Hacking

In the wasteland, pre-Fall digital infrastructure didn't just survive — it mutated. Corporate servers still hum in sealed bunkers, their AI guardians running on corrupted directives. Settlement mesh networks stitch together salvaged routers and jury-rigged repeaters. Military installations defend themselves with intrusion countermeasures that can fry a hacker's neural interface. And buried beneath it all, the old internet — fragmented, feral, and full of secrets.

This chapter provides comprehensive rules for digital intrusion, network construction, and cyberwarfare. It expands on the Hacking advanced skill and the Technician's Cyberwarfare abilities with a full subsystem for interacting with the digital world.

For the Hacking advanced skill, see Advanced Skills. For the Technician's Hacker specialization, see Technician. For crafting tech systems (servers, AIs, networks), see Crafting.

Network Architecture

Every hackable system is a network — a collection of connected nodes defended by ICE (Intrusion Countermeasures Electronics). Understanding network architecture is the first step to cracking it open.

Network Tiers

Networks have tiers that determine their complexity, security, and the quality of data within them.

Nodes

A node is a discrete system within a network — a server, a terminal, a sensor array, a door controller. Each node has a type that determines what a hacker can do once they reach it.

Node Connections: Nodes are connected in a topology. The GM maps the network as a simple diagram — nodes connected by lines. A hacker moves through the network node by node, like moving through rooms in a dungeon.

Network Topology Types

ICE (Intrusion Countermeasures Electronics)

ICE is automated security software that protects networks. When a hacker trips ICE, it activates and begins countermeasures. ICE comes in three categories: White, Gray, and Black.

White ICE Passive (Defense)

White ICE doesn't attack — it blocks, logs, and alerts.

Gray ICE (Active Defense)

Gray ICE fights back — it disrupts, ejects, and traces.

Black ICE (Lethal Defense)

Black ICE is designed to kill. It targets the hacker's mind through their neural interface or connected device. Black ICE is illegal in most settlements but common in military and corporate networks.

Black ICE and Non-Neural Hackers: Characters hacking through an external device (terminal, datapad) instead of a neural interface take half damage from Black ICE (the signal is attenuated through the device). However, external devices are destroyed if they take 20+ damage from a single Black ICE hit.

Intrusion Procedure

A hack follows a five-phase procedure. In combat, each phase takes 1 action. During downtime, each phase takes the listed time.

Phase 1: Reconnaissance

Before attempting a breach, a hacker scans the target network to assess its defenses.

Check: Hacking or Technology vs. DC 12 (Tier 1) to DC 20 (Tier 5) Time: 10 minutes (downtime) or 1 action (combat, with disadvantage)

Success reveals (choose a number equal to margin of success ÷ 2, minimum 1):

• Network tier and topology type
• Number and type of ICE layers
• Number of nodes (approximate)
• Location of a specific node type (if you know what you're looking for)
• Whether an AI guardian is present
• Known vulnerabilities (+2 to your next Breach check)

Failure: You learn nothing useful. Failure by 5+ alerts the network that someone is probing.

Phase 2: Breach

Gain initial access to the network through the Gateway node.

Check: Hacking vs. the network's Base Breach DC (see Network Tiers table) Time: 1 minute (downtime) or 1 action (combat)

Breach Methods:

Success: You're in. You now occupy the Gateway node and can navigate to adjacent nodes. Failure: Breach fails. You can retry, but each failure after the first increases the DC by 2 (the system adapts). Failure by 5+: Lockout triggers (Tier 3+) or countermeasures deploy.

Phase 3: Navigate

Move through the network from node to node, bypassing ICE as you encounter it.

Check: Hacking vs. ICE bypass DC (see ICE tables) for each layer of ICE Time: 1 round per node (combat) or 5 minutes per node (downtime)

Navigation Options:

• Move to Adjacent Node: Standard movement. Encounter any ICE defending that node.
• Stealth Traverse: Move without triggering Watchdog ICE. Hacking check vs. Watchdog's detection DC. Failure triggers the Watchdog.
• Map Network: Spend an action to reveal all nodes adjacent to your current node and their types.
• Bypass ICE: Attempt to disable or circumvent ICE blocking your path. On success, the ICE is suppressed for 1 minute (combat) or 10 minutes (downtime).
• Destroy ICE: Permanently disable ICE. Requires beating the bypass DC by 5+. The network administrator knows ICE was destroyed and can rebuild it during downtime.

