Organization[]

Posted by: Atalee Bonedanse, Firewall Scanner <Info Msg Rep>

I hope I’m not breaking any greenhorn illusions here, but any dreams of Firewall backing you up with its monolithic “organization” are straight-up wishful thinking. Firewall only barely qualifies as a single organization at all. We don’t have much hierarchy, barely any standardization, and only limited information sharing. We’re fractured, contradictory, undersupplied, and quite likely rife with enemy spies. Whoever did it ﬁrst, however, did it right, because despite everything, Firewall works.Firewall is a brilliant information security puzzle. The biggest threats to an organization are often internal: power-mongers, espionage, misinformation, infection, corruption, politics. The Firewall cell structure ﬁxes that. Firewall is broken into collective working groups called servers, and each server contains a number of small operational cells. Each cell and server operates independently, with only limited direct contact with any other Firewall members. Data sharing is managed through a secure and anonymized digital network called the Eye. Secrets in the server stay in the server until they decide to share it, and the server doesn’t have any special access to secrets outside of the server except what is shared through the Eye. Similarly, cells usually only have access to what is shared with them.
What this means is that any spies that have inﬁltrated Firewall—and there are plenty: Jovian, Consortium, ultimate, exhuman—are compartmentalized. They only have access to what their particular cell or server knows (and the “declassified” stuff shared via the Eye). Exsurgent infection, corruption, and abuse of power spread through the organization slowly, as contact with other servers is limited. If one cell is exposed, the others remain safe. The server structure also keeps Firewall safe from Ozma’s repeated attempts at curb-stomping us. There is no “Chief of Firewall” they can quietly replace, no board of directors to quietly subvert and manipulate. To control Firewall, they’d need to replace 50.1% of the proxies, and even then I’d bet on rogue servers and spin-off factions growing to ﬁll any gaps.
All of this decentralization comes with a cost: we’re disorganized, disparate, sometimes tripping over our own feet. Take a look at a swarm next time it’s tasked with moving a massive object. You get some going the wrong way, some hanging on the object uselessly, some wandering off or just transmitting noise. Somehow, though, despite the apparent disorganization of a million self-directing bots, they get the job done. I can’t help but look at a group of blind, fumbling, dumb robots who just moved a million times their mass without thinking, “Yep, that’s Firewall.”

Sidebar: Firewall Terminology[]

Here’s a handy reference to Firewall jargon:

Cell: A clandestine group of Firewall sentinels.
Crow: A proxy that focuses on research and scientiﬁc analysis.
Crypt: A digital cache hidden within the mesh.
Eraser: Heavily armed proxies that are called in to contain threats beyond the capabilities of a normal sentinel cell.
Eye: Firewall’s internal social and data-sharing network.
Filter: A proxy that handles social engineering, media manipulation, and cover-ups.
Promethean: A rumored artiﬁcial super-intelligence (or group of), allegedly friendly to Firewall and transhumanity.
Proxy: A full-time Firewall agent with an assigned role within a server.
Register: A proxy that handles logistics and ﬁnances.
Router: A proxy that coordinates a server’s operations.
Scanner: A proxy that collects and analyzes data for signs of x-risks.
Scratch Space: A temporary secret cache of gear.
Sentinel: An on-call Firewall agent that works with a cell on ﬁeld ops.
Server: A working group of proxies, focused on a particular area or mission.
Vector: A proxy that handles hacking, communications, and online security.

Inner and Outer Circles[]

Firewall may lean towards the anarchistic side of things, but there is one major element of stratiﬁcation in its structure: sentinels and proxies. Proxies are the inner circle: they’re specialists, are in-the-know, organized into servers, and operate full time behind the scenes. Sentinels are the outer circle: they’re organized into cells, coordinated by proxies, know only what they need to, and are primarily part-time ﬁeld agents. The proxies are the heart and brain of Firewall; they keep the show running and effectively manage its operations. Sentinels are Firewall’s hands—they go out and get dirty. The lines aren’t always so ﬁnely rendered, of course—there are plenty of proxies who take to the ﬁeld when needed, and some sentinel crews are always on the clock.
So why the hierarchical division? Security, primarily. Simply put, sentinels are our mooks. They’re disposable. Since they’re the ones engaging in actual operations, they run a much higher risk of getting caught, interrogated, or exposed. If they talk (and these days, most prisoners give up something), they don’t have much to tell. It’s easy to sever their ties and eliminate any trails back to Firewall. That may sound like a thankless job, but every single one of our sentinels knows this going in. We only recruit volunteers.
The other reason is commitment of resources. With the technology and capabilities we have today, Firewall only needs small numbers of people on deck full-time for each working group. Smaller groups leave a smaller footprint. So the proxies take care of ongoing needs, and we call up sentinels on a case-by-case basis. The much larger network of sentinels is free to go about daily life, whether that’s running a biz, creating art, or smuggling the latest nanofab designs. This also gives us some ﬂexibility when activating sentinels for operations—we can tag experts and specialists as we need them, go with our favorite crews when we have time to plan, and in emergencies we can call up whomever is closest to the situation.

Cells[]

Cells are usually between four and eight sentinels. They are typically coordinated by a speciﬁc router proxy, with communication overseen by a vector proxy. For most sentinels, these are the only proxies with whom they will regularly interact.
Many sentinel cells are created on demand, as needed to handle different missions. Most routers and servers maintain a stable of sentinels to call upon, picking and choosing from the candidates according to their skill sets and backgrounds to form a cell optimized for a particular task. If the router doesn’t have the sentinels they need, they put a call out on the Eye with the mission requirements and others usually respond with recommendations.
Quite a few cells also operate on a long-term basis. Usually, Firewall tries to keep teams of sentinels that work well together. Functional teams beneﬁt from common experience, and they often cover a versatile range of specializations. If a cell becomes too small, too large, or has the wrong skill selection, routers will work to swap assets. Some sentinels end up being part of multiple cells, but usually only in cases where the demands of the cells do not conﬂict.

Servers[]

Servers can be anywhere from six to ﬁfty proxies in size. Proxy servers are almost always long-term affairs, each dedicated to an ongoing project or theater of operation. For example, one server might be engaged in a long-term mission to eradicate an exhuman threat or investigate a system-wide smuggling ring that’s trading TITAN tech. Others may simply be overseeing all potential risks in a region such as Elysium, Lunar orbit, or the Neptunian system. Still others oversee ongoing Firewall projects such as Case ASTURIAS or Case FERAL MORAINE. The typical server oversees multiple sentinel cells. Larger servers mean more proxies (and more sentinels), which normally results in more oversight and available resources. Smaller servers react faster to threats, lose fewer resources to overhead, and suffer less from politics and espionage.
Servers operate collectively, making decisions either by consensus or majority vote. A few voluntarily elect leadership roles, though these are held accountable to the group. Servers are frequently dominated by a particular clique or faction. While proxy rotation is designed to reduce this, it’s unavoidable. Servers are normally aligned with the geographic region they’re associated with. Certain roles tend to attract members from certain cliques. Some servers just have a legacy they just can’t seem to shake. Eagle server, focused in Jovian space, was at one time nearly 60% argonaut and autonomist, but the SOPs and cultural inertia were enough to resist signiﬁcant change until the next rotation came around. In other cases, servers seem to forget their identities pretty quickly. That’s the nature of small organizations; remove a few key members and the entire culture shifts. Sometimes servers have an impact on their local environment as well. A few structuralist servers on Titan maintained friendly and open relations with the Science Police and Fleet Intel for several years. Their successes made them effective breeding grounds for winning over new proxies to the structuralist way of thinking.
Proxies are expected to rotate positions once a year, either taking on a new role within that server or moving to another server. This is to help break up power blocs, deter cronyism, and broaden each proxy’s skill set and experience. This also has the beneﬁt of keeping operatives from staying in the same role for too long, where they might be identiﬁed by our rivals. On the drawback side, it does sometimes restrict the development of tight bonds between server members, though team-building can be improved through a few intensive exercises throughout their tours. In some cases, proxies stay on for longer, especially if their rotation would interfere with an ongoing operation, though this is usually only approved by consensus from the rest of the server.
The rotation is not random; proxies either volunteer for a new gig (in the same server or a different one) and are voted in or another server actively recruits them based on their i-rep. There’s also a policy in place to encourage placement by software selection. In theory, this system relocates proxies to the servers that most need them, which both helps successful servers to keep their track records going and nudges less effective ones. The rotation software also intentionally populates servers with representation from a variety of cliques, in order to derail factional favoritism. In practice, however, many servers ignore this policy in order to avoid diluting their ideological ﬁefdom. Others allow it, but replacements may ﬁnd their new position comes with a heavy dose of political indoctrination or even some arm-twisting to ensure their allegiance to the server’s dominant beliefs.
Every few years, the rotation system comes under attack. People argue it guarantees spies are given access to more information and more contacts than they’d have by siloing. We also ﬁnd a lot of people chaff at having to transition just when they start to get comfortable. While it does make long-term friendships more difﬁcult, it keeps us sharp and makes for a culture that’s quick to form new relationships.
Most proxies only work with one server at a time. Rotating proxies isn’t effective if proxies maintain membership in multiple servers. A sentinel holding allegiances to multiple servers is a yellow ﬂag for possible espionage. Note that this isn’t the same as cooperating with a second server on a single, limited project. It’s expected that Firewall assets can pull on one another to complete missions, but you do so with the knowledge and consent of other members of your home server.
How are new servers created? A proxy makes a proposal to the rest of Firewall via the Eye. The proxies then vote and if they agree a new server is necessary, they horse trade as appropriate to create one. Usually this is to fulﬁll a speciﬁc role, either operational or locational (or sometimes, to help ease philosophical differences between competing cliques). Servers may be created with an indeﬁnite lifespan, to meet a particular, near-term goal, or with a predetermined server expiration date. For instance, a small server may be established to monitor Olympus and the TQZ indeﬁnitely. Alternatively, a dozen proxies may be assembled to provide TITAN-busting specialties. Or a few dozen crows and scanners are assembled for a six-month server sampling for basilisk hacks from public communications channels throughout the Consortium. All three of these servers will overlap geographically and operationally and ideally will keep in contact with one another to share sensitive data, though they will operate very differently with divergent goals and methods.
Cross-server communication is primarily managed over the Eye. Proxies sign in and post status reports of current items under investigation, open operations, internal affairs, and so on. Items requiring a vote are posted there as well. It’s up to the proxies to decide what in their servers warrants being shared and which operations are still too sensitive to release. Most servers do a good job sharing what Firewall needs to know while protecting their assets. A few think their server is their kingdom, but they toe a careful line. If the other proxies decide they’re working against Firewall’s interests, it’s one vote to toss them out. Firewall personnel frequently have personal relationships with members in other servers. The process of using those relationships depends on the servers involved. Many a ﬁght has started from a scanner thinking they’ll just send an informal data request to a friend in the next server over, only to ﬁnd out that email was intercepted and is considered back-channel data-sharing.

