Back then, I tweeted the blog post along and forwarded to the guys at Catan LLC, since they love seeing Catan mentioned in non-game-industry media. I also commented on the story there.

Forget-Not by Z Joya, on Flickr (BY-NC-SA)

I love this topic. My own epiphany in digital memory came back when I was trying to figure out if I was going to work with Dave Arneson on GURPS Civil War. (This was a long time ago; Dave has since died, and GURPS Civil War never came off, and the page soliciting it has been doing so since 2003.) So some time in those dark ages of online search, I happened across a message board archive (maybe Usenet, maybe some BBoard emulation) where a poster mentioned working with Dave, and I reached out to him about the experience. I don’t remember how he felt about working with Dave, but I distinctly remember his initial rejoinder: The Internet means never having to say “I don’t recall.”

Probably there are things that have disappeared from (or “been forgotten by”) the digital hivemind. But you’d be hard-pressed to guarantee that a particular bit of tid is nowhere to be found anymore. This knowledge is why it’s sometimes hard to watch action soap operas like 24. If you have a video incriminating the very powerful person and want to get the story out, just upload it.

There are some great thinkers thinking interesting things about what it means to be able to remember everything virtually these days, and what it means not being able to be forgotten. If you haven’t read all of these, they cover some good ground — this in basically my order of enjoyment:

• Total Recall: How the E-Memory Revolution Will Change Everything, by Gordon Bell & Jim Gemmell
• Ambient Findability, by Peter Morville
• Delete: The Virtue of Forgetting in the Digital Age, by Viktor Mayer-Schonberger.

The last book in particular ends with a fizzle, since I don’t think much of the plausibility of his solutions. But it was worth reading for the investigation of the problem.

I’ve also been reading some interesting things in “Data Finds Data” (Jonas & Sokol, in Beautiful Data).

—jhunterj

GURPS Monsters

Another of my GURPS books made the jump  to PDF from e23: GURPS Monsters can now be yours in instant download from: http://e23.sjgames.com/item.html?id=SJG30-6418

It just went “live” on April 25 and has been selling briskly, as far as my experience goes (which is not very far, admittedly). Enough so that in that handful of days, it pushed my royalties into the “cut a check” level all by itself, when otherwise orders for my previous books trickled in to get me a check every handful of quarters. So, good times, thank you, and go help out my May numbers if you don’t have yours yet!

Not convinced? There’s a 10-page preview available there as well, to try before you buy, and my designer’s notes are freely available on Pyramid. Or if you’d prefer the physical book, there are a limited number of those left too. (You can order it used or new from Amazon as well: GURPS Monsters; but today’s prices make that seem unlikely.)

—jhunterj

for GURPS 3rd Edition rules

Witeout was pretty far gone into Rio Largo’s main databank. He’d been in for over 10 seconds already, and time was running out. If only his Spanish was better! This was his first foreign run, and for the proggies, natch. The Chilentinan’s were doin’ some research in Antarctica, and Uncle Adam wanted to know whether it was bolshy or faex.

Bingo! Well, maybe bingo. Witeout found a file tagged ‘Antarctica’ but inside was shash data. Encrypted, drig! Better than nothin’, though, and it was too hot to hang around. Witeout slipped back through the Net to the good ol’ U. S. of A.

“All right, let’s hope it’s a simple cipher,” says Brian, Witeout’s player, looking up from his copy of GURPS Cyberpunk. “My Computer Programming is 17, so with the −6, I should get the real data on an 11 or less.”

“What does Computer Programming have to do with breaking codes, Brainiac? I found what you need here in High-Tech. See, roll against Mathematics−2 or IQ−8.”

“C’mon, Cryptography is in Terradyne. Hold on, I’ll look it up. (flip, flip, flip.) Here it is: Cryptography, mental hard, defaults to Mathematics−5 or IQ−6. Hmmm, but you get a +2 for simple ciphers.”

The GM cuts to the chase. “We’re going with what’s in the Basic Set. It’s got Cryptanalysis at Mathematics−3 or IQ−5. Your IQ is 13, so roll an 8 or less.”

Mark, playing the troop’s chiller, tries to decide which PC to zero first.

