This Just In! - Ice Ice Baby

Welcome to This Just In!, an internal NBN broadcast for training and continuing education for cybersec personnel in using our superlative information network to trace, tag, outpace, and frag any Runners who dare to show their face on the corporate grid. I'm your host, Cybersec Sergeant Scrier.

In the previous episode, I gave you the quick and dirty run-down of basic defense strategies for defending the servers here at NBN. If you dolts weren't paying attention the first time we aired, you can catch the re-runs here. You'd better have a good handle on the info in that briefing, because today we're going to spec out the secsoft tools you'll use for the job, since we know you won't read the bloody manual.

An artist can't paint without his brushes; a surgeon can't cut without his scalpel; a soldier is useless if he doesn't know how to use his weapon, and you chuckleheads are useless if you don't know how to use our Intrusion Countermeasure Electronics properly. The Runners are useless without one of you screwing up the firewall code, and you don't want to be that guy. Our "corporate relations seminars" aren't just for Runners, you know.


This Just In! is an article series dedicated to providing you guidelines and strategies to help you adopt the NBN faction for your Corporation play in Android: Netrunner. The next three articles will build on the previous one that outlined the basic server defense gameplan for NBN by taking a look at the ICE available to the NBN toolbox . This article will examine three general characteristics common to many of NBN's ICE, then highlight one exemplary ICE that exhibits all three traits.


Tracing and Tagging

We get attacked by hundreds of different Runners every day, using thousands of attack vectors making hundreds of thousands of attacks. That's the plight of being the king on top of the hill - everyone's always trying to tear you down to use as a rung so they can climb on top. Fortunately for us, there's little talent amongst fools in this, and only maybe one-in-a-hundred of them are actually dangerous. Those dangerous ones are tiny gods in cyberspace though, so why fight them on their terms?

Even the best of the Runners has to jack in to the network from somewhere in meatspace. One of the favorite tactics we've developed is tracking down their connection and painting them with the laser guidance for the meat-heads and missiles. The little rats normally leave us alone once they've gone scurrying away to find another basement to hide in, but even the ones that "resist" aren't exactly the picture of gun-toting muscle. But do you know where you can find gun-toting muscle? I don't know where we find it either, but I know we buy it with money, and we have plenty of that.


NBN's ICE have a few characteristics that distinguish them from the majority of the ICE belonging to the other corporations. As one could guess by looking at the NBN: Making News (Core) identity, tracing subroutines are more prevalent on NBN ice than those of any other faction. In order to make the comparison, look at the ratio of Tracer ice to total ice in each faction (based on the card pool as of Humanity's Shadow):

• Weyland: 3/8 = 37.5%
• Haas-Bioroid: 3/8 = 37.5%
• Jinteki: 0/9 = 0.0%
• NBN: 4/7 = 57.1%*

*TMI (What Lies Ahead) uses a trace to rez, but does not have the Tracer subtype; if you prefer to count this as a Tracer ice, the ratio becomes 71.4%


As another example, more NBN ice deals tags to the runner than any other faction in the game as well:

• Weyland: 2/9 = 22.2%
• Haas-Bioroid: 1/8 = 12.5%
• Jinteki: 0/9 = 0.0%
• NBN: 2/7 = 28.6%

In order to take advantage of NBN's natural inclination toward the tracing and tagging mechanics in their ICE, their identity, and even their agendas (Restructured Datapool (What Lies Ahead)), we need to make sure we have strong tag punishment to support these ICE. Cards like Closed Accounts (Core), Psychographics (Core), Freelancer (Trace Amount), Private Security Force (Core), and Scorched Earth (Core) help ensure that tags are a constantly looming threat from NBN, which in turn helps prevent some of NBN's ICE from become an expensive liability.



On-Encounter Attacks

There's an advantage to having a hand somewhere in producing nearly every piece of end-consumer data that traverses the global information networks - we have a veritable treasure trove to mine for profiling and categorizing the behavior of just about every person that jacks in. 99.9% of it is about as interesting as watching paint dry to me, but the oddball stuff... Turns out, even the worst Runner leaves a lot more interesting trail than the vapid mouthbreathers watching our content streams. In fact, the worst ones leave the largest wake; the good ones try to cover it up behind them. Even those can still be detected, and the eggheads geniuses that came up with the algorithms for doing it have automated some of them into our ICE. The time it takes to collect data limits how potent a response we can make if the Runner starts decompiling the ICE right away, but when trouble inevitably comes knocking and it all hits the proverbial fan, you'll be glad for small favors.


