Campaign Tools

How This Chapter Works

A Division 5 campaign runs on a repeating structural unit called the Operation. Most sessions are one operation. Some operations span two or three sessions; some short operations fit two into a single evening. The chapter begins with the four-act structure every Operation follows, then provides the building blocks to fill it: mission briefs, operation-type playbooks, locations, hooks, a full starter Operation, and random tables.

The four acts (Tasking, Intel Phase, Execution, Exfiltration) exist because they map to the actual rhythm of real-world intelligence operations and because they produce good television. A session that runs through all four acts produces a complete story; a session that skips an act produces something that feels incomplete in a way the table can usually name afterward.

The locations, hooks, and tables are designed to be used mid-prep and mid-session. A GM preparing for Thursday’s session who has ninety minutes to build a runnable operation uses this chapter by picking a hook, stapling it to two locations, rolling a complication on a random table, and calling that prep done. The chapter is built for that use case.

The Four-Act Operation

An Operation is Division 5’s core session unit. It has four acts, each with its own function, its own scene count, and its own pacing. Tables new to Division 5 should run the first three operations in the full four-act structure; experienced tables may compress or expand acts as fits the story.

The Pacing Baseline

A single-session Operation at a table of four to six players typically runs:

Total session: roughly 2.5 to 4.5 hours of active play. A campaign running weekly at these pacing baselines produces roughly one Operation per session, forty-odd Operations per year, which is enough for two or three full campaign seasons.

Tables that run longer sessions may split Operations across multiple evenings; tables that run shorter sessions may preserve the structure and run lighter Operations (fewer scenes per act, smaller complications, less elaborate Intel Phases).

What Players Do in Each Act

The four-act structure is also a player menu. When the table slows down, ask which act you are in, then choose an action from that act. This keeps an operation moving without requiring the GM to invent a new procedure every time the players hesitate.

If a player says “I do not know what to do,” start with the act menu. If the answer is still unclear, the GM should name the immediate pressure: the target is leaving, the guard is suspicious, the asset is frightened, the border officer is checking the file, the police are two minutes out. The next action should answer that pressure.

Act 1: Tasking

The Operation begins with a briefing scene. An NPC handler, the station chief, the desk officer, or a more senior figure at Division 5’s London, New York, or rotating capital of the week, delivers the operation’s premise: here is what we want, here is what we know, here is what you have to work with.

Tasking’s function is to set the stakes and the shape of the operation. The players leave Tasking with three things in hand:

• The target: a person, an object, a piece of information, or an outcome D5 wants from the operation.
• The constraints: what cannot be done (no fatalities, no attribution to a specific service, no interaction with a particular politician), what the operation must look like from outside if it succeeds.
• The window: the operation’s deadline, whether hard (the target is departing the city in 72 hours) or soft (within the next month, before the trail goes cold).

Tasking is not a dice-mechanical scene by default. The briefing officer is usually friendly, the information is usually accurate, and the team’s job is to listen, take notes, and ask questions. GMs may introduce mechanical friction (a Charm or Negotiation check to get clearance on a requisition, a Perception check to notice the briefing officer is not telling the whole story), but these should be used deliberately rather than filling Tasking with constant rolls.

Tasking’s deliverables. At the end of the Tasking act:

• The team has an identified target and a clear objective.
• The team has one or more constraints shaping acceptable outcomes.
• The team has a rough deadline.
• The team has a sense of the budget for the operation (Requisition tier, expected duration, whether this is a standard, major, or capstone operation).
• The team knows what the Exfiltration criteria are (what counts as clean success versus what counts as compromised completion).

Common Tasking pitfalls.

The hour-long briefing. Tasking that runs longer than thirty minutes is usually a sign the GM is loading too much backstory into the briefing. The backstory should emerge through the Intel Phase; the briefing is the premise, not the novel.

The unlimited scope. A Tasking that does not define constraints leaves the team unmoored. Every operation needs at least one thou-shalt-not to give the tradecraft something to optimize against.

The missing deadline. An operation without a deadline produces open-ended wandering. Even a soft deadline is better than none; the deadline creates the pressure that makes tradecraft matter.

The invisible handler. NPC handlers matter across the campaign. Tasking is where the table meets and re-meets them. Give the handler a voice, a tell, a real relationship to the team; this is the recurring NPC who will send the team into operations for months or years of real-world time.

Act 2: The Intel Phase

The Intel Phase is the signature subsystem of Division 5 (Chapter Eight). Everything the team does to prepare for the Execution, reading files, running surveillance, recruiting or confirming assets, building Legends, requisitioning gear, planning movement, happens here.

Intel Phase’s function is to produce Tradecraft Pool dice and operational plans. Every check in the Intel Phase has two outputs: a narrative consequence (the team learns the target’s daily schedule, confirms the asset’s loyalty, establishes a Legend) and a mechanical consequence (Successes contribute Boon and Ability dice to the shared Tradecraft Pool for use during Execution).

The Intel Phase has a structure. It is not a freeform “plan the operation” stretch; it is a scripted sequence of checks.

A full Intel Phase runs five scenes; a compressed Intel Phase runs three. Operations at higher tiers (Major, Capstone) may have multi-session Intel Phases that span weeks of in-fiction time.

Intel Phase deliverables.

• A shared Tradecraft Pool of 4–10+ dice (varies by operation scope and team performance).
• An operational plan, articulated at the table.
• Confirmed or updated Legends for each operative involved in Execution.
• Requisitioned gear, matched to the plan.
• Any complications or warnings discovered during prep.

Common Intel Phase pitfalls.

The skipped phase. Tables that skip the Intel Phase to “get to the action” consistently produce operations that fail mechanically and feel shallow dramatically. The Intel Phase is where the tradecraft lives; skipping it is skipping the game.

The bottomless phase. The opposite problem: a table that spends three hours on prep and never gets to Execution. GMs should cap the Intel Phase at five scenes regardless of how eager the players are to plan further. “You have prepared what you can prepare; what happens next is the operation.”

The dice-farming phase. A Tradecraft Pool mechanically generated through flat checks feels cheap. The Intel Phase scenes should have their own small dramatic stakes: the asset meet where the asset hints at being under duress, the surveillance that ends with the team realizing they were seen. The Pool dice are a byproduct of interesting scenes, not the point of them.

The phase without mistakes. An Intel Phase that produces only good news has not really been prepped. Every serious real-world operation’s prep surfaces at least one unpleasant fact. Build one into each Intel Phase.

Standard Intel Phase structure:

Act 3: Execution

The Execution is the operation proper. The meet happens. The target is approached. The file is copied. The chase begins. Every act the team has prepared for now plays out.

Execution’s function is to run the operation the team planned, break it in interesting ways, and force the team to adapt. The Tradecraft Pool dice carry forward into Execution; the Legends are tested; the Requisitioned gear sees its first use or its first breakdown.

Execution is the mechanically-dense act. Most skill checks in a session happen here, most combat happens here, most of the Compromise Track accumulation happens here. The Pursuit Clock (Chapter Seven) runs here when a chase develops; the Legend Burn Track (Chapter Eight) is stressed here.

The Execution Phases.

Execution typically has three internal beats:

• The Approach. Getting into position. The meet, the infiltration, the stakeout’s climax. Mostly tradecraft, low on combat. The team is still operating within the plan.
• The Pivot. The moment the plan contacts reality. The asset has another agenda; the target is not alone; the infiltration reveals a security layer the Intel Phase missed. The team’s plan no longer maps cleanly onto the situation.
• The Resolution. The team’s response to the Pivot. This is where the operation succeeds, fails, or transforms into something other than what Tasking described. The Pursuit Clock, if one develops, usually fires here.

The Pivot is the most important beat of the Operation. A well-designed Operation has a Pivot that the Intel Phase almost caught: one clue the team missed, one asset who told them the wrong thing, one piece of gear they chose not to requisition. The Pivot makes the operation a story rather than a plan execution. Every playbook below closes its GM procedure with a worked Pivot; build your own the same way, by picking the one fact the Intel Phase almost surfaced and letting it land in Execution.

Execution deliverables.

• The target is acquired, destroyed, delivered, or lost.
• The team’s Compromise Track has adjusted (typically upward by 1–3 per operative during a standard-tier Operation).
• Legends have been exercised, burned, or deepened.
• The Tradecraft Pool is depleted or nearly so.
• The team has acquired new information that shapes the next Operation.

Common Execution pitfalls.

The scripted Execution. An Execution that plays out exactly as the Intel Phase planned is either a very easy operation or a GM who is not applying enough pressure. Every Execution needs at least one moment where the plan fails.

The combat-dominated Execution. Execution that resolves into three consecutive firefights has changed the operation’s shape. That may be exactly what the table wants for a high-action episode, but it should still remain a spy problem: routes closing, witnesses multiplying, hostile files filling in, and assets becoming harder to protect. If Execution is producing back-to-back gunplay, give each fight an intelligence-work consequence and a noncombat way to change the situation.

The absent Pivot. An Execution without a Pivot is a dry recitation of the plan. Force the Pivot if one does not arrive naturally: an unexpected visitor, a surveillance discovery, an asset’s changed loyalty.

The frozen team. A team that does not know how to respond to the Pivot is a team that has not had the Pivot framed clearly. Name the Pivot at the table: you assumed X; Y is true instead; what do you do?

Default Spy Outcomes

Most Division 5 scenes should move forward even when the roll fails. Spy fiction does not stop because one operative missed one check; it changes shape. Use this matrix when no procedure already defines the result.

The GM should announce the likely consequence before the roll when the stakes are obvious. “If this fails, the guard calls the desk.” “If this fails with Bane, the asset’s Exposure rises.” Visible risk makes consequences feel earned.

Spy Pressure and Difficulty

Use the Core Rules’ normal difficulty ratings. The table below is a spy-specific calibration layer: it helps the GM decide when to add Boon or Bane dice , raise difficulty, or advance pressure.

Do not stack every modifier in the scene. Pick the two or three that define the pressure. A roll with six Bane dice is usually a sign the scene should be reframed as impossible, not rolled.

Operational Alert Clock

When no custom procedure applies, use the Alert Clock to track how close the scene is to open exposure. It works for covert entry, social infiltration, safe-house searches, dead drops, border holding areas, hotel corridors, embassy parties, and hostile offices.

Advance the clock by 1 for a failed high-risk check, a Bane on a noisy action, repeated hesitation under time pressure, or a visible mismatch in cover. Advance by 2 for a Calamity, public violence, a captured teammate, a blown signal, or an asset panicking on camera. Reduce by 1 only through meaningful counteraction: a credible false explanation, a cutout absorbing attention, an asset taking a risk, a successful cleanup scene, or a Tradecraft Pool spend that specifically addresses the alert.

At segment 4, do not simply say “you are caught.” Say what catching looks like: the target is moved, the guard draws a weapon, the clerk locks the passport booth, the embassy Marine blocks the stairs, the surveillance team converges, the police enter the lobby. The operation continues, but its genre has changed.