GURPS 3rd Ed Rules

Many GURPS books make reference to codes and ciphers. If they mention a skill to be used, it is variously called Cryptanalysis, Cryptography, or Cryptology. Its defaults vary widely, from Mathematics −2 to −5, IQ −5 to −8, or Computer Programming −6. Sometimes it’s a /TL skill, sometimes it isn’t. Not particularly universal, is it?

General Cryptology

Definition of Terms

First, the terms need to be defined. Cryptology is the combination of cryptography and cryptanalysis, cryptography is the creation of cipher and code methodologies, and cryptanalysis is the set of methodologies for obtaining plaintext from ciphertext without the proper keys. What that boils down to is cryptographers figure out how to encode stuff, cryptanalysists try to break the code, and cryptologists study both activities. A cryptosystem is what the cryptographer produces and what the cryptanalysist tries to defeat.

A cryptosystem can be secure (unlikely that anyone without the key can obtain any part of the original message) in two ways. If it is secure in the information-theoretic sense, then no amount of computational power and clever approaches can ever yield the original message. This is usually an impossible level of security to obtain. More often, a cryptosystem attempts to be secure in the computationally feasible sense, so that original messages cannot be obtained with any reasonable amount of computation.

There are other related activities. Cryptanalysis and cryptography are two opposing components of the opposing methods of signal intelligence and signal security (or SIGINT for those of you with GURPS Special Ops). These signals come in two varieties, communication and electronic.

Communication security can involve steganography, traffic security, and cryptography. Steganography is the set of methodologies for concealing the fact that a message is being sent. It includes things like invisible inks, microdots, and hiding messages in background noise. Traffic security involves keeping information from being derived from the patterns of communication traffic. For example, dummy messages can be sent so that when the time comes to send a large number of real messages, it doesn’t seem as unusual.

Communication intelligence includes interception and direction-finding, traffic analysis, and cryptanalysis. Interception and direction-finding try to defeat steganography by obtaining the message or the source of the message, respectively. Traffic analysis tries to deduce facts from patterns of communication traffic.

Electronic security can involve emission security and counter-countermeasures. Emission security is simply the electronic version of steganography—trying to keep the adversary from becoming aware that electronic signals are being used, for example, by shifting radar frequencies. Counter-countermeasures are used to successfully send electronics signals when the adversary is using countermeasures to prevent them from being successfully transmitted.

Electronic intelligence includes electronic reconnaissance and countermeasures. Electronic reconnaissance involves interception and direction-finding, just like with communication intelligence. Countermeasures include techniques like radar jamming and sending false radar echoes.

Historical Cryptology

Cryptography has existed since the fifth century B.C. when the Spartans developed and used a transposition cipher (in which the letters of the message are rearranged). Cryptanalysis is much younger. The Arabians were the first to document their cryptanalytic methods, in an encyclopedia completed in 1412.

A US Navy WAVE sets the Bombe rotors prior to a run. Photo by J Brew (CC-BY-SA-2.0)

Cryptology made intermittent gains through its lifetime. Advances in other fields sometimes lead to these gains. The use of radio communications in World War I led to the growth of cryptology into a mature science. The development of powerful computers in the 1960s made some of the complex modern protocols feasible. The development of public-key cryptography in the late 1970s stimulated academic interest, since it could be widely used in non-military situations. (Public-key cryptography involves two keys, the public key for encoding and the private key for decoding.) One of the most recent advances uses quantum mechanics and Heisenberg’s uncertainty principle to send messages encoded in beams of polarized light.

GURPS Rules

Character Types

Chemist/Computer Programmer/Engineer/Gadgeteer/Physicist

This group of character types can have some impact on the development of new methods of signal security and signal intelligence, such as invisible inks, password programs, cipher wheels, and quantum encryption devices.

Most of these scientists may find it useful to know Signal Security or Signal Intelligence. These are not required as long as someone else (with the appropriate skill) is handy to specify what needs to be developed.

Cinematic Spy

The master-of-all-trades superspy certainly needs to include Cryptography in his repertoire, and probably Signal Security as well. If the Bad Guys are taking steps to keep the Important Information from the Superspy, he would do well to have Signal Intelligence and Cryptanalysis as well.

