So, There have been a lot of questions about the Umbral Choir (a faction I've been waiting on for a very long time) and hacking specifically. I've decided to do my best to put together an easy to follow (if lengthy) guide. A single disclaimer to begin: I am Valadeus, I am by no means an expert player nor do I claim to be but I do like to share what I've put together with others so that all of us can benefit as a community. This guide is merely my own discoveries and I will edit/change things as I discover or learn more. Without further ado, I give you:

Do You Even Hack, Bro?!

A Hacking Guide by Valadeus

The Basics

Hacking is essentially information warfare (or cyber warfare) in Endless Space 2 and it's important for you to keep that in mind. The basic rule of hacking is you want to get as much information and benefit as you can and give as little as possible to everyone else. There's a lot of things to consider and the whole system can be a little daunting at first so let's dive in and start with the basics. 

Initiating the Hack

To initiate the hack simply bring up the hacking interface by clicking on the "Scan" button at the top middle of the screen (bound to spacebar by default). This will bring you to this window:

We'll go over each section of this window in detail but I wanted to cover one part that isn't showing in this example. In the upper-right corner of this interface will be a window with your recent hacking events. These events are clickable and will center the camera on the node those events reference. It's important to frequently check this window so you can make sure not to miss anything. Moving on!

The first part of this window you'll want to pay attention to is the Hacking Console, located at the top just left of the center. 

It's a simple console, there are only three buttons. 

The first button is the Initiate Hack button which begins a Hacking Operation. Simply click this button, click on a friendly node to set it as your starting point and then move it along the path you want until you click on your destination system. Pro tip: Clicking on each system along the way will establish waypoints which force the hack to go through those systems, the game will try to create the shortest path possible for you by default but when hacking it is important to remember that "the shortest path is not always the best path."  We'll go over routing and why it's important when we get to the Hacking Calculations and Results section near the end. For now, just know that this is how you start all Hacking Operations. 

The second button on this console is the Defensive Program button. Clicking on this button will bring down a list of all Defensive Programs you have available. To place one, simply select the one you want to place, select a friendly node and you're done! 

The third button on this console is the Offensive Program button. Clicking on this button will bring down a lsit of all Offensive Programs you have available. These are a little more complicated to use so we'll go over them in detail in the Hacking Modifiers section. For now, just know that this is what the third button does. 

We're now done with the console and moving on to the next window you'll want to draw your attention to, the Bandwidth Bar window: 

This window has a few more sections to cover and it changes frequently so we'll just touch on each area briefly here. The first area is the Bandwidth Allocation Bar which shows you the total amount of bandwidth you have available and how it's currently being used. We'll go over how this bar changes in a few paragraphs but for now just know that this is where it's located. 

Below that you'll see the Hacking Operations window which will list your currently active Hacking Operations, where they start, where they end and how many turns remain on the operation. One important thing to note is that a red arrow indicates an operation that has run into opposition (an opposing Defensive Program) and is being traced. 

Below that will be the Trace Operations section if you are currently tracing an opponent's Hacking Operation. These will appear automatically when someone's Hacking Operation runs into your Defensive Programs and will have the system where the trace started and a few question marks until it reaches the source point (if it reaches), when then triggers a dialogue option on how to proceed. We'll go over that later. 

The last part of the window is the Sleepers section. This will list your number of Sleepers, show a graph detailing how many you have in each empire and a list of all siphoned resources your Sleepers are providing you (if any). I'll go over Sleepers in a little more detail in the Hacking Results section. For now, this is all you need to know about the Hacking Interface!

Hacking Modifiers (Backdoors, Defensive Programs, Offensive Programs, Bandwidth, Routing and Tracing)

Hacking Operations have several modifiers that will determine their success or failure. They're listed in the lengthy title of this section (you're welcome) with the exception of one: your empire's hacking speed. However since this one is passive and can only be modified by research, I won't bother going into detail. Suffice it to say "faster is better" and researching the appropriate technologies to increase your number of available operations and empire hacking speed should be a given if you plan to make use of hacking. 

