Freelance Traveller

A Mini-Game for Computer Hacking

by John McClain with Jeff Zeitlin

This article originally appeared in the March/April 2022 issue.
Mr McClain’s PDF of the rules can be downloaded here.

Introduction (Jeff Zeitlin)

Late in January, I was perusing the discussion in a room on the Traveller Discord, and came across a link to Mr McClain’s rules for computer hacking. I inquired, and subsequently had a discussion in e-mail with him about these rules and whether Freelance Traveller would be permitted to publish them. Permission was granted, and thus I present them here. [Mr McClain’s PDF of the rules (without the introduction, notes, or example game) can be downloaded from Freelance Traveller’s website; follow the link to them above or from this issue’s contents page.]

The Core Rulebook for Mongoose Traveller Second Edition, on page 64, offers the following two tasks that would seem to be relevant to computer hacking:

To search a corporate database for evidence of illegal activity: Difficult (10+), Electronics (Computers) check, (1D hours, INT)

To hack into a secure computer network: Formidable (14+), Electronics (Computers) check, (1D×10 hours, INT)

Mr McClain indicated that two of his players wanted a form of hacking that took less time than the multiple hours (or days) that the tasks above required. While he was working on some rules for this, it occurred to him to make it a counter-game, and the final results were as presented here.

The Rules (John McClain)

Introduction

This minigame replaces the traditional Electronics (Computers) check for hacking in Mongoose Traveller Second Edition. This replacement takes the form of a two-person counter-game. The Traveller that initiates the hack will be referred to as the attacker. The Referee will serve as, and be referred to as, the defender. The attacker may end the hack at the start of any round.

Operation Points

Operation points serve as the competitors’ currency which may be spent each round by performing operations. Each operation that is attempted will consume one operation point.

At the start of a hack, the attacker’s operation points are equal to the total result of the attacker’s Electronics (Computers) check; Include the Dice Modifier from any intrusion software in this check.

The defender’s operation points are equal to the total result of the defender’s Electronics (Computers) check. The use of security software on the defender’s system will grant additional operation points as shown in the table (right).

A defending system may have one of two types of operator: An NPC, or an Agent Program. If a defending system has no operator, it will only have operation points equal to the bonus given by any security software. If the defending system is using an agent program as an operator, it will make its initial Electronics (Computers) check with Dice Modifier as shown in the table (left).

Only one operation may be performed per side each turn. If both sides run out of operation points, the hack will be terminated.

Advantage

Advantage is a representation of the ground gained, or the gains denied, by both the attacker and the defender. Advantage ranges from -3 to 5 and may be changed through the operations performed each turn. An advantage of -3 indicates that the attacker has been completely shut-out and the hack will end at the end of that round. An advantage of 5 represents a situation in which the defender’s system has been completely compromised and is at the whim of the attacker. Advantage starts at 0.

No operation may be resolved if it would cause the advantage to exceed 5 or drop below -3.

Operation Turns

The minigame is organized into a series of turns, each of which lasts for one minute. At the start of each turn, both the attacker and defender will choose an operation, and conceal it. After choosing an operation, either side may declare that they wish to reverse the order of resolution for the soon-to-be revealed operations. Attempting to reverse this order will cost one operation point. At this point, both operations will be revealed and resolved in the following order, if they were not reversed: Attacker, Defender. If both side attempted to reverse the order of resolution, it remains unchanged.

Notes (Jeff Zeitlin)

• All operations succeed unless the description specifically requires a player to make a roll.
• Advantage being “less than” or “below” a specified value means that it is more favorable to the defender than that value. “Greater than” or “above” is more favorable to the attacker. Similarly, positive Advantage changes are favorable to the attacker; negative changes to the defender.
• When an operation takes multiple turns (Full Audit, Reset), the defending player must choose Wait until the requisite number of turns has passed.
• Attacker operations with large negative Advantage may represent goals of the hack. This, plus limitations on operations that may be used, encourages tactical planning by the attacker.

Sample Game (Jeff Zeitlin)

Scenario:

The player-characters have been hired by a megacorp to hack into the computers of a small office of a subsidiary of a competitor to find evidence that the competitor has been providing “covert” support for a pirate band that has been preying on the megacorp’s ships. The referee rules that if the player-characters can achieve a “steal database” operation, they will have sufficient evidence to satisfy their employers. However, word has leaked out, and the target is aware that a “hack” is a possibility.