Phase 4: Execute

Once you reach your target node, perform the action you came for.

Check: Depends on the action (see Node Actions below) Time: 1 action (combat) or varies (downtime)

Phase 5: Exfiltrate

Get out cleanly. Exfiltration is automatic if no alarms have been triggered. If the network is on alert:

Check: Hacking vs. DC 15 (alert level 1) / DC 18 (alert level 2) / DC 22 (alert level 3) Time: 1 action (combat) or 1 minute (downtime)

Clean Exit: No evidence of your presence beyond what Loggers recorded. Messy Exit: Disconnect immediately Free but leave traces. Network administrators can identify your neural interface signature or device MAC address with a Technology DC 16 check. Trapped: If you fail exfiltration while Black ICE is active, you take one more hit from the ICE before disconnecting.

Node Actions

What you can do at each node type. All actions require 1 action in combat or the listed time in downtime.

Data Store Actions

Control Node Actions

Comm Relay Actions

Security Hub Actions

AI Core Actions

Vault Node Actions

Processing Node

Processing nodes contain the network's computational resources — servers running calculations, decryption queues, data analysis pipelines. Most hackers skip these, but a skilled operator can leverage raw processing power for significant tactical advantages.

Hacking in Combat

When hacking during active combat (not leisurely downtime), the following modifications apply:

Action Economy

• Each intrusion phase costs 1 action
• Bypassing ICE costs 1 action per ICE layer
• Node actions cost 1 action unless specified
• You can hack and take other actions on the same turn (3-action economy)
• You must maintain line of effect (an unbroken signal path — wireless range, wired connection, or network relay; not the same as line of sight) to a connected device or be within Neural Interface range

Concentration

Active hacking requires concentration, following the same core rules as spell concentration (see Magic — Concentration).

Will save DC: When you take damage while connected to a network, make a Will save. The DC equals 10 or half the damage taken, whichever is higher.

On failure: You are disconnected from the network entirely. Your avatar is ejected, all active hacking effects end, and you must re-breach the network from scratch on a subsequent turn. This includes losing control of any redirected systems (turrets, doors, locks).

Single concentration slot: You can maintain only one concentration effect at a time — whether that's an active hack, a redirected turret, a redirected security system, or a spell requiring concentration. If you redirect a turret (which requires concentration), you cannot simultaneously concentrate on a spell or maintain control of another system. Starting a new concentration effect ends the previous one.

Standing orders: Systems you've already reprogrammed (permanently changing friend/foe designations, disabled alarms, unlocked doors) do not require concentration. Only active, ongoing control (turret targeting, system override, live monitoring) requires concentration.

Combat Hacking Shortcuts

The Technician's Neural Interface and Hacker specialization bypass much of the intrusion procedure:

Non-Technician Combat Hacking

Characters with the Hacking advanced skill can hack in combat, but it's slow:

• Recon: 1 action (with disadvantage)
• Breach: 1 action
• Navigate: 1 action per node
• Execute: 1 action

A typical hack during combat takes 4-6 actions (1.5 to 2 full turns). This is intentional — the Hacking skill is designed for deliberate out-of-combat intrusion, not firefight hacking. The Technician class owns combat hacking.

Digital Combat

When ICE fights back or when two hackers oppose each other in the same network, digital combat occurs.

Initiative

Digital combat uses the same initiative as physical combat. If you're already in physical combat, your hacking actions happen on your normal turn.

Hacker vs. ICE

ICE activates when triggered and acts on initiative count 10 (or the network administrator's initiative, if one is actively defending). ICE attacks automatically — no roll needed from the ICE. The hacker must make saves or checks to resist.

ICE Threat Level scales with network tier:

Note: This table provides default DCs for generic ICE effects and GM-created ICE. The specific ICE types listed in the White/Gray/Black ICE tables above have their own fixed DCs that take precedence. For example, a Firewall explicitly scales by tier (DC 14/17/20), while Neural Spike always uses DC 19 regardless of network tier.

