Black Hats Rulebook

Table of Contents

Table of Contents

• Objective of the Game
• Before the Game - Hire Your Crew, Build Your Cyberdeck
• Setting Up the Game
• Network Topology
• Runners and Rigs
  • Runner Tokens
• The Data
• Node States and Subnets
• Hacking
  • What counts as "connected"?
• How to Play
  • Setup
  • Turn Structure
  • What can I do on my turn?
    • Play a Card
    • Activate a Runner
  • Pass
  • End of Round
• The 2098 Buyout - How Did We Get Here?
• Quick Reference
  • Once Both Players Have Passed the Round Ends
  • Hacking
  • Winning and Disconnection
• New Hackers Start Here! - Starter Crews and Cyberdeck
  • Purple Crew
  • Green Crew
  • Starter Cyberdeck

Objective of the Game

Victory is determined based on points.

You typically score 2 or 3 points for successfully running the data from the enemy server to your crew's data server.

You score 1 point each time you disconnect an enemy runner.

As soon as someone scores their fifth point, they win and the game ends immediately. If both players score their fifth point at the same time, whoever holds the first player token wins.

Before the Game - Hire Your Crew, Build Your Cyberdeck

Your crew and cyberdeck lists are created before the game according to the following rules:

• A crew can take 20 bandwidth worth of runners and rigs.
• Each runner in your crew has a specific bandwidth cost.
• In addition, each runner must be equipped with one rig card which also costs bandwidth.
• Runners and rigs are unique. Your crew cannot have two of the same of either.
• Cyberdecks must include exactly 20 cards.
• You can have up to 2 copies of any individual card in your deck, except for "Hack the Network." You may have up to 20 copies of "Hack the Network" in your deck.

First Time? For your first game it is recommended you use the crews and cyberdeck found on the last page of the rules before beginning to customize your own.

Setting Up the Game

Black Hats is played on a hexagonal grid called the network.

1. Place the network board in the middle of the play area between both players. Designate one player as purple and the other as green. Place the point trackers over the 0 for both players.
2. Each player lays out their crew cards face up on their side of the network board with their character token, places their rig cards on their runners, and shuffles their cyberdeck. Be sure to let your opponent review your runners and their rigs - but not your deck!

Network Topology

In order to understand how runners and cards affect the game, it is important to understand how the network operates.

Individual hexes on the network are called nodes. Nodes may be in any 1 of 4 possible states: red, blue, gray, and offline. Gameplay begins with every node in the network set to the states printed on the network board. During the game, players will use cards that hack nodes to change their state, covering them with the appropriate hex tile. See "Hacking" (pg.8) for more.

Connected nodes of the same state form a subnet. Runners can only cross into a new subnet one time during their movement.

In the example below, only the runners connected by yellow lines share a subnet and are capable of attacking each other:

[Diagram omitted: example of a subnet showing runners connected by yellow lines.]

Runners and Rigs

Runner cards have the following attributes:

• A. Bandwidth - The cost of adding the runner to the crew.
• B. Attack Power - The number of cards the runner flips from the cyberdeck when attacking.
• C. Passive - An effect that is always in play.
• D. Signature Action - A special action only this runner can use.

Rig cards grant runners their remaining attributes:

• A. Bandwidth - The cost of assigning this rig to a runner.
• B. Signal Strength - How much damage the runner can take before being disconnected.
• C. Security - Incoming damage to a runner is reduced by their rig's security value.
• D. Speed - The number of nodes that a runner can move into on their turn.

[Card anatomy diagram omitted; the labels above are the printed callouts.]

Runner Tokens

Runners are represented on the network by circular tokens. The background color shows which player controls which runner and the hourglass icon on the back shows that the runner is "exhausted".

Runners cannot move through nodes occupied by enemy runners, but they can move through allied runners. A runner can never end their movement in the same node as another runner.

Flip a runner token to their exhausted side once the runner has already acted in the current round. They will flip back to their ready state at the end of the round once both players have passed.

The Data

Each team's data is represented by a 6-sided die the same color as their team.

Runners extract the data from the enemy data server and try to transport it back to their own data server to secure it.

Data is extracted with 5 signal strength and always has security equal to its current signal strength.

When a runner attacks, if they're eligible to attack the runner carrying their data, they may attack the data directly instead. Make sure to update the die to reflect its new signal strength (and therefore also security) after the attack.

Node States and Subnets

At any given time a node (one individual hex) is always in one of the five following states:

• Red, Blue, or Gray - No inherent effect.
• Offline - Cannot be moved into by runners.
• Data Server - These purple and green nodes cannot be hacked and runners may not enter them. The data is extracted from a node adjacent to the enemy data server and is secured from a node adjacent to your own data server.

