I've been considering how to handle hacking in Fate. You could of course handle it as a single skill test when success means you successfully perform a subversive action. However I get the feeling that many players would want a bit more crunch to hacking with separate stages for probing, gaining access, and performing subversive actions like in EP Core.
This lead me to developing the idea of a hacking map. Having the Hidden, Covert, Spotted, and Locked statuses as zones on the map. Failing a subversion test moves you down a zone and succeeding with style moves you up a zone. You could represent the zones as concentric circles and attach multiple nodes together to represent more complicated networks. Your access level would probably be represented as an aspect. Moving into the Spotted or Locked zones causes gives the Alerted aspect with a free invoke to the system.
However, as I thought about the effects of moving from zone to zone, they started to look more and more like consequences. I considered replacing the status zones with a stress track, but thought that might slow things down too much. So then I considered a zero-length stress track with spotted and locked being mild and moderate consequences. The tradeoff being that the mild and moderate consequences do not fill character consequence slots and are separate for each system. I like this because it means that a single botched roll will alert the system and make the rest of the hack more difficult. Once the character has a moderate "Locked" consequence, the security can begin attacking the character's Rep or Composure with counter hacking, or simply lock the hacker out. I'd still use a zone map to represent nodes and available subversion actions. Maybe replace the status zone with access level zones so players can see what access level they need to preform the available actions. That makes hacking into a mini game of moving your character into the same zone as your desired action.
I haven't had a chance to playtest anything yet. I'm still torn between if access level should be zones or stress track+consequences/aspects, how long the stress track should be, and if consequences should fill character consequences or not. Anyone have any feedback or other ideas to contribute?
Welcome! These forums will be deactivated by the end of this year. The conversation continues in a new morph over on Discord! Please join us there for a more active conversation and the occasional opportunity to ask developers questions directly! Go to the PS+ Discord Server.
Hacking Rules Ideas
Thu, 2014-02-27 18:10
#1
Hacking Rules Ideas
Tue, 2014-03-25 05:43
#2
I run two EP games with Fate
I run two EP games with Fate rules. I created hacking rules where the hacker had an exploit track. The exploit stress track represents how many good exploits the character knows. The exploit stress track was short and refreshed only at the start of each session. If a character wants to hack a system, he defends with his hacking skill against the security value of the system. He always gets in the system, but needs to stress damage and consequences if he is not good enough.
The advantage of this approach is the characters get into all systems (if they are willing to take the consequences) but are always cautious (“don’t use your exploits on this system, maybe we need them later”).
I had additional ideas for a bot net stress track for denial of service attacks but never tested them.
Thu, 2014-05-15 18:26
#3
I've been using the Diaspora
I've been using the Diaspora Social Combat rules more recently and it's given me a few more ideas on hacking. I think I'd use access privileges instead of statuses as zones on a map. I'd represent each node as concentric circles with admin, security, and user levels with admin in the center. Id place the various actions and active security in the different zones, and various boundaries to represent firewalls, etc. Players must maneuver themselves and the desired actions into the same zone (using the Diaspora Social Combat rules) before the time limit to be successful. For probing, I'd use a time track with a longer time interval, but few consequences for failing. For brute forcing, I'd might use a time track with a shorter time interval to represent time until you're traced, or just use mesh stress track.
Ideally, I'd combine the hacking with other investigation activities on the same map so all players could participate. For example, maybe the team needs to track down three clues, one by interrogating a prisoner, one by searching a room, and another by getting encrypted data off a node. I'd put everything on one map so the players could move around simultaneously to collect all three clues.
I'd probably only do this for complicated tasks. For simple hacks with few consequences (like overriding a low security door or something) I'd probably resolve as a single roll.
Mon, 2014-05-26 15:41
#4
Let us know if you ever get to playtest this
I'm curious about how it works out for you. It sounds complicated to me, but maybe I'm not looking at right.
—
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/IU.jpg[/img]
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/TC.jpg[/img]
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/AU.jpg[/img]
Wed, 2014-05-28 21:01
#5
I haven't had a chance to
I haven't had a chance to play test my hacking idea yet, but I have used Diaspora social combat a few times with great success. It's easier that you'd think because each roll represents large abstract efforts instead of each individual action.