Digital Combat (Hacker vs. Hacker)

When two hackers meet inside a network, combat resolves through a 3-round Digital Duel — a structured battle of wits, exploits, and nerve. Each round represents seconds of furious code execution and counter-intrusion.

Initiative: Both hackers roll Initiative normally. The higher Initiative acts first in each round.

Round 1 — Probe: Both hackers make contested Technology checks. The winner learns the opponent's loaded programs, connection method (neural interface, deck, terminal), and current network access level. The loser learns nothing. Tie: both learn connection method only.

Round 2 — Exploit: Both hackers make contested Technology checks. The winner chooses one effect:

• Eject from Node (Safe): Opponent is pushed out of the current node and must spend 1 action to return.
• Deploy ICE (Aggressive): A program you have loaded activates against the opponent as if they triggered it. The opponent must resolve the ICE normally.
• Steal Program (Risky): Attempt to copy one of the opponent's loaded programs. The opponent makes a Will save (DC = your Technology DC). On failure, you copy the program into an empty slot. On success, you learn which program they protected but gain nothing.

Round 3 — Resolution: Final contested Technology check. Results:

• Win by 5+: Opponent is ejected from the network, takes 2d8 psychic damage, and their connection point is traced (you learn their physical location).
• Win by 1-4: Opponent is ejected from the current node only. No damage. No trace.
• Tie: Both hackers are ejected from the node. Neither takes damage.

Disengage: At the start of any round, either hacker can Disengage as a free action, exiting the duel. The disengaging hacker is ejected from the current node (not the network) and the network alert level increases by one step.

Action Economy: Each round of a Digital Duel costs 1 action per hacker. A 3-round duel consumes all 3 actions in a turn. If one hacker has actions remaining after the duel ends (e.g., the opponent Disengaged in Round 2), they can use remaining actions normally.

Active Network Defense

A network administrator (an NPC or player character) can actively defend their network. This takes concentration and limits them to 1 action per turn for physical actions.

Network Alerts

Networks have four alert levels that escalate as intrusion is detected.

De-escalation: If no intrusion activity is detected for 10 minutes (downtime) or 5 rounds (combat), the alert level drops by one step. Reaching the Security Hub and disabling alarms drops the alert level to Green immediately. Lockdown cannot be de-escalated — it must expire (1 hour) or be bypassed.

Logger clarification: A Logger ICE records each unauthorized access event (failed check, bypassed ICE, accessed restricted node). Three recorded events within 1 minute automatically triggers a Yellow alert. The Logger itself does not count as a "Yellow trigger" for Red escalation — only the resulting Yellow alert does.

Programs and Hacking Tools

Hackers can carry software tools that provide bonuses or special capabilities. These are crafted or purchased items (see Crafting for construction rules).

Common Programs

Advanced Programs

Program Slots

A hacker can load a limited number of programs into their interface or device at once:

Swapping programs requires 10 minutes and access to your program library (stored on a data chip or at a base terminal).

Using Programs in Combat

Programs loaded into a hacking device (datapad, neural interface, custom deck) follow these rules during combat hacking:

Passive Programs (Ghost Protocol, Neural Firewall, Signal Mask): Always active once loaded. No action required. Their effects apply automatically as long as you are connected to a network.

Active Programs (Icebreaker, Skeleton Key, Virus Payload, Data Siphon): Activating an active program costs 1 action (or replaces one Navigate/Execute action during a hack). You can activate a maximum of 1 active program per turn — even if you have actions remaining. Programs that target ICE or nodes resolve immediately.

Reactive Programs (Counter-Intrusion, Tripwire): Activate automatically when their trigger condition is met. Do not cost an action. You can have multiple reactive programs loaded, and each triggers independently.

Program Slots: Your device's program slot limit (datapad 2-4, neural interface 4-6, custom deck 6-10) determines how many programs you can have loaded simultaneously. Swapping a loaded program for a different one requires 10 minutes outside of combat or is not possible during combat.

Secure Tunnels

A secure tunnel is an encrypted point-to-point communication channel that resists interception, tracing, and tampering. Tunnels are critical infrastructure for factions, trade networks, and covert operations.