Cipher Clerk

Unlikely choices for PCs in a heroic campaign, these individuals held important positions nonetheless. Simple mistakes in their daily tasks could provide the enemy with invaluable information. They all must have Professional Skill: Cipher Clerk.

Conspirator/Diplomat/Paranoid/Scribe/Telegraph Operator

These are the character types that may routinely use cryptographic protocols in their lines of work. Even if they don’t know the science of Cryptology, many should have the Professional Skill of Cipher Clerk, so that they can send and receive secure messages with some degree of success.

Femme Fatale

As pointed out in GURPS Espionage, the femme fatale need not be a female. In espionage, these manipulators will often need to send reports or receive instructions while in the, ahem, company of important figures. Even apart from the spy world, cryptology can be handy for secret lovers—Vatsyayana’s Kama-sutra lists secret writing as one of the 64 yogas that women should know.

Historian/Theologian

Occasionally a researcher finds an encrypted historical or theological text. Most often they will only study cryptology on the job—working with more experienced cryptanalysists as the need arises.

Intelligence Analyst/Black Chamber Member/Government Investigator/Intelligence Officer

Intelligence Analyst is the generic category that all of these character types fall into. Signals are intercepted and read without the sender or recipient realizing what was going on.

Black Chambers were the NSAs of their time, intelligence-gathering entities operating in peacetime. Mail from one European country to another would be opened by members of the Black Chamber, read, resealed, and delivered. If the message inside was encrypted, it would be held long enough to decrypt it. As modern diplomatic methods evolved, so did modern cryptographic methods evolve in the Black Chambers.

Black Chambers were common in Europe in the 1700s. Russia established one as well, the Spets-Otdel, during the reign of Peter the Great. England’s Black Chamber, Austria’s Geheime Kabinets-Kanzlei, and France’s Cabinet Noir all stopped operations in the 1850s, mostly because of public opinion. The United States also operated a Black Chamber after a success with cryptolologic service in World War I. The American Black Chamber was in operation from 1919 to 1929.

These other character types do the same kind of work, just in different arenas. Government Investigators would work within a government, possibly as Internal Affairs. Intelligence Officers are military officers who do their work in wartime, intercepting enemy communications. These characters would be skilled in Cryptography, Forgery, Languages, and Signal Intelligence.

Mage

In a world where magical spells are closely guarded secrets, mages would need cryptology the same way nations do. They would want to keep their knowledge hidden while learning the knowledge that their neighbors possess. See below for an example of a mage using cryptography as part of a security plan for his grimoire.

Netrunner

Some netrunners may need to act as intelligence analysts. They can either use an expert system or take the do-it-yourself approach. Most netrunners will not have security clearance to come by either option legitimately, but there is always the black market (or a good character story and Unusual Background).

New Skills

Cryptology/TL (Mental/Very Hard) No default

This is the science of textual information security. It allows the use of both the Cryptography and Cryptanalysist skills below. If the GM wishes to retain the simplified one-skill mechanic for this avenue of study, he should ignore Cryptography and Cryptanalysis and permit players to purchase only Cryptology. Mathematical Ability will add to this skill.

Cryptological training requires a Top Secret/Special Compartmentalized Intelligence Clearance in the modern U.S. and similar clearances in other settings. No one with disadvantages that would make him a potential security risk is likely to be selected for such training. An Unusual Background or other Advantage that the GM allows may be substituted for this clearance. Cryptology may be learned at lower TLs without the clearance or other explanation—it is assumed that earlier methods are publicly documented.

Historical note: the bonus from Mathematical Ability would be unavailable in the ‘real’ world until 1920, when William Frederick Friedman’s The Index of Coincidence and Its Applications in Cryptography was published. Friedman was the first to apply statistical concepts to the letter frequency distributions used in cryptologic techniques.

Cryptography/TL (Mental/Hard) Defaults to Cryptology

Cryptography is the science of developing code and cipher protocols and techniques. It allows the creation of new methods of encipherment, and the selection of appropriate techniques and combinations of techniques to define a protocol for a given security need. Mathematical Ability will add to this skill.

