Government gamers warned of Pokemon security threat
Electronic spy agency says GPS in game could allow criminals to track employees
OTTAWA— Canada’s spies are guarding against a new threat to operational security: Pokemon.
Canada’s electronic spy agency issued guidelines for spooks and employees playing Pokemon Go, a popular augmented reality game for mobile devices based on the hit 1996 Nintendo game.
The game uses a phone’s GPS and camera to catch and battle Pokemon in the real world; players collect, train and fight Pokemon at “Pokestops” and “gyms” attached to locations such as churches and parks.
But because the game requires location and camera data to play, it poses a risk to people who would rather not be tracked: like employees of the Communications Security Establishment (CSE), Canada’s powerful electronic spying agency.
The guidelines, obtained by the Star through an access to information re- quest, were circulated by CSE’s American counterpart, the National Security Administration (NSA). They recommend a number of steps for spooks to avoid detection while training to be the very best Pokemon master.
“Note that the information (used) by the game in the course of regular play could be used to deduce pattern of life,” the unclassified memo reads.
For instance, if you check into the same Poke-stops while walking your dog or commuting to work, that information would show times when you’re likely not home or what bus routes you commonly take.
The agency also recommended creating a dummy Google account, using a fake name not associated with your other online activities, like “Professor Oak.” Trainer names should likewise avoid using real names or biographical information, such as birthdays.
CSE also noted that camera data could be used to deduce location — if you caught a Pokemon in front of a street sign or recognizable landmark, for instance. The agency pointed out, perhaps with a little disappointment, that there were no Poke-stops or gyms at its new multibillion-dollar headquarters in Ottawa. But CSE still recommended not catching Pokemon when in restricted areas.
While this is all good advice for spies in the field, it’s also something to keep in mind for regular users of augmented reality games that make use of mobile device data. While those games are still relatively new, Pokemon Go’s massive overnight popularity suggests they’re with us to stay. When asked for comment, a spokesperson for CSE said the agency takes the “operational and personal security” of its employees seriously.
“With this is mind, CSE takes advantage of every opportunity, including the rise in popularity of Pokemon Go, to share security information and reminders to help ensure that our employees conduct their activities in a manner that does not put themselves or CSE at risk,” Ryan Foreman wrote in an email last week.
“We would also like to point out that we are confident that Team Rocket would never pass a CSE security clearance process.”