Nodes are grouped into subnets. A subnet is any set of nodes which share the same state and are touching each other ("connected"). There is no limit to how large or small a subnet can be. A node with no adjacent nodes in the same state is still considered to be a subnet consisting of 1 node (itself).

Players may hack nodes to change their state using cards and runner abilities, thus changing the shape of subnets on the network.

Hacking

Many cards and abilities refer to hacking one or more nodes.

To hack a node:

1. Place hex tokens over the chosen nodes to reflect their new state.
2. Remove all lock tokens from the network (if there are any).
3. Add lock tokens to the newly hacked nodes.

Nodes containing runners or lock tokens cannot be hacked. Data server nodes cannot be hacked.

Note: You can hack a node to the state it's already in, if you so choose.

If a card or ability refers to "changing the state" of a node rather than "hacking" a node, that ignores this process and its restrictions. You can never change or hack the state of a node to the offline state if it contains a runner.

What counts as "connected"?

"Connected" means that each hacked node must touch at least one other hacked node. Two possible examples of a "hack 4 connected nodes" effect are shown in the printed diagrams (omitted here).

How to Play

Setup

• Determine first player - Randomly determine the first player by rolling the data dice.
• Draw cards - Each player draws six cards from their cyberdeck.
• Deploy runners - The first player deploys all their runners to their home row (the row of hexes on their edge of the board), then the second player deploys all of their runners to their homerow.

Turn Structure

The game is broken up into rounds. A single round consists of both players taking alternating turns beginning with the first player, and does not end until both players have passed.

What can I do on my turn?

Each turn you can do one of the following:

• Play a card
• Activate a runner
• Pass for the round

Play a Card

Select a card in your hand, reveal it to your opponent, and carry out the effects on the card.

Activate a Runner

Exhausted runners cannot be activated. When a runner is activated, they may move then take an action - in that order only.

1. Move

Runners may move a number of nodes up to their rig's speed value and may change subnets once. They may not move through or into nodes containing enemy runners. If that runner is carrying the data, the data moves with them.

2. Take One Runner Action

• Extract data: When adjacent to the enemy's data server, a runner may extract the data, which begins with 5 signal strength and has 5 security. Place the data die on the runner token with the "5" side facing up.
  • If you already have a runner carrying the data, it's destroyed when you extract a new one.
• Transfer data: If a runner is carrying the data, they may pass it to another allied runner in the same subnet.
• Secure data: Capture the enemy data for points and profit.
  • This action can only be taken by runners adjacent to your own data server and carrying the enemy data.
• Reveal cards from the top of your deck equal to the remaining signal strength on the data. You score points equal to the highest damage value among the revealed cards.
  • Note that if your deck ever contains no cards, immediately shuffle your discard pile into your deck and continue revealing cards until the proper number are revealed. Do not resolve any flip effects on cards revealed this way (those are for attacks).
• Attack: Attempt to damage an enemy unit or data they're carrying.
  • Attacks can only be made against runners and data in the same subnet as the attacker.
  • Reveal a number of cards from the top of your deck equal to the value of the attack and add the damage values on the bottom of the cards, then subtract the defender's security. The result is the damage dealt by the attack.
    • If the sum of revealed damage values is at least 1, the attack always deals at least 1 damage, regardless of security.
    • Some attacks "bypass" an amount of security. In these cases, treat the target's security as that much less. For example, if the target of an attack has 3 security and the attack bypasses 2 security, treat the target as having 1 security. If multiple such effects apply, use only the highest among them - don't add them together.

3. Exhaust the Runner

After a runner takes their action, exhaust the runner and flip its token to the exhausted side.

Pass

Once you pass, you forfeit this turn and may not take further turns until the next round. The other player may continue taking turns until they choose to pass.

End of Round

1. Remove all Lock tokens from the network.
2. Resolve abilities that trigger at the end of the round. If there is more than one, the first player chooses one of theirs (if any), followed by the second player (if any). Repeat until all are resolved.
3. Each player places opposing disconnected runners in their owner's home row, starting with the first player and alternating. If there are no open nodes to place that runner, they are removed for the rest of the game.
4. Refresh all runners.
5. Each player draws two cards. If your deck ever contains no cards, shuffle your discard pile into your deck and continue drawing, if necessary.
6. The player with the fewest points may reassign the first player token. If players are tied, exchange control of the first player token.

The 2098 Buyout - How Did We Get Here?

In 2098, amid a worsening climate crisis and globally failing economies, the wealthiest corporations in the world cut a deal with the United Nations and its member states.

Known simply as the 2098 Buyout, an alliance of megacorporations agreed to use their considerable treasuries to bail out the global economy. In return, the nations ceded all practical governmental authority. From then on, nations would continue to exist only as a source of social identity, rather than as geopolitical entities.