Sidebar: Agent Identity[]

Anonymity is the name of the game, and it is expected that all Firewall participants operate solely under their assumed identities. Multiple cover identities are provided to each agent, and most arrange for their own backup IDs privately, in case of emergencies. Each sentinel and proxy also has an anonymized pseudonym that they use for communicating via the Eye.
Sentinels and proxies are supposed to use their cover identities when interacting with each other, in order to limit any potential exposure. In practice, agents who work together over time tend to learn much more about each other, and extensive personal relationships between individuals in a long-term cell or server is quite common. This is not discouraged, as it helps to build camaraderie and trust, which can be crucial to a cell’s survival. This is a potential risk with which all ongoing cells and servers must grapple.
Many servers craft special cover identities for their router positions. These personas stay in place even when the original proxy rotates out; their replacement assumes that identity and continues on. If you’ve been with the same proxy since the Fall, don’t think it’s because Firewall left them out of the rotation schedule.

Sidebar: Front Groups[]

It is not unknown for servers to establish their own front groups, behind which they conceal their operations. A front such as a hypercorp ofﬁce, non-proﬁt research group, gate expedition microcorp, or autonomist working group can be useful in explaining away the server’s presence and activities. Front groups are not always easy—the cover requires work to maintain. People might wonder about a hypercorp that does nothing proﬁtable or a body-mod clinic that has sketchy-seeming characters going in and out of the back room at all hours. Some fronts are actually hidden behind legitimate businesses that they control, with clever accounting and misdirection used to conceal what’s going on behind-the-scenes. In some cases, servers choose fronts that are themselves illegal, such as a smuggling dens or militant groups, taking an extra risk in order to get even closer to the people, groups, or places they’re monitoring. This is the closest servers like to get to ﬁeld operations, and you can expect them to have plans to shut down the operation and disappear on a moment’s notice, leaving a smoking crater if they need to.

Sidebar: Notable Servers[]

Cloud-Conceals-Hunter is a recent server, still heavily recruiting sentinels. It’s operated by a tight-knit group of ﬁve proxies. They actively seek high-risk covert-operations missions and maintain a very high success rate. They use their success to justify a policy of heavy memory editing, fork theft, and maintaining egos in cold storage or virtual training environments between missions. It is widely speculated that they will gradually break off from Firewall. Most of their assets believe they work for one of several false fronts, they rely on an independent computer system for communications, and all inter-server communications is limited to proxy participation in votes. They refuse all proxy rotation requests. Several crows have taken it on themselves to audit the organization, but pre- and post-operational interviews show most of the assets consent to the treatment.
Eagle Server is a mid-sized server of approximately 15 proxies, with a heavy Jovian inﬂuence. Primarily aligned with the conservative clique, their focus is on research, political subversion, and covert operations in Jovian space. While officially very committed to Firewall’s transparency policies, some habits are hard to break and members tend to fall into old habits of tight hierarchies resistant to outside inﬂuence. They are very security conscious, but loyalties between members run deep. Jovians face a higher barrier to entry into Firewall than many, and so the server is surprisingly welcoming to all types, but assets and missions are kept very compartmentalized to guard against espionage.
Lima Server is the descendant of a research group established before the Fall. It’s since spawned a dozen servers of its own and struggles to maintain a size below 50 proxies. Lima Server is considered to have written the wiki on Firewall operations. It undertakes all types of Firewall missions, but its focus is on predictive research and organizational effectiveness. Lima encourages a high amount of creativity and risk-tolerance in cells, but puts weight on pre- and post-operations research. Most ﬁndings are posted organization-wide for implementation in other servers.
Threadum Server, informally named after the investigation into a proxy by the same name, was recently shut down after ﬁndings of abuse of power, political meddling, and racketeering. Threadum and a small band of cohorts established the server as a research organization in the inner system, but in actuality they were using Firewall resources to set up and sponsor anti-Consortium fronts on Mars, Luna, and Mercury. They would fabricate ﬁndings to justify missions (in reality terrorist attacks) and skim resources. A pair of whistle-blowers brought the abuse to the attention of other servers, who staged their own investigations and eventually set the issue to vote. Threadum was recently captured on Mars associated with one of their own terrorist groups and left for the Consortium to deal with. Those assets not suspected of wrongdoing have mostly been transferred to other servers, but a lot of people have seen their i-rep permanently burned. We’re working to track down orphaned cells, still operating with no communication with the (now defunct) server or the remainder of Firewall.

Proxies[]

Proxies make the server go. We provide the ﬁnancing, organization, data research, administrative support, and all of those millions of other services which you expect to be available 24/7. Technically we’re all equal rank, but we have people who depend on us (and sometimes people who give orders, under the sanction of the rest of the server). In theory, proxies have one dominant role: crow, router, and so on. In smaller servers, we ﬁnd people ﬁlling lots of roles. We also try to avoid over-specialization in favor of cross-domain generalists who are better able to connect the dots and recognize patterns across the data.

Scanners: Data Collection and Analysis[]