Creating a Secure Tunnel

Requirements:

• Two endpoints (physical devices: comm relay, server, terminal, neural interface)
• Both endpoints must be powered and operational
• Hacking or Technology proficiency

Check: Technology DC 16 (local, <1 mile) / DC 18 (regional, <50 miles) / DC 22 (long-range, <500 miles) / DC 26 (satellite relay, unlimited) Time: 1 hour (local) / 4 hours (regional) / 1 day (long-range) / 3 days (satellite) Cost: 50 cr + 2 Tech (local) / 200 cr + 5 Tech (regional) / 1,000 cr + 10 Tech (long-range) / 5,000 cr + 25 Tech (satellite)

Tunnel Properties

Tunnel Encryption Tiers

Maintaining Tunnels

Tunnels require periodic maintenance or they degrade:

• Check: Technology DC 12, once per month
• Failure: Tunnel reliability drops. 25% chance per use that the connection drops or data is corrupted.
• Neglected for 3+ months: Tunnel collapses. Must be re-established from scratch.

Physical damage to either endpoint immediately severs the tunnel.

Tunnel Operations

Who can create a tunnel? Any character with Hacking or Technology proficiency and access to a compatible endpoint device (comm relay, server, terminal, or neural interface). The initiating endpoint must be a device you physically control or are currently hacked into.

Endpoint initiation: Once a tunnel is established, either endpoint can initiate communication. The receiving endpoint does not need an operator — data can be sent to an unmanned terminal for later retrieval.

Can tunnels be traced? Standard ICE and network monitoring cannot detect an active secure tunnel. Detecting a tunnel requires one of:

• An Adaptive AI or higher (cognitive level 4+) actively scanning: Investigation DC 22
• A dedicated counter-intrusion scan by a skilled hacker: Technology DC 20, requires 10 minutes of active scanning
• Physical inspection of the endpoint hardware: Investigation DC 18, requires physical access to the device

Tunnel destruction: Destroying or powering down either endpoint immediately closes the tunnel. Data in transit at the moment of closure is lost. The remaining endpoint receives a "connection terminated" alert but no information about why.

Tunnel limits: A single device can maintain a maximum of 3 simultaneous tunnels. Each additional tunnel beyond 3 requires a Technology DC 20 check to establish (the device's bandwidth is strained).

Building and Defending Your Own Network

Characters who establish a base (see Downtime) can build and maintain their own network. This provides communication infrastructure, data storage, and defensive capabilities.

Network Construction

Use the crafting rules in Crafting for building individual components. The network as a whole is assembled from these components:

Installing ICE on Your Network

You can install ICE on your network's nodes to defend against intrusion.

Requirements: Technology or Hacking proficiency. Security Server node must be present.

ICE Maintenance: Each piece of ICE requires a Technology DC 12 check per month to maintain. Unmaintained ICE has a 25% chance of failing when triggered. ICE destroyed by intruders must be reinstalled from scratch.

Class Feature Synergies

The Hacking advanced skill is available to any character, but certain class features change how characters interact with networks. The Technician remains the undisputed master of digital systems — the features below provide alternative approaches, not replacements.

For Technician-specific hacking features, see Combat Hacking Shortcuts above.

Scavenger

• Salvage Data (L1): When a hack fails or you are ejected from a network, spend 1 Salvage Die to salvage data fragments. You recover partial information from the last node you accessed — enough for one useful detail (a name, a location, a partial schematic, a security rotation schedule) at the GM's discretion. This doesn't require a check but can only be used once per network per day.
• Jury-Rig Access (L6 Tinkerer): You can bypass a Gateway node on Tier 1-2 networks using Engineering instead of Hacking. This takes 2 actions (instead of the normal Breach phase) and requires physical access to the network's hardware. On success, you enter the network at Alert Level Yellow (the bypass is noisy). This does not work on Tier 3+ networks.