Backdoors

Backdoors can be created on any "hostile" node, hostiles nodes are nodes owned by Minor Factions, opposing Major Factions and the Pirate Faction. They are created by hacking the node and selecting the "Establish Backdoor" option. Backdoors serve two primary functions: they provide you with a point of origin for Hacking Operations should you not wish to start on your own friendly node (say to bypass that really pesky Pirate Faction node that keeps tracing you) and they provide a +5% hacking speed to all Hacking Operations performed on adjacent nodes to them. (Adjacent by hacking terms, these are not defined by starlanes but are any system that is one hacking jump away from the backdoor). 

A few things to remember about backdoors: They can be destroyed by an opposing hacking operation, they can be destroyed by a trace operation, they can be destroyed by a Lockdown or Firewall program owned by another player. They also permanently allocate 5 bandwidth for as long as they remain open. Use them wisely. 

Defensive Programs

Defensive Programs are programs that you place on friendly nodes (nodes owned by you or an ally). They permanently allocate an amount of bandwidth depending on the program and any variables involved and will remain active until you manually disable them, lose control of the node or exceed your bandwidth allocation. There are five defensive programs and I will go over them each in detail. 

Encrypt - This is the basic defensive program that every empire starts with, it also happens to be the most generally useful. It slows all opposing Hacking Operations on this node by 50% and will trigger a trace operation. I strongly recommend placing these on any system you suspect is going to be either the target of or a waypoint in a Hacking Operation. 

Interrogate - This program increases the bandwidth cost of all opposing offensive programs by 30%. This can be very useful for keeping your opponent from using Accelerator Program or Divert Program if they're pressed for bandwidth but is very situational because you don't know the bandwidth availability of your opponent. I don't recommend using this program much unless you have spare bandwidth and want to protect a particularly sensitive node (such as your capital). The exception is if you can couple this with Encrypt and your opponent is passing through several of your nodes, you can quickly drain them of bandwidth if they hit this defensive combo on several of your nodes. 

Lockdown - This program simply prevents the creation of backdoors on this node. Very situational. Useful if you think your opponent is going to try to create backdoors to bypass your defensive programs elsewhere but generally not recommended since its use is very limited and easily worked around by a skilled hacker. 

Firewall - One of two 30 bandwidth programs, this program makes the node it is on immune to several Hacking Operation results which are listed in its tooltip. Due to the bandwidth cost of the program it is not recommended for widespread use and is best reserved for systems that are in danger of military invasion (to block the Jam Commands result) or to create a buffer around your capital system so opposing hackers can't create backdoors for easy access to your capital. Use sparingly and wisely. 

Track - The other 30 bandwidth program and, in my personal opinion, the most interesting of all defensive programs. It's not really a "defense" but is more of a surveillance tool This program will not trigger a trace operation but will instead alert you when a Hacking Operation targets or passes through the node it is on and then tracks the movement of that operation to its conclusion. This can be extremely useful for gathering information on enemy hacking movements and which systems they are targeting making it easier for you to find Sleepers, track down backdoors and establish defensive programs on the right systems. Recommended for use on systems that aren't extremely sensitive to protect and preferably are likely to be waypoints to more sensitive systems. 

Offensive Programs

Offensive Programs are tricky to understand but hopefully this will help. These programs must be placed on hostile nodes, consume an amount of bandwidth for as long as they are active and are only active for a single Hacking Operation. There are four offensive programs:

Accelerator - This is your bread-and-butter when hacking, it increases the hacking speed of your Hacking Operation by 30%. It's important to understand that, like all programs, this program only affects the specific node it is placed on and has no effect on other nodes or the travel time between nodes on this Hacking Operation. The primary use for this program is to beat a trace operation. You get notified that your Hacking Operation has triggered a trace operation? Place an Accelerator program on the node in question and finish that operation quickly. If used on every hostile waypoint in an operation, it can reduce your overall operation time by a couple of turns depending on the length of the route. 

Piggyback - This program reduces the bandwidth cost of other offensive programs used on the same node as itself. If you're really pressed for bandwidth and you are getting into a program fight over a specific node then this might be prudent to use but this happens extremely rarely. You are unlikely to get into a situation where you will use enough offensive programs on a single node to make much use of this program. It is best used as a counter to the Interrogate program if you notice your offensive programs are costing a bit more than you'd expect. 

