Security in Fantasy 1: Fleshing Out Heists

Every so often, I ask a question in the OSR Discord server. They're always really friendly and helpful with even strange questions. Today I was curious about what they thought about an alternative to the popular Blades in the Dark. I got some really good answers, and when I mentioned I worked in security, some friendly folks were interested in how I would flesh out a heist-style campaign or module.

One user in particular (Jojiro from dungeonantology.com) gave me seven questions to answer. While I'm pretty sure he meant some small answers, I'm overly verbose and tend to go way too much in-depth with my explanations, so here you go.

I'm sharing this with the rest of the OSR community so you can take some of this advice in mind if you plan on playing or running a heist-centered game in the future.

Keep in mind that I’m working from the perspective of a fantasy-ish world. Not everything in here
will be 100% realistic.

1) What is the actual information an adventuring party needs to complete a heist? Categorically,
what's the bare minimum before they should even attempt such a thing?

Location/Layout. You need to know where you're going and where you are at all times. Is it a
wooden warehouse? A mystical forest? Where specifically will you be operating in that environment?
How can you use that environment to your advantage?

Time. You also need information on what and who is inside at the time of your attack. Are there more
guards? Are certain security measures enabled/disabled at certain times of day? When is the place
most active? Least active? When is the time for doing things unnoticed in a reasonably-sized crowd
and when is the time for doing things without anyone seeing? How much time do you have to
complete the job?

People. Anyone who’s doing inside work (recon, soc eng, etc) needs to have a cover, a reason why
they’re there. You don’t necessarily need a story, but you need appropriate clothing, accessories, and
attitude. More than that, you'll likely need at least one person that is "friendly". Not necessarily a
mole, but a person who can reasonably vouch for your cover (someone you've talked to before as
your cover or have otherwise corresponded with).

I think the bare minimum you'd need for an attack is a cover (you're a janitor/new night guard/office
of the inspector general) and knowledge of at least exterior security measures. That's what I'd call
"bare minimum", maybe suitable for low to mid-security reconnaissance jobs. But ultimately you can
tell a lot about the place from just an exterior glance.

2) What is an example of going "above and beyond" the bare minimum?

"Above and beyond" isn’t too much of an issue, as long as your costs don't exceed what you're
trying to gain in the first place. Reason why is that the more creative and innovative the approach,
typically the more successful it is. Not always, but it tends to follow that trend.

But if you really wanted to go ham…

• Having specially-crafted items for that specific place (unique picks/tools/etc)
• Assuming a false identity for months or years for a single goal
• Scouring building blueprints for architectural/structural anomalies and weaknesses
• "Crying wolf" operations and false-alarm spam
• Substantial amounts of blackmail

These are, in my opinion, examples of going above what might be necessary. But these also may
be used in a fictional grand heist, so they may make sense in an RPG world and not necessarily
reality.

3) What questions are best at yielding the information in 1, and who should they ask?

I covered a lot of questions in 1 but I’ll go into more specific examples here.

Location and Layout:
Most entry-level information about a place can be easily gotten by an exterior
look. Are there back doors? Loading gates? Flaws in fences? Sewer/water flows that aren't
adequately grated? In an RPG, think about magic. Can your familiar see a roof hatch? Does your
cleric sense magical wards? Who might be susceptible to illusions? Having your players consult a
mage or other professional may be prudent for these questions if they can’t necessarily answer them
through examination.

Additionally, seeking out people who may know about the interior of the place may be necessary.
Maybe someone was fired and is really bitter about it? Maybe you’re asking them about a potential
investigation of a fungus breakout/insurance claim and need to know what the boiler room layout is.
Creativity comes out really well here.

Time
For time, performing recon at various times of day is essential. Players could make a table of guard
shifts if you wanted to get in-depth. Maybe they tail one person in particular at an ideal time of day
and find out their schedule and routine.

Finding out how much time they have to complete the job is important. When do the guard shifts
change? Does the magic get recharged? When would someone notice the hole in the wall? When
would somebody be noticed missing? Do people inspect the target often?

People
As far as people go, knowing who they are and what they do is important. Of course, as a GM you
don’t need to have every single detail about their lives, but having a table of likes/dislikes/bonds
would be nice, as well as a few names. Some essential questions for those wanting to blend in might
be:

• Who would you mention if you needed to mention the name of a higher-up, and
• Who would you say you had a drink with a couple of nights ago?

