"That server is ice cold and night black. Like your sister. Also you don't wanna touch it or things will get all hairy and nasty. Like your sister. Basically I'm telling you that I had sex with the IC on that server and it wasn't good."

In ages past, computer security was in the relatively simple realm of keeping unwanted users from logging on to one's system. In 2071 that isn't really practical, and it became impractical for so long that terms like "Firewall" just don't even mean the same thing anymore. It's more like a "Wall of Fire". The last time people seriously thought that they could just disconnect their computers from the Internet and be safe from hacking was in 2029, which is over 40 years ago from the standpoint of shadowrunners. Indeed, the majority of shadowrunners were not even alive the last time someone talked about network segregation as a valid defense against network attack. Keeping intruders out is a multi-tiered process of inaccessibility (because the most effective hacking procedures are essentially line of sight, moving your systems to physically inaccessible locations is actually a reasonable defense), and actively fighting back. You can't necessarily keep people from hacking in, but you can set fire to people's brains when they do it. Keep that in mind, because it's incredibly different from the way computers work in the modern world.

Intrusion Countermeasures, or IC for short (pronounced "ice"), are an integral part of Shadowrun and always have been. There are some systems that the faint of heart simply do not go to because the programming there will fry your brain. This is deemed unfortunate, as most shadowrunners consider their brains to be their second favorite organ. IC scours a network looking for the influence of hackers and does a number of things to undo this as a problem. But before we really get in to talking about what IC can do, let's start by talking about what it can't do.

"That IC looked like hundreds of bees."

Computing power in Shadowrun is abstracted. We don't keep track of how many processor cycles you have dedicated to whatever processes. We don't even care. If IC is running on a system, it is protecting the entire system to the best of its own capabilities. It is not possible to run another copy of the IC to get better protection. Hell, you can't even benefit from having a copy of a different IC system protecting your system.

IC is kind of like virus protection software. Running it is great, and it will ward off a number of potential threats. But running Norton and McAfee at the same time isn't helpful. If you have processing cycles to burn, you should get yourself an IC system of a higher rating rather than getting more copies with the same rating.

In the Matrix, IC can as easily be rendered as a single bridge-keeping troll as by a pack of dogs. It's completely unimportant how “many” icons the IC has. IC is lots of individual instructions zooming through the network at high speed. It's scanning logs for illegal commands, it's scouring data sets looking for tampering, and if these all get represented as a series of monks copying books or a massive tiger sniffing for prey that means precisely jack diddly.

Most importantly of all, in the instance where there are many devices running on a network together, the single best IC available defends the entire network and all the others don't do a god damned thing. The network as a whole is parallel processing in some ill-defined but extremely powerful fashion and problems anywhere in the network can potentially be detected. Hiding the data you are insinuating somewhere in the network where the IC won't recognize it as phony is the providence of Matrix Perception tests, not something that you as a player should have to work out based on network schema and individual device ratings.

"Did you whizz on the electric fence?"

IC can't use any programs at a range greater than Connection. It can attack users, it can trace hackers, and it can unravel your Matrix signature. But it can't do any of that unless there is a current open connection between the system it is running on and your system. IC can send e-mail and do all kinds of other Matrix crap. If an IC discovers an intrusion attempt it can send a PM to other computers saying “Hey! Somebody is intruding into my system!” it can even send spam e-mail asking people to pretty please open up an active connection. But it can't offer any mechanical assistance to another system, nor can it attempt to hack itself a connection to a system that declines its offer.

Remembering that computing power is delineated completely arbitrarily, it is easy to see that one could just as easily define the display of pull-tab burritos as an empty network as one could define each of the Freshsene™ detectors for each of the flavor racks as empty networks. So if IC could make attacks at a signal or even handshake range, the world of Shadowrun would collapse almost instantly. Computing can be divided and subdivided as much as you want. If those subdivisions were each afforded an initiative count in battle the game would suffer tremendously as there would be no logical reason for there to be any finite limitations on armies of computer programs. Because we are trying to model the Matrix from Virtual Realities and not the Matrix from Matrix 2: Electric Boogaloo, having unstoppable armies of Agent Smith is unacceptable. So pretty much everything we're saying about technological specs and hardware limitations and such is flavor text to explain what is at its core a completely game mechanical concern. If we've overlooked something and you figure out some way to have IC operate at range other than Connection and still be consistent with what we wrote, just walk away and pretend you didn't.

Presumably there is some additional technical constraint that is preventing you from doing that or something. Seriously. For the children.

"I don't even know what that is. Our system is over there."
"But... it's all on fire."
"Yes. Yes it is."

For all the limitations that IC has, it is still a quite fearsome opponent. Once a connection is open, even an empty network can send horrible pulses of energy across an open connection, very little in the way of calculations are required. And so it is that some of the most effective IC is also the simplest: it simply attempts to damage the intruders in some permanent fashion. A piece of IC that damages electronics is called "Gray IC" and a piece of IC that damages real people is called "Black IC". Sometimes IC that merely traces and reports intruders or attempts to sever connections and call for technical support is called "White IC", but most speakers just call it IC with no adjective.

IC can also be used offensively. While a connection is open, the IC "defending" either network can send baleful signals up the connection to the other. A hacker who just wants to wreck things can indeed come with guns blazing and a pet dog who also has guns blazing.

"I'm going to open up a can of whup ass. Figuratively. I mean, it's an actual can, but I won't actually be opening it."

The limitations of IC only apply to the actions of the Firewalls of networks themselves. Very important facilities will oftentimes hire the services of real metahumans who are not restricted in these fashions at all, and behave exactly like a hacker because they are a real hacker (a real Hacker who happens to have the passwords set to log in to premade security accounts on just about every device and network in the facility before the action even begins). But some of the really shady projects go for a hybrid system: running networks on "brains" that are literally grown for the purpose.

In Shadowrun's timeline, the first of these brain-in-a-jar systems came online in the early 2050s, which does in fact mean that some of the currently active systems will have been working for longer than some of the 2071 player characters have been alive. So these IC/Hacker hybrids are not new news or opaque legends to any hacker worth their salt. Levels of sapience for these brain-jar systems varies tremendously, with some being just like dwarfs who are even slower on their feet and others being essentially just like black boxes that generate the raw processing power that a combat hacking network needs if it is to project force beyond its own direct connections and nothing more.