Scanners collect and analyze data from throughout the solar system and beyond for signs of x-threats. They are our ears against the pulse of the social networks. We keep agents in every major news outlet, security service, political party, reputation network, and ﬁnancial market. Data is parsed in bulk by us and uploaded to private servers or corners of the Eye for analysis. The data analysis folks are of the “more is more” school of thought, but due to the sheer quantity of data shuttling around this solar system, scanners are responsible for pulling out only the information that may be relevant to Firewall operations and sorting it by reliability and threat level. Most of the work is done through search algorithms and limited AIs; stuff that requires a more thorough look or specialist expertise is sometimes passed over to crow proxies. The process is prone to a lot of false positives (and worse, false negatives). The volume of data to sift through means we never have enough heads, even with our scanners forking themselves to the limit. Pinpointing the stuff that needs attention takes real skill.
Infomorphs and AGIs are especially popular here, as the profession usually means you’re spending thirty hours a day in the mesh. The nature of the job means we need ears in every clade, so specialists in exoplanetary operations, ultimates, Jovians, and inner-system corporate politics are especially well appreciated. Scanners have a professional-level understanding of a broad range of subjects and ﬁelds in order to be able to keep up on the traffic, with an emphasis on steganography and cryptography. Larger or more siloed servers may attempt to direct scanners towards a very limited ﬁeld or location, but proxy rotation means that’s rarely the case for long. Scanners tend to keep contact with other servers more often than other proxies, simply due to the need and desire to share data and analysis results with scanners and crows looking into the same ﬁelds. Brilliant scanners are the ones with the knowledge base to understand data across a dozen disparate ﬁelds, the intuition to realize they’re looking at a cohesive story, and the puzzle-solving to ﬁgure out that story. Usually we aren’t that good, even on those rare occasions we’re staring all that data in the face. That’s why we tag and sort the data and pass it on to the crows or vectors to draw out those conclusions.
Of all of the proxy positions, this is the one most likely to instigate a new operation. Simply put, scanners are our digital scouts, and they tend to take notice of the enemy ﬁrst. When something hot comes across their feeds, it is their job to evaluate whether to open a new ops ﬁle. This usually means passing their results to the rest of a server for a vote, after which a router is tasked with getting the ball rolling. In some cases, scanners may simply ask to divert more resources to an investigation ﬁrst, which means they pull in sentinels or even hired contractors (through blind fronts, of course) to do some “direct observation.” This authority to kick things off is of course tempered by the scanner’s own reliability. A scanner that regularly squawks with false positives is going to be double-checked before we commit resources to it. Servers rapidly come to appreciate a scanner that has a knack for snifﬁng out real problems. Even with a pro, however, it’s always good to double-check the results before committing.
Because scanners are the probing organ of Firewall, we tend to get exposed to a lot of espionage attempts, chaff, and noise in the data. Even worse is the transhuman tendency of seeing patterns where there are none. It puts us in a tough place. On the one hand, we can’t ignore the signs of an x-threat, but on the other, false calls waste resources—or worse, lead us into traps. Managing your scanner i-rep is pretty important. We can usually rotate scanners out if they’re having a rough time. Sometimes it just takes a few months to rest the old noodle before you’re back in your prime. Unfortunately, if you’re just worthless as a scanner, that’s a quick way to get yourself uninvited to Firewall’s party.

Crows: Research[]

Crows do the heavy lifting of deep research. They are the ones currently studying, testing, and exploring their ﬁelds of interest—many of which happen to threaten the ongoing survivability of transhumanity. Crows include researchers in recovered TITAN and alien artifacts, exhuman design, social conﬂict and genocide, AI programming, advanced physics and nanotech, and numerous other things that may one day kill us all. It’s not all doom-and-gloom, however. Crows also include specialists in ﬁelds like habitat engineering, mesh infrastructure, morph design, surveillance systems, economics, and just about any other topic that may serve as a bullet-point in a Firewall operation’s brieﬁng. If it’s something for which Firewall may need an expert opinion, then you can assume we’ve recruited a crow for that. A lot of crow projects are continuations of projects started by the groups that initially came together to form Firewall.
Crows tend to be clustered in servers that focus on their area of interest, often with their own labs. It should come as no surprise that we recruit heavily from the argonauts, and many crow servers in fact work out of dedicated argonaut facilities. The line between a Firewall crow and an argonaut researcher sometimes blurs a little, especially given the wide range of topics Firewall tries to keep ahead of. We don’t just work on xenobiology and nanoweapons, but memetics, applied mathematics, physics, economics, simulspace design, and more. Firewall sticks mostly to ﬁelds that can be directly applied to our work, but that still makes for a pretty long list. Firewall also maintains a number of black labs; facilities researching truly dangerous technologies. As you can imagine, crows tend not to rotate as much as other proxies. Because of how many labs lean heavily towards the pragmatists, this creates a bit of an ideological bubble Firewall struggles to handle effectively.
A few crows operate on their own, being on call for whatever server needs their input. We can tap these individuals for professional analysis. Sometimes they may smuggle data or equipment out to Firewall, kicking off a new investigation. Frequently, these individuals are also tapped to participate in more active missions.
It’s worth noting that most crows have “real” jobs or ongoing projects of their own. Sometimes getting them to focus or produce results in a timely manner can be problematic. I can say from experience, there’s almost never a point when a crow’s ongoing research doesn’t “need their attention” just as Firewall requires their immediate and complete participation in a new investigation. Handling this competition for time can be a major headache. If it can be tied to something they’re already looking into, however—well, then you may see some magic happen.
As experts, crows carry the heavy burden of saying whether something is a threat or not. Sometimes there’s no way to know without taking it out to the ﬁeld and blowing something up. Crows sometimes hand off some piece of alien or experimental technology for a sentinel team to test. This is frequently terminal for the team, but the way in which it is terminal can tell us whether what we’re handling is an x-threat or not.

Routers: Coordinators[]

Routers are the folk that make things happen. They coordinate operations and do all of the organizational grunt-work necessary to actually achieve Firewall’s mission. It’s one of the most overworked, security-sensitive, and under-appreciated roles in Firewall. Trust me, I know, and there’s a reason I’m only a scanner now.
The router skims all of the data from their crows and scanners and makes sure it gets where it needs to go for further analysis, investigation, or action. Once something is noted as a threat, it falls to the routers to ﬁx it. Sometimes someone else takes the initiative. There’s nothing stopping a crow or a scanner from stepping up, but it’s not in their job description, so normally it’s dropped on a router’s desk instead. The router selects and activates a team. “A team” is a broad term; we address threats with sentinels, erasure squads, vectors, or other crazy plans, as needs demand. The router pulls on resources, either from Firewall or from personal networks to equip the team with everything they’ll need to succeed. The team goes off to save the day, while the router does their darnedest to keep tabs and activate more resources, as necessary.
Servers vary in how much power they give routers. Structuralist servers normally give routers the full trust and powers of the server. More autonomist servers try to keep routers in check with transparency and open votes. No matter where your server falls on the spectrum, it’s your router’s name on the mission and they normally bear the brunt of the blame if things go south. When things go well, that glory usually goes to the sentinels, for their hard work and bravery. And after the mission is done, while you enjoy some down-time? Your router is back to channeling data from party A to party B, setting up training exercises, reviewing performance metrics, double-checking rep was properly bumped, tying up loose ends, and collating reports to the rest of the server that yes, that investigation really was both necessary and successful. There’s a reason routers have the highest turnover in Firewall.
Me? I’m just taking a long vacation, harvesting the Whiskey rumor mill, and chewing the rag for rookies like you in exchange for drinks. They’ll pull me back soon. Routers are always in short supply. But I reckon I’ve got time for a few more rounds before then.

Vectors: Infosec, Comms, and Data Manipulation[]

Vectors are the hack squad. They primarily provide a support role. A proxy puts in a call to the server’s vector teams, and they provide communications, digital intrusion, records collection or manipulation, sabotage of local infrastructure, or whatever else is necessary. Occasionally they’ll accompany an active team on the ground conducting an investigation, but most vectors are averse to getting shot and we have enough hacking talent among our sentinels that that’s rarely the case.
It sounds glorious, and I don’t want to steal any of their credit, but in practice most of the work we call on vectors for is research or clean-up. The router and vectors are rarely in a place to act with the same speed and insight as the sentinels on the ground.
Vectors include more than just digital data manipulation specialists—they also include our psychoengineers. Firewall’s wetware-hacking vectors are responsible for cracking and examining egos and, where absolutely necessary, applying behavior modification. Their duties range from psych support for troubled agents and loyalty tests on new recruits to psychosurgical interrogation of hostile operatives and brainhacking countermeasures.
Firewall worries a lot about keeping the vectors happy. After all, they create or wash our dirty laundry. They also get kept on a very short leash. Vectors are held to a high standard in transparency, with suspicious behavior such as side channels or separation of privilege considered violations that are subject to review. Vector squads are heavily compartmentalized (to limit intentional as well as accidental data leakage—remember, the data they handle could destroy Firewall). Unfortunately, vectors tend to be more victimized by partisanship than most. Structuralists may call out pragmatist vectors as x-threats themselves. There have been a number of cases of documented emotional or verbal abuse. Fortunately, vector transparency means these events are thoroughly recorded and can be quickly dealt with.

Registers: Quartermasters[]

What do you call a miserly, two-faced, fork-tongued, double-dealing snake who skims your pocket to save the universe? If they work for Firewall, they’re probably a register. The truth is, Firewall operates on an ad-hoc, shoestring budget. We get income from donations, reselling technology, and investments, plus we have public and secret fabrication facilities scattered throughout the system. While that adds up to hundreds of millions of credits, it has to cover server space, secret operations, black labs, equipment, bribes, salaries, and everything else that keeps Firewall running. Meanwhile, groups like Ozma or the Junta have hundreds of billions to spend on their programs. The registers are the wizards who convert some rep network tit-for-tat into a morph and twenty thousand shares in ExoTech.
The registers don’t get a lot of credit, and that’s because when they’re doing their job, you don’t notice them. They manage Firewall resources, including favors, cash, investments, gear, and reservations. Did you egocast in to a waiting morph and a plasma riﬂe? You have a hotel room and a fake ID? That’s the registers twisting arms and moving accounts. Meanwhile, they’ll arrange to rent your morph while you’re away and skim the proﬁts back into the organization. In the inner system, they pull in credits to ﬁnance operations. In the outer system, these are the sorts of people who everyone wants to know: party-planners, the inexplicably famous, marketeers off-loading Firewall excess, ﬁxers, and currency exchangers. In both realms they launder favors and cash to hide the tracks of Firewall movements and oversee safehouses and supply depots. In some servers, they even provide legal services, local contacts, and cultural context on the habitat.
Some factions seem more keen on registers than others. Structuralists frown on a role having so much power behind the scenes and choose instead to invest as much as they can into the hands of specialized routers to provide managerial oversight. Conservatives and backups both adapt well to a robust ﬂow of currency. No server lasts long without registers.
More than once, I’ve seen registers play politics as well. A proxy who violates social norms ﬁnds themselves suddenly without cash or social capital? That’s a register somewhere sticking up for the sentinels. Of course, it’s proxies who hold the cards. A register who abuses the cash ﬂow will be left out in the cold, so they better be damn sure about what they’re doing before they pull rank like that.

