Roleplaying Games | Online Privacy

D&D is Best When It’s Mr. Robot | Cryptomancer

A Fantasy Role-Playing Game About Hacking

“Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.”

— Edward Snowden

Cryptomancer is basically Lord of the Rings meets Mr. Robot with a side of Watch_Dogs. Alongside typical fantasy features like wizards and dragons, there’s also a magical internet called the Shardscape. The shardscape is a vast network of private and public shardnets, which are accessed with psychic crystals.

Through these crystals, humans, elves, and dwarves can send and receive mental messages. This magical internet puts real-world issues into a fantastical context. Issues like online privacy and disinformation. The explanations of how it all works are ridiculously contrived, but no more than any other fantasy gimmick.

Veteran gamers will recognize bits and pieces of other TTRPGs. More than one commenter has said that Cryptomancer is like Shadowrun, but in reverse. Instead of adding magic to a cyberpunk setting, the designers added the internet, and all the accompanying madness, to a fantasy setting.

Like Vampire: The Masquerade, relationship networks form the backbone of Cryptomancer campaigns. Like ARC: Doom and Mörk Borg, Cryptomancer has a built-in clock counting down to the end of the game, and the party’s eventual demise.

The game’s heroes are on the run from the setting’s Bad Guys, called the Risk Eaters, from the get-go. The player-characters know too much, or maybe they’re destined to upset the status quo. Either way, the characters don’t know exactly why they’ve been marked for death. They just know that the Risk Eaters have burned their lives and want them dead, along with anyone that helps them.

Because the Risk Eaters keep the entire realm stable, human, dwarf, and elf governments all provide resources and legitimacy to this organization. They’re like the UN if the UN was actually Section 31. Nobody fucks with the Risk Eaters.

The various fantasy species are recognizable, but not quite stereotypical. The dwarves mine the crystals that make up the Shardscape, and have cornered that market. Elves are bio-industrialists that farm and sell soma, an insanely potent but legal drug. Humans are the backbone of the workforce, and make up most of the military that keeps the orc hordes at bay.

Cryptomancer’s orcs are also not-quite-Tolkienian, but I won’t spoil the fun details.

To go along with the fantasy internet, a lot of the game’s magic has a hacking angle or an internet-ish vibe. One spell summons a “network” of moving plants from the ground to grab a target. Another spell lets the caster see through crystals in a private shardnet, turning them into mystic webcams.

Other spells allow mages to “encrypt” voices and faces. The caster can magically scramble their own identity in meatspace, but that’s nothing. They can also encrypt someone else’s voice and face, like identity ransomware. Imagine not only being unrecognizable to your family and friends, but also being unintelligible to everyone everywhere.

Because Cryptomancer was designed with an infosec angle, even mundane security is a big part of the game. Concepts like defense-in-depth, social engineering, and risk management are all adapted to Tolkienian fantasy and explored. But the designers have left gaps in their various cryptosystems. There are exploits, and some of them don’t require special spells or gear. Players only need to be creative and lucky to hack normally secure systems.

And everything is a system. Shardnets. Dungeons. The mail. The guards around a castle. A lock. Cryptomancer totally commits to its premise of fantasy hacking.

In a lot of ways, Cryptomancer’s villains ARE the system. The author has described the Risk Eaters as a mashup of the Spanish Inquisition and the NSA. They’re not explored in detail. Their brutal deeds are hinted at in disturbing fiction and conspiratorial story seeds. The designers have left it up to GMs to flesh these villains out.

But it’s not hard to see how creepy the Risk Eaters can be when you think about them in real-world terms. You don’t know what Google or China know about you. You don’t know how much the government knows about your internet searches. You don’t know if you didn’t get a job because you liked a pro-union post on LinkedIn. You don’t know that the next President won’t order the NSA to identify every anonymous Twitter user that ever said anything mean about him.

And if you think none of that matters because you have nothing to hide, you’re wrong.

One last dumb detail: Cryptomancer’s supplement titles are confusing. The current edition of Cryptomancer, 1.5, is bundled with volumes 1 and 2 of Code & Dagger. However, there’s a separate supplement also called Code & Dagger vol. 1 that’s completely different. The bundled Code & Dagger books were written for Crytomancer 1.0 and are technically out of date, but a lot of the material still works.