Two clocks elsewhere in this chapter reskin this same pattern for a specific medium: Triangulation for live radio traffic (Signal Traffic Procedure) and Detection for cyber intrusion (Cyber Intrusion / Digital Operation). Both keep the Alert Clock's shape, rising segment by segment toward exposure, and differ only in their trigger list and top value.

Act 4: Exfiltration

The Exfiltration is the operation’s close. The team gets out. The target is delivered, the file is passed up the chain, the body is left where it will be found by the correct person. Division 5 closes the ledger on this operation.

Exfiltration’s function is to resolve consequences and set up the next Operation. The Compromise Track registers where it has moved; the Legends register their new states; any assets cultivated or lost are tallied; the team takes stock.

Exfiltration is short but essential. The act has two or three scenes: the extraction itself, a debrief with the station handler, and (optionally) a scene of personal consequence for one operative (a late-night drink, a visit to a contact, a phone call home). The act is short because the dramatic weight has already been spent in Execution; Exfiltration’s weight is aftermath rather than climax.

Exfiltration deliverables.

• The operation is formally closed at Division 5’s level.
• Post-operation attribution analysis runs (GM adjudicates what hostile services now know).
• Compromise, Legend, and Asset states are recorded.
• Any hooks for future operations are planted.

Common Exfiltration pitfalls.

The missing Exfiltration. Sessions that end with the last bullet fired in Execution leave the act unresolved. Even a five-minute debrief closes the operation properly and preserves campaign continuity.

The all-exposition Exfiltration. A debrief that consists entirely of the GM recapping what happened is a waste of table time. The debrief is a scene: the handler has questions, the team has accounts, and the scene is usually where the next operation’s seeds are planted.

The missed consequence. A team that took three Compromise marks during Execution and then treats Exfiltration as routine cleanup has not absorbed what just happened. The GM should frame the Compromise arithmetic explicitly: you are now at 3, which means X.

The premature capstone. Some GMs try to resolve a whole campaign arc in a single Exfiltration. Don’t. The Exfiltration closes this operation; campaign-arc resolutions get their own Operations with their own full four-act structure.

Operation Debrief and Advancement

The operation is mechanically complete when the table has debriefed the outcome and recorded what changed, not when the team leaves the scene. Run this procedure at the end of every operation, even if it takes only five minutes.

Outcome Grades

Use the grade only as a debrief shorthand. It is not a moral judgment and it does not replace the Core Rules’ experience system. It tells the GM what kind of consequence the operation should leave behind.

If a campaign uses session XP, award it after this debrief. If it uses milestone advancement, this debrief is where the milestone is justified. Division 5 does not reward only success. It rewards surviving, learning, preserving deniability, protecting assets, and making choices that define the character.

Advancement Questions

Before experience is spent, ask each player one question:

• What did your operative do under pressure that they could not have done at the start of the campaign?
• What mistake are they training never to repeat?
• Who taught them something?
• Which skill, talent, specialization, or custom-tree step appeared on camera?
• What did the operation cost them personally?

An answer is enough to justify most ordinary experience spends. Rating 4-5 skills, Tier 4-5 talents, and custom-tree breakthroughs should require a stronger answer: a specialist instructor, a season of repeated use, a failed operation that taught the lesson, or a downtime scene that makes the growth visible.

Teamwork in Operations

Division 5 is a team game even when one operative is rolling. Use the table below to give non-rolling players something concrete to contribute.

Use the core Assisted Check rules for teamwork: a concrete assist normally grants +1 Boon die . If the first assistant has more ranks in the relevant skill than the acting character, that assistant grants +1 Ability die instead of the Boon die . A second assistant can only add +1 Boon die . No check can gain more than two assisting dice total, and no check can gain more than one Ability die from assistance. If the assist creates visible risk, a Bane on the main roll can affect the assistant: a Legend hit, exposure to a witness, an asset’s Trust loss, or a future obligation.

Mission Briefs and Operational Authority

A Division 5 operation begins as a brief before it becomes a plan. The brief is more than a prop. It is the table’s contract for what the team has been asked to do, what the institution has authorized, what support exists, and what consequences will follow if the operation crosses its boundaries.

At the table, the brief should answer ten questions:

The Player’s Use of the Brief

Players should treat the brief as a tool they can interrogate. Before the Intel Phase begins, the team should ask:

• What is the actual target? A person, a file, a device, a relationship, a public belief, or a future event.
• What are we forbidden to do? If the brief says “no fatalities,” that is a rule of the operation, not color.
• What actions are pre-authorized? If covert entry is not authorized, the team can still request it during Tasking or improvise it later at a cost.
• What does clean success look like? Clean success is not always “get the thing.” Sometimes it is “make everyone believe someone else got the thing.”
• Who must not know? The answer may include allied services, station personnel, assets, or even other D5 cells.

If the players are uncertain, they can ask the briefing officer directly. The GM should answer in operational language, not puzzle language. “You are authorized to enter the office after hours, copy files, and plant a listening device. You are not authorized to harm the diplomat, compromise the embassy, or trigger a police response.” That sentence gives the team enough to plan.

The GM’s Use of the Brief

For the GM, the brief is a pressure map. Every authorized action tells you what the institution is prepared to defend afterward. Every unauthorized action tells you what becomes a consequence if the team does it anyway.

Use this rule of thumb:

• Pre-authorized action means no automatic institutional fallout if performed cleanly.
• Requested and approved action means the team must spend time, leverage, or a Tasking-scene check to widen the authority.
• Improvised action means the team can do it, but Exfiltration must account for it.
• Prohibited action means the team can still choose it, but it becomes Compromise, Attribution, asset Exposure, or institutional trouble unless the team spends serious effort to bury it.

Do not use authorization to trap the players. Use it to make choices meaningful. A team that violates the brief to save an asset may have made the right human decision and the wrong institutional decision. Division 5 is built for that tension.

Authorized Actions

The following labels are useful on handouts and in Tasking scenes.

Reading the Brief at the Table

When the GM hands the players a mission cover sheet, give them a minute to read it and then ask for three answers:

1. What is our primary objective?
2. What are we not allowed to do?
3. What is our first Intel Phase question?

If the table cannot answer those three, the brief is not ready. Fix it before play continues. Players do not need perfect plans, but they need a clear frame.

Spy Operation Playbooks

The playbooks below do not add new core subsystems. They are ways to run common spy missions using the existing engine: Legends, the Tradecraft Pool, Assets, Compromise, Attribution, Era Framing, and the compact mini-procedures that support particular scenes. Each playbook tells players what to try and tells the GM what to frame.

1. Black Bag / Covert Entry

Scope and authority. A black-bag operation is a surreptitious entry into a restricted location to search, copy, photograph, plant, remove, or alter something without the target knowing the entry occurred. Covert Entry authorizes access. Black Bag Search authorizes the search or manipulation. Theft, property damage, planted evidence, and device placement need brief authorization to be in scope.

Player procedure. Build a Legend that explains presence near the site, then work the entry in order: routines, window, bypass, movement, search. Spend Tradecraft Pool dice on the moment the operation would otherwise leave evidence.

GM procedure. Frame three layers: approach, interior, exit. Give the location one mundane complication and one operational complication. The mundane complication is a cleaner, night guard, neighbor, alarm test, maintenance worker, or weather event. The operational complication is a second team, a changed schedule, a trap, a false file, or evidence that someone has already been there.

Primary skills. Tradecraft, Surveillance, Stealth, Perception, Coordination, Forgery, Cyber. For physical bypass, use Coordination for locks, safes, restraints, pockets, access panels, device placement, and other precise manipulation. Use Forgery for credentials and paperwork. Use Cyber for electronic or networked controls. Use Stealth for moving through the site without being noticed.

2. Technical Collection / SIGINT

Scope and authority. Technical collection covers bugging, wire monitoring, signal intercept, device access, camera feeds, drone observation, and cyber-enabled collection. Brief specifies the collection target and its boundary: one room, one phone, one radio channel, one server, one vehicle, one meeting.

Player procedure. Decide whether the collection is physical, digital, or hybrid, then match the toolset to the target: device, network, or protected channel. Plan the collection exit before the collection begins.

GM procedure. Make collection produce more than “you hear the secret.” Give the feed noise, partial truth, timing pressure, or a second listener. A technical collection scene works best when the team must decide whether to keep listening, act now, or burn the channel.

Primary skills. Surveillance, Cyber, Cryptography, Tradecraft, Forgery, Perception, Knowledge (Geopolitics).

3. Defection / Asylum

Scope and authority. A defection operation moves a willing source from hostile control to D5 protection. It may include first contact, vetting, family movement, document support, extraction, debrief, and resettlement. Brief scope: whether D5 wants the defector, the information, both, or neither if the risk becomes too high.

Player procedure. Do not assume sincerity. Run the contact safely, stabilize the defector, test the story without destroying trust, validate the claims, and arrange papers and movement. Ask what the defector cannot leave without: family, proof, money, medicine, or revenge.

GM procedure. Build the defection around three questions: Is the defector real? Who is watching them? What do they need before they will move? Pivot: the family is under surveillance, the file is incomplete, the defector is a dangle, or the information is true but politically explosive.

Primary skills. Tradecraft, Negotiation, Charm, Interrogation, Knowledge (Geopolitics), Forgery, Surveillance, Drive or Pilot for movement.

4. Counterintelligence / Mole Hunt

Scope and authority. A mole hunt identifies a hostile penetration inside an agency, station, cell, embassy, contractor, or asset network. It is usually compartmented. Brief covers the suspect pool and the investigative authority: file access, interviews, surveillance of allies, false documents, loyalty tests, or controlled leaks.

Player procedure. Start with access: who could know the compromised fact? Work file review, pattern checks, canary traps, false tells, and interviews in whatever order the suspect map suggests. Do not accuse early unless the brief authorizes disruption over certainty.

GM procedure. Give the players a finite suspect map. A mole hunt without boundaries becomes fog. Each suspect should have one incriminating fact, one exculpatory fact, and one private reason to lie. Let the Pivot show the leak is narrower, older, or more personal than the team believed.

Primary skills. Knowledge (Counterintelligence), Perception, Tradecraft, Surveillance, Deception, Interrogation, Cyber.

5. Snatch / Rendition

Scope and authority. A snatch operation seizes an unwilling target and moves them to a controlled location. It is one of the highest-risk mission types in Division 5 because it creates witnesses, physical evidence, legal exposure, and moral injury. Brief fields to nail down: target, permitted force level, holding authority, transfer plan, abort condition.

Player procedure. Confirm identity before action, then run pattern of life, capture window, approach, and extraction in sequence. Force enters only if the brief allows it; interrogation only after the target is secure. Prepare a mistaken-identity exit.

GM procedure. Run the operation as a clock: identify, isolate, seize, move, contain, debrief. At each step, ask what evidence is created. Do not let the scene become a simple combat encounter. The hard part is not grabbing the target; it is making the grab mean what the brief needs it to mean afterward.

Primary skills. Surveillance, Tradecraft, Deception, Disguise, Athletics, Brawl, Medicine, Drive, Pilot, Interrogation.