Erasers: Combat Specialists[]

The erasure squad is the mop-up crew. Their skill set includes heavy weaponry, demolitions, and mass destruction. Erasers get called in when the situation has gotten out of hand, when breaking a few eggs isn’t enough to contain the mess and the entire kitchen needs to be burned to the ground. Sometimes their presence is justiﬁed. Usually it’s because a sentinel team fucked up.
Usually Firewall pulls on sentinels to complete an investigation. Our pool of sentinels gives us a selection of people with a variety of skills and the right afﬁliations to ﬁt in wherever the job may be. Erasers don’t require those social ties or real-world experience as much as they need full-time, specialized training in killing things. It’s common for erasers to come from military or ultimate backgrounds, where combat operations were a daily routine. Others used to do something else before an unfortunate experience made them unsuitable for that job, and it’s just a case of Firewall saying: waste not, want not. It’s better not to pry too deep; you don’t want to know about whatever they saw or learned to put them on that path. Some erasers are actually kept on ice and only thawed out when needed—they don’t have much of a life outside of being a murder machine. The best erasers work in squads, wielding a variety of armaments and tactics against potentially unknown threats. The really scary ones operate solo.
How they’re implemented varies. Pragmatists like the “egocast in and blast things” strategy. Backups frequently prefer the “sneak in and blast things” variant. Conservatives tend to go for a “get them close and blast everything from a distance” approach. Regardless, you should notice a theme here. Many servers do without erasure squads altogether, preferring sentinels to not fuck up in the ﬁrst place, then tasking them with clean-up when they do.
Look, I know plenty of sentinels fancy themselves as erasers. You aren’t, and you don’t want to be. Erasers are fucked in the head. You don’t get a job killing thousands of people full-time without knocking a few screws loose. In our server, the erasers were kept in training simulators when not in use. We only pulled them out as a last resort, when things are beyond recovery. If you see an erasure squad, you’re already a target. If you’re on an erasure squad, it’s because you’re already the monster. Consider yourself warned.

Old Friends[]

To: <Encrypted>
From: <Encrypted>
Attachments: <Encrypted>
We’ve been friends from way back, back in the old team. You remember that? I thought I was some fancy shit because I’d just hacked New World Bank and I was ready to take on the world? It was just the four of us back then. You, me, Olga with the crazy, exsurgent-infected brain, and Roget. Remember how Roget walked? His whole torso would twist with each step, like his pelvis was second-hand from one of those joggercize videos, and we’d tease him about it. Every morph he sleeved into, it didn’t matter, same stupid twist.
We were the best, back then. Back before Roget cracked and the doctors said it was stress accumulation, he’d never be able to run with us again. Back before whatever it was that happened to Olga, the poor slob. I hope you remember, because that’s why I’m contacting you. You’re the only one who trusts me enough and is stupid enough to listen to me.
I saw him again. We were doing a job in a little hab near Pandora and things went south. It was beyond salvageable. Whatever it was they found was highly contagious, and it wasn’t waiting on anything so pedestrian as inhalation vectors. People were dropping all over. I called it in. We were headed back towards the shuttle when we ran into the clean-up crew coming the other way, all sleeved in some sort of combat-modiﬁed steel morphs. They knew our idents so I know they knew we were the sentinels who called them. It didn’t matter. They were torching everything. Flamers and seekers, if it moved, it got scorched. Half my team was reduced to ash and scrap in seconds. Fortunately, they weren’t chasing anyone in particular, just making a beeline to life support, so I managed to duck out of the way and let them pass.
What would you know, but one of those assholes was walking along with the same, stupid twisting torso. It was Roget. I messaged him. He just responded with some boilerplate, “Stay in cover, everything is safe,” and kept on his way. He didn’t recognize me. I wonder if he even recognized his own name. But it was him, I’d bet my life on it. Hell, I nearly did.
Listen, I know this sounds crazy, but I need you to do some digging. Check out the attached video, check out his kinesics. Tell me I’m wrong. If I’m not, ﬁnd out where they’re storing his ego. They’ve done something, and I know he didn’t consent to this. I haven’t told my router about it. I want to imagine there’s an explanation, but I’m afraid what I’ll do if there isn’t.

Filters: Social Engineers[]

Erasure squads are scary because they’ll atomize your morph. Filters take it to a whole new level. Upset them and you’ll ﬁnd out you’re an ego trader specializing in children and all your passwords and accounts are splashed across the breaking newsfeeds. Good luck walking that one off. We call them in, both during and after the mission, to keep everyone off the real trail. When you set the nuclear plant into meltdown, they’re the ones who link the nuclear engineers to petal abuse and gross incompetence.
The good news is, the ﬁlters work with a light touch when they can, and they recognize that a hypercorp can take a rep hit in ways that a private citizen can’t. Whenever possible, they pin things back on organizations or legitimate bad guys. That’s good, because you can’t restore a reputation from backup. The social engineers also work as an offensive weapon, destroying the reputations of spies, attackers, and exhumans so thoroughly that the best they can hope for is to work cleaning bathrooms.
In addition to relying on their own g-rep and f-rep, ﬁlters tend to keep good working relationships with scanners, crows, vectors, and sentinels, as these individuals provide critical visibility into networks and an easy point to inject changes. Usually their work is fairly straightforward; organizations are looking for someone to pin the blame on. Hand them a name and just cause and they’ll do the rest. Occasionally, they require more invasive methods. This may warrant activating a vector squad for a more comprehensive digital assault or assembling a sentinel team to properly seed evidence, prime witnesses, play a few memetic attacks, and tidy up any evidence of any competing accounts.

The Making of Monsters into Myth[]

Posted by: Gavin Gladwell
<Info Msg Rep>
Ever wonder how exsurgents and asyncs stay out of public discourse? Thank the Firewall ﬁlters. Even though exsurgent monstrosities and other horrors were on the newsfeeds during the Fall and still pop up on an unfortunately regular basis, these accounts are undermined as hoaxes, hallucinatory agents, or creative vid/sim editing. When the authenticity can’t be denied, it is explained away as TITAN experimentation. People who claim that viral alien horrors and crazed psychic mutants actually exist are safely tagged as trolls or conspiracy theorists and ignored. No one takes it seriously—at least until they see it in person, and we take care of that with memory edits. Sure, you’ll ﬁnd mention of asyncs and jellies and more in the darker areas of the mesh, but no one pays attention—except us and groups like Ozma.
Firewall can’t take all of the credit; it’s a group effort. Ozma, Oversight, the hypercorps—even the Titanians—are all in on it. No one wants to spook the public. Stories are edited, covered up, and made to go away, one way or another. Sometimes we compete to see who can get to the cover-up ﬁrst and put their own unique spin on it.