Government militaries were disbanded and privatized into MILNET as a measure to prevent nationalistic wars. In addition, all governmental assets were sold off to the highest bidder among the megacorporations. The 2098 Buyout was billed as the drastic measure needed to generate the considerable capital required to effectively engineer the solution to the collapsing climate.

By 2125, the climate and global temperature had officially been stabilized, but considerable environmental damage had already occurred. As far as the public was concerned, the climate crisis has been halted, although rumors persist that some of the technology developed by the megacorps has only kicked the can down the road another few hundred years at best or decades at worst.

Still, the relative swiftness of corporate action and the newly-stabilized global economy gave most of the population a reason to view the 2098 Buyout as a huge leap forward for humanity.

Most human life remained in large urban centers, which had defenses erected against the chaotic weather and massive super storms that plagued the late 21st century. Global travel declined significantly with the rise of early, and comparably primitive, virtual reality and telecommunication software.

In 2148, the first digital mind renderer technology was developed by Khonsu. For the first time in history, this allowed network traffic and data to be rendered directly into a human's visual cortex. While connected to the system, merely closing one's eyes allowed a completely digital 3-dimensional space to be rendered in the literal mind's eye of the user.

After 2160, the emergence of IMBs new server technology that worked in tandem with the Khonsu mind field renderer allowed for unprecedented amounts of data to be stored, transferred, and managed directly via the human brain. It allowed virtual data to be stored directly in neuronal tissue in combination with implanted cybernetic hardware. This led to massive boosts in processing power, opening new vistas of research allowed by direct mind to machine interface.

By the 2170s, "running" data was a firmly established career, both legally and illegally. By having a VR avatar interface directly with a server on the network, the brain becomes a wetware drive that stores the compressed information until the hacker has digitally "run" the data through VR space to the correct server for depositing. Running data is standard operating procedure for small time gangs and megacorporations alike. Running work includes corporate espionage, cryptocurrency theft, industrial sabotage, and blackmail. Runners are often the target of intercepts by other running crews who attempt to disrupt these operations.

Quick Reference

On your turn, do ONE of the following:

• Play a card from your hand: Place the card in your discard pile and resolve its effects.
• Activate a ready runner: When you activate a runner, they can move, then take an action. Each is optional but they must be taken in that order:
  1. Move at your rig speed, crossing up to 1 subnet border. You cannot move through systems containing an enemy runner. You cannot end your move in a system continuing another runner.
  2. ONE of the following actions: Attack a runner or the data. Push it. Use their signature action. Extract, transfer, or secure the data.
  3. After they finish their activation, flip their token to the exhausted side.
• Pass for the round: You can take no further actions until both players have passed and a new round begins.

If a card or ability refers to "changing the state" of a node rather than "hacking" a node, that ignores this process and its restrictions. You can't change the state of a node to the offline state if it contains a runner, though.

Once Both Players Have Passed the Round Ends

1. Remove all lock tokens from the network.
2. End of round abilities trigger.
3. Reconnect runners disconnected this round.
4. Refresh all runners.
5. Each player draws two cards.
6. Assign player one token.

Hacking

1. Replace the current state with a different one by placing a tile over it.
2. Remove any existing lock tokens from the network.
3. Place Lock tokens on the newly hacked node(s).

You may not hack a node if:

1. It contains a runner (ally or enemy).
2. It contains a lock token.

Winning and Disconnection

If any player ever has 5 victory points, the game ends immediately and they win. You score a variable amount of points for securing the data and 1 point for disconnecting an enemy runner.

When a runner is disconnected: Your opponent scores 1 point immediately. Then at the end of the round in the reconnect and refresh runners step, they place them back on the board in an unoccupied online node in your home row. That runner is ready and has full signal strength. If there are no eligible nodes, they are not placed back on the board and are gone for the rest of the game!

New Hackers Start Here! - Starter Crews and Cyberdeck

Purple Crew

Runner	Rig
Gh0st	Khonsu Blinkbeacon
Wee Rin	Gonkboard Xtreme
Arson Nick	Gonkboard Defender
Sally Shortstop	Roboware 1680

Green Crew

Runner	Rig
Wyld Chyld	Battlestation Mk2
James 'Jimmy' "Jester" Mahoney	Roboware Leapfrogger
Skeleton Dee	Roboware 9999
CATapult	Gonkboard Gonk Edition

Starter Cyberdeck

Both players should use this their first game.

7x Hack the Network

One each of the following 13 cards (20 cards total):

• Asynchronous Transmission
• Big Hack
• Corporate Espionage
• Hot Swap
• Huge Hack
• Installation Wizard
• IP Tracer
• Low Orbit Ion Cannon
• Peer 2 Peer
• Ransomware
• rm -r
• Scatter Hack
• Speak Softly