Cryptographical training requires a Top Secret/Special Compartmentalized Intelligence Clearance in the modern U.S. and similar clearances in other settings. No one with disadvantages that would make him a potential security risk is likely to be selected for such training. An Unusual Background or other Advantage that the GM allows may be substituted for this clearance. Cryptology may be learned at TLs lower than the current TL without the clearance or other explanation—it is assumed that earlier methods are publicly documented.

Cryptanalysis/TL (Mental/Hard) Defaults to Cryptology

Cryptanalysis is the science of obtaining plaintext from ciphertext without the proper keys. Computer equipment is extremely helpful, if available, in conjunction with this skill. The availability of other plaintext/ciphertext pairs in the same cryptosystem is an asset; however, message brevity is a serious impediment by even the most skilled cryptanalysist. Mathematical Ability will add to this skill.

Cryptanalytical training requires a Top Secret/Special Compartmentalized Intelligence Clearance in the modern U.S. and similar clearances in other settings. No one with disadvantages that would make him a potential security risk is likely to be selected for such training. An Unusual Background or other Advantage that the GM allows may be substituted for this clearance. Cryptology may be learned at TLs lower than the current TL without the clearance or other explanation—it is assumed that earlier methods are publicly documented.

Computer modifiers: +Complexity of the decryption program, with a successful Computer Operations roll.

Other modifiers: +5 for a known plaintext/ciphertext pair in the same cryptosystem. −10 for a message of a single word, −9 for fewer than 5 words, −7 for fewer than 10 words, −5 for fewer than 25 words, −3 for fewer than 50 words, −1 for fewer than 100 words, +1 for more than 150 words, +3 for more than 300 words, +5 for more than 500 words. Additional modifiers may be made based on the cryptosystem. [This skill originally appeared, in a different form, in GURPS Special Ops.]

Hobby Skill: Cryptogram Solving (Mental/Easy) Defaults to Language−4*, Cryptology+2, or Cryptanalysis+2

This is the ability to solve simple substitution ciphers, such as those published in puzzle magazines. Mathematical ability will add to this skill.

Note to GMs: Simple substitution ciphers are never used in modern times to secure important information. They are used to make information mildly inconvenient to obtain, or to provide a small delay if the information needs to remain unknown for only a short time. For example, some postings on the Internet’s newsgroups are encrypted using a method known as rot-13, where each letter is replaced by the letter 13 places away in the alphabet. It can be decrypted through the same method, and many newsreaders provide that method of decryption. No one expects the information to remain undeciphered, but it does allow the distribution of information that some members of the audience may not want to read immediately, such as movie spoilers, joke punchlines, or off-color remarks.

Note: This skill is not historically available until TL4. During medieval times, cryptology was considered a black art, like witchcraft. The ability to produce real information from a jumble of meaningless letters was viewed as divination.

*The default to a language skill should only be allowed in game worlds where cryptogram puzzles are common.

Professional Skill: Cipher Clerk/TL (Mental/Easy) Defaults to IQ−4, Cryptology−2, Cryptanalysis−2, or Special

This is the ability to use cipher equipment and to follow the appropriate methodologies for encoding and decoding transmissions given the proper keys. In a modern setting, using a computer-program-based encryption protocol with standard documentation, this could also default to Computer Operation−2.

Signal Security/TL (Mental/Average) No default

The Signal Security skill includes the areas of steganography, transmission and emission security, and traffic security (note that ‘signal’ can mean any type of information transfer). Steganography is used to hide the fact that a message is being sent at all. Transmission and emission security attempts to avoid direction-finding techniques by sending a long message in one short burst or shifting radar frequencies.

Traffic security similarly tries to render traffic analysis fruitless by changing call-signs, sending dummy messages, and applying radio silence. This skill allows the application of existing methodologies. To develop new methodologies would require rolls against the appropriate skill: Chemistry to develop a new invisible ink, Engineering for hidden compartments, etc.

Signal Intelligence Collection/Jamming/TL (Mental/Average) No default

This is the ability to operate sophisticated intelligence-gathering and direction-finding systems targeted at secure signals. In modern times this can include voice or Morse radios, telephones, radar, telemetry, etc. In earlier times it would be limited to detecting invisible inks and the like. Again, ‘signal’ can mean any type of information transfer.