Sentinels[]

Most of our assets are sentinels. Lots of proxies like to write off sentinels as hobbyists or the reserves just called upon to meet shortfalls in the organization, but that’s selling you short. In practice, sentinels are used like the duct tape of the organization, which is to say: for everything. Sentinels are tapped to do research, forward up alerts from the feeds, conduct social engineering or hacking missions, re-appropriate technology for testing, test technology Firewall picked up from elsewhere, and of course, conduct investigations and remedial actions. The only deﬁning trait of a sentinel is that you’re there when we need you—and you’re somewhere else when we don’t. Whereas proxies barely exist at all outside of Firewall, sentinels have full-time lives they attend to.
Each server maintains a list of sentinels grouped by team, noting in their dossiers their skill sets, theaters of operation, any job preferences, as well as their public encryption key and encoded contact information. When an operation gets put together, we’ll contact you for any jobs that match. When you’re a sentinel, things tend to be pretty ﬂuid, to a point. Most sentinels are on-call, meaning that you go about your lives and keep your router up to speed on your location and activities. When an op comes your way, you’re expected to drop everything you’re doing and take care of it. This can be damn inconvenient, but that’s the glamorous secret agent lifestyle for you. At least you can do normal life things in between the occasional bouts of tension and terror. Some sentinel cells prefer to live the full lifestyle, going right from one job to the next. Routers usually accommodate this; if they don’t have the next mission lined up, they’ll let the cell apply for open postings on the Eye. They might not always give approval for taking on ops with other servers, however, especially if there’s some sort of factional rivalry going on between servers or they simply think the mission will take you too far away or for too long. Among routers, poaching sentinels from other servers/routers is
considered bad form, but it sometimes happens out of necessity. Who has access to a sentinel’s dossier? It varies based on the server. Structuralists tend to give everyone in the server access. Conservatives like to limit it to just the router. A sentinel’s real identity, including anything which might identify them on the outside, is protected and kept within the server. Servers also maintain more sensitive data, including each sentinel’s biography and psych proﬁles, but these are kept in ofﬂine storage, only accessible to the vectors and medical personnel responsible for protecting and assessing them. If the sentinel team has a dedicated router, they probably get redacted copies as well. For most everyone else, they have to operate off of the sentinel’s i-rep and Eye proﬁle. If a sentinel cracks, it’s the responsibility of the routers and vectors to make a proper assessment. What happens after that depends on the server.
If it seems like the router sees a lot, it’s because they do; they have to be able to make executive decisions and manage their people safely and effectively. Meanwhile, sentinels barely see anything—they operate on a strict need-to-know basis. We ensure they know who they’re working for and why—we can’t afford to have loyalties challenged while in the ﬁeld. Then we give them just enough information for them to ﬁnish their mission, and try to avoid feeding them anything they don’t need or which might confuse matters. Don’t take it personally, it’s just good opsec.
Overall, we try to keep our sentinels fed and happy. They need to be sharp, independent, and willing to do what needs to be done. That sort of attitude doesn’t come from arm-twisting. In that sense, sentinels hold one of the cushiest positions in Firewall … discounting all of the brain parasites and laser amputations you lot seem to fall into. I’m not complaining—keeping your sentinels happy is necessary if we’re going to do what needs to be done. I’m just saying it would be nice if you bought us a gift card or something now and again.

Other Firewall Roles[]

Firewall is a big organization. As such, we have plenty of personnel ﬁlling any number of other roles critical to the functioning of Firewall. Not all of these easily fall into the proxy-sentinel dichotomy or even the deﬁned proxy positions. We still need people to manage the maintenance robots, conduct repairs, courier sensitive packages, inﬁltrate various groups, provide on-site medical services, and so on. A lot of proxies will handle double duty on these tasks, along with their primary responsibilities. Otherwise we turn to sentinels, ally assets, and contractors, in that order. When it comes to allies and paid help, we tell them nothing about Firewall. If we trust them enough to talk about Firewall, we usually recruit them as sentinels.

Administrative Functions[]

Most sentinels never get to see how Firewall executes administrative functions, especially how we keep our hangar of sentinels well stocked. There’s a few reasons we keep this stuff opaque. First, if Ozma knew our HR methods, we’d have even more spies than we already do. There’s also the fact that some of our methods don’t paint us in a very good light when taken out of context. While things vary a lot from server to server, the fact is most proxies will justify anything when measured against the extinction of transhumanity. With a lot of thought and planning, we’ve avoided having to do that “anything” so far, but sometimes it feels like we get pretty damn close.

Recruitment[]

Proxies are given a free hand to recruit who they like. A surprising number of recruits come straight from the ﬁeld, with contact initiated by sentinels. If someone ﬁghts back against a swarm of seething exsurgents that would drive the average shmoe insane, it tells us they’ve got the gumption and the motivation we’re looking for. Usually recruitment by a sentinel in the ﬁeld is as quick as “come with us, we’ll explain on the way.” This falls into the “we trust sentinels to show good judgment” category. When I hire people, I give a little more thought as to what I’ll do if they say no.
Firewall is a secret organization. It’s not going to stay secret by asking everyone we meet if they want to join. So when I’m looking to recruit, ﬁrst I get a copy of their ego. Yeah, that’s right, we arrange a forknapping. I push that up to my vectors to do a full psychological evaluation and simulspace interview. Firewall comes back telling me whether the candidate is appropriate for the job, what the likely answer is, and what bait to dangle to bring them in. If the answer is no, I walk away. If it’s yes, I set up a meeting to make a formal offer. Here’s where things get skeevy, so hang on. Now and again, the proﬁle says they’ll say yes, but in reality they say no. At that point, the safest clean-up is to kill them in such a way that the stack can’t be recovered. An airlock or other mechanical malfunction is normally a good cover. We make sure they get restored from a backup—that conveniently doesn’t remember our offer—quickly. It’s dirty, it doesn’t come up much, but I’ve done it. Then I keep that person on the list for “ask again later.”
Sometimes you run into someone with the skills Firewall needs when they’re not being rescued from exsurgent monsters. How do I win over someone who has a lot to lose by participating in a system-wide conspiracy? The warm, snuggly feeling of saving transhumanity isn’t enough for some people. That’s okay, Firewall attracts all types. It seems we cater to adventurers chasing the rush in a post-death world, people driven by a burning hunger for vengeance, freedom fighters, fugitives, smugglers, profiteers, fringe scientists, and the professionally curious. The Firewall network gives access to resources that transcend factional boundaries and legal restrictions. We give the tools and support to help people achieve their own counter x-threat goals. Most importantly, we give respect. At best an artifact hunter is considered a con-man. We consider them heroes.
Whatever the hook is, I ﬁgure it out early. That’s not normally too hard; learn enough about anyone and we can assemble a pretty solid psychological proﬁle. A fork is better, but not always easily available. Not all proxies do this the same way, but I like to pull them in piece by piece. For most people, it’s a series of carefully laid out personal experiences and relationships. We try to surround them with friends and enemies who plant little concepts and ideas, and work to extinguish those memes which will make them resistant. For the more calculating sorts, we seed their environment with favorable articles, equations, and ﬁndings, while undermining their current ideological structure. This is called priming the target, and I don’t mind admitting I’m not half-bad at neurolinguistic programming when I’ve got a couple of ﬁlters behind me writing the script. Finally, I pull in some sentinels and vectors to create an “event.” A market hiccup, a simulated nanoplague, legal action, whatever. Just something to test that person’s beliefs. Once their understanding of the universe and their place in it is properly put into disarray, I appear, not as an out, just as a different road than the one that took them here. Some people prefer to hire the target on for bigger and bigger jobs, going with the “frog in boiling water” technique, but I ﬁnd those recruits tend to see Firewall as just a job, and Firewall can never be just a job. Our work is too important—and the pay is too low—for anything but true believers. Provide a “road to Damascus” situation and that’s what you’ll get.
Yes, this process has a certain amount of slime in it. Like they say, if you like biofuels, don’t watch how they’re made. We use these methods because they work, and because one delicate egg getting cracked is an acceptable loss in the grand scheme of things. I hear that some routers follow a different ethics release number, and have some compunctions against egonapping and mind-wiping. The truth is, not every router does things like this. We have competing manuals on how to recruit ﬂoating around the Eye, including the hardcore “snatch an ego, modify it, run it through a loyalty test, and toss into the ﬁght” all the way to “ask nicely with an NDA in hand.” All of us have one thing in common: the recruiter is responsible for the recruit. If I contact you and you start blabbing, I take the rep hit. Some people are all right with that, as long as they can go to bed feeling clean as an operating room. Unfortunately for them, there’s a second factor to consider. Most of us agree that Firewall needs to stay secret. Some of us agree more vehemently than others. If your recruit starts streaming the Firewall-interaction highlights from their lifelog, some hardliner within Firewall is likely to pick up on it, and your recruit will disappear (and if Firewall doesn’t get to them, Ozma will). I feel bad spacing someone for saying no, but I feel better knowing I’m freeing them from a lifetime of carrying a secret that will get them egonapped or permanently dead if they tell the wrong person.
The good news is, once you’re in, things change. Smart routers realize that it’s respect that keeps good agents in the organization. A sentinel who is afraid their ego is being modiﬁed between jobs isn’t going to stay long. A scanner won’t sign up if they think their memories will be wiped when they decide it’s time to retire. Handling our agents with respect is the one time we break the data containment rules. Agents’ egos are sacrosanct. Free agency rules supreme. Router training says we never force anyone to take a job, we never conduct unnecessary or non-consensual ego modiﬁcation, we don’t secretly delete memories. I can’t say those rules are followed universally. Servers that break them tend not to last long, but then some aren’t created to last for long. Some require a recruit to consent to invasive procedures up front—if they don’t, they aren’t brought in. A proxy who maintains a cold storage of memory-altered agents they pull out as needed will get the blind eye as long as it’s all voluntary and doesn’t shake the trust of agents in other servers.
To back our sacrosanct-ego policy, Firewall SOP encourages each recruit to keep a non-Firewall data storage location for ego hashes, private journals, or whatever else they need to confirm we haven’t been tampering in their brain box between jobs. We call that data stash the agent’s token, and its safety is sacred.
Once the recruit knows the basics—Firewall is at war against the big black of extinction, our basic SOPs, and the mission parameters—we try not to share anything more. Everything is need-to-know, and if you’re a fresh recruit, you don’t need to know. Once you’re accepted by Firewall, it’s time for us to put you to work.