6. Wet Work / Sanctioned Lethal Action

Scope and authority. Wet work is a sanctioned operation whose intended outcome may be a target’s death. It is not ordinary combat and not a license to kill anyone nearby. Brief specifies target, authorization source, required conditions, collateral limits, preferred attribution, disposal or discovery expectation, and abort condition.

Player procedure. Verify the target twice. Identify the required condition: alone, confirmed identity, carrying material, after handoff, before crossing border, or only if extraction fails. Match the approach and the method to what the table's tone allows, then run Attribution cleanup afterward. Ask what the death is supposed to look like: accident, hostile-service action, criminal violence, natural cause, battlefield loss, or disappearance.

GM procedure. Keep the moral and institutional frame visible. A wet-work operation should have an authorization chain, a reason it cannot be solved by capture or exposure, and a consequence even when it succeeds. Test the team's certainty at the Pivot: wrong-target possibility, changed orders, collateral presence, the target offering information, or evidence that D5 has been used.

Primary skills. Surveillance, Perception, Tradecraft, Stealth, Disguise, Sniping, Ranged, Melee, Brawl, Demolitions, Medicine, Deception, Attribution cleanup through Tradecraft, Forgery, or Cyber.

7. Active Measures / Disinformation

Scope and authority. Active measures manipulate what a person, institution, public, service, market, or algorithm believes. The operation may plant a forged file, stage a leak, discredit a target, create a false flag, protect an asset through misdirection, or provoke an adversary into revealing themselves. Brief scope: the audience and the desired belief.

Player procedure. Decide who must believe the lie and what proof they require, then build the documents, the delivery, and the distribution to match. Build an exit for when the lie is partly believed, believed by the wrong audience, or traced back.

GM procedure. Track three audiences: intended target, unintended observer, and future analyst. Active measures rarely stay inside their original box. At the Pivot, the false story works too well, reaches the wrong person, or collides with a truth the team did not know.

Primary skills. Deception, Forgery, Cyber, Knowledge (Geopolitics), Tradecraft, Negotiation, Charm.

8. Liaison / Station Politics

Scope and authority. A liaison operation works through allied, rival, domestic, private, or station channels. The target is cooperation: access, silence, permission, a prisoner transfer, shared surveillance, or a deniable handoff. Brief names what D5 can admit, what must stay deniable, and what may be traded.

Player procedure. Enter with a position, a concession, and a line you cannot cross. Work the relationship as hard as the terms. Remember that an ally’s help creates a debt.

GM procedure. Run institutions as characters. The allied officer wants something. The station chief wants something. The domestic service has legal constraints. The private firm has a client. The Pivot: cooperation is possible but expensive, or the liaison partner is running its own operation through the same channel.

Primary skills. Negotiation, Charm, Deception, Knowledge (Geopolitics), Tradecraft, Perception.

9. Money Trail / Finance Operation

Scope and authority. Money operations follow, move, interrupt, disguise, or weaponize funds. They cover bribes, shell companies, cutouts, ransom channels, procurement, audit trails, expense accounts, crypto wallets, bank transfers, and cash drops. Brief scope: whether the team is allowed to spend, steal, freeze, forge, or merely observe money.

Player procedure. Ask what the money proves, then follow it through whichever channel fits: paper, digital, cash, or a bribe. Treat every payment as a potential attribution signature.

GM procedure. Make money useful but sticky. A payment solves one problem and creates a record, witness, dependency, or debt. At the Pivot, the paymaster is not the apparent actor, the account is a trap, the bribe recipient is already owned, or the clean money is dirtier than the dirty money.

Primary skills. Knowledge (Financial Systems), Forgery, Cyber, Streetwise, Negotiation, Tradecraft, Perception.

10. Communications Discipline

Scope and authority. Communications operations establish, protect, test, or recover channels: dead drops, brush passes, burst transmissions, one-time pads, emergency phrases, duress codes, missed-call signals, hotel-desk protocols, courier chains, and compromised-channel behavior. Brief covers which channels exist, which are trusted, and who may know them.

Player procedure. Keep messages short, authenticated, and disposable. Match the medium to the era, watch for a tail, and prepare a plausible carrier for anything physical. Always define what silence means.

GM procedure. Treat every channel as a relationship with a failure mode. A dead drop can be watched. A phrase can be copied. A one-time pad can be reused under pressure. A phone can be clean and still pattern-matched. Pivot on a channel that works but should not have worked, or one that fails in a way that reveals a human hand.

Primary skills. Tradecraft, Cryptography, Surveillance, Cyber, Forgery, Deception, Perception.

Signal Traffic Procedure

Use this when the channel itself is the scene: radio windows, one-time pads, numbers traffic, burst transmissions, dead-letter codes, steganographic posts, or secure-device exchanges.

For Shadow War radio, track Triangulation from 0 to 5 during any live transmission: the Alert Clock, reskinned for a listening ear. Add 1 for each failed or Baned Cryptography/Tradecraft roll, each extra minute beyond the planned window, or each repeated schedule from a known location. At 3, hostile direction-finding has the district. At 5, it has the building, field, or convoy. The next scene is a raid, extraction, or desperate relocation.

One-time pads are safe only once. Reusing a pad converts the next hostile intercept into at least a Contextual Attribution signature and gives the GM permission to introduce a false message that looks authenticated.

11. Station / Safe-House Logistics

Scope and authority. Station logistics operations establish, inspect, relocate, burn, or recover the physical infrastructure that makes spy work possible: safe houses, caches, vehicles, go-bags, document lockers, emergency clinics, cutout apartments, and station cover businesses. Brief scope: building infrastructure, using it, testing it, or destroying it.

Player procedure. Treat logistics as operational, not background. Choose and test the site, paper the lease, and watch for hostile attention before committing to it. Always define the burn protocol before the safe house is used.

GM procedure. Give each site one strength, one vulnerability, and one human attachment. A safe house is not just “safe.” It has a landlord, a neighbor, a cleaner, a tax record, a parking pattern, a water bill, or a child downstairs who notices shoes in the hall. The site turns out safer than expected for the wrong reason, or compromised in a way that is not immediately visible: let that be the Pivot.

Primary skills. Tradecraft, Forgery, Streetwise, Surveillance, Cyber, Perception. Equipment and site resources use Requisition through the normal gear rules.

Station Burn Protocol

Use this when a safe house, station cover, cache network, vehicle pool, clinic, courier chain, or local support structure is no longer safe.

A clean station burn usually costs time and resources but avoids immediate Compromise. A rushed burn should leave one unresolved trace. A failed burn should become an operation in its own right: rescue the asset left behind, recover the file from the landlord’s son, or stop the hostile service from running the old channel as a controlled set.

12. Surveillance Detection / Counter-Surveillance

Scope and authority. Surveillance detection operations prove whether the team, an asset, a channel, a location, or a target is being watched. Counter-surveillance may be authorized as observation only, active disruption, false-route feeding, or hostile-team identification. Brief scope: stay clean, identify the watchers, or deliberately let them see a lie.

Player procedure. Decide what you are testing: a person, route, location, vehicle, channel, or Legend. Design the route, watch for tells, and break contact or feed a false story as the scene demands. A clean SDR should end with a decision, not just a roll: proceed, abort, relocate, or bait.

GM procedure. Run surveillance as pressure, not as a binary. A tail can be absent, possible, confirmed, mapped, or exploited. Give the players signs they can act on: repeated faces, route coincidences, unnatural timing, a vehicle that should have turned, a camera angle that matters. Pivot the scene on a surprise: the team is not being watched by the service they expected, or the apparent tail is protecting the same asset.

Primary skills. Tradecraft, Surveillance, Perception, Drive, Stealth, Deception, Cyber in Nightscreen camera-state environments.

Surveillance Detection Route Procedure

An SDR is a structured test, not a vibe check. Run it when the team needs confidence before a meet, drop, crossing, or safe-house use.

Read the result in table terms:

Players should always leave an SDR with a decision: proceed, abort, relocate, break, or bait. If the answer is only “you rolled well,” the procedure did not do its job.

13. Border Crossing / Travel Pressure

Scope and authority. Border operations move people, packages, money, vehicles, or identities through a state-controlled threshold: airport, train station, seaport, road checkpoint, hotel registration, embassy gate, customs declaration, or internal movement control. Brief covers whether D5 can use diplomatic channels, whether the crossing must be deniable, and what happens if the team is delayed.

Player procedure. Treat the crossing as a scene, not a formality. Match Legend, luggage, language, money, route, and behavior, and pick the lane, official or unofficial, that fits the risk the team is willing to carry. Decide in advance what you do if secondary screening begins.

GM procedure. Run border pressure in four beats: approach, document check, human question, exit or secondary. Ask what the official sees first: passport, accent, nervousness, unusual luggage, database flag, dog reaction, or cash declaration. Give the Pivot a concrete shape: the visa is good but the hotel booking is wrong; the guard accepts the passport but asks in a dialect the Legend does not cover; the biometrics pass but the travel pattern is flagged.

Primary skills. Forgery, Disguise, Deception, Tradecraft, Knowledge (Regional Politics), Charm, Negotiation, Streetwise, Survival & E&E, Cyber, Perception, Drive or Pilot where vehicles matter.

14. Cyber Intrusion / Digital Operation

Scope and authority. Cyber operations enter, observe, alter, disrupt, or steal from digital systems. In Nightscreen they are common; in Long Dark they are rare specialist events; in Shadow War they do not exist except as radio, cryptographic, or signals-engineering analogs. Brief specifies the target system, permitted effect, attribution boundary, and whether physical access is authorized.

Player procedure. Define the intrusion objective before rolling: access, persistence, exfiltration, sabotage, false planting, trace, or cleanup. Match the skill to the step, physical or digital, cutout or credential, and read the ladder below. Do not roll “hack the system” without naming what success does.

GM procedure. Run intrusion as a ladder with a detection clock. A simple system may need two steps; a hardened state or corporate target may need all five.

Track Detection from 0 to 5, the Alert Clock reskinned for a digital intrusion. At 2, the target notices an anomaly. At 3, a defender investigates. At 4, access is contested or cut off. At 5, the operation is attributed at least Contextually unless the team wins an immediate cleanup scene.

Opposed cyber scenes use Cyber vs. Cyber when both sides are active. If one side is a system rather than a person, set difficulty by system posture: Average for ordinary corporate access, Hard for serious commercial security, Severe for state or critical infrastructure, Extreme for hardened intelligence targets.

Tradecraft Mini-Procedures

Use these when the table needs a concrete answer to “how do we do the spy thing?” without creating a new subsystem.

Forgery Time and Inspection

Forgery is not instant unless the table wants cinematic speed. Use the scale below.

Fast work raises the difficulty by one step. Proper aging, real source blanks, good Operational Funds, or Garden support can lower it by one step.

Source, Cover, and Blowback Guidance

The playbooks tell the table what an operation does. The guidance below covers the connective tissue that spy campaigns repeatedly return to: whether intelligence is true, what covers cost, who can authorize escalation, what coercion does to the table, and what happens when an operation leaves the shadows.

