Security Devices

This page is incomplete.

It was last edited Thursday, November 17, 2022 by Arcology Expert Program.

These rules modify those found under Security Devices in Shadowrun Fifth Edition Core Rulebook (p. 358).

Doors, Windows, & Locks

The rules for security devices (and bypassing them), specifically the section on Doors, Windows, & Locks in Shadowrun Fifth Edition Core Rulebook (p. 359) and the tools used in conjunction with them are quite inconsistent.

Key Locks & Transponder-Embedded Keys

This section is fine as-is, with one caveat — in line with the changes to Active Skills, use Electronics + LOG Test for dealing with transponder-embedded keys. Also, note that if the character is Untrained in the Locksmithing skill and is relying entirely on the capabilities of an Autopicker, roll only the Autopicker's Rating.

Maglocks

Cracking the Case

 ^[edit]

Cracking a maglock's case to access the electronics requires a Locksmith + Agility [Physical] (Maglock Rating × 2, 1 Combat Turn) Extended Test. Reassembling the case afterwards requires the same test.

Whether or not physical violence (treat it as attempting to destroy a Barrier with Structure and Armor equal to the Maglock's Rating) is beneficial to bypassing a maglock depends on the site's security design. If the lock is designed to fail-safe, smashing it will in fact open whatever it is securing, but will also inform the security system of the breach. If the system is instead designed to fail-secure, destroying the lock will not open whatever it is securing... and it will still inform the security system of the breach.

A maglock can have one (or more) authentication methods — keypads, card readers, voice recognition, facial recognition, print scanners, retinal scanners, or DNA scanners. Accessing the maglock's electronics is only required if the goal is to bypass the authentication method completely. It's probably worth noting that a great many authentication schemes involve both a keypad and some other form of authentication — this is what's known as multi-factor authentication.

In the case of keypads, either the character has the code or they don't. If they don't have they code, they have to access the innards as described in Cracking the Case. They can then attempt to rewire the circuits and/or bypass the code. The character makes a Extended Locksmithing+LOG [Mental] (Maglock Rating × 2, 1 Combat Turn) Test Test, and may add the rating of a sequencer to their die pool.

Other types of authentication require a different approach. Obviously, just getting the genuine article is the best method. A legitimate authentication fob (card, RFID, etc.) or an actually authorized person for the various biometric scanners works best. Munging the electronics as described above is always an option, too, but there's no special device to assist like there is with a keypad. Instead, if the character can get their hands on a legitimate article temporarily, they can make a duplicate.

Regardless of the authentication scheme, the process is the same. First, whether by hook or crook, the character needs to get a sample to be duplicated. With the sample in hand, the character uses uses a Collector to assemble the information needed to create the Exemplar. The equipment and test required varies by the type of authentication attempting to be duplicated — if it's a device, use the rating of the device as the limit, if it's a kit use the character's Mental Limit. This sets the Rating of the Exemplar.

This information is the used with the Duplicator to create the Duplicate. The character makes an Extended Test using the listed Attribute, Skill, and Limit. This test reflects either physically building the Duplicate or programming the device used to create the Duplicate. The interval is 10 minutes, with a target Threshold is Rating of the Exemplar or the Rating of the device involved, whichever is lower. If the character is pressed for time, they can stop rolling before reaching the target Threshold and take whatever success they've achieved by that point. The result is the Rating of the Duplicate.

To bypass the authentication, make an Opposed Duplicate Rating × 2 vs. Maglock Rating Test Test. If the Duplicate is successful, the lock opens. If the Maglock wins, it remains closed — but see anti-tamper systems.

Maglock Passkey

As an alternative, a Maglock Passkey can fool a card reader without needing the original or cracking the case. The character simply swipes the passkey and crosses their fingers. Make a Maglock Passkey Rating vs. Maglock Rating Opposed Test Test. If the passkey wins, the lock opens. If the lock wins, it doesn't open.

Card Reader

• Collector: Keycard Copier w/ Matrix + Logic [Rating] Test Test
• Duplicator: Electronics Kit w/ Electronics + Logic [Mental] Test

This is probably the easiest authentication device to bypass — getting the original key and swiping it through the copier collects the data required to make a duplicate with an Electronics Kit.