Modifiers: −2 for isolated communications shorter than one minute, −1 to −10 for rough handling or poor maintenance of equipment. [This skill originally appeared in GURPS Special Ops.]

Traffic Analysis/TL (Mental/Hard) No default

This is the ability to identify target unit types and organizational structures from data such as callsigns, prosigns, and transmission patterns of intercepted communications traffic. [This skill originally appeared in GURPS Special Ops.]

Investigation of Problems and Solutions (Cryptographic Techniques)

The standard problem for cryptographers is to send messages from one party to another such that no other party can gain information from the message. Here are some other things that aspiring cryptographers can develop:

• Anonymous Election: electronic election where every voter’s vote remains private and every voter can check that the election was not falsely manipulated. −6 penalty.
• Anonymous Transactions: electronic transaction where one party remains anonymous, but the other party receives some assurance (such as ability to pay or authorization). −4 penalty.
• Certified Mail: simultaneous exchange of a secret message and a signed receipt. −4 penalty.
• Digital Signature: the recipient can be sure of the sender’s identity, but the message is not secret. No penalty.
• Contract Signing: digital signatures are simultaneously exchanged. −2 penalty, or −4 if the signed document is secret.
• Oblivious Transfer: the sender cannot be certain if the intended recipient receives the secret message. −2 penalty.
• Secret Sharing: a group of people all hold pieces of a secret, which are unintelligible taken individually. If a large enough percentage of the group put their pieces together, the secret can be produced. −4 penalty.

Each of these additional properties would represent a −2 penalty: anonymity, authentication, multi-party usage, obliviousness, secrecy, and simultaneity.

Rules for ‘Attacking’ Cryptograms

If the game includes both cryptographers and cryptanalysts making and breaking codes, the GM should treat attacks on cryptographic systems as contests of skill rather than simple skill rolls. Whenever a new protocol is developed, record the amount by which the roll was made. When it is later attacked, the cryptanalyst must succeed by that amount or more. Usually, however, the GM will be creating all of the protocols (or using historical ones) and the players will be trying to break them. In this case, the GM assigns modifiers to the different protocols as he sees fit, and the cryptanalysts must make rolls at the specified penalties (or bonuses).

An attack on a secrecy protocol has varying degrees of success. If the cryptanalyst succeeds by 1 or less, the message is only partially decoded. The GM gives the player some interesting pieces of information, but not all of it. If he succeeds by 2 or more, the entire message is decrypted. If he succeeds by 6 or more, he can also decrypt any future messages sent in the same protocol with the same key. On a critical success, he can obtain the secret key as well. Note that if the cryptanalyst knows the protocol being used, he can often determine the secret key once an entire message has been decrypted without a critical success.

An attack on an authentication protocol also has varying degrees of success. If the cryptanalyst succeeds by 1 or less, he has achieved an existential forgery—he can forge a signature on one message chosen at random. If he succeeds by 2 or more, he can forge the signature on one message of his choosing. If he succeeds by 6 or more, he can forge the signature on any number of messages. On a critical success, he can obtain the signer’s private key as well.

In a cinematic campaign, all keys and passwords are words, numbers, or phrases that have special meaning to the user and can be guessed. Examples include ‘TRUSTNO1′ for Fox Mulder on The X-Files television series and ‘RAMESES II’ for Ozymandias in the  Watchmen graphic novel. ‘PASSWORD’, ‘SECRET’, and ‘SEX’ are good guesses for unsophisticated users, along with birth dates and maiden names. In a cinematic campaign, or a realistic game with naive users, the GM can allow a character to guess such a password or key on a roll of 3 on 3 dice. Bonuses should be given for intimate knowledge of the subject’s biographical information, or for the importance to the game’s plot. Or if the character has time and resources for a brute force attack on a system that the GM (or player) has already determined is protected by one of the naive passwords, the GM can rule that success is automatic.