Source Evaluation and Debrief

Intelligence is not true because an asset said it, a file contained it, or a hostile officer died carrying it. Intelligence becomes useful when the team knows how much weight it can bear. Division 5 handles this with two questions at debrief:

1. How reliable is the source?
2. How credible is the information?

Player procedure. During Intel or Exfiltration, ask what would prove the claim wrong. Use Knowledge to test context, Surveillance or Cyber to corroborate behavior, Tradecraft to identify tradecraft signatures, Interrogation to test a detained or defecting source, and Assets to seek independent confirmation. A player can spend a Tradecraft Pool die during Exfiltration to preserve one useful lead from otherwise uncertain intelligence.

GM procedure. Assign a reliability and credibility rating secretly or openly, depending on table style. If players act on A/B intelligence, reward decisive action. If they act on C/D intelligence without testing it, convert one later complication into Soured Intel or add one Bane die to the first check that depends on the bad premise. Do not make false intelligence arbitrary. Bad intel should have an author, a motive, and a trail the players can eventually find.

Prisoner and Detainee Handling

Captured people are not inventory. They are witnesses, liabilities, moral facts, and future consequences. A detainee may be an opposition officer, a hostile asset, a wrongfully seized civilian, a defector under guard, or a PC who has fallen into hostile hands. The table should know before play how hard-edged it wants these scenes to be.

Player procedure. Secure identity first, safety second, information third. Use Medicine if the detainee is injured or drugged, Interrogation for questioning, Negotiation or Charm for rapport, Perception for condition and fear, and Tradecraft for transfer, concealment, and debrief protocol. If the team cannot state where the detainee goes next, the operation is not over.

GM procedure. Run detainee scenes for decisions, not spectacle. Frame the question: What does the team need, what is the detainee afraid of, who knows the detainee is missing, and what happens if the detainee is harmed? Resolve hard interrogation through checks, consequences, and aftermath; see the table-boundary note under Kompromat, Blackmail, and Intimate Tradecraft for the house line on coercion and content.

Interrogation Procedure

Interrogation scenes are information scenes under pressure. They should produce answers, lies, costs, and aftermath, not spectacle.

Run an interrogation in rounds. A round may be ten minutes, an hour, a day, or a full debrief session depending on the fiction. Before the first roll, the GM defines the subject’s Information Ladder.

The interrogator chooses an approach each round:

Oppose the check with the subject’s Resilience or appropriate social defense. On success, move up one rung. On success with 2+ Boons, move up one rung and learn whether the answer is complete, partial, or shaped. On failure, no rung is gained; the GM may offer a partial answer with a cost. On Calamity, the subject shuts down, lies convincingly, suffers harm, or creates immediate Exposure.

GM rule. Information extracted under duress is never automatically reliable. Rate it using Source Reliability and Information Credibility before the team acts on it.

When PCs Are Interrogated

When a player character is the subject, use the same Information Ladder, but define the rungs before rolling so the player knows what is at risk. The player rolls Resilience as the primary defense. Deception may be used to feed a prepared lie, Tradecraft to protect operational procedure, and Willpower-linked social talents may apply if they clearly fit.

Each interrogation round is opposed by the interrogator’s Interrogation or relevant social skill. On a PC success, they hold the current rung. On success with Boons, they may plant a controlled lie, identify the interrogator’s pressure point, or bank +1 Boon for a later escape/rescue scene. On failure, the GM may advance one rung, inflict Strain, or mark a Legend hit if the interrogation attacks the cover. On Calamity, the GM advances one rung and adds one consequence: Compromise, asset Exposure, Soured Intel, or a hostile file entry.

No PC narrates graphic suffering. Resolve the mechanics, state what information is at risk, and cut to consequence when the scene has done its work.

Poisoning and Covert Administration

Poison in Division 5 is a tradecraft choice with forensic, moral, and timing consequences, not a damage shortcut.

To use poison covertly, define four things: delivery, onset, effect, and cover story.

Effects usually do one of four things: incapacitate, disorient, kill, or mimic illness. Nonlethal effects inflict Strain, impose Bane dice , or remove the target from the scene. Lethal effects use the listed weapon or poison gear profile and should trigger Attribution if the body is examined.

An L-pill remains a table-level decision by default. If a table wants a mechanic, treat its use as immediate lethal poison on the user: no attack roll, no damage roll, and no rescue unless another character was already physically intervening and succeeds at a Severe Medicine check. The real consequence is what information dies with the operative and what the opposition learns from the body, not the Wound track.

Lethal Authority Consequences

When a target dies, answer two questions at Exfiltration: Was it authorized? and Was it clean?

This table makes player agency legible rather than removing it: the same human-choice-versus-institutional-choice tension covered under Mission Briefs, above, applies here too.

Cover Types and Tradeoffs

Legends are the rules layer; cover type is the table-facing fiction. When a player chooses a Legend, the cover profession should tell everyone what doors open and what scrutiny follows.

Player procedure. Choose the cover that explains the scene you want to enter. Do not use a cover only because it sounds cool. A journalist cover is good for asking questions and bad for carrying a suppressed weapon. A contractor cover explains the weapon and creates a signature. A tourist cover gets through the lobby and fails in the boardroom.

GM procedure. Let a good cover solve access problems, then test the cover where it is weak. The business consultant can enter the conference but must answer a finance question. The diplomatic attaché can attend the reception but is watched from the moment they arrive. The tourist can be overlooked but cannot plausibly enter the secure floor.

Kompromat, Blackmail, and Intimate Tradecraft

Coercive leverage is part of espionage. It is also corrosive. Division 5 has used blackmail, kompromat, honey traps, and romantic access. It does not regard them as clean tools. They damage assets, handlers, Legends, and campaigns if treated as clever shortcuts.

Table boundary. Any operation involving sexual leverage, intimacy, humiliation, or coercive personal material should be cleared at session zero or paused for a direct table check before it appears. Fade to black is the default. No player should have to negotiate personal boundaries through their character’s competence.

Player procedure. State the leverage and the intended outcome. Use Charm or Deception for consensual social access, Negotiation for pressure short of coercion, Interrogation for controlled questioning, and Tradecraft for cutouts and delivery. If the plan depends on humiliation, sexual coercion, or threat to family, expect Asset Trust damage and long-term consequences even on success.

GM procedure. Make coercion effective but expensive. Blackmail can open a door, but it raises Exposure, creates resentment, and invites betrayal. Honey traps can create access, but they produce emotional fallout and often a hostile counter-operation. Do not reward coercive play with frictionless success.

Authorization Escalation

The brief names what is already authorized. During play, teams will want more. Use the escalation ladder to decide who can widen the operation and what it costs.

Player procedure. If you want to exceed authority, say what you want, why it matters, and what risk you accept. The GM may call for Negotiation, Leadership, or Tradecraft during Tasking or Exfiltration. In the field, approval may cost time the team does not have.

GM procedure. Approval should clarify stakes, not stop play. A denied request should still leave choices: proceed without authority, find another route, narrow the objective, or abort. If the team exceeds authority and succeeds, the Institution step of the Exfiltration debrief still applies.

Public Scandal, Press, and Legal Inquiry

Attribution answers what hostile services can prove. Public Heat answers what the outside world can see. A public scandal may be a police case, news report, parliamentary inquiry, corporate lawsuit, viral video, leaked file, or family asking why someone disappeared.

Use Public Heat when an operation becomes visible beyond the intelligence world.

Player procedure. Reduce Public Heat by creating mundane explanations, moving witnesses out of danger, repairing visible damage, using liaison channels, producing plausible documents, or shifting the story toward a less dangerous truth. Use Deception, Forgery, Negotiation, Knowledge, Cyber, or Tradecraft depending on the public trace.

GM procedure. Public Heat does not replace Compromise. It changes the arena. A team can have low Compromise and high Public Heat if no one knows D5 was involved but the incident is everywhere. A team can have high Compromise and low Public Heat if hostile services know exactly what happened but keep it secret. The best spy campaigns use both.

Clearing Public Heat

Public Heat clears through explanation, time, distraction, or institutional action. It does not clear because the team left town. A local newspaper, police file, insurance claim, viral clip, or parliamentary question can stay alive after the operatives are gone.

At Heat 3 or 4, at least one future operation should feel the consequence unless the team spends real effort clearing it. That consequence can be a nervous handler, an unusable route, a legislative inquiry, hostile propaganda, a witness resurfacing, or a public agency asking the wrong questions for entirely legitimate reasons.

Downtime and Personal Fallout

Downtime is the space between operations where the institution repairs what can be repaired and the operative lives with what cannot. It is abstract. Division 5 does not track rent, utilities, car payments, or whether a cover identity remembered to buy groceries unless those details become operational.

After Exfiltration, each PC may take one downtime action if the fiction allows days or weeks of quiet. A season break may allow two or three. Downtime actions do not require rolls unless hostile pressure, scarce resources, or personal secrets make them uncertain.

Personal Fallout

Personal cost is not a new track. Use it as a set of tags the GM and player can bring back when the campaign needs the human cost on camera.

A fallout tag should produce scenes, not arithmetic. Once per operation, the GM may offer 1 Fortune Point to bring a tag into play: the estranged spouse calls during Tasking, the child appears in OSINT, the dirty-money broker asks for a favor, the operative recognizes the same brand of cigarette from the interrogation room. If the player accepts, play the pressure and add the Fortune Point to the player side of the Story Point pool. If they refuse, the tag waits.

Players can clear a fallout tag through a meaningful downtime scene, a season break, or an operation that resolves the underlying issue. Some tags should not clear; they become part of the character’s ending.

Training Between Operations

Experience spending should be tied to fiction when possible. A skill increase means practice, instruction, a hard lesson, or a specialist course. A new talent means someone taught the operative, the operative survived the relevant failure, or the character spent downtime formalizing a trick they have already shown in play.

For compact campaigns, training can be a sentence. For long campaigns, training scenes are useful pressure: the Wetworker at the range after an unauthorized kill, the Face drilling accent work with a Garden officer, the Analyst learning Cyber from someone who resents being assigned as tutor.

Support Materials in the Body

Printable dossiers, cover sheets, asset cards, and reference handouts belong in the document portfolio. The book still benefits from the checklist version when rules already exist.

Target dossier fields and asset trackers should remain simple until the portfolio is built. The rules already define their contents; the portfolio will make them pretty and fillable.

Campaign-Level Pacing

Beyond single Operations, the campaign has its own structure.

The Season. A unit of 8–12 Operations constituting a coherent arc. The Season has its own Tasking (an opening theme or pressure), its own Pivot (a mid-Season reveal that changes the terms), and its own resolution (a culminating Operation where the Season’s pressure lands).

The Recurring Nemesis. An antagonist (Chapter Nine) whose shadow falls across multiple Operations in a Season. The Nemesis appears in the Intel Phase of Operation Two as a rumor, in the Execution of Operation Five as a fact, in the Exfiltration of Operation Eight as a confirmed face, and in the climax of Operation Ten as the direct opposition.

The Long Vendetta. A multi-season throughline spanning two or three Seasons. The original Tasking gets forgotten; the operation has become personal in a way that crosses multiple deadlines. This is where Division 5 campaigns resemble their literary and film touchstones: the mole hunt in Tinker Tailor, the twenty-year Smiley-Karla arc, the Bourne Ultimatum spanning three films.