Voice Recognition

• Collector: Microphone w/ Extended Socialize + Charisma [Social] (Microphone Limit, 5 minute) Test Test
• Duplicator: Voice Synthesizer w/ Performance + Logic [Mental] Test

Generating an appropriate voice print generally involves acquiring a high-fidelity recording of the target saying words that include the appropriate phonemes needed to recreate the passphrase, typically by engaging the target in conversation. The challenge is getting them to say what you need said without revealing why. As with the Duplication Test, the character can abandon the attempt before reaching the limit of their recording equipment and hope what they have is enough.

Note that the Limit for a Microphone is equal to the Rating of the Microphone plus the Rating of any Audio Enhancement installed in that microphone, and cyberears automatically include a microphone with a rating equal to the implant's rating.

STATscan

 ^[edit]

Security Devices/STATscan

Facial Recognition

• Collector: Camera w/ Extended Sneaking + Charisma [Social] (Camera Limit, 1 minute) Test Test
• Duplicator: Synthskin Mask w/ Matrix + Logic [Mental] Test Test

Synthskin masks can be programmed from a high-fidelity video recording of the target's face. Getting sufficient angles to program the mask properly can take some time, so it's an Extended Test. As with the Duplication Test, the character can abandon the attempt before reaching the limit of their recording equipment and hope what they have is enough.

High-quality facial recognition scanners (Rating ≥ 5) include a thermal component, based on the pattern of blood vessels under the skin. A camera equipped with thermographic vision can collect this data. If it's needed but not present, increase the Maglock's effective rating by 1.

Note that the limit for a Camera is equal to the Rating of the Camera, plus the Rating of any Video Enhancement installed in the camera, and cybereyes automatically include a microphone with a rating equal to the implant's rating.

Print Scanner

Medical Records vs. Security Records

 ^[edit]

The first thought on biometrics might be: "Why don't we just hack the security database to get the profile and build our fake from that?" The problem there is hashing and salting — security databases don't include the original print, only data that can be used to validate a scan. Besides, cracking a lock is often an easier task than cracking the host that controls the lock.

Medical databases are a different story. Because they often need to be compared over time to diagnose medical issues, they tend to include the full data rather than only what's cryptographically useful. The higher the social stratum (and the higher the medical contract) a person has, the more likely they are to have more complete data in their medical profile. Of course, those hosts tend to be more secure, too.

• Collector: Forensics Kit w/ Sleight Of Hand + LOG [Mental] Test Test
• Duplicator: Cellular Glove Molder w/ Extended Medicine + Logic [Molder or Exemplar] Test

Fingerprints are among the easiest biometric data to gather because they can be lifted from anything the target has touched with bare skin.

Full palm scanners (Rating ≥ 5) may include a thermal component, based on the pattern of blood vessels under the skin. A camera equipped with thermographic vision can collect this data as with facial scanners, using the same rules though the interval is only 15 seconds. If it's needed but not present, increase the Maglock's effective rating by 1.

Retina Scanner

• Collector: Retinal Scanner w/ Medicine + Logic [Rating] Test Test
• Duplicator: Retinal Duplication Cyberware w/ Matrix + Logic [Mental] Test

A retinal scan is probably the hardest biometric to acquire and the hardest to fake. It can only be recorded with a purpose-built retinal scanner, and it requires the subject to remain still while the image (both a visual capture of the inside of the eye and a thermal scan of the blood vessels behind it) is captured. Actually making use of the scan requires a relatively uncommon cybereye modification, Retinal Duplication.

DNA Scanner

• Collector: Forensics Kit w/ Medicine + Logic [Mental] Test Test
• Duplicator: Chemistry Kit w/ Chemistry + Logic [Mental] Test Test

DNA scanners generally work by breath (sampling tissue and saliva aspirated into a tube) or a small blood sample. Creating a serum to fake out one of these sensors involves getting a sample from the target — blood is best, but skin, hair, or other bodily fluids can do the job. The rating of the sample is based on it's age —

Anti-Tamper Systems

The extra paranoid may equip their maglocks with Anti-Tamper Systems. Identifying the presence of such a system requires a Locksmith + Intuition [Mental] (Anti-Tamper Rating) Test Test. Failing to identify the system means that an alarm is triggered when the character attempts to crack the case as described above. If identified, add the Anti-Tamper Rating to the required threshold for the Extended Test.

The Anti-Tamper Rating also determines how "paranoid" the system is when it fails to authenticate an access attempt. If present and authentication fails as described above, make a Test using the Anti-Tamper Rating × 2 against a Threshold equal to the false authentication source's Rating. If the Anti-Tamper System is successful, it identifies the fake as an attempted breach and sounds the alarm. If it fails, it assumes user error and asks for a repeat.