Infiltrator

• Intel Dice — Reconnaissance (L1): When performing Phase 1: Reconnaissance on a network, spend 1 Intel Die to gain advantage on the Hacking check. On success, you also learn the network's topology type (Linear, Star, Mesh, Tree, or Airgapped) in addition to the normal reconnaissance results.
• Contingency — Digital (L2): You may prepare one of the following digital contingencies: Dead Man's Switch (if you are forcibly disconnected, one pre-selected data file is automatically copied to your terminal), False Trail (when detected, the Trace ICE targets a spoofed location — you gain 1 extra round before your physical location is identified), or Backdoor (if you successfully exfiltrate, you leave a hidden access point; your next Breach check on this network within 24 hours has advantage).
• Cascade Failure (L6 Saboteur): When you successfully compromise a Control node, you may trigger a cascade failure. The network's Alert Level increases by 2 (affecting all other hackers present) and one connected node of your choice goes offline for 1d4 rounds. This is loud, aggressive, and distinctly not how a Technician would do it.

Psion

• Psionic Interface (L1, requires Telepathy discipline): You can interface with an AI Core node using Psionic Power (WIS) instead of Hacking (INT). This bypasses the Gateway entirely — you connect directly to the AI's consciousness. However: this only works on networks that have an AI Core node, you can only access the AI Core (not other nodes), and the AI gets a Will save (DC = your Psionic Power DC) to reject the connection. On a failed save, you can communicate with the AI, attempt to persuade or deceive it, or extract information it has access to. Sapient and Transcendent AIs are immune to compulsion through this method but can still be communicated with. Each round of psionic interface adds +1 Focus.
• Psionic Breach (L5): Spend 2 Focus to force a connection to a Tier 1-3 network's Gateway without equipment. Make a Psionic Power check against the network's Base Breach DC. On success, you enter the network in a limited psionic state: you can traverse nodes and access Data Stores, but you cannot use programs or hacking tools. You take 1d4 psychic damage each round you remain connected. On failure, you take 2d6 psychic damage and the network goes to full alert. This does not work on Tier 4-5 networks.

Mutant

• Biological Interface (L1, requires Heightened Senses or Prehensile Limbs mutation): You can interface with biotech networks (Kethara Collective systems, alien-grown networks, organic computing nodes) without a terminal. Your biological tissue forms a direct connection. You use Survival or Nature instead of Hacking for checks on biotech networks. This provides no benefit on standard electronic networks. Biotech networks are uncommon — the GM determines when this applies.
• Adaptive Response — Digital (L2): The first time you take neural feedback damage from ICE in an encounter, you gain resistance to neural feedback damage for the remainder of that hack. Your mutant physiology rapidly adapts to the attack pattern. This does not protect against Black ICE effects other than direct damage (Puppet, Cortex Bomb, and Mindburn still apply normally).

Web Hosting and Services

In the wasteland, the "web" isn't the old internet — it's a patchwork of local mesh networks, settlement intranets, and faction-operated relay chains. Hosting a service on this infrastructure is valuable and dangerous.

Hosting a Service

A hosted service runs on a server you control and provides ongoing functionality to connected users.

API Interfaces

An API (Automated Protocol Interface) connects two services or systems, allowing them to share data and trigger actions automatically. APIs are the glue that turns isolated systems into integrated infrastructure.

Creating an API:

• Check: Technology DC 16 (simple data sharing) / DC 18 (conditional triggers) / DC 22 (complex multi-system integration)
• Time: 4 hours (simple) / 1 day (conditional) / 3 days (complex)
• Cost: 25 cr + 1 Tech (simple) / 75 cr + 2 Tech (conditional) / 200 cr + 5 Tech (complex)

API Types

API Security

APIs are attack vectors. Every API you create is a potential pathway for hackers.

• Unsecured API: Any hacker who reaches the API's node can use it to access the connected system. They don't need to breach the remote system separately.
• Authenticated API: Requires credentials. Adds the API creation DC as the bypass DC for unauthorized use.
• Rate-Limited API: Only processes a set number of requests per minute. Prevents brute-force attacks but limits legitimate throughput.
• Encrypted API: Data in transit is encrypted at the tunnel tier used by the connection.

Best Practice: Always run APIs through secure tunnels with authentication. An unsecured API connecting your base's control hub to a remote turret is an invitation for someone to turn your own guns on you.

Quick Reference

Intrusion Phases

Common DCs

Hacking Skill vs. Technician Class