While the prevalence of tracing and tagging on NBN's ICE already differentiate it from that of the other corporations, there is one ICE trait that is held exclusively by NBN's ICE and no other - the on-encounter attack. These effects are similar to normal ICE subroutines, but because they are triggered automatically by the Runner encountering the ICE prior to when normal subroutines are run, the attack is engaged even if the Runner breaks the ICE. The most widely recognized of these is Tollbooth (Core)'s ability to end the run immediately unless the Runner can pay the three credit "toll". While the attacks only make up a small fraction of the total ICE capability you will need even in an NBN Corporate deck, they are an important defensive measure for slowing down a Runner with a full breaker suite and a rich economy while you try to reposition and regain the upper hand.


Now that we have observed the traits that make NBN ICE unique as a group, let's examine one particular ICE that illustrates all three:

Data Raven (Core)

DVR. Ha! I wish I could go back 40 years ago and buy a beer for the marketing genius bastard that sold that hook to all the television-numbed fish. For all you knobs in the room, that device isn't a Digital Video Recorder. No, that device is really the Distributed Reconnaissance Vector, DRV, or Data Raven for you dolts too slow to put it together on your own. Back in the day, our own eyeballs were the best tools we had for combing through video surveillance recorded by this network of appliances. We had buildings full of personnel working 'round-the-clock hunting for the same information we now get through a collection of facial and gait recognition, retinal scanning, voice spectrum analysis, and transformation insensitive pattern matching trojans that are backdoored in almost every DVR, webcam, cell phone, traffic camera, video game console, and retail kiosk in the developed world. Hell, your toaster probably has them installed too, but I'd have to check with Engineering to be sure.

Now nobody gets past the Ravens without being seen. Nobody. The Ravens see everything.


Data Raven (Core) has a single subroutine, a strength three trace that doesn't end the run, cause brain damage, trash a program, or any of the other terrible things that we normally associate with extremely threatening ICE. A successful Data Raven trace simply hosts a counter on Data Raven, and these counters can be spent to tag the runner. Just a tag on its own isn't that threatening, and there are several ICE that are capable of tagging the Runner, so why is Data Raven so special?

The key to understanding this is recognizing that the hosted counter it scores essentially banks the tag for use at a time of your choosing. To understand how powerful this is, consider the game situation where you have a Private Security Force (Core) agenda scored. This is a pretty common agenda in NBN decks because of the prevalence of tag mechanics in that faction. A tag from an ICE like Draco (What Lies Ahead), Hunter (Core), or Matrix Analyzer (Core) is only relevant if it "sticks" to the Runner until the Corp turn without the Runner discarding it first, and often only if the Corp can punish it before the Runner's next turn when he gets a chance to remove it again. The tag from Data Raven can be given to the Runner on the Corp turn via the power counter paid ability, at which point Private Security Force may strike. If the Runner has three or more cards, then it's possible that a "stuck" tag might not really be all that helpful on the turn it sticks. On the other hand, if the Runner has two or fewer cards, he can be immediately flatlined by Private Security Force. A hosted counter on Data Raven threatens this grisly end on EVERY turn when PSF is scored, not just the turn following the successful Data Raven trace.

A hosted counter also means that for any one turn of the Corp's choosing, any operation card which requires the Runner to be tagged first may be played: Scorched Earth (Core), Freelancer (Trace Amount), Closed Accounts (Core), and so on. Even if the Corp has none of these cards, being able to tag the Runner at any time does allow the trashing of critical resources like Personal Workshop (Cyber Exodus) and Kati Jones (Humanitys Shadow). It can enable Tagstorm decks to get turbo-charged in one turn as well by enabling a turn of Closed Accounts (Core), Big Brother (Trace Amount), Big Brother (Trace Amount), or fast advance with a turn of Big Brother (Trace Amount), install Astroscript Pilot Program (Core), and Psychographics (Core) to score Astroscript. The possibilities here are myriad and painful for the Runner.

For this reason, you will almost never see this trace activate unless the Runner is certain he can beat it. Runners are scared of this ability, and they should be. If they see Data Raven, they will almost never run against it unless it can be broken or you are too poor to win the trace. A surprise rez on the card won't allow the trace to run either, because Data Raven has another on-encounter attack that activates before the subroutines take effect and allows the Runner to choose between taking a tag or ending the run immediately. This on-encounter attack is unfortunate with regards to the trace subroutine, and this elimination of surprise is one of the major weaknesses of the card. There are typically terrible consequences to the Runner for face-checking an unrezzed sentry without being properly prepared; in the case of Data Raven, the Runner simply aborts his run by choosing not to take a tag to continue.