Overload - This program increases the bandwidth cost of defensive programs placed on this node. It is extremely situational and has absolutely no effect if your opponent isn't pressed for bandwidth. However, since defensive programs are permanent and therefore always drain bandwidth, this program can actually cause a bandwidth breach and force your opponent to manually shut down their defensive programs or have them randomly shut down until they are back within their allowed bandwidth. It's use is largely dictated by chance so I tend to avoid this program personally. 

Divert - Perhaps one of the most confusing and misunderstood offensive programs, this progam allows you to change the destination node of your current hacking operation. It's most efective use is when you are attempting a Hacking Operation to one system and run into defense unexpectedly in a waypoint before your destination. If the subsequent trace operation would finish before your Hacking Operation does, your ownly real recourse is to either let the trace finish (giving away your hacking source and suffering penalties), cancel the Hacking Operation (suffering a loss of 30 bandwidth for 5 turns) or use a Divert program to relocate the destination to a much closer destination (perhaps the one that is currently tracing you?) thus allowing you to finish your operation before the trace finishes. Situational but can be a major life saver. 

General Program Usage Rules

Remember that all programs only affect a single node, whichever node they are currently placed on. They have absolutely no effect on any nodes before or after their position on a hacking or trace operation and have no effect on the empty space between nodes!

Trace Operations are not affected by defensive programs. There is no way to slow down or hinder a trace operation except by the routing of your Hacking Operation!

Your empire's hacking speed has no effect on the travel time of your hacking operation between nodes, it only affects the speed at which you hack nodes. 

Bandwidth

Simply put, bandwidth is a resource used in hacking. The most important things to note: 

Hacking Operations cost 0 bandwidth! You can begin a Hacking Operation even if all of your bandwidth is currently allocated (this is not recommended, but it's possible)!

Defensive Programs permanently allocate bandwidth until you manually disable them. 

Offensive Programs allocate bandwidth for a single Hacking Operation and then shut down afterward. 

Backdoors permanently allocate 5 bandwidth as long as they remain open.

You can cancel Defensive Programs at any time to free up their bandwidth (you cannot cancel a Defensive program that has triggered a trace operation until that operation finishes).

You cannot cancel Offensive Programs manually. They will deactivate when the operation finishes and not a moment sooner. 

You can close a backdoor whenever you feel like it. Opening it again is another matter.

Of note, the bandwidth bar uses three colors: white, red and blue.

White bandwidth is neutral bandwidth allocation it indicates bandwidth allocated for backdoors and bandwidth penalties (such as canceling an operation). If you're Umbral Choir then your beacons will also be indicated by white bandwidth. 

Blue bandwidth is bandwidth allocated to defensive programs.

Red bandwidth is allocated for correctly placed and currently active offensive programs. If you place an offensive program and the bandwidth bar does not have a red indicator then you have placed it incorrectly and it is currently not helping you. See below: 

In order: Neutral Bandwidth, Defensive Program Bandwidth, incorrectly placed (inactive) Offensive Program Bandwidth, correctly placed (active) Offensive Program Bandwidth

Routing and Tracing

A subtle but ultimately important part of your Hacking Operation is the path you choose to take. I stated at the beginning that the shortest path is not always the best path when it comes to hacking. Now I explain why: trace operations. Remember that a trace operation must follow the path of your Hacking Operation all the way back to the source in order to shut down your hack. The longer your path is, the longer the trace operation will take to succeed. So while it may be tempting to take that three turn path to the opponent's capital city through your backdoor, they're most likely going to trace it back, shut down your operation and destroy your backdoor all at once. Instead, take the 18 turn route through several systems so your oponent has to trace the whole operation back to the start. 

