The CIA's Grimoire

by Giles Schildt

In worlds of any tech level featuring both magic and intrigue, spies will rely as heavily on magic as James Bond relies on Q's technology. When espionage budgets are large enough, specialized spells will be developed to enable secret communication, recover information from destroyed documents, and generally make spying more efficient. This article includes a simple, optional system for creating secure versions of GURPS communication spells, a discussion of selected magical espionage issues, and samples of spells and spell variants that might be researched by an espionage agency.

Secure Communications Spells

Magic provides opportunities for communication that, even by the standards of today's technology, are incredible. In many worlds magical communication is "magically secure," but GURPS includes guidelines for eavesdropping on magical communications, for example rolling at -4 to eavesdrop on the Telepathy (see p. M29) spell.

One apparent solution to this problem is to send telepathic messages in a prearranged code; for example, the message "John has a red beard." could mean "The British are coming." Unfortunately, Telepathy, in the words of GURPS Magic, is "Full two-way communication . . . Both the caster and the subject know the whole of each others' thoughts." Therefore, any adversary listening in on the telepathy channel would also discover the means to decode the message -- unless both participants were ignorant of the real meaning. (This might work well in a silly campaign, with a brigade of ignorant mages locked in dark rooms handling state communications sounds like something from a Monty Python script.)

To make secure versions, double the cost to cast and maintain. Duration and time to cast remain the same. Prerequisites are the insecure version of the spell and Encrypt (p. G78). Double the cost to create any item. If a password for adding participants is desired, add two seconds to casting time and one to casting cost.

When using a secure version of any communication spell, only the original caster can perform an additional casting to add more participants unless he includes a passphrase. (This wouldn't have to be a spoken passphrase; it could be a gesture, spell component, or anything suitably magical. It is just a small variation in how the spell is cast which creates a unique encryption method.)

When a wizard who doesn't know the passphrase attempts to eavesdrop, they must win a Quick Contest of Skills at -10, with each repeated attempt on the same link at an additional -5. Remember to include range penalties from the intruding caster to a participant or the "telepathic link," if the GM chooses to have those exist at geographic locations in his campaign (see below). Anyone using a regular spell in an attempt to listen to the secure one will hear only static or gibberish. Like mundane cryptanalysis, once these penalties reduce a casters effective skill below 3 he can not make any attempt at all.

Some spells, like Communication (p. G20) and Wizard Mouth (p. G61), can obviously be overheard by anyone within earshot of a participant. A secure version of these spells will have Converse (p. G93) as an additional prerequisite. To make Wizard Ear (p. M79) secure from casual eavesdropping, Converse must be cast on everyone speaking to each Wizard Ear. Similarly, the secure version of Wizard Eye (p. M54) only prevents intercepting the data while en route; it does not interfere with other means of seeing items in its field of vision.

To make a communication spell that is difficult to detect and difficult to eavesdrop on, either cast Conceal Magic (p. M61) on all participants before casting the communication spell, or use Delay (p. M63) to link Scryguard (p. M61), Conceal Magic, or both to the telepathic casting. (Conceal Magic could be cast after the telepathy spell is cast, but then it would be vulnerable to detection for at least Conceal Magic's casting time.)

An inhumane GM could even allow adversaries to attempt to divert ranged communication magic with Scryfool (p. G74) by ruling that finding the correct subject is an "information" portion of the telepathic spell. Of course, the truly paranoid can use a traditional code and recognition signal with the secure version of Communication. A spell which provides visual and voice authentication, which an adversary would have to subvert with Disguise (p. B65) and Acting (p. B62).

Espionage agencies might even research spells to tamper with the contents of magical messages. Details are left to GMs malevolent and vindictive enough to want them. One option is a man-in-the-middle attack; the initial spell is diverted to an imposter who then establishes his own link with the first caster's intended recipient and delivers an altered message.

The overall security of these spells depends on the GM's interpretation of magic phenomenon. The standard GURPS interpretation handles magic as a direct link between the caster and the subject (like a telegraph). (See "Magic Explained!" by Sean "Dr. Kromm" Punch for details.) These could be intercepted by anyone in-between the participants (as the magic travels . . . not necessarily a straight line). The caster could specify a longer route to avoid potential eavesdroppers if he pays the longer range penalties. Still, if anyone who makes a Telepathy-4 roll can rummage through all the links with a smaller range penalty than his margin of success, then telepathy is very insecure.