Note that the magical spell Encrypt (GURPS Grimoire, p. 78) will produce ‘encrypted’ text that cannot be deciphered through mundane cryptanalytical attacks. It must be resisted or magically dispelled, or the encrypted item must be taken to a no-mana area. Truly fiendish mages will translate their most secret works into an ancient or alien language, encrypt it using mundane techniques, and then enchant the resulting work with the magical spell. See GURPS Magic Items 2, pp. 40-41, for even more convoluted methods.

Further Reading

Non-fiction

• HIDDEN CODES & GRAND DESIGNS. Pierre Berloquin. Sterling, 2010.
• MODERN CRYPTOLOGY: A TUTORIAL. Gilles Brassard in Lecture Notes in Computer Science, Vol. 325. Springer-Verlag, 1988.
• THE CODE-BREAKERS. David Kahn. Scribner, 1996.

Fiction

• THE VOYNICH CYPHER. Russell Blake. CreateSpace, 2012.
• ENIGMA. Robert Harris. Random House, 1995.
• CRYPTONOMICON. Neal Stephenson. Avon, 2002.

—jhunterj

GURPS WWII: Frozen Hell

Once upon a time, I found myself in the wonderful position of writing a supplement for the GURPS WWII line. GURPS WWII: Frozen Hell covers the Finnish involvement in three wars within World War II: the Winter War of 1939–40, the Continuation War of 1941–44, and the Lapland War of 1944–45. There is precious little written in English on the actions and interactions of the Finns in WWII, and I took my title from the best of those few: A Frozen Hell, by William R. Trotter. I also wanted to ask Mr. Trotter to write the foreword to the book. But at the time I could not sift the Internet into yielding his contact information.

So I put a plan into motion to have him contact me…

I had gotten interested in the topic when I picked up Trotter’s Winter Fire at my local library. (I might even have stumbled across it while prepping for GURPS Monsters a few years earlier.) The novel was great, and I found that Trotter had also written a non-fiction account of the Finnish war experience too: A Frozen Hell. It was just as engrossing as the novel. So when the WWII line of GURPS books was being formalized, I offered to write the Finnish book.

So far, so good. Washington–Centerville Library was great at getting the various books (and film!) I needed to bring the book to life, and as the writing was drawing to a close, it occurred to me to ask Mr. Trotter to write a brief bit of intro for the book. But, as mentioned, the Internet at that time would not give up his email address. So I tried to attract his attention to me.

I created The Trotter Blotter listing everything even slightly related to Mr. Trotter’s opus as an Amazon ListMania list. It was shorter then, and missing even some of the older books, but the inclusion of the 1974 Word Processing by Thomas Johnston Anderson and 1999′s 66 Frames by Gordon Ball were proof that I had put more effort in than simply reformatting an Amazon search. (Google Books and Amazon’s own “Search Inside” feature weren’t around back then, but the Library of Congress website and some news searches helped.)

That was it. I tinkered with it a little, but it only took a couple of weeks for the email to come in. William R. Trotter, or Bill in day-to-day life, reached out to say thanks and to provide some additional information on new entries and corrections to what I had. I made those changes, pitched the idea of a brief intro, and we were set.

This is an illustration of one of the classic “rules” of networking: offer value to the people you’re networking with (or that you’d like to network with). If you’re only bringing up what they can do for you, it’s likely to be a short discussion. And it’s fine to have your own interests in mind too—there’s a line between mutual backscratching and using people, and I guess it has more to do with how miserly you are with your gifts to them. Be helpful, be good at it, be happy to be good at it, and trust the people you’re networking with. You might still be misconstrued and occasionally burned, but it seems to be a recipe for long-run success.

I got to meet Bill later at an Origins convention a few years later, I got a couple of books signed, and we chatted over dinner. I told him this story of how I set up the Amazon page to lure him in, which he appreciated even in hindsight (“… and I fell for it!”). He also liked the title enough to ask to use it on his website Trotterbooks.com, so you can find a different “Trotter Blotter” there now.

You can also check out my GURPS WWII: A Frozen Hell Designer’s Notes from Pyramid magazine; it’s one of their free sample articles. The book itself is also available in PDF from e23: GURPS WWII: Frozen Hell. And if you like any kind of weird fiction, do yourself a favor and check out Warrener’s Beastie by Bill; not Finnish, but still fabulous.

 —jhunterj