I think the trick is to get everyone involved by either having each character have something to do, or combining characters into teams where they can share skills. A great example is a heist. Lets say you need one character to create a distraction, one character to disable the security systems, and one to sneak into the vault and steal the macguffin. Include the hacking circles on the rest of the map instead of breaking it into it's own subsystem.
Each time one of the characters makes a move, the GM get to make a counter move that can be in any area of the map. This makes the action jump around as things go wrong and keeps everyone involved. For example, if the player does really well on his hacking attempt, the GM can change focus and have some of the guards go back to check on the vault or add additional traps that must be bypassed in the vault. The GM rolls more represent things going wrong or unexpected challenges rather than actual active resistance, although it can be that too.
I'm planning a session soon where I use social combat for a research/archaeological dig. The players have to move all the clues to the center of the map (a 3x3 grid). All the clues are visible on the map so the players know where to look, but the players don't know what each clue is until they move it to the center of the map to "solve" it. GM rolls are for things like environmental hazards/obstacles, exhausted or disgruntled crew, legal restrictions on historic grounds, etc. You could do a similar thing for hacking to steal sensitive data.
Sat, 2014-05-31 11:17
#6
How does this work narratively?
Do you describe everything in story terms, or do let the dice rolls speak largely for themselves? Some of what the players are trying to accomplish may be rather abstract. How do you address this?
—
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/IU.jpg[/img]
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/TC.jpg[/img]
[img]http://i1111.photobucket.com/albums/h469/Jefferson_Watson/AU.jpg[/img]
Sun, 2014-06-01 23:16
#7
Yes?
Yes? I'm not sure what you mean. I have players describe their actions abstractly, roll the dice, and describe the result in story terms. Maybe an example is best.
My players were trying to start a revolution. The first thing they wanted to do was get support from the people. One player started describing how he was searching for someone who could help him organize underground meetings. I told him that was pretty much a given considering the whole team was helping him and they had plenty of time. Then I told him to think bigger and more abstract; explain the actions he would be taking over several days. He then described how he would organize underground meetings and give rousing speeches to stir up discontent and gain support. I decided the speeches were the most important factor, so I had him perform 1 Oratory skill check to represent all of his speeches over several days. The corrupt government resisted by rolling their Propaganda skill, but the player was able to generate some shifts to move the people towards rebellion. I then described how their movement was gaining support and how people were starting to protest in the streets.
Then the government got to act. I decided that the government was going to respond by increasing the prices of basic necessities to keep the people too busy working just to make ends meet. The players decided they were going to steal food from the government warehouses to give to the people. One player started describing how he was going to carefully craft explosives that would blow through the walls but not damage the food. I told him these were good details, but describe his broader actions. He then described how he was going to lead a team of rebels in a series of smash and grab strikes against several warehouses using expertly timed explosive strikes to avoid direct confrontation, then distribute the food amongst civilians. I decided the primary skill of interest was Demolitions against the government's Security skill and had him do one roll for the whole operation. I then had the government respond by attempting to assassinate him with an air strike while he was escaping in a truck which he was able to avoid with a Drive test and his "Hard to Kill" aspect. This continued for several more rounds with different players describing their actions in broad terms and rolling the most important skill and describing the results, then deciding on how the opposition would react and having the players respond in kind.
In Eclipse Phase hacking, you might try to track someone using a series of spimes, or plant false information to throw pursuers off your trail as a action during social combat.
On an somewhat related note, I was thinking about how the Fate Core four outcomes could relate to hacking. You have Succeed with Serious Cost, Succeed with Minor Cost, Succeed, and Succeed with Style. Succeed with Serious Cost could be locked status with a security team or counter hacking dispatched. Succeed with Minor Cost could be spotted status with increased security alert for further actions. Regular Success is self explanatory. Succeed with Style can give an free tag aspect to use later. This would probably be a better approach for short term obstacles in a given scene.
Sat, 2014-12-06 23:52
#8
It’s a puzzle, and like most
It’s a puzzle, and like most EP->FATE conversion puzzles it seems to boil down to trying to translate concepts EP cares a lot about into concepts FATE cares little or nothing about.1 The trick is to find concepts both care about and focus there.
