In the previous post I have presented a number of issues I have with common cyberpunk games. Hacking has them all: a specific set of skill, equipment and rules that must be listed and learned and are a nightmare at the table. Let's look at how we can design an osr hacking system.

How hacking fits in cyberpunk?

• It is modern punk culture. Individuals are fighting the symbols of the global system using their tools and their wits.

• It outlines the consequences of modern technologies. Now suddenly your email account becomes a proof of identity and can be used against you. In the name of convenience everything becomes connected and those connections are not safe. People have a hard time grasping this new reality. Even corporate don't understand how to recognize good security because this is a very abstract domain. In the physical world you can look at a door and estimate how solid it is. Not so much with a server farm or a power plant.

• It is a versatile tool for players. Player can use it to manipulate information, take control of surveillance cameras, lock/unlock doors or even break stuff by operating them out of specs. In D&D the classic spell list has become more of a handy toolbox than a mysterious source of power. In cyberpunk hacking has gone from a mundane tool to an almost magical capability.

The risks

Hacking has some drawbacks. It is powerful for small organizations because it is much easier to attack than to defend. If a lone individual becomes a target he is immediately crushed. The only protection is anonymity. When a hacker tries to subvert a system, every trace left may be gathered to form a puzzle that will allow the target to notice him, locate him, and ultimately identify him.

Identifying a hacker may means that you recognize some patterns in his fake identities, or even his physical location. You can spot him easily but also send some people to arrest him. The hacker needs to lay low somewhere or make some drastic change if he wants to stay free (like getting rid of his equipment and find a new place to live).

Target states track

Time to convert all this in gaming concepts. First a player states that he wants to hack into something in order to achieve some goal. He will need some equipment and if your game has those, the right skill.

Then it should be a race. The player is trying to achieve his goal. The targeted system progresses on an awareness track. Each turns both sides roll a dice and advance on its track by a number of point depending on the result.

• Oblivious: no indication that anything is happening. If the player succeeds at this step it is a total victory. The goal is achieved without any negative consequence.
• Alerted: something is happening but few elements are available. At this point the attacker risks are rising quickly. Even if he succeeds at this step, he has left some minor traces. From now on the target might decide to shutdown its system in some cases to protect valuable assets. Shutting down the system might still be a form of minor victory for the attacker.
• Attack located: the system knows what is targeted and what means are used. It is now able to defend itself actively. Next rolls attacker rolls should be more difficult. Traces left by the attacker might lead to identification later even if the attacker stops and retreat.
• Attacker identified: the system is able to defend even better. The attacker will have to face heavy consequences sooner or later.

Special equipment

Rolls on both side should be kept simple (D20 vs DC using a stat or a skill). Special equipment like a custom program or chip might give a bonus or a penalty under interesting circumstances:

• -1 to detection checks when the hacking while connected with a wire inside a building hosting the system
• +2 on hacking rolls while the target is oblivious

Preliminary legwork (such as stealing an employee identity) should give bonuses.

What can hacking achieve?

Since hacking is a bit abstract it might be less intuitive for players to understand what they are able to achieve. You should remind them that any equipment that has some degree of automation (cars, doors, elevators, etc) is connected to the internet and vulnerable. Establish some truth about the world. Can cybernetics be hacked? Can memories be manipulated? The answers should be yours to define. Present an outline and make rulings when you need to. Don't forget to stay consistent.

So hacking can achieve a lot of things. But important targets will probably be well protected. Provide a way to probe those defenses. This can be in itself a hacking goal. The player goes blind. If he succeeds you give him some ideas about the DC and track sizes. Otherwise, this kind of information can be obtained offline thanks to bribery or from a contact.

Pacing considerations

Rolls should be swingy and change the situation. After each pair of rolls the player should have to decide if he pushes further or retreats. The system can have multiple targets with various difficulty levels to increase the complexity & stakes of those decisions.

As much as possible, hacking rolls should be intertwined with actions from other offline characters.

• the other PCs are fending of guards while waiting for the exit to unlock.
• a player has a fake ID and a guard has taken it for a check. Can the hacker register the fake ID before the guard scans the card?

So here we are. A simple hacking system with a single roll and some tracks. This still needs some details but I feel good about it.