Privacy vs Security[]

# Start Æther Jabber #
# Active Members: 2 #
< Brainwave: This agent token thing is an awful idea. It sets the tone that sentinels can’t trust their routers and encourages them to post their secrets and feelings about it in some unsecured journal somewhere. This is just begging for someone to steal data and map out Firewall operations, and it’ll get people killed. My server provides secure storage to each sentinel for this sort of thing. I’m sorry, but feeling cozy takes distant second to protecting transhumanity.
> Sassyfrass: Hey, I’m not going to say you don’t have a point. But you’re going to ﬁnd that recruitment in servers that do that is way down. When people don’t know if they can even trust themselves, it causes its own set of issues. We’re already trusting these people to pull our toes out of the reactor. Trust them to know how to keep their own bunks tidy when it’s done.
< Brainwave: I’m not saying they’re going to try to exﬁltrate data. I’m saying they don’t have the knowledge or resources to keep that data safe. This isn’t something you can protect by just messing with privacy settings. The best policy is to wipe memories after a mission. Next to that, you contain everything in a space you control. Then you know everyone is up to standards.
> Sassyfrass: No one is forcing anyone to post anything, and short of wiping memories, we can’t much stop them from posting it either. We’re just saying, have a place that’s secure enough you can trust it—against the bad guys and against Firewall. Not everyone knows how to set one up on their own, but you can buy them cheap or ask your router or a friend to set one up. It’s easier to ﬁx than fear in the people you should be trusting. Firewall doesn’t work like your military hierarchy, stop trying to make it.

Dirty Minds[]

To: Muldrew, Router
From: Higgs
Consider this notice of termination. I’m out. I signed up for saving the universe. Instead I’ve been at Max-Bods for six months, copying egos awaiting farcasting. I know you said they’d be okay, but I don’t know what you’re actually doing to them and this is some skeevy shit. I’m okay with smuggling out sentinels. Those guys give consent. Not this. I remember my training, I’m going to keep your secrets. But I’ve got a lot of soul-searching to do.
Don’t message me back.

New Recruits[]

# Start Æther Jabber #
# Active Members: 2 #
< Proxy A: Hey, you know how in most servers, it’s SOP to send a copy of the fork of potential recruits to [REDACTED] server?
> Proxy B: Yeah, that’s just for archiving purposes, right? System redundancy?
< Proxy A: That’s what I always thought, but the weirdest thing just happened. We were in the process of bringing in an asset we’d had as an ally for months, very much sentinel material. We snagged a copy of their fork, per usual, and ran them through the standard loyalty tests and recruitment pitches. Everything was looking golden. We had plans to recruit them tomorrow.
> Proxy B: What happened?
< Proxy A: We just got word from [REDACTED] server that the potential recruit is a deep cover ExoTech agent.
> Proxy B: Holy smokes. Wait a minute—how did they know?
< Proxy A: I’m still not entirely sure, but everything points to them running tests/interrogations on the fork we gave them. Not only are they not just an archive, but they seem to have psychscanning methods that are a step above what our server can do.
> Proxy B: Let me guess, you looked into them, but it’s all above your clearance.
< Proxy A: Yep. Everything that server seems to do is so classiﬁed, it might as well be on another plane of existence.
> Proxy B: So what’re you going to do with the recruit?
< Proxy A: Recruit him, but feed him snipe hunts. We’re going to see if we can draw out what ExoTech is looking for, maybe gain some insights into their ops. The psych proﬁle that [REDACTED] gave us is so thorough, we’ll have him eating whatever we feed him for months.

Advancement[]

Firewall advancement is a strange beast. The primary push to bring in more proxies is operational needs. When a server is looking to grow, they usually look to proxies on rotation ﬁrst. Barring that, they’ll scan the sentinels they have on hand, looking for ones with the skill sets they need. Experience is not always a factor. The best ﬁeld ops are often too valuable to bring out of the ﬁeld. On the other hand, the longer you’re a sentinel, the more “need to know” information you pick up over time. At some point, this can be considered a liability, and it may be safer to Firewall’s future ops to bring you to the inner circle. If you’re looking to advance—whether you’re sick of the stress of ﬁeld ops, or you just think your skills could be put to better use—the best agenda is to make yourself useful. Respond to requests for assistance on the Eye and voluntarily put your own time in on projects that Firewall might value. Eventually someone is likely to notice.
Advancing to proxy requires a proposal by an existing proxy, passing the vote, and getting access granted. Unless a proxy blocks you, congratulations, you’re now as underappreciated as I am. Getting promoted to proxy is a big deal; it’s basically full-time-and-a-half Firewall. That magical transformation varies by server. Some let people serve as a proxy while still maintaining their other commitments. Others require something a little more serious.
The most common route is forking. One fork leaves their old life and identity behind so they can live the Firewall life, with all the secrecy and sucking chest wounds that involves. The other consents to some mild psychosurgery to forget the promotion ever happened (and possibly is pushed out of Firewall altogether). Yeah, there’s another Atalee out there. I hear she’s better with company. Some people don’t ken well to that, though, and Firewall being what it is, they’re free to do something about it. As a sentinel, you can try to switch to a router with another, more liberal server and get your promotion there.
Before you’re upgraded from sentinel to proxy status, you can expect to be called in for psych and philosophy evals. There’s really no getting around this. No, you can’t get those done yourself and send them to us, nice try. Even if you got pulled in by some maverick sentinel in the ass-end of the system, there isn’t a single server out there that will accept a new member who hasn’t been through a nice, friendly, psychosurgical interview. We can’t risk letting inﬁltrators, exsurgents, or people with destructive or toxic personalities into our inner operations. When you accept that promotion, you’re letting go of your mental privacy. They’ll go through your entire life history, and they’ll doublecheck the details. In some cases, they might even bring in some past acquaintances—voluntarily, if sentinels, forknapped if not—to corroborate your story. Expect to answer some uncomfortable questions—we all have secrets. You can also expect to be run through some simulations. We need to know how you’ll react when the world is collapsing around you. On the positive side, we’ll excise those memories if you like.
Firewall attracts all types, and we have all kinds of jobs. If you’re a crackerjack, expect to get the sorts of jobs you can’t mess up. If you are of a politically-unfriendly persuasion, such as a die-hard bioconservative or a corporate stooge, you’re going to ﬁnd yourself carefully contained and generally underutilized. That isn’t to say we don’t have Jovians, oligarchs, and so on. They’ve just proven beyond a shadow of a doubt that they’re team players when it comes to ﬁghting x-risks. Still, allegiances run thick, and some servers are far more hostile than others.

Termination[]

The sun sets for each of us. Hopefully when we go it’s with a good word and fond memories. Voluntary separation is a tough spot for Firewall. The truth is, even a low-level sentinel can walk away with more information than we’re comfortable parting with. This comes back to respect. Unless we put you on a job you knew would result in lack, we let you leave on your good word you won’t share what you know. There’s always the option of voluntary psychosurgery to suppress difﬁcult memories. This is more frequently taken to stop the nightmares than out of respect for Firewall’s secrecy, but it still happens. In either case, the philosophy is: we left your brain alone when you were on the job, we’ll leave it alone when you’re off. Of course, proxies who happen not to subscribe to that philosophy will handle things differently, but they’re the exception.
Involuntary separation is rarely so gentle. If you fucked over the organization, if you’ve proven yourself untrustworthy or dangerous, hostile to Firewall, or a self-serving tyrant, then you are now a threat, and Firewall will bring its assets to bear against you. Psychosurgery is considered the gentle approach. Setting you up for a fall so hard you get sentenced to ﬁnal death is considered much tidier. Don’t fuck us over. Firewall is not in the business of playing games.
In either case, once you’re back in civilian life, we try and keep tabs on you for a few years. The information you know gets less sensitive with time, and having your router check in is good for helping you transition smoothly (or to reconsider your decision). Of course, should your router notice you’re writing a tell-all exposé, it’s time to activate the vectors and ﬁlters so we can revisit the “involuntary separation” options.