The Attacker in this scenario is one of the player-characters, INT 10 (DM +1) and Electronics (Computers) 2. The player rolls Electronics (Computers) and rolls a 10, +1 for INT DM, +2 for Electronics (Computers) skill. For this scenario, the Attacker has 13 Operation Points.

The referee rules that the targeted computer has Security/1 software (grants 6 Operations points) and an Agent/1 operator (DM +2). The referee rolls Electronics (Computers) and rolls a 7, +2 for the Agent/1 DM, +6 for the Security software’s Operations points. For this scenario, the Defender has 15 Operation Points.

Round 1 (Advantage 0):

Attacker has 13 Operation Points
Defender has 15 Operation Points

Attacker attempts: Steal Database
Defender attempts: Block Connection (and Reverses)

Since the Defender was expecting the attack, they spend the extra Operation Point to reverse the order of resolution. This reversal succeeds (because the Attacker didn’t also try a reversal). The attempt at blocking the connection requires that the Attacker now roll Electronics (Computers) for 10+; given the Attacker’s DM +3, the connection will succeed if the Attacker rolls 7+. The roll is only 6, however, and the connection is blocked. The Advantage is now -2. The Steal Database operation fails, as the Advantage change of -3 would put the total Advantage past -3.

Round 2 (Advantage -2):

Attacker has 12 Operation Points
Defender has 13 Operation Points

Attacker attempts: Blind Exploit
Defender attempts: Obscure Defenses

Since the Attacker’s operation is resolved first, the blind exploit succeeds, moving the advantage to 0. Then, the Defender attempts to obscure the system’s defenses, which can be prevented if the Attacker rolls Electronics (Computers) for 10+ (7+, and then add the INT DM of +1 and the Electronics (Computers) skill of +2). The roll is 8 before applying DMs, meaning that the Attacker succeeds, and the defenses are not obscured.

The above is how the round was presented in the PDF. However, it has been (correctly) brought to our attention that the Defender should have had an opportunity to block the Blind Exploit by rolling Electronics (Computers) for 10+. The sample game plays out the same if the Defender rolls 7-, as the Agent/1 operator grants a DM of +2.

Round 3 (Advantage 0):

Attacker has 11 Operation Points
Defender has 12 Operation Points

Attacker attempts: Steal Database
Defender attempts: Change Passwords (and reverses)

The Defender realizes they’ve made a mistake, and now tries to fortify the system quickly, in a panic, so they spend the extra Operation Point to change system passwords ahead of the attacker’s next phase of attack. The Advantage moves to -2 as a result, and the Attacker’s attempt to steal the database is again foiled (it would move the advantage past -3).

Round 4 (Advantage -2):

Attacker has 10 Operation Points
Defender has 10 Operation Points

Attacker attempts: Phish
Defender attempts: Remove Vulnerabilities (and Reverses)

The Defender is still trying to fortify the system ahead of the next attack phase, so again spends an extra Operation Point to reverse the order of resolution. The attacker did not also try to reverse the order, so the Defender’s reversal succeeds, and the Remove Vulnerabilities is resolved first, moving the Advantage to -3. The Attacker’s attempt to Phish is now resolved, and the Defender rolls Electronics (Computers) for 8+, with a DM of +2 since the operator is Agent/1. The referee rolls a natural 9, and the Defender easily resists the Phish, leaving the Advantage at -3.

Since the Advantage is at -3 at the end of this round, the attack ends (the Attacker is locked out of the system), and the Attacker has failed in their objective.

Closing Thoughts (Jeff Zeitlin)

As written, the mini-game uses the rules for throwing task checks from Mongoose Traveller Second Edition. Converting them to other versions of Traveller wouldn’t be difficult.

These rules were written with a single attacker and a single defender in mind. If you want to have teams of hackers (attackers) or of operators (defenders), consider having each additional team member add to that team’s Operation Points without otherwise changing play. A first guess at how to do this is to add the team member’s INT DM and Electronics (Computers) skill, and divide by two, rounding up.