Locations

A rotating gallery of drop-in locations across the three eras. Each location has a sketch of its physical and operational character, three NPCs, and two ready-to-run hooks.

A Farmhouse in the Limousin (SW)

A working farm in the rolling country of south-central France, thirty kilometers from the nearest market town. The farm has been in the Marchand family for three generations. Pierre Marchand, sixty-two, runs the farm with his wife Hélène and a deaf farmhand named Vincent. The family has lost a son to the war already; the surviving daughter, Marie, twenty-four, has begun taking the farm’s grain wagons on trips that Pierre does not ask about.

The farmhouse has a wireless set hidden under the barn floor, kept in a sealed metal box against damp. Transmissions have been going out from this farm since the autumn of 1942. The Germans have direction-finding vans in the region but have not yet triangulated the farm; a raid is perhaps two operations away.

Three NPCs.

Pierre Marchand (farmer, Resistance cell leader). Patriot disposition. Will protect his daughter and his radio operator with his life. Paid for his son’s death in 1941 and has not forgiven any German he has met since. Useful as a handler-type asset for operatives working the area.

Marie Marchand (courier, cell member). Steady disposition, unusual at twenty-four. Her courier runs have already had three near-failures; the next one is statistically likely to be the last. Useful as an asset, dangerously close to the operational burn-out line.

Oberstleutnant Koenig (Funkabwehr officer, forty kilometers away). The officer currently building the case on this signal. Patient, methodical, German. Appears in the backstory of the farmhouse’s operational arc; if the operation runs long enough, Koenig will eventually appear in person.

Two hooks.

The Radio That Must Not Transmit. The next scheduled transmission from this farm will be intercepted by Koenig’s team. D5 has learned this through an independent source. Options: prevent the transmission, re-key the circuit to buy time, or extract the radio operator and the family before Koenig’s raid arrives.

The Daughter’s Last Run. Marie’s odds have run out, and this is the run where it catches up with her unless the team intervenes. Accompany her, take over the run themselves, or provide the cover that lets her make it alone before she disappears north.

A Café on Unter den Linden (LD)

A small café on East Berlin’s main boulevard, three blocks from the Brandenburg Gate. The café has been at this address since 1954; the Stasi has had a file on it since 1956. The waiter, Hans Gerlach, has been on the payroll of three services, East German Stasi, Soviet KGB, and (for the last eleven years) British SIS, and is paid by all three to take messages, hold tables, and remember faces. He is a small man with tired eyes and a crossword puzzle that he completes at the counter between customers.

The crossword puzzle in Neues Deutschland, clipped and filed by Hans every day, has been a dead-letter channel since 1962. One crossword clue, answered correctly, signals that a message is waiting in a particular hollow of the counter.

Three NPCs.

Hans Gerlach (waiter, triple agent). Cynic disposition. Sixty-one years old. Has not been home before midnight in a decade. Knows he will not retire; the retirement plan is the grave. Useful as a meeting facilitator, a message drop, and a reader of the Stasi’s current priorities.

Ingrid Schmidt (regular customer, Stasi officer off-duty). Watchful disposition. Drinks the same coffee every weekday between 15:00 and 16:30. Reads the same newspaper. Notices who comes in, who leaves, and when. Does not pay Hans for reports; she gets them by implication.

The Man in the Corner (Western intelligence officer, whose service rotates). A table that the café quietly holds for whichever Western service has currently booked the 14:30–16:00 window. The occupant rotates; the table does not.

Two hooks.

The Crossword Has Been Answered Wrong. Today’s Neues Deutschland has been printed with a deliberate error in the crossword: the signal clue does not work. A message was supposed to be passed through this channel. Either the team locates the sender and explains, or it works out why the signal was sabotaged and by whom.

Hans’s Last Week. The Stasi file on Hans has been growing quietly for months; it is now thick enough to justify his arrest. Hans has noticed. He wants out. The team’s next operation crosses his café tomorrow. Use him one more time, extract him, or let events take their course: the choice is the team’s.

A Serviced Apartment in Dubai (NS)

A 34th-floor serviced apartment in the DIFC, rented month-to-month through a shell company. The apartment has reinforced doors, a government-issued encryption router (provided by the building’s facility management), and cleaning staff rotating between nine intelligence services. The city’s state-grade surveillance is thorough but uninterested in routine corporate occupants; the apartment’s residents are assumed to be one of several dozen intelligence-adjacent short-term operational housings in the same two-block radius.

Three NPCs.

Rashid Al-Harbi (building concierge). Pragmatic disposition, sixty-two. Knows which apartments in this building are operational and which are genuine. Does not tell. Takes tips in dirhams and favors in equal measure. Useful as a local fixer for operations in the DIFC.

Sofia Andersson (cleaning staff supervisor, former Swedish military intelligence). Mercenary disposition. Retired from Swedish service in 2017; now runs the cleaning roster for a cluster of buildings in the DIFC on behalf of a private intelligence firm. Knows everything that happens in the apartments her staff clean, which is everything.

Muhammad Al-Zahra (regional facility manager, Emirati government liaison). Patriot disposition, subtle. Reports to the UAE’s state security service. Has access to every apartment’s key records, CCTV feeds, and elevator logs. Maintains plausible deniability about any given operational tenant by not asking questions the building’s residents do not want asked.

Two hooks.

The Router Has Been Changed. The apartment’s facility-provided encryption router is a different model than it was last month. The change is plausibly explained (routine equipment upgrade). It is also plausibly a compromise: every service with access to the building could have swapped the hardware. The team can sweep and confirm, or simply operate on the assumption that their traffic is now being captured.

The Cleaning Staff Rotation. Sofia’s cleaning supervisor for this apartment has been replaced this week. The new supervisor is a woman the team does not have a file on. She has been through the apartment twice. The team must work out which service she is placed by before the next operational meeting scheduled in the apartment.

A Suburban House in Bethesda (NS)

A single-family home in a tree-lined neighborhood north of Washington. Four bedrooms, two cars in the drive (a Tesla and an Outback), a golden retriever, a wife who is a lawyer and works from home two days a week, two kids in public school. Nothing about the house is operational to external appearance. The basement is operational to nearly every external appearance except this one.

The owner is a mid-level analyst at a Washington intelligence office. He has been the asset Division 5 has been handling for six years. The handling has been good, he has produced without being detected, and is now approaching the point where he is either going to be promoted into a position that makes his access catastrophic for his service, or going to be discovered because his personal paper trail has finally accumulated enough indicators to be read by a sufficiently dedicated counter-intelligence officer.

Three NPCs.

Mark Chen (the asset). Cynic disposition. Forty-one, smart, tired. Still believes in the general premise of what he is doing but does not especially believe in the mission any given operation requires. Is beginning to wonder whether he will ever see a day in his life when he is not running.

Sarah Chen (the asset’s wife). Professional disposition. A labor lawyer. Does not know her husband is an asset. Has begun to notice small things, her husband’s mood, certain phone calls, the intensity of certain weekends, and has not yet assembled the pattern. Will eventually.

Agent Diane Rios (FBI counter-intelligence officer, Washington field office). Professional disposition. Has a file open on a cluster of mid-level analysts in the target’s agency, one of whom is almost certainly leaking to a foreign service. Chen is not at the top of her suspect list. He is on it.

Two hooks.

The Promotion. The promotion described above has landed as a formal offer. Let it happen (higher-value intel, higher risk), block it (a career-damaging move on their own asset), or exfiltrate Chen before he accepts.

Diane’s Lunch. Agent Rios has made contact with a colleague of Chen’s for a quiet lunch. The colleague is a friend of the asset. Rios’s questions will make it back to Chen; what Chen does with them is the operation. The team’s window to prepare Chen’s response is forty-eight hours.

A Viennese Optician’s Workshop (LD)

A small optician’s shop in the Innere Stadt, family-owned since 1881. The shop sells spectacles to an aging clientele and grinds lenses on nineteenth-century equipment that is still serviceable for its intended purpose. The shop is also, this part is not known to the clientele, the workshop of one of the finest concealment-device makers in Cold War Europe, operating on a quiet retainer from two Western services and the occasional unacknowledged job for a third.

The workshop occupies the back half of the shop, accessible through a door marked Private that is usually locked. The Quartermaster in residence is Herr Doktor Stefan Kluge, a seventy-year-old survivor of multiple services and multiple countries, who has outlived most of the officers he has ever built equipment for.

Three NPCs.

Stefan Kluge (Quartermaster). Exacting disposition, sixty years deep. Has built concealment devices for SOE, for CIA, for D5, and on one memorable occasion for a service he would not name. Charges in Swiss francs, payable into an account in one particular canton. Does not negotiate. Does not take on work he does not want. Useful as a recurring resource, once a relationship is established.

Anna Kluge (Stefan’s granddaughter, apprentice). Twenty-eight, has been apprenticed to her grandfather since she was nineteen. Will inherit the workshop and the client list. Is nearly as skilled as her grandfather and, importantly, has a modern eye for equipment that he does not: miniaturization, modern materials, a grasp of the emerging transistor-scale concealment opportunities that Stefan regards with polite interest.

Mr. Aleksandrov (a regular customer, buying spectacles). A Warsaw Pact diplomat who has been coming to this shop for his spectacles for eleven years. Has no idea the back room exists. His spectacles are excellent. His presence in the shop twice a year makes the establishment’s Western clientele mildly paranoid, which is useful operational cover.

Two hooks.

The Commission. Kluge has accepted a high-value commission on behalf of an unnamed third party. The team, on a different operation, discovers that the commissioning party is the opposition Nemesis. Warn Kluge, extract the item, or let the work proceed and learn exactly what it is: the item appears in the field either way, so knowing its shape may matter more than stopping it.

Anna’s Visitor. A young man who claims to be a journalism student has made two appointments with Anna for “a feature on traditional artisanship in Vienna.” His cover is almost convincing. He is almost certainly a junior intelligence officer looking for a way in. Anna has noticed; Stefan has not. Warn the workshop, or leverage the situation instead: that call belongs to the team.

A Cross-Border Train, the Eastern Mediterranean (SW)

A sleeper train running from Istanbul through Adana and on to Aleppo, then Baghdad, crossing the boundary of the then-neutral Turkey into Vichy Syria and then on into British-administered Mandatory Iraq. The train is the primary cross-border movement for civilians, diplomats, and operatives in the region. A compartment holds four; the corridor is smoke-filled; the wagon-lit attendants are paid by several services.

Three NPCs.

The Wagon-Lit Attendant (Giorgios Papadopoulos). Greek national, fifty-five, has worked these cars since before the war. Knows every smuggler, every spy, every wealthy refugee. Helpful for tips and favors. Reads people faster than any of them realize.

The German Businessman in Compartment 3 (Herr Schmidt). Travels on this train every month for “textile business.” Is, in fact, an Abwehr courier carrying materials between Istanbul and Aleppo. Is not carrying anything particularly important most trips; the operation is the pattern of travel, which provides cover for the trips that matter.

The British Lieutenant in Compartment 7 (on leave, traveling for personal reasons). A young officer from the Mandatory Iraq administration, traveling on what he believes is a private matter. He has been identified by SOE as a person whose movements may be of use. He does not know this.