Remember that a trace operation begins when your Hacking Operation starts hacking the node a defensive program is on. Your hack continues and if you can finish the hacking operation before the trace reaches the source of the hack then you complete the hack with no ill effects. Below is an example of routing and how to use it correctly. In this example we have a system with several available nodes. Our hacker is attempting to hack the capital of his opponent and has a couple of backdoors nearby that he could quickly use to reach the capital in a few turns, however the capital is most certainly defended and the trace will complete long before the hack completes. Here is an example of the system: 

Here is an example of a bad path that will complete in 4 turns but will ultimately be traced and shut down. 

Here is an example of a good path that will take 18 turns total but will complete long before the trace completes. Namely it passes through no hostile nodes except the capital so it won't encounter any early resistance and the path is long enough that the trace will take at least 7 turns to complete, making it so that the hacker will complete the operation long before the trace completes. 

This is your primary weapon against trace operations. Not your offensive programs, not your hacking speed, not the mind games you want to play in chat with your opponent. This. Remember shortest path is not always the best path!

Hacking Results

I'm not going to go into detail about the various hacking results of each different kind of operation (hacking Pirates, Minor Factions, Major Factions, Capitals and Sanctuaries all provide different options). Play around with them a bit and find what suits your needs, I can make general suggestions below:

Hacking Pirates is basically only useful for establish backdoors so you can go around them next time or for stalling a fleet arrival if you're trying to besiege them. 

Hacking Minor Factions is generally going to be for quickly building relationship with them through the "Improve Image" function if you plan to eventually assimilate them or simply want to have their passive bonuses as quickly as possible (or establish yourself as sovereign so no one else can). You may occasionally find yourself using the "Impersonate Ambassador" function to try and usurp sovereignty from another faction. If you're already the sovereign or don't care about assimilation or being the sovereign then "Hack Economy" is arguably the strongest hacking result in the game. 

Hacking Major Faction cities is best done to test defenses (see if it starts a trace), establish a backdoor or embed a Sleeper to get more information. I'll go into Sleepers in a little more detail in the next section. Beyond that, the single most effective result available to you is "Jam Commands" when you plan on invading a system, the amount of time and manpower you'll save by forcing your opponent to hurt themselves cannot be overstated. 

Hacking Major Faction capital cities has many uses but is one of the hardest things you can do in hacking, assuming you face a competent opponent. Stealing technology, abducting Sleepers or Jam Commands are all useful. The rest sound a lot better than they actually are. 

Hacking Sanctuaries is for the sole purpose of destroying them. 

Sleepers

Sleepers are an excellent source of information and they should be used largely for that purpose and that purpose alone. If you get your Sleeper count to the benchmark of 5 or more to start siphoning resources it is important to know that you are actually siphoning those resources which means you are literally taking them from the empire. An observant opponent will notice this suddent decrease in their FIDSI production and, if they mouse over the tooltip in the right system, will see some very humorous but not-so-cleverly disguised reasons for why they are losing resources. Examples range from anything from mitigating bad press to system-wide beautification initiatives to the establishment of meditation chambers in symphony halls. These humorous explanations for why they are losing resources will also change every single time they mouseover the resource and all read like things you'd find on poorly written financial ledgers. 

Because of that, I strongly recommend leaving your Sleeper count low until you can readily and safely hack several systems in the same empire at once to spread Sleepers out over the Empire making them harder to track down. Use Sleepers largely to track what your opponent is building, what their FIDSI and approval economy looks like, what their system defenses look like and what (if anything) is in their hangars. 

Putting it all together (conclusion)

Hacking is a really fun system, even if it's not your cup-o'-tea then learning to defend against it will be prudent. Play around with it, experiment, learn what works and doesn't work and most imporantly have fun with it! 

I will go into the specifics of how hacking changes for the Umbral Choir in my Umbral Choir guide which I will try to have posted tomorrow, I will put a link to that guide here when it is complete. 

For those of you who want a TL;DR: 

Offensive programs only work on hostile nodes, only last for one operation and only affect the node they are on. 

You cannot stop or hinder a trace in any way other than routing through several systems to force the trace to take longer. 

Read the guide for anything more specific. 

Thanks and I hope this helps at least one person! 

If you have questions, want me to experiment with something or would be interested in seeing your question(s) answered in real-time, feel free to ask me for a stream session dedicated to experimenting and answering questions. 

~Valadeus