From:	Marc Renouf renouf@********.com
Subject:	Matrix Security Tally
Date:	Thu, 1 Jul 1999 11:34:38 -0400 (EDT)

On Wed, 30 Jun 1999, Jean-Francois Audet wrote:

> Does security tally raise for everyone present at the same time or is
> it for each individual?

Security Tally is an individual thing, but keep in mind that some
types of IC you activate may make things harder for other deckers in the
system.
For instance, Decker A is skating along, being sly, taking few
chances. His Security Tally is sitting pretty at a 3. Decker B, on the
other hand, is in a rush, isn't being careful, and is taking stupid risks.
He very quickly pushes his Security Tally up to a 7, at which point a
Mitsuhama "Mark V Eyeball" Probe IC routine is activated.
What does this mean? It means that the system suspects that
something's awry. It could be a program leaking memory, it could be a
device failure, it could be a series of unauthorized attempts to write to
a segment of protected memory. The system doesn't know what, but it wants
to find out. Hence the Probe IC, which rolls its rating versus the
decker's Detection Factor, with each success further adding to the tally.
This wouldn't be so bad if it only looked at Decker B, but it's
looking on the host in general. This means that it's also looking for
Decker A (though it doesn't know that). As a side note, this will also
impact normal users in the form of slowdown, as the Probe IC queries *all*
of the processes in order to figure out what's going on.
What happens if nastier IC is tripped? In these kinds of
situations, I rule that Security Tally is a measure of just how far the
system has narrowed down where the problem is. If it's confident enough
to launch active, belligerant IC, then it "sees" you in particular. It
says, "requests and orders coming in on port X through process Y are
unauthorized and represent a threat - attack that threat." But things
happening elsewhere are not necessarily affected. If they were, every
time a decker mistakenly activated Black IC, it would kill all the *legal*
users of the system too. Training new employees all the time would get
expensive.
Keep in mind however that just because Decker B has tripped a
"Sendako Seek and Destroy III" bit of Killer IC at trigger step 11, the
Probe that he kicked off at 7 is still around, still making Decker A's
life difficult. That's what you get for running with amateurs. So while
you may not get your progs, your deck, or your brain fried as a direct
result of someone else's stupidity, it still makes your life more
difficult.
To me, this is a realistic, reasonable, and fair approach. It's
probably not a canonical approach, but then again, what good rule is?

Marc