Two hooks.

The Document in the Samovar. A document is being passed from Istanbul to Aleppo tonight, concealed in the hollow base of a brass samovar in the dining car’s service area. Before the train reaches Aleppo, the team can substitute it, photograph it, or destroy it outright.

The Lieutenant’s Miscalculation. The British lieutenant in Compartment 7 is meeting someone in Aleppo tonight who is not who they claim to be. SOE has worked out that the lieutenant is about to walk into an Abwehr trap. The team has eleven hours to prevent it, extract him, or let the meeting proceed and capture the Abwehr network around him.

A Safe House Above a Hardware Store in Hamburg (LD)

A two-room apartment above a Hamburg hardware store, rented under a West German shell company’s name. The apartment has been a D5 safe house since 1974, rotated through different tenant identities to keep the paper trail from accumulating. It is currently officially occupied by a Mr. Klaus Werner, an insurance adjuster who travels frequently and is rarely in Hamburg.

The apartment has three beds, a safe concealed in the floor under the kitchen sink, a pre-arranged exit route through the attic into the adjacent building, and a small library of German-language documents supporting the Werner Legend. The hardware store owner downstairs does not know the apartment is operational; he believes Mr. Werner is a real insurance adjuster who tips well at Christmas.

Three NPCs.

Willi Bauer (hardware store owner). Incurious disposition, a solid Hamburg burgher. Sixty-eight. Does not inquire about his upstairs tenant’s business; his late brother-in-law was in the SS, and Willi has made a life choice to not ask questions about other people’s affairs. Makes excellent sauerbraten.

The Current Legend Occupant. When the safe house is being actively used, whichever operative is running the Werner Legend is technically the current tenant. Between uses, the apartment sits under a plausible tenant story (“Mr. Werner is on assignment in Munich for three months”).

Ilse Weber (local Stasi agent, nineteen years under cover in Hamburg). Methodical disposition. Has been surveilling this particular block of Hamburg for eleven years, not because she has identified anything specific but because the block is on her routine route. Has noticed that the tenancy of the upstairs apartment turns over more frequently than tenancies usually do; has filed notes; has not yet acted on them.

Two hooks.

The Compromised Safe. The safe under the kitchen sink has been opened, then closed and re-sealed to appear untouched. The operation using the apartment discovers this during a pre-use check. The team has a forty-eight-hour window to work out who accessed the safe, what they took, and whether the safe house is burned beyond use.

Ilse’s Promotion. Ilse Weber has been offered a transfer off Hamburg surveillance, and her handover is the safe house’s best chance in years: a replacement who has not yet learned this block’s rhythms. The team has perhaps three weeks before the new officer catches up. Use the gap to move the asset, relocate the safe house, or try something bolder while Ilse is still the only one who understands what she has been watching.

A Black Site Off a Minor Highway, Eastern Europe (NS)

A compound of three industrial buildings, an access road, and a perimeter fence, all set in a patch of rural Romanian countryside forty kilometers from Bucharest. The compound is officially a disused agricultural processing facility; its unofficial use is as a black-site interrogation facility contracted to one of several Western services on a rotating basis. The facility has been operational since roughly 2003; its records are held offline; its staff rotate in and out through a separate facility outside the country.

Three NPCs.

Site Supervisor Petros Nikolau (contractor, ex-Greek special forces). Cynic disposition. Runs the facility on a rotating twelve-week contract through a private-military firm. Is not aware of which government service has sent any specific detainee; is aware that the detainees are, in all cases, people whom someone has decided should be here.

The Current Detainee. Varies by scenario. At scenario start, the detainee is whoever the operation is about: an extracted asset being held for debrief, an opposition officer captured through an earlier operation, or a third party whose presence in the facility is itself the mystery.

The Cook. An older Romanian woman, Maria, who has been the facility’s cook for seven years. Knows far more about what has happened here than any of the rotating staff. Will not speak to outsiders. Will provide occasional useful clues if approached carefully in her native language by someone who respects that she has a life outside this facility that she will not discuss.

Two hooks.

The Wrong Detainee. The team arrives to process or extract an expected detainee and discovers that the detainee held at this facility is not the person they were told to expect. The paperwork says one thing; the prisoner is someone else. The team has hours to work out what has happened.

The Facility Closes Tonight. The facility’s contract is expiring; the site is scheduled to be emptied and cleansed of operational traces within the next twenty-four hours. The team’s interest is in either a piece of information held here, a particular detainee, or the identity of whichever service was last using the facility. The clock is running.

Operation Hooks

Twenty-five one-to-three-line operation seeds. Ten are era-neutral; five are Shadow War-specific; five are Long Dark-specific; five are Nightscreen-specific. (Some of the “era-neutral” hooks have strong era affinities; they are grouped here by clarity rather than strict rule.)

Era-Neutral Hooks

1. The Courier Is Missing. A courier carrying a package to a scheduled meeting has not arrived. Trace, retrieve, complete the meeting. Complications: the package has been opened; the courier is alive but defecting; the meeting’s other party is not who the briefing claims.

2. The Asset Requests an Emergency Meet. A long-running asset triggers the pre-arranged emergency signal. The reason is unknown. The team runs counter-surveillance and brings the asset in. Complications: the signal is a trap by opposition service; the asset is under duress; the asset is sincere and knows something catastrophic.

3. The Burn Notice Arrives. Division 5 has issued a burn notice on one of its own operatives. The team is instructed to locate the operative, determine the basis of the notice, and resolve per the notice’s terms. Complications: the operative is innocent; the notice itself is a deception by a hostile service; the operative will not go quietly.

4. The Shadow Audit. An allied service’s internal auditor has been investigating their own files and is close to identifying a D5-run asset inside their agency. Discredit the auditor, remove the file, or extract the asset: pick one. Complications: the auditor is correct, competent, and protected; discrediting her requires an action the team would rather not take.

5. The Two-Day Window. A person of interest will be in a particular city for two days. The operation must make contact, produce a result, and extract: all within the window. Complications: the person is accompanied by protection; the window itself was a deception to draw D5 to that place.

6. The False Flag. An operation that appears to be the work of one particular service turns out to have been run under false attribution. The team’s mission is to identify the true actor and report up the chain. Complications: the true actor is Division 5; the true actor is an ally; the true actor is inside the team.

7. The Lost Technology. A piece of specialist operational equipment (an era-appropriate item) has gone missing from an allied service’s inventory. The team is tasked with recovering it or confirming its destruction. Complications: the item has been modified; the item has been used already; the item’s existence was itself classified above the team’s read-in.

8. The Retirement Gift. A retiring officer of a rival service is about to be granted permanent protection and a comfortable pension. D5 has cause to believe the officer has information that would be catastrophic if leaked. The mission is to neutralize the risk. Complications: the officer is willing to talk if approached correctly; the officer is under someone else’s protection; the officer is not who the file claims.

9. The Training Exercise. A routine training operation with an allied service has been compromised: someone has turned the exercise into a real operation. The team must work out who, why, and what the real target is, in real time. Complications: the compromised party is a team member; the “compromise” was planned by D5 leadership without informing this team.

10. The Archive Request. A foreign government has formally requested the release of a historical file from D5’s archive. The file in question contains information that, if released, will expose multiple still-active operations. The team is tasked with producing a plausibly responsive file that does not compromise ongoing work. Complications: the requester already has the true file; the archive has been infiltrated; the true file reveals something about the team itself.

Shadow War Hooks

11. The Collaborator’s Daughter. A French industrialist collaborating with the Germans has a daughter who has been feeding intelligence to the Resistance. She has been identified and will be arrested within days. The mission is to extract her, and to decide what to do with her father.

12. The Wireless Set in the Chimney. A radio operator who has not transmitted in three weeks has either been captured, killed, or gone to ground. The team must locate the Paraset, determine what has happened to the operator, and resume the circuit or extract the team still depending on it.

13. The Listening Post. A German Funkabwehr direction-finding station has been triangulating a Resistance circuit for months. The station must be destroyed or relocated in a way that does not immediately reveal D5 involvement. Complications: the station is staffed by drafted Austrians sympathetic to the Resistance, and one is a potential asset.

14. The Returning Aristocrat. A Hungarian aristocrat believed lost behind German lines has surfaced in Lisbon with a story that half his family’s estate is still intact and can be used as a Resistance base, if D5 can get him back. His account is interesting, improbable, and possibly entirely manufactured.

15. The Cypher Clerk. A cypher clerk working at a German occupation headquarters has approached an allied sympathizer with an offer to defect with materials. The materials would be worth any risk. The clerk is either sincere, under Abwehr control, or trying to buy freedom for a family member held hostage.

Long Dark Hooks

16. The Defector Who Will Not Defect. A senior KGB officer has been in deep contact with a Western service for two years, apparently preparing to defect. Today he signals that he will not defect, but he has information to pass, if the team can arrange a meet without the Moscow station’s knowledge. Moscow Rules apply.

17. The Photo in the Album. A family photograph album retrieved from a defector’s luggage contains, on page eleven, a photo of a person who is not known to Western services, but whose face matches the description of a senior Warsaw Pact officer whose identity has been a mystery for fifteen years. The identification, if confirmed, reshapes the counter-intelligence map.

18. The Walk-In. A man has walked into the D5 station in a neutral capital and asked to speak to “a British officer who can authorize immediate extraction.” He has credentials that nearly check out. His offer is plausible and terrifying. The decision must be made tonight.

19. The Mole in the Embassy. One of three officers at an allied embassy is working for Warsaw Pact intelligence. The team must identify which, without alerting the other two (who will, correctly or incorrectly, take any investigation of themselves as an insult to their service). A classic counter-intelligence scenario.

20. The Border-Crossing Mother. An East German woman attempting to cross to the West with her infant son has been intercepted at a border checkpoint. Her husband, a D5 asset, has been transmitting for eleven years. The extraction has until dawn to succeed before she is transferred to Stasi interrogation.

Nightscreen Hooks

21. The Deepfake Confession. A video confession from a D5 operative circulating on intelligence back-channels is almost certainly a deepfake, but it is convincing enough that several services are now treating it as authentic. The team can produce irrefutable proof of the forgery, or make the video’s claims operationally moot without ever disproving them.

22. The Cryptocurrency Trail. Financial analysis has identified a cryptocurrency wallet that has received consistent payments from a suspected opposition paymaster over three years. The wallet’s owner is unknown; tracing it requires a cyber operation against an exchange that is not entirely cooperative with Western services.

23. The Private Intelligence Contract. A former intelligence officer has left and founded a private intelligence firm. The firm has begun taking contracts from a foreign government. One of those contracts is a target that concerns Division 5 directly. The team must disrupt the contract without exposing D5’s interest.

24. The Facial Recognition Match. A CCTV system in a European city has matched a face entering the airport to a face D5 has been hunting for twenty-six years. The face has aged, moved, and changed names. The match is either a breakthrough or an adversarial-image deception designed to draw D5 to that city.

