A system contains data, programs, and devices (anything from cameras and locks to industrial machinery). A datafortress is a system or part of a system that protects restricted data, programs, or hardware: a firewall blocks access to its contents, and authorization checks if a user has permission to access it. A netrunner is anyone actively accessing these systems using a cyberlink; an intruder seeks unauthorized access to systems, while a sysop defends the system.
Systems also have terminals: computers in the same physical or virtual network. They are generally not considered systems, but it is possible to network systems together. A system could even only be accessible from another system; "air-gapped" or offline systems are only accessible from terminals.
Using these rules requires using a system through a cyberlink. Non-cyberlinked users can give directions to a system, but any actions taken as a result as considered to be taken by the system; the lack of neural interface makes the user's own skills largely irrelevant. In addition, most systems have enough automation to not need such instructions.
The following skills are important to netrunning:
Systems include servers housing datafortresses, as well as computers (often portable, sturdy cyberdecks) used to infiltrate them. For the purposes of these rules, systems have the following attributes:
A netrunner is always using a system: usually, an intruder is using a relatively weak system (a personal computer or cyberdeck), and a sysop is using a powerful server.
A system can have multiple concurrent netrunners using it: this is typical of important corporate and governmental systems with multiple sysops. Each user can take their own actions, but will generally need their own copies of any programs loaded into Memory.
Each extra netrunner using a system imposes a -2 penalty to the system's Speed.
An INT/System Knowledge test can be used as a complementary test for all netrunning against a specific system: if successful, the complementary bonus applies to all actions against the system, from attacks to indexing (but not sysops using the system).
Programs come in various types, and are measured in Level (generally 1–10). Without the appropriate program, a netrunner cannot attempt actions requiring it (but for actions where the program level would be added to the "defensive" test, it counts as 0).
De-Rez: To de-rez a program means to forcibly remove it from active Memory; it will remain in storage, and can be loaded back up.
(double memory use for anti-personnel software?)
...
To do anything useful, you must connect to a system. For most systems, you can do this online; some are public and easy to find, while others can only be connected to if you know where to go.
A netrunner will usually route or "bounce" their signal through servers, often compromised ones, to defeat traces.
Before connecting to a target system, a netrunner can place Steps between themselves and the system. Each Step reduces their Speed by 1. Generally, the netrunner can choose the security of the system they want to use as a Step: that is, they get to pick the DN that they and any trace have to defeat. To add a Step, the netrunner must succeed at a test of INT/Cyberlink Op vs. the chosen DN.
An established series of Steps is a Route, and a netrunner can keep and re-use a Route until it gets compromised (generally because law enforcement informs the system that it has been used for intrusion). A Route may be partially compromised (starting from the Step where logs were deleted).
A Trace will almost always eventually (usually within minutes, at most) complete, unless the netrunner is able to access a system used as a Step to delete or modify the logs.
If a netrunner has backdoored a system on their route, they can quickly access it to delete logs and stop a trace cold.
In some cases, a netrunner may want to actively cut off a trace at a Step the trace hasn't reached and the netrunner hasn't backdoored; in that case, they must penetrate the datafortress to modify or delete the logs—an entire second intrusion attempt. Thus, a long Route starting with an easily-penetrated system may be a good idea.
Note that your effective Route to a system that is part of your full Route is shorter. Thus, any new Trace launched from that system is going to reach you faster.
A netrunner who has physical access to a terminal on a system can use that to get into the system. For "air-gapped" or offline systems, this is the only way to get access. Regardless, the netrunner gets +2 to Speed and +2 to Spoof Authorization, Bypass Firewall, and Avoid Detection. However, there is no way to bounce your connection: a single Trace will locate the terminal they are on, but the netrunner gets one chance to mislead the trace with an INT + Cyberlink Op + Stealth test. If successful, the Trace turns up some other terminal on the system (but obviously, they still know the intrusion is from inside the system).
Just as in meatspace, netrunners take one or more actions per phase. A netrunner can simultaneously take meatspace actions and cyberspace actions. As usual, each action beyond the first in a phase imposes a -3 penalty on other actions.
Systems only take one action per phase, unless they are multi-core systems (in which case each core takes their own action).
