needs to be applied to how the SINless society works, why and how shadowrunners can operate and so forth. If, for instance, the thoroughly policed areas are small, isolated and tightly controlled, their existence is basically irrelevant for 90% of the world's population. In that case you can view shadowrunners more or less as fast-moving insurgents into those areas. They just have to accept that if they set foot there, they have a narrow window of time in which to operate before the heat comes down.

If the whole world is a panopticon (which it isn't, by the rules or by the fluff) then it's game over. There are no runners.



Dude, I hope you're sitting down because I have some really big news for you:

Facial and gait recognition are real. Like now. Today. Perfect? No, but rapidly improving and they are actually used on a daily basis in the real world. I know this because I have dealt with installations (and I keep up with the tech press because hey, why not - I play Shadowrun). And given the corporate nature of the cops, they absolutely will go for jaywalkers - fines help justify their existence to the taxpaying overlords. Just like automated tollbooths and red light cameras today. And because Big Data is also a real thing, today, you bet your boots they will mine the ever-loving crap out of that data to improve their hit rate when it's prosecution time.

So yes, they know that John the John and Hettie the Hooker went around the corner, and came out five minutes later, smoking, and that financial records indicated that NY300 passed between them, and that this means that John can't have been the bank robber who kindasorta walks like him, who hit Horizon Employees Credit Union around the same time. Lucky John!




Fine. So run your games outside anywhere closely monitored. No corp compounds, no gated communities, hell, nothing with a security rating above a C-. Problem solved.

I think the SIN rules are essentially fine as written. At least, as long as you assume that things work differently in the Barrens, where there's a healthy cash/barter economy going among the SINless.


Off-topic, but it's not for ID, they want the card so they can charge you if you bust up the hotel room or the rental car.


A SIN is broadcast at all times when in public spaces. That logically means that it can't be used to access anything meant to be secure.


Here's how I would work this, if I were writing smart fridge software. You create a "fridge account". You set up direct deposit from your bank into this account, whatever your monthly food budget is. The fridge looks at the amount of money coming in, your food preferences, and autonomously makes purchases accordingly (if that functionality is enabled). If someone hacks the fridge, they can blow all the money in the "fridge account", but they don't get the underlying bank account.


Let's say that the last time I went into Foot Locker, I bought Adidas sneakers. Foot Locker knows that. Now, every time I walk past a Foot Locker, I get ads for Adidas sneakers.

So, Foot Locker keeps an internal record of people's purchase history, indexed by SIN, and uses that to tailor ads. The SIN itself is all that's needed for tailored ads.

But if you gave John Q. Hacker my SIN, he can't tell what kind of shoes I've bought recently. If he thinks to hack the Foot Locker purchase history database, he'll be able to find it out, but without first getting illicit access to Foot Locker's servers, he has no idea.


You need more than a SSN to get a credit report, at least in the US. You need a lot of info. And credit reports don't include bank balances, and I don't think they include major purchases either.


Presumably similar to the "fridge account", discussed above. If she creates an account with a particular store, she could have a standing arrangement where she just goes in, picks something up (sees an ARO that indicates price and remaining balance) and if she walks out with it, her account is debited.


I don't remember this example specifically, do you have a page number? But presumably, she chose to participate in this scheme. She set up the OkCupid account, linked it to her SIN, and now anyone with the same dating app on their commlink gets a little heart ARO over her head when they see her, if they click it they can access her profile.


Why do you think this is the case?


Law enforcement corps, Knight Errant and Lone Star, explicitly don't share information on criminals with each other. I don't think it's fair to assume any level of cooperation.

Megacorps will literally virus bomb each other's offices for a bit of a competitive edge, as long as they think they won't get caught.