Other interpretations are possible. If magic communication is broadcast (like a radio) then anyone within a reasonable range could intercept it, and it would be easy to intercept in a large, football-shaped area between the participants. If magic is a point effect an attacker has to cast his eavesdropping spell on one of the participants. In a world where magic is . . . well . . . just magical, and therefore not bound by geographical concepts, anyone anywhere could listen in, but range penalties of all kinds seem a little inconsistent in such a world.

The GM also needs to decide how communication links can be detected. A reasonable solution is to declare that a potential eavesdropper must detect and identify the spell being used; for example, to could be recognized when it is cast, using Identify Spell or Analyze Magic on a participant or the link, or the like. It could be possible to detect a telepathic link with Detect Telepathy (see below) or Detect Magic (p. M53). Getting a directory of all worldwide Telepathy links every time your roll succeeds by four is probably appropriate only in slapstick campaigns.

Magical and Mundane Encryption

Another important question is how "mundane" decryption interacts with magical encryption and vice versa. Could a mage who listens to the static of an encrypted telepathy link analyze the data with a computer to decrypt it? The answer might be yes if you could accurately record the static (with Memorize, p. G59, for example) and transfer it to a computer (for example, with Data Transfer, below). In practice it's probably best to assume magical cryptographers stay abreast of mundane crytographic research too, and could make this impractical with current computers. In any event the GM can enhance playability by just saying no, or enhance realism by defining the relative strengths of magical encryption spells in mathematical terms (for example, the 128-bit encryption version of Telepathy). Stronger spells could be carefully guarded secrets.

Simple substitution codes are nothing more than a secret language, and as such could be translated by Gift of Tongues or Gift of Letters (p. M30). The GM could assess a penalty for more creative codes or even treat is as a contest of skills with the cryptographer. However, having a single spell break a complex modern cryptographic algorithm is unrealistic, unbalancing, and (most importantly) doesn't provide any good roleplaying opportunities. Instead, mages could try to read the mind of a person who knew the key, get vague information about the message with divination spells, or use Machine Possession/TL (p. G98) on the computer that decrypted the message; any one of which could lead to interesting adventures. If players insist on using magic to "do lots of math" and break the code like a computer would, determine how much electricity a computer would need to do those calculations and determine spell cost from the fatigue equivalent chart found on page 99 of GURPS Grimoire. That number will be quite beyond their magical capacity.¹

Other Spell Adaptations

Some spells are almost the answer to the CIA's prayers. Of course, they would commit their vast resources to remedying that situation.

First and foremost would be a version of the History (p. M54) spell that could recover destroyed documents. At the GM's option, this could be merely a variant of the History spell, but it is more realistic to handle this as the new TL-dependent spell, Recover Data, below. This is not the only way a mage could recover erased data. He might cast Repair on shredded paper, or use Magnetic Vision and Small Vision on disks to read erased data as a technological forensic scientist would. (He will certainly need greater knowledge of the disk's format than would be required to read disks that were not erased; depending on how the data was erased, he might need higher magnification too.)

It goes without saying that any espionage agency worth its name will have a magically protected headquarters. Exact details are up to the GM, who can feel free to allow such an agency wide leeway with the research of defensive enchantments. In particular, persistent, area versions of many information spells (for example, Know Illusion (p. M53), Detect Magic) would be developed as powerful intruder detectors for use with Link (p. M64) to create traps and alarms. A variant of Utter Dome (p. M78) with a few doors mundane visitors can walk through is possible. Perhaps those doors would be in mana-drained hexes to prevent hostile spells from entering through the holes. No mana zones are likely to be used as traps or barriers, and GMs might even allow a powerful agency to switch mana on and off like the lights in a few locations. (Such an enchantment would be expensive even by their standards.) Working out detailed costs for those spells isn't important unless a PC is in charge of such an agency's security; otherwise, just define the effects assume the government is willing to pick up the tab, whatever it may be.