25. The Cloud Leak. A cloud provider used by a target organization has been penetrated by parties unknown. Data is flowing. D5’s interest is in certain files within the leaking dataset. The team’s mission is to acquire those files, determine who else is reading them, and, if possible, identify the original intruder.

Hooks as Skeletons

Each of these hooks is a skeleton: a premise that needs skin. The GM’s prep work on a hook is deciding who the people are, where the places are, what the deadline is, and what the Pivot will be. Use the Locations gallery and the NPCs in Chapter Nine to dress the skeleton. A hook prepared for Thursday evening needs roughly forty-five minutes of GM work to become a runnable Operation.

The Starter Operation: Concrete and Ashes

A full four-act starter operation, playable in any of the three eras with minor reskinning. The Operation is built for a team of four to six operatives across one long session (five to six hours of table time) or two shorter sessions (three hours each). This writeup provides the full text for GM use.

Operation Summary

The Premise. A person in possession of a piece of information is about to be moved, not captured, not killed, not recruited, but moved by a third party whose identity is contested between D5’s analysts. The target has a window of roughly 72 hours before the move. D5 wants the information before anyone else gets it.

The Target (by era):

• Shadow War: Dr. István Halász, a Hungarian physicist working on early fission-related calculations, being moved from occupied Budapest to a German research facility in the Harz Mountains.
• Long Dark: Mikhail Petrov, a junior KGB defector preparing to hand over a set of operational files to a Western service, being moved by his Warsaw Pact handlers from Vienna to Moscow.
• Nightscreen: Amira Haddad, a ransomware broker who has fragments of the kill-switch for an ongoing state-level cyber operation, being moved by a private intelligence firm from Dubai to a classified location in Central Asia.

The Information (by era):

• Shadow War: A set of mathematical calculations on uranium enrichment, memorized rather than written down.
• Long Dark: A set of tradecraft files, asset names, drop locations, current operations, all on microfilm concealed in personal effects.
• Nightscreen: A set of cryptographic keys and operational metadata stored in a combination of paper notes and an encrypted USB device.

The Complication. The third party moving the target is contested. D5’s two analysts disagree on whether the movers are opposition intelligence, an allied service, a private paramilitary contractor, or (improbably but not impossibly) a rogue element of D5 itself. The team will not know which until sometime in Execution.

The Window. Seventy-two hours from Tasking to target’s scheduled move.

The Success Condition. The team acquires the information, copy, transcribe, or take the original, without allowing the movers to complete their transport and without triggering cross-service escalation. The target may be extracted, neutralized, or left in place; the information is the deliverable, not the person.

Act 1: Tasking

The Scene. The team is summoned to a location fitting the era, the SOE briefing room in 1943 London, the D5 station in 1974 Vienna, the rotating office in 2024 Geneva, for a briefing from an NPC handler (use your campaign's recurring handler if you have one). The briefing runs twenty minutes of table time.

The Briefing Officer’s Key Points.

• Target identified, with photo (era-appropriate).
• Mover identified, with the analyst-level caveat that the mover’s service affiliation is uncertain.
• The information’s value and its nature.
• The window: 72 hours.
• Requisition tier: Major Operation.
• Constraints: no open violence; no attribution to D5; no escalation with the suspected-opposition movers if they turn out to be allies.

The Question the Briefing Cannot Answer. Which service is actually moving the target?

Tasking’s Cliff. The briefing officer reveals, near the end, that Division 5’s two senior analysts on this file disagree sharply about the movers’ identity. Both analyses will be provided to the team. The team must choose how much weight to give each.

The two analyses:

Analyst Alpha’s view: The movers are [opposition-service]. The information, if acquired by them, compromises D5 operations for months. The operation is urgent and the movers are hostile.

Analyst Beta’s view: The movers are [allied-service] conducting a joint operation with a third-party contractor. The information’s transfer is sanctioned at a level the team has not been read in on. D5’s Tasking is either ignorant of the sanction or is a deliberate move against the allies.

Both analyses are partially correct. The truth, revealed during Execution, is that the movers are a private contractor hired by an allied-service faction acting without their own headquarters’ sanction: an off-books operation by officers who should not be running off-books operations. This nuance is deliberately hidden from the team.

Act 2: The Intel Phase

The Intel Phase runs five scenes and produces the Tradecraft Pool for Execution.

Scene 2a: The Dossier Dive. The team reads the target’s file. The file contains the target’s known movements, a list of known associates, and one critical piece of information that is inconsistent with the mover being opposition intelligence (the target has been seen in the past month in a location that opposition intelligence does not routinely operate). An attentive Analyst catches this; the unattentive team does not notice.

Scene 2b: The Ledger Query. An Analyst character queries D5’s institutional memory. The Ledger returns one piece of historical precedent: seven years ago, a similar operation, same pattern of unclear mover attribution, same kind of target: ended with the realization that the movers were an off-books allied faction rather than opposition. The Ledger does not name the faction but provides enough shape for a careful reading to notice the parallel.

Scene 2c: The Asset Check. The team contacts a local asset, a cultivated source in the target’s city, for a current-state confirmation. The asset reports that the target is where the briefing said, preparing to be moved, and that the target is aware of being moved. The asset reports that the target is not resisting the movement, which is inconsistent with the opposition-capture model.

Scene 2d: Field Surveillance. The team conducts direct surveillance on the target. The target is visible, preparing to travel, and is being observed by at least three other parties that the team can identify, a local security detail (appears to be local paramilitary), a cluster of what looks like private-sector operators (two men, a woman, non-descript vehicles, Western ethnicity), and a single individual of unclear affiliation who is herself watching the private-sector operators.

Scene 2e: Requisition & Legend Prep. The team finalizes gear and Legends. The Quartermaster (PC or NPC) raises the question of whether to requisition non-lethal or lethal options. The Tasking said no open violence; the team decides which weapons to carry anyway.

Intel Phase Yield. At good performance, the Intel Phase yields a Tradecraft Pool of roughly 6–8 dice. At excellent performance (four of five scenes successful plus a Dossier Dive catching the inconsistency), up to 10 dice.

Act 3: Execution

Execution runs three internal beats: the Approach, the Pivot, and the Resolution.

Beat 3a: The Approach. The team positions for the operation. The target is at a location, a Budapest apartment, a Vienna hotel, a Dubai serviced apartment: preparing for the move. The team’s plan (whatever it is) proceeds through the Approach normally; the team makes initial contact with the target, either covertly or directly.

The target’s response depends on how the team approaches:

• Direct approach (introducing themselves as allies): The target is initially receptive. The target believes the movers are also allies. The target is confused by the team’s presence.
• Covert approach (surveillance, acquisition of information through other means): The team confirms what Intel Phase suggested: the target is cooperating with the movers.

Beat 3b: The Pivot. The Pivot arrives in one of two forms:

Form A. The movers arrive early and begin the move. A clash between the team and the movers is immediate. The movers are professional but not overtly hostile: they identify themselves (truthfully or by cover) as a private-security firm contracted by a client. The client is named as an allied-service codename that the team recognizes.

Form B. The target, during a quiet moment with the team, reveals that they are being moved at their own request, to a destination they believe is safe, under arrangements they have made with an allied-service officer. The target names the officer. The officer is real and known to D5, but the officer’s headquarters does not know about this operation.

Either form surfaces the core complication: the movers are not opposition, and this is not a simple capture. The team must now decide whether to complete their own operation (acquire the information) while allowing the move to proceed, stop the move and report up the chain, or actively interfere with the allied officer’s off-books operation and risk an inter-service incident.

Beat 3c: The Resolution. The team’s choice produces one of three resolutions:

Resolution A: The Clean Acquisition. The team acquires the information (copy, transcribe, photograph) while allowing the move to proceed. The movers complete their contract; the target reaches their intended destination; D5 has the information; the allied officer’s off-books operation is undisturbed. The cleanest outcome. Requires the most tradecraft. Typically involves the Tradecraft Pool being used heavily.

Resolution B: The Interference. The team stops the move. The target is extracted by D5 instead. The allied officer learns, eventually, that their off-books operation was disrupted by D5. Inter-service consequences follow at the campaign level; the allied officer is now a potential opposition to future operations. The information is acquired, but at a significant attribution cost.

Resolution C: The Escalation. A firefight or chase develops. Attribution cascades. Multiple services are now aware of the operation. The target may or may not be acquired; the information may or may not be acquired; D5’s relationship with the allied service is damaged at a level the team will feel in future operations. The loudest outcome, and often the most dramatic. Sometimes the team chooses it; sometimes they fall into it.

Each Resolution feeds different Exfiltration consequences.

Act 4: Exfiltration

The Debrief. The team returns to Division 5’s station and debriefs. The handler, the same NPC from Tasking, receives the report. The handler’s reaction depends on which Resolution occurred:

After Resolution A: The handler is pleased but curious. D5’s analysts were both wrong, and the handler wants to understand why. The operation has generated a small campaign-level mystery about which allied officer was running the off-books operation and why their headquarters did not know.

After Resolution B: The handler is conflicted. The information is acquired, which was the mission; the attribution consequences are significant, which was not. The handler will face questions from D5 leadership about why the operation escalated to inter-service interference.

After Resolution C: The handler is exhausted. The information may or may not be secured; the attribution damage is real; a larger campaign arc has been opened about repairing the relationship with the allied service. The handler will go to bat for the team, but not indefinitely.

The Personal Beat. After the debrief, one operative (the player’s choice, or the GM’s if no one volunteers) takes the personal-consequence scene Act 4 calls for, in whatever form fits this character.

The Seed for the Next Operation. The Exfiltration debrief plants one of two seeds:

Seed A: The Allied Officer Identified. D5 leadership, through the post-operation investigation, identifies the allied officer who was running the off-books operation. The officer (NPC, GM-designated) is someone whose off-books work has crossed D5’s lane more than once. The next Operation (or one in the near future) will involve this person directly.

Seed B: The Private Contractor Identified. D5 identifies the private contractor firm. The firm has been taking contracts from multiple allied-service factions and is becoming, unambiguously, a problem. A future Operation will target the firm directly.

Both seeds can be planted; if only one is planted, it should be the one that interests the team more (read their energy at the table).

GM Notes for Concrete and Ashes

On the Core Complication. The operation’s core design is the Pivot from the assumed-hostile model to the off-books-allied model. Every beat of the operation should push toward that Pivot. An Intel Phase that catches the inconsistency early should be rewarded with a smoother Execution: the team that saw it coming gets to plan for it. An Intel Phase that misses the inconsistency produces a harder Pivot, which is sometimes more fun dramatically.

On the Two-Analyst Framing. The disagreement between Analyst Alpha and Analyst Beta is the operation’s central tension. GMs should not resolve the disagreement for the team; the team must choose which analysis to act on with incomplete information. This is a genre-defining decision, not a puzzle to be solved by more dice.

On the Reskin. The target, the information, the location, and the movers change from era to era; the structure does not. GMs running a multi-era campaign may reuse this operation as a recurring motif, with the personnel updated each time.

On the Personal Beat. Take ten minutes; ask the player what their character does after debriefing; play it through. This is where long campaigns earn their weight.

