A Working Taxonomy of ICE Bypass Mechanisms: Recoding 47 High-Value Intrusion Case Records from the Sprawl, 2031–2043

1. Introduction

Intrusion countermeasures electronics (ICE) are the defensive programs that surround corporate data in the matrix, refusing, tracing or repelling unauthorized access. A lethal subclass, black ICE, can kill or permanently injure the console cowboy whose nervous system is jacked into the deck at the moment of contact. Cowboys answer ICE with icebreakers, programs written to open, dissolve or slip past it. The owners of these systems, the zaibatsu and a few family corporations, publish almost nothing about the intrusions they suffer.

What does get written down is filed by name. A security directorate records a breach under the system that was compromised, and the operator community remembers the same breach under the cowboy who made the run. Both serve liability and reputation (Tanaka-Reyes, 2039), but neither says much about how the ICE was actually defeated, and that is the only property of a breach from which a defender can generalize. Two intrusions against unrelated targets may share a mechanism and therefore a remedy, while two intrusions against the same system may have nothing in common.

This paper recodes an assembled corpus of intrusion case records by bypass mechanism and asks two questions. First, can a small set of mechanism classes be applied reliably by independent coders, including to cases that played no part in deriving the classes? Second, among cases where the target's subsequent defensive revision is documented, does mechanism class account for defensive outcome better than target type, the organizing variable of the existing archives? We write in 2045, in the decade after the Straylight run and the Wintermute–Neuromancer merger, and our corpus ends with records accessioned in 2044.

2. Methods

Successful intrusions into zaibatsu systems are illicit and closely guarded, so no single archive holds a representative record. We assembled 47 case records dated 2031–2043 from five sources. Sense/Net's internal security incident digests supplied 16 cases and the Hosaka Security Division's restricted incident supplements supplied 15; both describe the breach from the defender's side. The Chiba City Black Clinic Case Registry supplied 11 cases, reconstructed from the histories of operators treated for neural injury after contact with black ICE. Three cases came from restricted Turing Registry accessions at Berne, which concern runs that touched ICE owned by, or operating under, a registered AI. Two came from BAMA municipal court depositions. Duplicate accounts of one breach were merged.

One deposition case predates the Straylight run and comes from the independent-operator record of the early 2030s, which survives mainly in court depositions and street testimony. It concerns a military-grade Russian icebreaker used by two independent cowboys against a private operator's defences. We retain it because its mechanism is unusually well described, and we mark it wherever it bears on a result.

Mechanism classes were derived on the 35 cases accessioned through 2041 by iterative comparison between the two authors. The primary mechanism of a case was defined as the one without which the breach would have failed. Structural exploitation covers bypass through a logical flaw in the ICE's own code, typically found by reading its branching architecture (Kessack, 2040). Credential mimicry covers programs that the ICE accepts as legitimate traffic, including slow mimetic icebreakers that take on the appearance of the system they enter. Brute deconstruction covers icebreakers that wear through a barrier by sustained load, accepting detection, a mode whose limits are set largely by console load handling (Ono-Sendai Deck Engineering Group, 2036). Social or physical-adjacent bypass is defined positively, as a breach whose decisive step took place outside the matrix through physical entry to hardware, manipulation of personnel or a manufactured diversion; it is not a residual category, and a case fitting no class was to be recorded as unclassifiable.

Each author then coded all 47 cases independently, blind to target identity and operator name where the source permitted redaction. The 12 cases accessioned in 2042–2044 served as a held-out set to which the frozen scheme was applied without modification. Disagreements were resolved by discussion. Cases in which an AI appears to have assisted the intruder against its owners' ICE were given a separate flag in addition to their primary class; this flag is our coding decision and does not constitute a fifth class.

For the predictor comparison we used the 19 cases whose source records the target's post-incident revision and at least one later attempt against the revised system. The outcome was binary. A case counted as defended when the next documented attempt using the same mechanism class was halted before any data left the system, within 24 months of the original breach. We fitted two single-predictor logistic models, one on mechanism class (four levels) and one on target type (zaibatsu research systems, financial and data-holding services, and media and simstim production), and compared them by deviance and Akaike's information criterion (AIC), following the small-corpus procedure of Achterberg (2041). Each was also tested against the intercept-only model by likelihood ratio, and the class table by the Freeman–Halton extension of Fisher's exact test. Per-class rates carry exact Clopper–Pearson 95% intervals. Both corporate sources extend beyond the owners' own systems. The Hosaka supplements cover Hosaka research installations and the financial and data-holding services for which the Security Division held protection contracts; the Sense/Net digests cover Sense/Net's media and simstim production systems and the client data services hosted on its infrastructure. Of the 19 follow-up cases, 11 come from Hosaka (8 zaibatsu research, 3 financial and data-holding) and 8 from Sense/Net (5 media and simstim, 3 financial and data-holding).