That said, the on-encounter attack is the final piece of Data Raven that makes it one of the best ice in the game, and unequivocally my favorite. In the early game, this attack makes Data Raven effectively an "end-the-run" (ETR) ice because of the threat its trace produces, and this trace is even more threatening than normal in NBN due to the NBN: Making News (Core) identity. Data Raven's four credit rez cost is one of the cheapest in the game for an "end-the-run" ice that is so difficult to break. Having a strength of four means that Ninja (Core) requires four credits to break it, Pipeline (Core) requires seven credits to break it, Mimic (Core) can't break it at all without support from Ice Carver (Core), Parasite (Core), or Datasucker (Core), and Femme Fatale (Core) costs five credits to break it even after its nine-credit install cost. Not only does the ice have a significant cost to break, breaking it will not stop the on-encounter tag, which costs an additional click and two credits to remove.

Once the game has advanced past the early stages and the Runner has a complete rig assembled, Data Raven's ability to function as ETR ice is reduced or eliminated. The ICE still has a very important purpose at this point in the game. Because breaking the subroutines on Data Raven does not stop the on-encounter tag, it is amazing protection against several Runner strategies which make the final finishing blow by using Nerve Agent (Cyber Exodus) or Medium (Core) to make consecutive runs on the HQ or R&D central servers. Assuming you have a way to punish the Runner taking tags (and you should, or Data Raven is useless!), then the click it costs the Runner to remove the tag after a successful run is a click they can't use to continue attacking and charging their viruses. Not only is this a significant nuisance on its own, but assuming you are playing Tollbooth (Core) (and you likely are if you are playing NBN), Femme Fatale (Core) and Parasite (Core) now have six cards to contend with that can make significant attacks on the Runner that go off even if the ice is broken.

On a final note for Data Raven, remember that the cost to remove the tag is at least as expensive as Tollbooth's three-credit toll, since a tag takes a click (which can always be converted to a credit) and two credits to remove. If the Runner has Magnum Opus in play, then the Data Raven attack is costing them at least four credits instead of three, and keep in mind that clicks are even more valuable commodities late game than you might think. As an example, remember that Biotic Labor (Core) allows the Corp to effectively buy a click for FOUR credits, and that card is four influence when played outside of Haas-Bioroid!

There are two significant drawbacks to Data Raven. First, as stated before, Data Raven is useless without the means to punish tags. That's not really that much of a drawback for playing it in-faction for NBN, since NBN has arguably the most complete tag punishment mechanisms in the game (though we're admittedly jealous of Scorched Earth in Weyland). That said, tag punishment does take up a significant portion of a Corp deck which is already heavily burdened with agenda and ICE requirements, so including Data Raven is not a trivial deckbuilding consideration.

Data Raven's other drawback is that its tagging mechanisms won't stop the most cunning Runners if they have designed their strategy to subvert the attacks you would typically use to punish them for being tagged. This is a difficult task for the Runner, but not impossible. If their deck includes few critical Resources, has adequate countermeasures for meat damage from Scorched Earth and Private Security Force (such as Plascrete Carapace (What Lies Ahead)), and can quickly recover from having their credits destroyed, then Data Raven is in serious danger of doing nothing but providing a blank buffer in HQ or R&D. The only thing we can do to continue to punish tags against this kind of Runner is to utilize Psychographics (Core).

Be aware as well that desperation can substitute for this particular brand of cunning in a Runner who is making a final attempt to steal victory in a game which you are about to win. The Runner winning the game obviously prevents the Corporation from punishing tags on a turn that will never come. Do keep in mind that if your game is 5-5 and you're threatening a victory that the Runner can't otherwise stop, you will likely find that your Data Raven defense gets ignored entirely.


Thanks for tuning in to this week's episode of This Just In! I hope you enjoyed the show; please take a moment to leave comments to let me know if you enjoyed it or found any opportunities for improvements. In the next edition, we will continue profiling NBN's individual ICE - here's a preview!



Next time on This Just In!...


The Ravens routinely catch celebrities and politicians in all kinds of compromising situations. Having dirt on a few Senators comes in handy from time to time. One of the recent updates to copyright law included an adjustment we, ahem... suggested... that forced the media outlets online to adopt file codecs with built-in, automatic payment protocols that let us charge consumers every time our content is accessed. One of the cybersec devs caught wind of this and adapted it for our intrusion detection systems, and that's proved even more useful than the original application.

I don't think all the pirating crybabies we stopped thought we would approve when they started calling these Tollbooths, but we all thought that was pretty bloody fitting, so the name stuck. Marketing made us stop using the name to refer to our content provider payment collection system, but they don't get to tell us what to do with our cybersec tech. The only issue we've had so far is that our content stream denies access when a consumer's accounts are dry and doesn't bill them for content they didn't get. Some of the more clever Runners have figured this out and keep a nearly-empty bank account so the "billing" will be rejected when they're just probing to map our server logical architecture.