For FATE, it’s all about the interactive narrative and handing nearly everything as a character interaction. Therefore, the security statuses seem very important, since they lead to narrative consequences (countermeasures) and the FATE point economy. The access privileges and account status by contrast do not seem particularly important [to FATE] and can probably be handled by “being awesome” in your shifts. The other thing it strikes me FATE cares about is whether the system being hacked is Aware or Unaware in terms of the countermeasures the system deploys.
So a zone map would include the targeted System as a mobile “character.” Unaware, rather machine-like in the Skills it can deploy; Aware, nimble and able to summon additional resources and perhaps even access the FATE point economy.
Rather than concentric circles the zone map might instead be better imagined as like Diaspora’s planetary cluster maps, some nodes with only one potential destination [Outside Firewall/Locked Out <-> Inside Firewall] and others [Admin Status] as hubs to many nodes and destinations (and zone maps).
The target “System” is mobile player on the map, perhaps rather mechanical in its aspects and movements and options (countermeasures) unless it is Alerted, at which point it gains aspects and allies and perhaps even a FATE point or three—an active opponent much more difficult to corral on the zone map without taking on consequences. Hardened or ultra-secure systems can be granted an extra point or two rating (as like Armor) to represent their toughness.
It’s an interesting thought puzzle, for sure. Fun to think about!
[h5]1 See comment threads inre Wealth / Reputation modeling. EP is pretty fiddly on Rep bookkeeping, whereas FATE doesn’t really give a rip how things are acquired, merely that they [u][i]are[/i][/u] acquired.[/h5]
Sun, 2014-12-07 14:21
#9
I considered a similar model,
I considered a similar model, but it didn't hold up to a mental playtest. Hackers don't really move between the different access levels. They go directly from logged out to guest, user, security, or admin. And they usually stay there until they are locked out. Hackers also don't really move to the various action nodes connected to the user levels. Instead any action available to a user level can be preformed automatically if the user has that access level or higher, but requires a dice roll if it requires a access level beyond what the hacker has. I'm also not sure where a mobile system would move to on the map. It would simply stay on admin.
My current thinking is to correlate the levels of success with locked, spotted, hidden, and covert status. The desired access level still determines the base difficulty. Success with style or success with cost will raise or lower your status. If you become locked or do a brute force hack, you start hacking combat with data stress track where difficulties are increased and each failed shift causes data track stress until you are locked out, counter hacked, etc. This is actually fairly similar to what is in the EP Fate playtest.
Sun, 2014-12-07 15:46
#10
That’s an easier way of
That’s an easier way of conceptualizing it. What do you imagine the hacking team is rolling against? It sounds as if you’re treating the System as passive, but it strikes me the System is going to have its own Infosec as an opposed roll. I’d imagine the default “skill” for most systems would be +3 [ie, mook level NPC] but could even go as high as +6 for a hardened, sophisticated or ultra-secure system.
Also, how do you imagine other team members can contribute to the hacking sequence? One of the core ideas of FATE is that others can team their points to make you “awesome.”
Sun, 2014-12-07 17:26
#11
GenUGenics wrote:That’s an
Firewall rating? I don't think it matters too much if it's rolled or not.
Sure. I'd suggest a firewall skill rating +2 for security access or +3 for admin access or something like that.
I'm not fond of the straight bonus per number of teammates helping rule. I don't think it makes sense to have non-hackers help at hacking and I think it takes the spotlight away from the hacker during their time to shine. I'd maybe limit it to a single +1 bonus only if the teammate is of equal or -1 skill level of the main hacker. To coordinate a team of hackers I consider a completely separate challenge and is more based on your ability to plan and coordinate people rather than you hacking skill.
Otherwise I'd use the standard method of team members contributing which is by using aspects or by lending fate points.
Sun, 2014-12-21 23:06
#12
Borrowing from Diaspora Platoon and Social Conflict
Here’s a similar proposal that borrows heavily from Diaspora’s platoon conflict rules, as well as Diaspora’s social conflict rules. I've set it up so that all players can participate while still giving dedicated hackers the spotlight.
First off, make sure this is a conflict. If the details of a hack aren’t important enough to the narrative to be a full-blown event, just roll infosec vs. passive resistance and call it good.