3. Results

All 47 cases were assigned to one of the four classes and none was recorded as unclassifiable. Final counts were 13 structural exploitation, 12 credential mimicry, 14 brute deconstruction and 8 social or physical-adjacent. Coders agreed on 41 of 47 primary assignments (87%, κ = 0.83). On the held-out twelve they agreed on 10 (κ = 0.77, approximate 95% CI 0.50–1.00). Agreement therefore remained high on cases that played no part in deriving the scheme, although an estimate from twelve cases is imprecise. Four of the six disagreements concerned the boundary between structural exploitation and credential mimicry.

Two cases carried the AI-assistance flag, both from the Turing Registry accessions. The better documented of them is the Straylight run against Tessier-Ashpool core ICE, which we coded primarily as credential mimicry because the decisive program was a Kuang Grade Mark Eleven, a Chinese military icebreaker that proceeds slowly and is read by the target as friendly. The same run carries a secondary physical-adjacent code for the concurrent physical infiltration of the Villa Straylight. The pre-Straylight independent-operator case was likewise coded as mimicry, since the deposition describes its Russian program as passing the target's ICE as permitted traffic before it began to act.

Of the 19 follow-up cases, 11 (58%) were defended on the next attempt. Defended rates by class appear in Table 1. Structural exploitation had the lowest rate, 1 of 5, against 10 of 14 (71%) across the other three classes combined (Fisher's exact p = .11). This contrast was chosen after the rates were seen and is exploratory. The intervals overlap widely.

Mechanism class fitted the outcome better than target type, with a residual deviance of 20.45 against 25.63 and an AIC of 28.45 against 31.63, a difference of 3.2 in favour of class. Neither model, however, improved significantly on the intercept-only model (deviance 25.86, AIC 27.86). The likelihood-ratio test for class gave χ²(3) = 5.41, p = .14, and the exact test on the class table gave p = .20. For target type, χ²(2) = 0.23, p = .89, with defended rates of 5 of 8, 3 of 6 and 3 of 5 across its three levels. Because two of those levels each come from a single archive, this test compares sources almost as much as target types.

4. Discussion

Four mechanism classes covered the corpus and survived application to cases that played no part in their derivation, with agreement that held up on the held-out set. As a filing convention, mechanism appears workable. The difficult boundary is also informative. Structural exploitation and credential mimicry both depend on the intruder understanding how the ICE evaluates what it meets, and the finding of the concurrent topology study, that operators perceive a countermeasure's branching depth as spatial density from inside the matrix, offers one account of why coders found some cases hard to place on one side or the other.

On prediction, the evidence is directional and weak. Mechanism class was the better of the two predictors by AIC, and target type, largely a proxy for source archive here, carried little information about whether a revision held. Class did not, however, beat the intercept-only model, which had the lowest AIC of the three, and a 19-case subset cannot support a firmer conclusion. The ordering of defended rates is plausible on mechanism grounds. Brute deconstruction is loud and invites a direct patch, whereas a flaw in ICE logic, once used, may not be recognized as the route of entry. The intervals in Table 1 leave its reality open.

Social and physical-adjacent cases deserve a separate comment. Their follow-up record, 3 of 4 on a wide interval, may reflect the fact that the decisive step, a person admitted or a diversion believed, is visible to the target after the event. The Sense/Net raid that preceded the Straylight run illustrates the pattern: the diversion worked by turning the target's own emergency and correction responses into cover, and the reconstruction of that operation identifies designed exploitability of institutional correction as its distinguishing feature. The two AI-flagged cases are harder to generalize. Where a registered AI acts against its owners' ICE, the relevant defence lies in the constraints on the AI, and the reconstruction of the pre-merger record indicates that the partition failed because one registered half worked for months to remove it while the other resisted.

For record-keeping, we recommend that incident files carry a mechanism code alongside the target and operator fields they already hold, since this costs little and makes the comparison reported here repeatable. Prioritizing defensive research toward structural exploitation would be premature on the present data. It becomes reasonable only if a larger follow-up corpus reproduces a clearly lower defended rate for that class.

5. Limitations

Selection operates at every stage. Corporations record only breaches they detect and choose to document, so undetected structural exploits are almost certainly under-represented. Black ICE introduces a sharper survivorship bias. A run that ended in the operator's death leaves no clinical history and usually no defender narrative beyond a lockout log, so the registry cases describe survivors, and the most effective lethal defences are largely absent from the corpus.

The 19 follow-up cases differ from the other 28 in provenance. All come from the Sense/Net and Hosaka files, which record post-incident revisions; none come from the black-clinic registry, the Turing accessions or the municipal depositions, and neither AI-flagged case is among them. Within that subset, target type is nearly collinear with source: all zaibatsu research cases are Hosaka's and all media and simstim cases are Sense/Net's, and only the financial level draws on both. The weak showing of target type may therefore reflect differences in how the two corporations recorded repairs as much as differences between targets. Conclusions about predictors apply to breaches of corporate systems whose owners, or their security contractors, documented the repairs.

Source vantage also matters. Defender records describe mechanism as reconstructed by the defender, clinic histories as recalled by an injured operator, and the Turing material through redacted extracts; the redaction that allowed blind coding in some cases prevented it in others. Several early clinic cases are dated only to within a year or two. The AI-assistance flag rests on two partly accessible cases and is provisional.