Laying Ghosts (Night's Black Agents)

I've discussed ghosts before, in relation to Trail of Cthulhu and, to a lesser extent, Bookhounds. What about Night's Black Agents?

There's a long tradition of combating, even defeating, ghosts. Sometimes the combat can be brutal and spectacular; it took twelve ecclesiastics to beat Black Vaughan down, for instance. Generally in these tales the objective is not to force the spirit to move on to a different place. The idea is to imprison it here, on earth. As a spirit, it can't be killed, and as it's malevolent, it can't be sent to heaven. The only option, short of somehow sending it down below, is to keep it here, but in such a way as to render it harmless. Shove it into a grandfather clock, throw it down a well, put it in a room and seal the room - however you care to do it, do it, and then forget about it.

Much like vampires, really. Except that vampires have a specific list of banes where ghosts have only one recorded weakness: prayer, especially when delivered by sanctified holy men.

Night's Black Agents is a more active setting than Bookhounds. The agents are expected to be capable, combative people. It's less about arcane knowledge and more about how many rounds you can put downrange.

I gave these guidelines for Bookhounds ghosts, or spirits of place:

1. The truth of the haunting will probably never be known for certain, since most of the facts are unavailable.
2. It cannot be dealt with in the same way as, say, an ordinary antagonist encounter. Ghouls, for example, can be shot, or bargained with. There is no way to communicate with a haunting of place, and probably no way to kill it.
3. It has a great deal of power behind it, possibly magical power. That means other people besides the protagonists are going to be interested in it. That also means it could be very dangerous.

I'd modify them for Night's Black Agents, as follows:

1. The truth of the haunting must be linked to the Vampire background. If vampires in your game are mutant creations of science, then ghosts should have a scientific background as well. A Satanic vampire game has Satanic ghosts, and so on.
2. It cannot be dealt with in the same way as an ordinary antagonist encounter. Ghouls can be shot or bargained with, but ghosts don't have the same weaknesses. Bargaining may be possible, but difficult.
3. It has power behind it, but that power is going to depend on the method of its creation. It ought never to be as powerful as, say, a Renfield, let alone a vampire. This isn't a major player; it's a mood piece, possibly even a booby trap.
4. These ghosts can be defeated but probably not destroyed, in the same sense that vampires can be defeated, but can come back from the grave. 

In NBA vampires come in four delicious favors: mutant, supernatural, damned, alien. What kind of ghost stories can be told with the same premise?

Mutant: Their markers are medical symptoms; their emphasis is infection. The ghost is a vampiric remnant, something that lingers in those areas where vampiric infection has occurred. Say the vampire attacks and kills someone; the ghost is what's left behind, and can be dealt with by cleansing the area in the same way crime scene cleaners deal with the aftermath of a bloody murder. It might be inhaled, or infects through contact with unprotected skin. It might be some fragment of memory from the victim - their daughter's first birthday party, say, which causes anyone infected by it to relive that day again, and again, and again. It might be something left behind by the killer, an eye infection that causes the victim to see, say, blood, whenever they look at, or are in the presence of, certain things. Say the murder victim was a blonde female teen. Now, every time the agent sees a blonde of about the same age and gender, the agent hallucinates blood. Dealt with by medicines, or injecting liquified Banes.

Supernatural: Their markers are strange superstitions, their emphasis hunger. This best fits the traditional ghost story, and is the best candidate for magical manipulation. If, through magic, an unruly ghost can be imprisoned in, say, a grandfather clock, then it can be used as a supernatural bomb. Send it to the target, and sit back and watch the fun. Casting the Runes is the prototype. It's never clear, in stories like these, whether the ghost is a human spirit or some kind of older, pagan thing. A semi or demi God, perhaps. Some remnant of, say, the Great God Pan. A ghost of this sort probably has limited intelligence and free will, and the older ones can be very dangerous. You don't survive several hundred, or thousand, years, without learning a trick or two. Dealt with through arcane rituals found in worm-eaten texts.