Thanks for the Memory[]

To: <Firewall Node 898847638>
From: Living the Truth
Best way to hide a lie is between two truths. They wipe everyone. Us sentinels? There’s too much dirty laundry in our heads to let that walk out the door. How many of us do you think there are? Five hundred? Five thousand? Way too many for Firewall to keep its secret with pinky swears. One day you wake up in the clinic with no memories and all of your backups mysteriously lost, and that’s the happy ending. Proxies? They can’t go back. They don’t have a life to go back to! When a proxy breaks with the pack, they’re spaced. Open your eyes! I’ve seen it happen myself and I can send the ﬁles to back it up.
Look, I’m sorry to be the one to share bad news. I didn’t know when I signed up either. But it’s better to know the Firewall retirement plan now, while you’re still useful.

To:<Firewall Node 898847638>
From: What-did-I-just-read?
LtT, you need to get your head checked. If Firewall wanted disposable assets, there are plenty of sentinels who would volunteer to be forked, modified, and destroyed without any of your conspiracy. Remember, this is a volunteer organization from top to bottom, and we all have to sleep in the bunk we make. I’ve had friends retire and they’re doing just ﬁne in civilian life.

Firewall Governance[]

So who calls the shots? Who directs Firewall, who administers everything? The answer is everyone and no one. Despite the rumors, there’s no secret council or governing body. In large part due to the autonomist inﬂuence in Firewall’s early days, everything is handled through direct democracy. For most day-today affairs, servers run their own show. They decide what operations to pursue, they handle their own admin, they’re in charge of their own opsec, and so on. They are also expected to collaborate when it comes to sharing resources. This doesn’t mean they operate without restrictions. Every server is expected to adhere to Firewall’s mission statement, and those that don’t are held accountable. Servers that stray off the reservation are voted out and cut off—or worse, actively hunted and shut down.
Decisions affecting the entire organization are uncommon, but they happen. Any proxy can initiate a proposal, but for a vote to be called they need to get 500 proxies to back the measure. Ofﬁcially, settling proposals is straightforward: every proxy gets a vote. Since we all operate anonymously, that vote is cast using our private keys. Majority vote wins. Simple, right?
The i-rep of the proxy that authors it makes a big difference in how likely the measure is to get traction. The individuals proposing the measure normally meet with different opposition groups to nudge and alter the proposal to something approaching a compromise. There’s an internal understanding that minorities sometimes get screwed in majority-vote situations, so there is usually—but not always—an attempt to acknowledge their concerns. Faction politics play a major role here. A lot of these issues are hashed out over the Eye, but in an organization built on anonymity and secrecy, the real decisionmaking is often made in side-channel negotiations, back-room deals, rep-twisting, and even a little back-scratching. This means that a proposal’s success is often settled before it even comes up for a vote. For a decision voted on by every member of the group, the process can be very opaque. There’s also the matter that sentinels are excluded from this process. While there are security and compartmentalization reasons for this, there’s something to be said in that sentinels outnumber proxies and arguably face the repercussions from Firewall’s group decisions more directly, as they are in the ﬁeld. There’s an ongoing and heated debate over this issue, pushed strongly by the structuralists, but ironically most sentinels are unaware of it.
A number of Firewall-wide decisions involve devoting resources to large operations—specifically, operations that require multiple servers to work together. Quite a few votes involve establishing new servers to take on fresh operations. Others deal with operational minutiae or handling servers or proxies that have not been adhering to the game plan. The vast majority of org-wide decisions, however, are policy matters. You may have noticed all of the policy docs on the Eye? Well those are guidelines for handling Firewall operations, and they’ve been hashed out over months and years of debate. This is where faction politics really raise their ugly little heads, and the policy forums resound with their ongoing clashes. A lot of these issues are hypotheticals and what-if scenarios, but some of them have real consequences to our operations. The whole reason Firewall tolerates asyncs, for example, rather than killing them or locking them away, is because the pragmatists pushed through and won a vote on the matter, and it’s now ofﬁcial Firewall policy. The conservatives still grumble about that one, but for the most part, they adhere to it.
Of course, given the independence each server has, Firewall-wide policy mandates are in some ways more like declarations. Since we all have limited visibility into other servers, it’s difficult to see how closely each toes the Firewall party line. Let’s say your server decides the ultimates are an x-threat that need to be nudged back a bit, which goes against Firewall policy. As long as you keep your operations secret, there won’t be any fallout. If it is discovered, however, you can expect your proxies to be held accountable—so it’s in their best interest to stamp out that sort of thing. No one signed up for Firewall out of their own best interest, though, and wisdom and group pressure often lose out to ideology.

Outside Influences[]

Firewall has a few bosom friends, as well as some powerful patrons. While they don’t have votes (that we’re aware of), they still have clout. If the director of the lab for femto-materials sciences says they only want a particular server to have access to the lab or they’ll cut off their support, that’s a request Firewall heeds. We even have a few oligarchs in our ranks who are used to their word being law. While Firewall will never kowtow to them, we’re willing to tip our hats when it opens doors. This leads down a dangerous road. Many outspoken members are ﬁrmly against “selling out.” Usually, though, the pragmatists can negotiate out a deal everyone feels is advantageous.
The faction most deeply embedded with Firewall is the argonauts. They have their ﬁngers everywhere. They host many of our computer systems, they’re well-represented among our proxies, they provide data analysis, and they’re generous with funding. The result is, Firewall politics can be a little sensitive to the current argonaut party line. We’ve struck a good balance. The argonauts seem comfortable with Firewall operating independently, even when we foul up some of their operations. When they request our support or ask to participate in a particular investigation, however, the vote normally passes without too much fuss.

Conflict and Issues[]

Nobody has an exact count on the number of proxies and sentinels in Firewall. What’s clear is we have several thousand people plus forks, all with their own idea of what Firewall should be like. Each with their own motivations, fears, methods, and psychoses. We have war criminals working with refugees, Jovians defending mercurials, Lifeboat vets sharing a capsule with new-school hypercorp black hats. When things work well, it restores your faith that maybe transhumanity is worth ﬁghting for after all. When they go sour, everyone is arguing with the full conviction that their opponent is on the side of extinction, while our reluctant sentinels make for the hatch with Firewall’s crown jewels. The point is: conﬂict happens. A lot. Both within Firewall and with outside entities. How we deal with it has become an art all of its own.

Internal Conflicts[]

It is very difﬁcult to pull rank in Firewall. Some servers actually do establish a hierarchy, which they enforce through duty assignments and rep penalties. Even without a command structure, servers have a code of behavior by which everyone is expected to abide. Rarely will Firewall fall back to such antiquated notions as sending someone to the brig, unless that individual is clearly a threat to Firewall operations and is awaiting a proxy vote for incompetence or treason. However, trust creativity to fill that gap. A proxy rotated into a hostile server may ﬁnd a year behind bars a welcome reprieve compared to the “corner ofﬁce” treatment, inundated with busy work and surrounded by hostile compatriots. The fact is, you need to adapt to your assignment. At worst it’s one year before you’re on to your next tour. There’s nothing that prevents proxies from rotating out early, either.
The reputation system does a lot to fix this. Someone who consistently bucks the trend will get down-voted and passed over for juicier assignments and better equipment. Meanwhile, a proxy who elects themself as server boss may ﬁnd their rep score so low they couldn’t lead a servitor. Newbies sometimes complain the reputation system isn’t fair, but even they ﬁgure out how to live with it eventually. Rep encourages people to be polite and work together, and with a ﬂat organization like ours, that’s gold.
For sentinels, life is a little different. Frequently all sentinel trafﬁc is routed through just one or two proxies, and sentinel reputation votes aren’t weighted as heavily as those of proxies. Plus, sentinels don’t rotate, and proxies don’t always transfer their sentinels over to the new guy when they rotate out. This means some proxies can and do pull rank. Usually it’s for the better. Your proxy has been dealing with this stuff for a long time, they deserve a little faith.

Factionalism[]

Factionalism undermines the whole rep system. Voting blocs can buoy bad apples and sink good ones, while insulating internal problems from review and analysis. Cliques based on ideologies are to be expected; you support people you agree with. Some people hold onto those cliques a little too tightly or bring in their outside politics in determining who they do or don’t like, and that sort of shit doesn’t ﬂush. Some people also practice retaliatory down-voting. If you down-vote that other guy just because they’re a mercurial and people suspect that, expect some negative feedback. Some simply only help their friends and toss mushy apples at the cliques they don’t like. This happens a lot around big votes.
How do we handle this? Not too well, I’m afraid. It’s a work in progress. Proxy rotations help a little. It breaks up those tight circles and just plain exposure to people from the other side helps shut down biases. Still, Firewall is firmly rooted in the autonomist tradition, which means less-represented (and less rep-happy) groups like the Jovians tend to suffer. Does the Consortium invasion of Locus qualify as an x-threat requiring (justifying?) Firewall intervention? That sort of thing can split Firewall into pieces, and most of the combat is in those smoke-ﬁlled chat rooms. Even in the day-to-day, our natural instinct is to help people who think and act like us, and brush off the Jovian who just doesn’t “get it.”
It’s an issue with a few thousand forum threads discussing it, but don’t expect it to be resolved any time soon.