New Spells

Organizations like the CIA perform extensive and secret research on technologies important to state security at all tech levels. In a world where magic exists, spells would certainly make that list of technologies. These might be some of the first spells such an agency would develop.

Detect Telepathy Communication and Empathy College

Information, Area

This spell will detect all spells that involve communication, including spells used for all forms of possession and mind control and those that only provide vague indicators of the subject's mental state, such as Sense Emotion, Truthsayer, and Sense Foes (because the later can identify the degree of hostility). It does not detect spells that merely locate minds (such as Sense Life, Watchdog, and Seeker). If it is ever uncertain if a spell involves communication, the GM's ruling is final.

When cast on an area it will detect only that someone is using magical telepathy, without revealing who. Knowledge of the type(s) of spell(s) being cast depends on the success of the skill roll. The spell(s) would only be named on a critical success. If cast twice on the same area by the same caster, the spell will only detect contact that started since the previous casting, but if cast successfully it can be recast on a smaller area to localize the source. The caster can exclude a known user of telepathy if he specifically mentions it before casting.

Base Cost: 2
Prerequisites: Watchdog, 5 Mind Control or Communication and Empathy spells.
Item: Staff, Wand, or Jewelry. Energy cost to create: 400. An area may be permanently enchanted to detect any use of telepathic spells for 100 times the base energy cost, although this serves no purpose unless the spell is linked to an alarm or trap.

Telepathy Shield Communication and Empathy, and Protection and Warning Colleges

Area

Subtracts five from the caster's skill on any attempt to cast a communication spell (see Detect Telepathy for details) into, out of, or through the affected area. Remember that Area spells are only four hexes high so a telepathic link could be routed over the shield. Double the energy cost for a penalty of -10; triple the cost for a penalty of -15.

This spell (along with Teleport Shield) will probably be maintained continuously at all secure locations. At espionage agencies a small areas may be left unprotected for official communications and interrogations.

Duration: 1 hour
Base Cost: 1/2 to cast (minimum 1), same to maintain.
Time to Cast: 10 seconds
Prerequisites: Detect Telepathy, Spell Shield, 6 Mind Control spells and 6 Communication and Empathy spells.
Item: An area can be permanently shielded for 75 energy per hex.

Data Jar Enchantment College

Regular

Creates an information repository within an inanimate object. Nearly any object can hold small amounts of information, but only gems are suitable for use as large containers. A gem can hold up to one gigabyte of data per carat of mass.

A jar can be created either empty or containing information specified by the initial caster, which can never be altered. A "read-only" jar may be enchanted to automatically reveal its contents to everyone who touches it. To place restrictions on the Jar, use a limiting enchantment. The jar can also be enchanted with Data Transfer so non-spellcasters can use it.

Cost: 25
Prerequisites: Enchant

Data Transfer/TL Knowledge College

Regular

Copies information between two dissimilar mediums. This spell has two subjects, the source and the target; if neither is the caster, add distance penalties to both subjects. Either subject could be a computer, piece of paper, magical data jar, biological mind, etc. The Memorize spell is strongly recommended when storing data in biological minds. If either subject is an intelligent, being it must be willing. This spell does not create capacity to hold the data; if there isn't enough "memory," the copy will be missing information. Only data can be transferred, not a subjects soul or intelligence; for that use a possession spell or Soul Jar.

The spell will translate the format of the data, but not its meaning. For example a picture transferred to a computer will be digitized, but a computer program transferred to paper or a human mind will still be just bits -- it will not be disassembled or interpreted. Foreign languages will still be "Greek" to the subjects, however the information could be transferred to someone or something that can translate, then sent back when translated. Even if the target knows the appropriate language, this spell will not grant understanding; however, once the information is acquired it can be studied normally.

The caster must be able to acquire the data from his senses, a willing life form, or a functioning machine. Other sources will require additional spells. For example, to read data from a floppy disk the caster would need Magnetic Vision and Small Vision, but a functioning hard drive could be accessed by providing it with power (such as Lend Power). The information in a book could not be transferred while it was on the shelf, but the caster could quickly flip through the pages.