These two can cement someone into a culture immediately. Saying you’re a fungus inspector may not

be sufficient; saying you’re a fungus inspector and Mr. Black urgently asked you to check out the
break room for said fungus is much more believable. Or a player could pretend to be a new guard and
say that Captain DeSchnozz is a real dick. Either way, it cements believability.

4) What are "failure states" of a heist? When should one call it quits, and what are symptoms of a
failure?

A failure is when you don’t achieve your goal. When the players fail a goal, it doesn’t necessarily
mean things are over, and some re-organization and planning may need to happen instead.
Truthfully, there’s few states of outright failure that can happen, as even heavy security can be
planned around, it just takes a ton of time.

The big failing that’s talked about would be getting caught. But even then, that can be planned around.
Can they break out of prison? Can they get an obscenely good lawyer? Unless the whole party is
executed, the plan is merely on hold. Maybe it would be even easier to execute now that the mark
believes the perpetrators are locked away or dead.

Really the only heist-ending failure would be a cold case. If there’s not enough information to go on,
and the players can’t find anyone who knows anything, the trail is dead. There’s no way to proceed
beyond that point, and the time investment it would take to find someone who knows something would
be ridiculous compared to just finding a new, more available mark.

5) What is, definitionally, a contingency plan? Why is a contingency plan good? Why even make one if
your plan is so perfect and will just work amirite?

A contingency plan is a plan for when things go to shit. And they will go to shit. The first rule of any
plan is that the plan will fail at some point. There’s just too many variables to reasonably account for.
So, contingency plans are a must. They don’t have to be dramatic, either. Contingencies can happen
even during smaller goals and jobs. What if your players need to bug out for some reason?

But what is a good contingency? Good plans must be read through like a novel, and any “plot holes” or
things that rely on coincidence or chance must be accounted for. Contingency plans also always
assume the worst in a reasonable way. Instead of just assuming that the fungus inspector disguise
works, have a plan for when someone questions it. Have a plan for when that would fail, and when all
else fails always have at least two ways of escape. 

There’s no accounting for everything, of course, but you don’t need to be a super genius to make
contingencies; the simplest problems are usually the most common and should be accounted for.

6) How can you gain information without asking questions? (Tailing people, stealing paperwork, reading
correspondence) Isn't this too risky? How can you make this less risky?

Tons of ways. Dig through people’s trash, people are stupid about leaving identifying info right in the
garbage. Be observant, since people are typically vain and display themselves all around their personal
areas. Listening in on conversations is also an undervalued skill; don’t expect to have the entire plot laid
out before you, but you can gain names, gossip, and topics to use in social engineering.

Speaking of, social engineering is so, so useful. To the point where it’s required. People love to talk, so
if you act like a great listener to the right people and give them attention, they’ll likely yammer on and
give you exactly the info you need. Especially if they’re a dramatic type. Have them tell you about their
horrible boss and what he does, or what their work day is like. You don’t even have to mention work.
There’s tons of ways to go about this without exclusively relying on asking the GM questions.

7) How do you make use of either useless or incomplete information? When the GM tells you that
Tabitha sometimes walks her cat, does that mean that Tabitha is a suspicious person? When the GM
tells you that the night watchman blows his horn three times every night and you have no idea what that
means, do you just panic and give up? Assume there is no way to get the meaning of the signal within
time, or assume Tabitha has nobody who speaks up for her.

Almost no information is truly useless. If Tabitha walks her cat, the players know she’s a cat person.
They can go talk to her about her cat. Maybe borrow your warlock’s cat and walk it in the same direction
to strike up a conversation. Then you can pivot to other things like what she does, who she is, maybe
gossip a little. Make a friend. That’s an in. 

The night watch ringing the bell is some sort of aspect of his job. Even if the players don’t know what it
means yet, using that to maybe impersonate that watchman at some point is essential. You could also
bring it up in casual conversation, like “God, that damned watchman ringing that bell always wakes me
up at night. Why does he need to do that anyways?”. That’s an in.

If information is well and truly useless, the GM should simply not provide it, or abstract it. Red herrings
are fine, and not every piece of info is vital, but truly useless information just wastes you and your
player’s time.

----------------------------------------------------------------------------------------------------------------------------------------

Thanks for reading. The next look in Security in Fantasy will be the tools of the trade; useful equipment and techniques for your party rogues, thieves, and troublemakers. Until then, see you soon!