Operating At Cross-Purposes[]

Unfortunately, coordination across servers is a little complex, and it’s not uncommon for multiple Firewall teams to be assigned to the same x-threat, totally unaware of each other. There are even cases where different information has led to different Firewall teams being assigned in opposition to one another; one is assigned to destroy the target, the other to recover it for study. In theory, routers and the Eye should limit our working at cross-purposes, but the span of Firewall operations and our focus on information control mean it’s inevitable.

Infiltrators[]

You’re already familiar with the old standbys: Ozma, TAHI, and their likes. We know we’ve been inﬁltrated. They’re too good to not have succeeded. We have a few servers dedicated solely to rooting out spies like this—sometimes that new proxy that just rotated into a server is working double duty as a counter-intel operative. What we do when we ﬁnd these spies varies. Sometimes we draw-and-quarter them, in the psychosurgical sense. We send others on “special operations,” tag their accounts on the Eye to limit access, and wrap them up in layers of surveillance so thick a nanobot couldn’t squeeze by undetected. When we do it right, they don’t even know they’ve been made. We keep them nicely insulated, but still put them through the regular rotation cycle to all sorts of “high-security” projects where we feed them delicious hand-picked “secrets.” The best part is grouping a bunch of spies all together in the same lab or operation, then privately informing each that we suspect one of the others is a mole. They go crazy trying to root out the other spies to prove their loyalty, totally unaware the only legit Firewall agents there are their handlers. We should ﬁlm that stuff and sell it.

Secret Societies[]

Firewall has plenty of secret societies. It’s a natural consequence when people make friends using only false identities and encrypted communications. We get plenty of little political knitting circles who coordinate forum posts and data releases to support their preferred ideology—usually an extremist fringe of one of the existing cliques. The truly caustic get rep-dinged into oblivion, but for most of them the only real cure is transparency. Once people know they’re getting played, they’re able to defend themselves. This could be better locked down, but all of the cliques engage in their own private data coordination campaigns, so it would be tough to put the boot to some without that coming back around.
Transhumanity is weird, and it gets weirder by the week, so we get lots of other small groups with their own secret agendas. We sure as hell have some singularity seekers in our ranks, hoping than an op brings them into contact with something that will let them transcend to a god-like super-intelligence or be one with the universe. We probably have some aspiring exhumans too. Then there are closeted religious believers, infomorph supremacists, and probably a few leftover freemasons, all working their own fraternal cronyism. Throw in some ascendant forkers who think they can do everything themselves, and you occasionally have a group that’s mucking things up for the rest of us.
Hard data on the actual penetration and effectiveness of these circles is impossible. Lots of people like to say that there’s a band of secret chiefs who operate Firewall from behind the scenes. I call spacer tales on that. If Firewall was coordinated by some great intelligence, why is it still such a confusing mess? It’s one of those stories that sticks around because it’s impossible to disprove. On the other hand, if it’s true, they’ve been doing a good job protecting transhumanity for the past ten years. Given the asteroid ﬁeld we’re ﬂying through, I’m not sure it’s a great idea to buck them now.

Small World[]

To: <encrypted>
From: <encrypted>
Vil, I checked over your stylometry results. You’re right, the counter-anonymizing algorithm was off, that’s why you were getting the anomalous behavior. I made some tweaks, I think you’ll ﬁnd it isn’t picking up that odd false-positive from before. I found the problem was the nature of the conversations centered around a limited number of key phrases. I think this soundly disproves your claims that thirty percent of messages on the Eye are sent from such a small number of individuals. In fact, I’m releasing a study next month describing the likely number and demographics of the proxies. I can assure you, there’s no central clique like you were suggesting. As a friend, I’ll keep this between us, but should your accusations go public, you’ll look the buffoon. Better to put this behind you.

Corruption[]

Firewall is a big pot of smuggling routes and dirty secrets, just calling out to the Extropian in each of us. It’s no surprise some people use it to make a little something something on the side. Industrious capitalists who “ﬁnancially incentivize” Firewall jobs for themselves are not unusual. To some degree, it’s hard to complain; when you’re busy saving the universe, a little inside trading falls into the “break some eggs” category. In fact, some routers use the opportunity for illicit (albeit, not immoral) income as a little sugar in the recruitment pitch. Just bear in mind, big paychecks leave big data trails, so don’t get greedy.
Real Firewall corruption is a little darker. Give a proxy access to spies and hit teams, and now and again they think they’ve got a throne to defend. Yes, we have had proxies activate Firewall assets as a personal army, to push their politics or commit some legitimate mayhem. Just like we have front organizations that ofﬁcially work for some great cause but actually work for us, proxies have used servers as an extension of some other organization. I don’t think I need to say what happens to those people.
We have seen proxies use their position of power to abuse those under them or depending on them. A proxy abusing another proxy is pretty tough without a hierarchy to enforce it, but abusing sentinels? Some proxies think that’s just tough love. These aren’t necessarily bad people here, just people who think keeping everything secret, hazing, assigning impossible jobs, and so on are just how proxies are supposed to do it. We have had a few legitimate sadists as well, I’m sorry to say. We stamp this sort of behavior out as soon as we ﬁnd it. Bad management will gut the organization faster than Ozma could. The issue isn’t our motivation to set things right, it’s that whole secrecy aspect built in from day one. Sentinels don’t always have access to the Eye, and proxies don’t normally give unﬂattering pictures of themselves. It’s easy for a proxy to keep a sentinel in the dark without the rest of Firewall being any wiser. Unless there’s a particular event to alert us to the situation, we’re not too likely to ﬁnd out about it for a long while.

Sentinel Resentment[]

Let’s face it: sentinels often operate in the dark. They know they’re only being told what they need to know, so there’s always that voice nagging in their head, wondering what’s being kept from them. Even if we give them everything we have, there may be details of which Firewall is simply unaware. When those details nearly take their heads off, they may blame their proxies for holding out on them. Routers rely on building up a relationship of trust, but it’s all too easy to have that undermined. There may be an aspect to an op that a router thinks is irrelevant and so doesn’t share it, only later to have that decision bite them in the ass. When the sentinels ﬁnd out they knew something about that all along, they probably won’t take it well.
Losing the trust of your sentinels can be a very bad thing. At best, you lose an operative. At worst, that mistrust screws up an op and gets people killed—or the sentinel swaps allegiances. Usually the process is long and slow, and a good router will do what they can to ﬁx things. If the router is oblivious, incompetent, or worse, then sometimes someone else needs to be tasked to come in and clean up the mess.

Arbitration[]

Once inappropriate activity is detected, a separate server is tasked with looking into the situation. Their report and recommended course of action is brought into a public discussion thread and put to the vote. This process is normally pretty quick. There’s no organization-wide legal code, and if there were, half the servers would ignore it anyway. If there are security concerns regarding a speciﬁc sentinel or proxy, they are normally put into online storage so they can talk with people and plead their case. Once the vote is taken, corrective actions or punishments are executed immediately. The accused can appeal the decision, but the nature of living under a panopticon means we normally have a pretty heavy body of evidence.
The penalties depend on how egregious the crime is and how popular and effective the proxy is. Some things tend to be swept under the rug: a scanner collecting data on a crush is frowned on and rewarded with a slap on the wrist. Abusing our sentinels or other proxies, providing false data to Firewall or impeding our mission, or crimes against transhumanity are taken very seriously. Because these are all people in-the-know, letting them just walk away from Firewall isn’t normally an option. We seek rehabilitation when we can, ego deletion for most other cases, but now and again we get creative.
Not everything goes to a vote. Some servers handle stuff internally. This could be to the offender’s beneﬁt or not. Pandora server recently became the subject of some focus because of their heavy-handed response to one of their crows leaking Firewall data. The crow’s ego was heavily modiﬁed and the older backups were ﬂagged as corrupted. The Eye was on ﬁre for weeks discussing what the appropriate response was (if any), and through the whole thing that crow was defending their server for their actions. Eventually the server was disbanded, but it wasn’t an easy call, and I don’t expect that same response next time a case like this comes up.

Rogue Servers[]

There are several known cases of Firewall servers going rogue. Some of these were exiled from the organization but continue to operate with their own agenda. A couple of these were so bad we’re still trying to hunt them down. A few simply drifted away from Firewall’s goals and policies and severed the ties themselves. At least one of these still recruits sentinels and purports to be part of Firewall—without telling them the full story. For all intents and purposes, we treat these rogues as hostile groups.

Firewall Organization 1e