Damned: Their markers are holy symbols and spiritualism, their emphasis is seduction. These ghosts are the bargainers, the promise-makers, the succubi and incubi. They are likely to be demons in their own right, capable of possession. They have a great deal of power when they're linked with a mortal soul, much less so without a suitable host. The Exorcist is the best example. Hungry Ghosts work well in this paradigm too. Of course, exorcists come with their own baggage, and rising demand for their services probably indicates widespread despair; the world is burning, and it must be the Devil's fault. Dealt with through spiritual intervention.

Alien: Their markers are various uncanny effects; their emphasis is invasion. In this version ghosts might be the aftereffect of alien tech, or just the presence of aliens. Quatermass and the Pit is the best example. Deep beneath the earth the last Martians lie entombed, and wait for the day when they can take over, piggybacking on our minds to recreate Mars. Until their rocket is uncovered, they can only throw out psychic shocks and disturbances - which is why Hobbs Lane, the London street that is being dug up, has such a shocking reputation. The Devil lives there, they say. Sure enough, there have been strange sightings, eyewitness reports, and horrible scenes there since the beginning of recorded history. In this instance ghosts are almost a warning, the canary in the coal mine - for if you see them, you know this is a tainted place. Dealt with through avoidance, or some kind of prophylactic treatment. Tin foil hat, anyone? 

The big takeaway, and the difference between these and the Bookhounds ghosts, is that they can be understood, challenged and defeated. It may require magic, or some kind of chemical cleansing, rather than a Glock, but the end result is the same. 

Ghosts of this type should generally not be very powerful; that spot is reserved for the vampires. Their main function is to squick or mislead, not defeat or kill. Aberrance rating, except for particularly powerful entities like the Great God Pan, ought to be low; somewhere around 5. No Free powers, and some will be more common than others. Possession seems one of the most likely for Damned ghosts, for example. 

The other thing to remember is, these ghosts can't be killed easily, but they can be diverted, imprisoned. Which means the agents can also weaponize them, if they can work out how to do that without getting caught in the blast radius. That's a story in and of itself. Figuring out how to do it is one thing; pulling it off in the heat of the moment, quite another.

Enjoy!

Car Hacking (Night's Black Agents, Dracula Dossier, Esoterrorists)

"By definition, a connected car has more control units, computing power, lines of code and wireless connections than a “non-connected” car – all of which make it more susceptible to attacks. By exploiting a weakness, a hacker could take control of the brake or steering systems, show incorrect information on the dashboard dials, or grab driver data."

From IIoT World, author Simon Hartley, The State of Auto Cybersecurity: Current Vulnerabilities of Connected Vehicles.

In 2015, Chris Valasek and Charlie Miller grabbed the world's attention by hacking, and gaining control over, a Jeep's dashboard functions from ten miles away. In 2018, the situation hasn't gotten any better. If a vehicle's autonomous or semi-autonomous, it's a cinch it can be controlled remotely. If it can be unlocked and operated via a smartphone app, it's a cinch someone's devised a way to spoof the app and steal the car.

Again, from the article, we're talking about devices that will require code somewhere in the 200 to 300 million line range - basically, a long, long, *long*, technical document. Or, if you like comparing it to literary works, Hamlet to the power of 837,988. That's a lot of stabbings and poison.

Code without mistakes or bugs, of course. Each bug introduces vulnerability. Vulnerabilities can and will be exploited.

That's before you consider that allowing third party software - apps - to have any degree of control over the vehicle means that the app, with all its vulnerabilities, is also a risk factor.

So, for example:

• I need to know where that vampire's been. She always drives that sporty Tesla. OK, spending a point of Digital Intrusion or Electronic Surveillance, whichever the Director thinks suits the task. I'm going to crack the car's GPS with this smartphone app, and see where the Tesla's been for, say, the past week.
• An infotainment system, you say? With a huge touchscreen right in the dash that controls every non-driving function? Well color me impressed. Let's just play with that satellite mapping software … oh, gee, looks like the route you wanted to take is blocked by a car wreck. Best take that recommended detour. No, we haven't set up an ambush there, honest, Hey! I can play videos! Has he got passengers? Cue up that blackmail material, and let's hope his wife is watching.
• No, no, I don't need to have any pools in Digital Intrusion or Electronic Surveillance. I just need to make a Preparedness check, and boom! Here's a sneaky little app I bought off the dark web. Shall we say, a 3-point dedicated Digital Intrusion pool? Why, yes, I think we shall.
• It probably goes without saying, but all these shiny toys need to be updated regularly, a task many users avoid. So known bugs and weaknesses still sneak through, because the necessary defenses weren't installed. Plus, anything that relies on passwords is only as safe as the user lets it be - which often isn't safe at all.
• Oh! I can use this smartphone app to lock and unlock the car, send destination information to the GPS, remotely stop or start the car, send its current location to the app, and run real-time diagnostics. I wonder if that power can be abused in some cunning way …

Of course, all this assumes someone's driving the vehicle. A self-driving car is a different story. This might seem a boon for those bloodsuckers who have to sleep during the day; just add tinted windows and some grave soil, and all your worries drift away. Except if someone's hacked the guidance software then they can tell your car to go, well, anywhere they want. Imagine being delivered to your slayer like a giftwrapped package!

Of course, what's sauce for the goose is good for the gander. Just what are the agents driving these days? A top-of-the-line sportscar, all the better for those thrilling chases? Well, that could be a problem, if the Conspiracy has some half-decent hackers on its side. Maybe it's time to get into vintage muscle cars. It can be tricky to get the parts for a '67 Thunderbird, but at least it won't freak out when someone waves a smartphone at it.    

Enjoy!

Dropbox Downtime

I recently did a bit of mental cleansing and wiped my Dropbox account clean.

DB's terms and conditions changed, and the price was due to go up. I realized most of the stuff crammed in there was junk, and certainly not worth $12 a month storage fees. So I saved what I wanted and axed the rest.

In doing so, I found a ton of notes for projects that never quite made it off the ground. As I'm in a hurry today, rather than a full post, I'll give you a sampler from the grab bag:

A Pleasant Afternoon. The character is invited to a private showing at an art gallery. It is the tail end of the season, when invitations of this type are thin on the ground. 

If they inquire, they discover that the gallery (Pyke’s, of Chapel Street) is supposed to be in murky financial straits. The owner of the gallery, Montague Pyke, is slightly known to the investigator as an acquaintance from years before, but they have not spoken in some time. 

Should the characters attend, they find that most of the gallery’s work is of the usual Victorian type; herds of Highland cattle, crofter’s cottages, still life with grouse, hunting scenes, views of the Thames and so on. None of them are worth much more than £20, though the asking price is a good £30-40 above that figure. 

Pyke is not present himself at the viewing; his assistant, Mary Hope, is in charge of the evening. There is a private viewing room separate from the rest of the gallery, which is only available by invitation, but as luck would have it Pyke has left their invitations at the door. 

The pictures in this gallery are more interesting, in the pre-Raphaelite semi Medieval style, and all are by the same artist, who signs himself as Schablone [German: Mask]. Each depicts a scene from some kind of morality play, with a character who very much resembles Pyke in the role of Everyman. Everyman, in each painting, is being abused by various figures who represent stock characters such as Popular Fashion, Ignorance, Folly, Greed, Envy, and so on. 

In the final portrait, Everyman is nowhere to be seen, while all the other characters are celebrating some kind of victory. In the background, easily missed, is Everyman, hanging from the rafters of a house. When the characters emerge from this private room, the gallery is completely vacant. The other attendees have vanished, as has Hope, and the walls are completely bare. A sign tacked to the front door advises that the previous occupant has been evicted for non-payment of rent. The canvases in the private room, meanwhile, are now blank. 

I originally intended this as a Victoriana flavor text moment. It was never supposed to be a full scenario. The idea was, the characters would encounter these minor notes in the larger plot every so often. There was no mystery to solve, really, but the mood of the piece and the overall weirdness of it was meant to cement the overall pattern of the campaign.

That said, there's no reason it should stay Victoriana. It could as easily appear in a Bookhounds, Dreamhouds, Esoterrorists or modern game. It's perhaps a little too quiet for Night's Black Agents, though it could fit an NBA Dust or Mirror game. You'd need to update the art style, but that's all. 