On Failure. Concrete and Ashes has no single failure state, in keeping with the Default Spy Outcomes matrix: every result is some mix of acquired information, attribution cost, and inter-service consequence. A team that “fails” to acquire the information clean still walks away having learned the movers were not hostile, with a seed for the next operation, and with a live team.

A Second Pass Through the Operation

A single operation can be run more than once, across different characters or different tables. Concrete and Ashes is built for this: the core structure rewards different approaches (the tradecraft-heavy team, the direct-action team, the Face-led recruitment approach), and the outcomes differ enough that a table that has seen one run does not necessarily know what a second run will produce.

GMs developing their own starter operations may find it useful to reverse-engineer Concrete and Ashes. The operation is built around a single Pivot, dressed with four acts, seeded with one or two hooks for follow-up. Any operation built on the same bones can be tuned, expanded, or re-imagined the same way.

Random Tables

Each of these tables produces a usable result in one minute or less. Roll the appropriate die; read the result; proceed.

What Went Wrong (1d10)

Roll when an operation needs to develop a complication during Execution.

1. The asset was also meeting someone else.
2. The safe house has been under observation for longer than anyone realized.
3. One of the team’s Legends has been flagged by an allied service’s routine screening.
4. A piece of Requisitioned equipment fails at a critical moment.
5. The target has a personal relationship with someone on the team (from years ago).
6. The opposition’s reinforcements are twelve minutes closer than intel suggested.
7. The asset has defected, again, to a third party the team did not know was involved.
8. The local police force has escalated to the operation for reasons unrelated to the operation.
9. A bystander has identified the team to a news outlet or journalist.
10. A team member’s Compromise Track has advanced for a reason the player will not share (GM private note).

Codename Generator (d20 + d12 + d10)

Division 5 codenames follow the institutional noun + color + number pattern (see Chapter Three): Wolf Red Seven, Heron Grey Four. Roll 1d20 for the Noun, 1d12 for the Color, and 1d10 for the Number. The pattern is loose; adjust results as taste fits.

Color (1d12): 1 Red · 2 Blue · 3 Grey · 4 Gold · 5 Green · 6 Black · 7 Amber · 8 Crimson · 9 Azure · 10 Jade · 11 Copper · 12 Silver.

Number (1d10): 1 One · 2 Two · 3 Three · 4 Four · 5 Five · 6 Six · 7 Seven · 8 Eight · 9 Nine · 10 Ten.

Example rolls: 1 + 1 + 7 = Wolf Red Seven. 4 + 3 + 4 = Heron Grey Four. 9 + 6 + 2 = Phoenix Black Two.

Asset Complications (1d8)

Roll when a cultivated asset’s behavior must deviate from the briefing.

1. The asset has a family situation they have not disclosed; their work has been pulled toward it.
2. The asset has already given something of value to a rival service; the team will learn this during the meet.
3. The asset has begun drinking heavily; today’s meet is the first the team has seen this.
4. The asset has moved financially beyond their declared means and cannot explain how.
5. The asset is asking to meet more frequently than operational doctrine allows.
6. The asset has begun a romantic relationship with someone whose service affiliation they do not know.
7. The asset has developed a fear, a person, a location, a pattern, that is shaping their work.
8. The asset is genuinely ready to walk away, and this is the meet where they will ask for exfiltration.

Station Rumors (1d10)

Roll for the informal rumor-mill texture at a D5 station or affiliated space. Use as Intel Phase color, debrief atmosphere, or operation-seed material.

1. The station chief has been recalled to London for a private conversation no one is supposed to know about.
2. An officer has stopped drinking, which is either a good sign or a catastrophic one.
3. An asset has been seen having coffee with a journalist from a well-known paper.
4. The D5 Quartermaster’s workshop has had two unscheduled deliveries this week that no one has a purchase order for.
5. An allied officer has started asking questions about D5’s current operations in the region.
6. A handler has been in the office unusually late for seven consecutive nights.
7. A rival off-books service has rented office space in this city for the first time in six years.
8. One of the station’s cleaners has been replaced; the new one does the job too well.
9. A senior D5 analyst has filed an internal memo that is reportedly being suppressed.
10. The station’s safe is suspected of having been opened by someone with authorization, for reasons no one can explain.

The Cleaner’s Arrival (1d6: Rare Event Table)

The Cleaner is a recurring Elite antagonist (Chapter Nine) who crosses all three eras. This table is rolled only when the GM suspects the Cleaner may be relevant to the current operation. Most rolls produce a no-arrival result.

1–3. The Cleaner is elsewhere; not relevant to this operation. 4. The Cleaner has recently been in the operation’s city. Traces are visible for an attentive Intel Phase. 5. The Cleaner is in the operation’s city now, working a different job. Paths may cross. 6. The Cleaner is working this operation, from a different side than the team.

The Weather (1d6)

Roll for a weather element that shapes the operation’s texture. Trivial-seeming but powerful for scene-setting.

1. Dry, sunlit, ordinary.
2. Overcast with intermittent rain; everyone is slightly damp and irritable.
3. Heavy rain; sightlines are short; footsteps muffled.
4. Cold snap; breath visible; gloves required; every surface hostile.
5. Fog; pursuit and surveillance both degraded; the city’s shape simplified to the nearest block.
6. Unseasonable weather (heat wave in November; snow in April); the anomaly itself is memorable.

Surveillance You Missed (1d10)

Roll when the GM wants to add a small post-operation surveillance finding to an attribution analysis.

1. A street camera the team did not know was there.
2. A delivery driver who happened to be passing at the critical moment.
3. A window across the street occupied by someone reading a book that might have been a cover.
4. A taxi that circled the block twice.
5. A bird-watcher’s camera: almost certainly a bird-watcher.
6. A parking attendant who pays closer attention than her job requires.
7. A pedestrian tracking app that captured one team member’s walking gait.
8. A neighborhood social-media group that noted an unfamiliar vehicle.
9. A child who saw something and will tell a parent who will tell an adult who will file a report.
10. A local police officer who made a quiet note on her personal phone.

The Dead Drop Complication (1d6)

Roll when a drop scene needs texture or complication.

1. The drop is loaded but damaged: the message is intact but compromised at the edges.
2. The drop has already been serviced; the message is gone and the team is late.
3. The drop location has been quietly moved since the last servicing.
4. The drop has been loaded, and an observer has been watching it for six hours.
5. The drop has been sabotaged: the message is there, but incorrect.
6. The drop is exactly as expected. The complication is in the message’s content.

The Unexpected Phone Call (1d6)

Roll when an operative’s phone rings, or their historical equivalent, at a moment the GM has not otherwise planned.

1. A family member calling with ordinary news.
2. An asset calling from an unexpected number.
3. A cover-identity contact calling with Legend business that must be answered in character.
4. An allied officer calling with a question that is too specific.
5. A wrong number: probably.
6. A voice the operative has not heard in years.

The Name in the Ledger (1d10)

A table for generating a name the Ledger’s historical entries refer to, for use in D5 institutional memory scenes.

1. Colonel Anthony Whitcombe (SW-era, died on operation 1944).
2. Miss Claudine Vigier (SW-era, Resistance liaison, retired to Provence 1946).
3. Konstantin “Kostya” Alekseyev (LD-era defector, relocated under Western protection 1973).
4. Margarethe Holz (LD-era, East German asset, exfiltrated 1983).
5. Sir Edward Ramsay (LD-era station chief, controversial legacy).
6. Mariam Qadri (NS-era analyst, whereabouts currently unknown).
7. Dr. Jonah Silver (cross-era Quartermaster figure, subject of several Ledger entries).
8. The Handler Whose Name Was Redacted (LD-era, referred to only by codename).
9. Lieutenant-Colonel George Fenton (SW-era, posthumously decorated).
10. The Current Director (a codename; the identity rotates).

The Meet That Went Wrong (1d8)

A historical meet: usable as Ledger precedent, a flashback scene, or a narrative beat for an operative with deep campaign history.

1. Vienna, 1967. The asset arrived, the handler arrived, the opposition arrived third. The handler extracted; the asset did not.
2. Lisbon, 1943. The meet was in a café, the message was verbal, and the opposition had bribed the waiter.
3. Berlin, 1978. Both sides arrived, both sides ran counter-surveillance, and both sides realized simultaneously that a third party had photographed both.
4. Dubai, 2017. The meet was at a hotel, the asset was under duress, and the handler ran the meet anyway to protect a deeper operation.
5. Belgrade, 1996. The meet was in a parking garage, and the garage collapsed mid-meet for reasons unrelated to any intelligence operation.
6. Havana, 1974. The meet was by chance, two operatives from opposed services recognized each other across a crowd, and became a private conversation neither ever formally reported.
7. Istanbul, 1942. The meet was a dinner, the restaurant was watched, and the meal lasted four hours before either party moved.
8. Paris, 2004. The meet was a phone call that was supposed to be untraceable and was not.

On Building Your Own Operations

A short set of principles for GMs writing operations outside the hooks and starter in this chapter.

Start with the Pivot. Every good operation has a single moment where the team’s model of the situation changes. Write the Pivot first: the one reveal, the one turn, the one piece of information that re-frames everything. Then work backward to figure out what Tasking should say, what the Intel Phase should discover, and what Execution should produce.

Pick the target carefully. The target is what D5 wants. It is not necessarily the operation’s most interesting element, the Pivot, the asset, the allied officer whose off-books operation complicates things are usually more interesting, but it needs to be clear, specific, and acquireable. Vague targets produce vague operations.

Give the team a choice at the end. The best Executions end on a choice the team must make under time pressure, which asset to protect, which Legend to burn, which rival service to expose. Build the choice into the operation from the start; it is what the team will remember.

Name your NPCs. An operation with a named handler, a named target, two named assets, and one named opposition officer is an operation that has populated its world. The names do not have to be elaborate, three-syllable real-sounding names work fine, but they must be consistent across sessions. A handler named in session one should have the same name in session twenty.

Consider the attribution consequences in advance. Every operation generates attribution signatures. A GM who has thought through which services will know what after this operation is a GM who can run the consequences coherently in the next operation. This is not extra work; it is the campaign’s continuity.

Plan for three kinds of team behavior. The tradecraft team will run the operation patiently; the direct-action team will run it violently; the face team will run it through social channels. A well-designed operation supports all three, with different difficulties and different outcomes for each. Do not design an operation that requires one approach: the team will find another, and the GM will be caught unprepared.

Leave room for player invention. The best sessions are the ones where a player comes up with something the GM did not plan: a cover the Face proposes at the last minute, a gadget the Quartermaster happened to bring for exactly this scenario. A GM who welcomes these inventions and adjusts the scenario to accommodate them produces better operations than a GM who holds the pre-planned script.

Revise after play. An operation, after it has been played once, can be run again, but will benefit from revision. The beat that did not land should be cut; the NPC who captured the table’s attention should be expanded; the Pivot that came too early or too late should be re-pitched. Keep your operation writeups in a folder; come back to them.

Use the scaffold. The four-act structure, the five-scene Intel Phase, the three-beat Execution, the short Exfiltration: these are not constraints but supports. A GM writing operations can plug new content into the structure and know the session will have the right shape.