Duration: Permanent, although a biological mind may forget normally, and quickly if it does not understand the data.
Cost: 1 per megabyte of data (minimum 3) (A typed single space page is approximately 4 kilobytes. An 8.5" x 11" picture digitized at good quality is approximately 1 megabyte.)
Time to Cast: 1 second per megabyte. Prerequisites: Copy, Scribe, and Telepathy. Machine Speech for TL-6+ versions.
Item: May be added to any Data Jar to allow a non-mage to read or write information. Energy cost to create: 100. Espionage agencies have devices that can record data from the interface ports of various types of computers into an attached Data Jar, but it is not generally known how they are made.

Recover Data/TL (VH) Knowledge College

Information

Recovers information that was previously contained on the subject item, which must be a data storage device of some kind. In addition to the general prerequisite below, the caster must know elemental or technology spells appropriate to the information storage device he is attempting to recover data from, such as Magnetic Vision (p. G102) for disks, Heal Plant (p. M75) for paper, Shape Stone (p. M31) for stone tablets, and so on. Alternatively, the GM could limit the caster's skill with this spell to his skill with the improvised magic noun for the subject matter. In either case, the GM's determination is final -- but he should pick one method and use it consistently.

The caster much touch the erased item (or its remains) while casting the spell. Attempts to extract information from a dead person's brain are left to the GM's discretion, who may rule that memories accompany the deceased into the spirit world and can only be recovered with Summon Spirit (p. M72).

Skill modifiers: For information simply erased: none. If the information was overwritten: -4. If the information was wiped, for example in accordance with Department of Defense Regulation 5220.22-M for classified data: -8. If the media was destroyed (melted, burnt): -10. If the destroyed documents were scattered: a further penalty of -1 for each 10% of the original mass that is missing. If the remnants cannot be accurately identified and other material is mixed in (for example other ashes in the fireplace, assorted protons in the nuclear reactor) extraneous material equivalent to twice the original mass of the document will prevent the spell from functioning. Lesser impurities cause a penalty of -1 to -10 at the GMs discretion. Asses a penalty of -1 if the documents were destroyed more than 24 hours ago, with an additional penalty of -1 for each full week that has elapsed.
Duration: Memory of the recovered information remains clear for one day, after that roll against IQ as per the Memorize spell (p. G59).
Cost: 1 per page of typed information (or equivalent) to be recovered. (A typed single space page is approximately 4 kilobytes.) If the caster only wants some of the information from a destroyed document, he must spend 10% (round up) of the cost necessary to recover all the data (time and energy spent searching) plus the cost for the data he wants.

Time to Cast: 1 second per megabyte stored on the original media.
Prerequisites: History, Repair, and see above.

The previous list is just a sampling or what a major espionage agency would produce . . . perhaps what may have leaked. If magic is common an organization with the resources of a modern government intelligence agency is likely to use magic for everything. It is certainly possible for a major espionage agency to exist in a traditional fantasy world at TL3; their existence is determined by political factors more than technological ones, and magic can replace technology for them too. Many of their spells will be jealously guarded secrets, which of course are the best kind of adventure seeds.

Note

¹ Take distributed.net's 1999 Data Encryption Standard (DES) crack for example. DES was widely considered obsolete because it was too easy to break; still, approximately 10,000 computers plus specialized equipment equivalent to roughly another 5,000 PCs spent 22 hours breaking the code. With the conservative assumption of 100 Watts per system, this totals 33,000 kWh of electricity. 1.8 fatigue per kWh yields 59,400 fatigue for an obsolete code. It's replacement (Triple DES) is many orders of magnitude harder to crack, on the order of 10^20 fatigue using the same assumptions. A standard web browser can create encryption that would be around 10^24 spell energy by that formula. Specialized code cracking equipment would substantially reduce the electricity required, but there is no reason to assume magic would be as efficient as a custom engineered decryption machine unless extensive magical research was done to perfect a specialized spell.

---

Article publication date: November 29, 2002

---

Copyright © 2002 by Steve Jackson Games. All rights reserved. Pyramid subscribers are permitted to read this article online, or download it and print out a single hardcopy for personal use. Copying this text to any other online system or BBS, or making more than one hardcopy, is strictly prohibited. So please don't. And if you encounter copies of this article elsewhere on the web, please report it to webmaster@sjgames.com.