Otherwise you’ve got a conflict:
Use a zone map to model the relevant network architecture. Have a zone for the hacker's access point, a zone or two for notable mesh areas connecting the access point to the target system, and then zones for the target system. Model passive sources of resistance (like firewalls) as pass-values for moving between zones. Use aspects to give zones some character ("public image board", "high-traffic hardline", etc). You can beef up a system’s security by adding aspects that favor the defending agents, or by giving those agents stunts that help them “on their home turf” (ignoring pass-barriers on their home zones comes to mind).
Then give each active agent (including opposing sysadmins or monitor AIs) a token on the map, and a "data" stress track tied to the interfacing skill. The location of the agent represents the focus of that agent’s attention within the system.
Just like in Diaspora’s platoon conflict rules: the default state for an agent is “stealth” or “undetected’, but you can have “spotting” tokens placed on you by enemy agents. You can only be attacked directly if you have one or more spotting tokens.
Regarding objectives: you can give rooms aspects that tie to physical actions, so that being in the “drone control computer” zone lets you control the cargo robots, while being in the “security camera feed” zone lets you see and wipe the camera data, etc. You can use pawns (like in the Diaspora social conflict) to represent data files to be returned to the access point, viruses to be delivered to the target system, and so on.
Then, proceed with turns just like in a physical conflict. Each agent gets a turn, and can do one of several things:
--Move around by rolling *interfacing* to overcome pass-barriers (like you would athletics in a physical conflict)
--Push along a pawn that’s in the same zone by rolling *interfacing* and giving shifts to the pawn to overcome pass barriers
(You could also let them roll interfacing once, and split the shifts between these two actions)
--Erode pass-barriers (e.g. firewalls) by rolling *infosec* against the barrier value and reducing the barrier by the number of shifts
--Attack a spotted agent by using an opposed *infosec* roll: damage shifts go to the data stress track, consequences are available as normal, and being taken-out could mean that you've been locked out and had your entry point traced.
--Attempt to spot a hidden agent by rolling opposed *infosec* to add “spotted” tokens
--Attempt to hide by rolling passive *infosec* vs the number of spotting tokens and spending shifts to remove spotting tokens
-- Boost or establish a firewall by rolling *infosec* vs the existing barrier value and spending shifts to increase the barrier value (this could be used to lock agents IN as well as out!)
--Create an advantage on a zone (e.g. “Locked Down!”, “Heightened Security”) or agent (“Tracer bug attached”, “Reading False Data”) using infosec
Like I mentioned up top, this allows you to involve all players while still giving the hacker the spotlight. Because the basic move uses interfacing instead of infosec (and everyone and their muse has interfacing) the other players can still move around, push along pawns, and serve as distractions - but you need a hacker to break down firewalls, remain hidden, and attack / defend against hostile agents. The only extra game mechanic is the spotted tokens, which aren’t bad to keep track of at all (use glass beads or poker chips or whatever).
What do you think?
Oh, on a somewhat related note, I like the idea of combining interfacing, infosec, and programming into just one “interfacing” skill, and using a “hacker” stunt and a “programmer” stunt to allow interfacing to function as those skills do now.
Edit: Using infosec to attack should apply spotting tokens to the attacker. Likewise, a dramatic failure on pretty much any action could apply spotting tokens.
Thu, 2015-01-08 16:59
#13
Sounds pretty cool, but I'd
Sounds pretty cool, but I'd probably only use it if everyone was playing as hackers or we had a hacking centric campaign. It's a bit much as a single subsystem within Eclipse Fate. I'd prefer to keep most hacking attempts to 3 to 4 rolls so as not to slow down the game to much for everyone else.
Sat, 2015-01-31 03:58
#14
bblonski wrote:Sounds pretty
That's fair! I don't think I'd use this much either - I tried to indicate that at the beginning of my post, but a specialized conflict of this scale would be pretty rare. I'd only consider something this complex for a major, plot-defining hack.
For smaller hacks I've been considering stealing elements from Jadepunk's dueling system, which meets exactly the criteria you've outlined. 1v1 duels in the street are a staple of the genre, so it distills them down to ~3 rolls, explicitly to prevent the rest of the table from getting bored. I think this could easily be adapted to hacking, but I haven't put together the details just yet.