I suppose the larger point I was getting at when I first wrote this bit - many moons ago, now - is that in any campaign you need a few downtime moments. When players provide you with opportunities to use those moments, take them. However players won't always do that, nor will they necessarily provide them at the right time. 

So you, as Director/Keeper/Insert Shiny Hat Here, need to prep for that. Create a downtime moment to be used as needed. It doesn't have to be anything major. There are no stats in this example, no clue spends. No victory condition either, nor is there a reward, though it could be a kicking-off point for something more. Who is Schabone, for example? Is it Pyke's pseudonym, some supernatural force, something else? Is this a manifestation of Carcosa? Is Pyke dead? 

What would happen if you stared at one of those Everyman portraits, trying to drink it all in? Would the figures begin to move? 

Enjoy!

Hotel Wi-Fi Horror (Night's Black Agents)

Inspired by this article in the Guardian.

Short version: hotel wi-fi is incredibly insecure. This is partly because the people charged with protecting it are hotel people, who put service before security.

“Hospitality companies,” writes Bloomberg's Patrick Clark, “long saw technology as antithetical to the human touch that represented good service. The industry’s admirable habit of promoting from the bottom up means it’s not uncommon to find IT executives who started their careers toting luggage. Former bellboys might understand how a hotel works better than a software engineer, but that doesn’t mean they understand network architecture.”

Hackers love hotels because that's where people spend money. That means everything's vulnerable,  including their credit cards, passport numbers, personal details - pretty much everything guests might have wanted kept secret. Moreover it doesn't stop at one hotel. Hack, say, Marriott in Ohio, and you probably have access to every Marriott in the chain.

The aftershock can be brutal. When Marriott did get hacked, it put at risk 383 million guest records, as well as more than 5 million unencrypted passport numbers and more than 9 million encrypted payment cards.

I imagine most of you reading this have been to at least one sci fi or fantasy convention in your lives. Perhaps you go to several each year. Consider this a warning: you, too, could become a sad statistic in some future article about identity theft. You do have a Virtual Private Network, right?

It doesn't help that most hotels, anxious to keep expenses low, don't bother to upgrade out-of-date systems. Nor do their staff get trained on the best way to avoid trouble. If a customer asks to charge his phone, does the server plug it into the wall, or into the office computer? Are there unsecured, unwatched ports - say, in the bar?

With all that in mind, a scenario seed:

Puttin' On The Ritz

The agents are hired to infiltrate a high-profile hotel IT system, say one of the hotels in the Ritz-Carlton chain. That gives the Director plenty of options, from Washington DC to Tokyo. The client wants any and all data  that can be retrieved about guests arriving and departing between a set of dates. Nothing's too trivial; if the hotel records how the guest likes her eggs, then the client wants to know about it.

The agents may believe they're being hired as deniable cut-outs for a major intelligence service, or by a mafia don on the make. If the target is somewhere high-profile, like the Ritz-Carlton Macau, then the agents may be able to work up full profiles about the guests' gambling habits as well.

The job ought to be simple, but there are two problems:

First, there's a guest in the penthouse suite who's very paranoid about security. Her machines are VPN protected, and she takes care not to let her guard down. Her personal assistant seems to be the one in charge; perhaps if the PA could be dealt with, it would be easier to get the data.

Second, Heat jumps through the roof shortly before the hack ends. The agents gain 3 points Heat, with no idea why. Turns out there's a VIP, a Saudi royal, who recently arrived at the hotel, and the VIP's complaining about everything from the olives in his martini to the laughable internet security. The VIP's particularly hot on internet security, because six months ago his identity was stolen and large purchases made with his credit card. The hotel's jumping like a flea on a hot griddle, which is why Heat spiked. If the VIP could be satisfied, things would go back to normal.

One of these two - the penthouse guest or the Saudi royal - has Conspiracy links, but the agents won't find that out until their plotlines have been dealt with. The question is, which?

Or are the agents' mysterious paymasters the ones with Conspiracy links?

Enjoy!