Standard protocol for systems and sysops is to try to crash the intruder (Attack System) and start a Trace; if a sysop is present, they will do each on the first phase. Black systems will try Attack Netrunner instead of trying to crash them. After the Trace is going, the next priority is to Cycle Firewall.
Note: Each instance of a program may only be used once per phase. In order to use e.g. Attack Software twice in a phase, a netrunner must have it loaded into their system's Memory twice.
Intrusion Actions
Attacks (attacker is automatically detected by the system and all users)
Utility Actions
Netrunner: 3d6 + INT + Cyberlink Op + Speed
System: 3d6 + Power + Speed
Initiative is required only when a system or sysop is aware of an intruder, or when netrunners are taking conflicting actions (e.g. one is trying to access a file to copy it while another is trying to access it to delete it).
A clever netrunner might want to use Attack Software on the Authorization, Detection, or Trace software on a system. This is an option, but any attack on a system causes detection. Generally, a system or sysop will deal with an intruder before re-loading Authorization or Detection, but if Trace is de-rezzed, they will Load it back and run it immediately. (If Trace is de-rezzed and loaded back up, it will resume from the last Step it had reached.)
Note that a damaged program may be Unloaded and Loaded again to restore its full Level.
Intrusion on a system leaves tracks. Removing your tracks from a system requires penetrating the datafortress and Modifying or Deleting the logs. Deleting the logs is going to make the intrusion obvious, but there will be no way to figure out who did it. Generally, an intrusion will happen too quickly for any backups of the logs to exist, but if the intrusion happened days ago, a very secure system may have backed up the logs to a secondary (or even offline) system.
Defeating an ongoing trace requires, at a minimum, three actions: Disconnect from the current system, Connect to a System and Modify Data. The second cannot be combined with other netrunning actions, so this requires 3 phases. This assumes that the netrunner has spoofed authorization or backdoored the system used as a Step—if not, they must either Spoof Authorization or Bypass Firewall to access the logs.
Crashing whoever is tracing you will buy you more time, but they can pick the trace back up from the last Step they were at once they reboot.
If a system detects intrusion, it will instantly try to detect and close backdoors (3d6 + Power + Detection, or 3d6 + INT + Cyberlink Op + Detection, vs. backdoor DN). Regardless, backdoors have a chance of being detected monthly on low-security systems, or weekly on high-security systems. Every time a backdoor is used, there is another chance it is detected.
typical system trace DNs...
| System | Firewall | Speed | Power | Memory | Trace DN | Programs |
|---|---|---|---|---|---|---|
| Public server | +2 | +0 | +4 | 10 | 16 | Authorization +2, Detection +2 |
| Minor business | +4 | +2 | +8 | 20 | 18 | Authorization +4, Detection +4, Trace +4, Anti-Software +3 |
| Major business | +4 | +4 | +10 | 40 | 20 | Authorization +6, Detection +5, Trace +5, Anti-Software +4, Anti-System +4 |
| Government/Megacorp (grey) | +6 | +6 | +14 | 60 | 24 | Authorization +8, Detection +7, Trace +7, Anti-Software +6, Anti-System +6 |
| Government/Megacorp (black) | +8 | +8 | +18 | 80 | 28 | Authorization +9, Detection +8, Trace +8, Anti-Software +8, Anti-System +8, Anti-Personnel +6 |
| Deck | Firewall | Speed | Power | Memory | Cost |
|---|---|---|---|---|---|
| Basic Cyberdeck | +2 | +2 | +2 | 20 | $10,000 |
| High-Quality Cyberdeck | +4 | +4 | +4 | 30 | $20,000 |
| Top-of-the-Line Cyberdeck | +5 | +6 | +6 | 40 | $50,000 |
| State-of-the-Art Cyberdeck | +6 | +8 | +8 | 50 | $100,000 |
decrypting files...
meatspace netrunner stuff...
... multiple actions at cumulative -3 (hack something, do ECM/ECCM, and pilot 1 or more drones)...
Netrunner with cyberlink and some "extra actions" coprocessor running 2+ bodies at the same time ... Of course even without that you could have a daemon written for the job run someone's body to do something relatively simple