Catching All of Your Data

Now you can read us on your iPhone and iPad! Check out the BTRtoday app.

Despite spouting resistance to my friends who had downloaded Pokemon Go following its release in early July, within a week I was hooked. The game quickly became one of the most frequented applications on my phone, and after initially using my 9-year-old nephew as an excuse to play, soon enough I was off catching ‘em all without him; taking advantage of my office building’s distinction as a PokeStop, I compared my collection with anyone that would listen.

One fateful morning, a few weeks after my initial download, destiny met me right in my own home. After waking up the #millennial way by dutifully and immediately checking my email, Twitter, and Facebook, I opened up Pokemon Go to see if any wayward creatures had stumbled onto my block.

Within seconds, a vibration—a wild Machoke appeared! With the augmented reality feature switched on, the angry gray humanoid stood directly on my mattress, daring me to catch it. Panicked, I flicked Poke Ball after Poke Ball at him, but it was all for naught—after escaping my third toss, Machoke disappeared in a huff of white smoke, and I was left staring at my unkempt bedsheets through my phone.

I proceeded to tell everyone I knew about the encounter and how close I’d come to catching one of my favorite Pokemon. He was right there, I kept saying, right in my own bed, just inches away from me! How could I have blown this so badly?

The disappointment of the chase had left me weary, but once I navigated the throes of those deep-seated Pokemon-based emotions, I realized the obvious—it hadn’t been a chase at all. The Machoke had simply popped up right in front of me, so close I could see my own bare feet through the camera.

That was the day I started thinking about Pokemon Go differently. Like many, I’d read the stories that began cropping up soon after its introduction—burglars using the game’s geolocation feature to target innocent players in Missouri, an 18-year-old Guatemalan kid shot to death after breaking into a home while playing. There were dozens of stories like this, coupled with think-pieces exposing clear flaws and asking pertinent questions about Pokemon Go’s overarching design, chief among them: can an imaginary world exist, in plain and seemingly tangible view, inside of our real one?

Aside from the obvious threat of bodily harm that could result from playing—so obvious, in fact, that Pokemon Go developers added a warning that displays each time the game is opened—the presence of augmented reality presents a new frontier of privacy concerns, mainly to do with personal data on smartphones.

While incredibly useful—and at his point, almost impossible to live without—smartphones are treasure troves of information and data for third party advertisers and, of course, the government. Parker Higgins, activist and director of copyright activism for the Electronic Frontier Foundation (EFF), explains that location-based applications like Pokemon Go only exacerbate data plunder, with geolocation serving as the foundation upon which such games are built.

“If you keep the app open, you give another third party a pretty constant flow of your location and activity,” he says. “That presents obvious problems, and depending on what your threat model is, the fact that a private company has all that data, whatever they’re doing with it, that can be problematic.”

The sheer amount of personal data is mountainous, given the more than 20 million daily users Pokemon Go saw in its earliest days of existence. That total has leveled off, but nonetheless leaves a number of questions about data transference within the game unanswered.

“Even if the data could be transferred securely from you to Niantic or whoever the game operator is, which is a big if, it’s still a lot of data to be moving,” Higgins says. “When you have that much personal data, and data that’s that sensitive, you start to get concerned about how well they treat it, how they hold onto it, and whether anybody else has access.”

The current version of the Pokemon Go doesn’t allow for player-to-player communication or trading, quelling initial fears and overblown reporting about the threat of personal tracking—but future versions of the game very well could.

And that’s not even touching the potential hijinks Google might be up to behind the scenes. For the uninitiated, Pokemon Go’s geolocation feature is based on information from Google Maps, providing players with a strikingly accurate layout of every city block, waterway, bridge, tunnel, and highway imaginable. Google’s armada of satellites and self-driving camera cars have captured almost the entire world at street level. If you can see it when you step outside, odds are Google Maps has it locked down.

Now put on your tinfoil hats and step inside the loony bin with me for a moment: could it be possible for Google to use Pokemon Go’s augmented reality feature to map the inside of our world—buildings, businesses, churches, homes–as thoroughly as it’s mapped the outside?

“If it’s not yet, that’s absolutely within the realm of technical possibility,” Higgins says. “That’s the sort of thing you would expect to show up in the privacy policy, and incidentally I would expect the data you’re getting from the camera in this sense isn’t super useful. But yes, that sort of thing could certainly be incorporated into a larger dataset.”

In fact, in terms of technical possibilities, Higgins believes we’re nowhere near the limit of privacy and safety concerns surrounding augmented reality. Perhaps the most telling aspect of Pokemon Go’s popularity is its ability to affect people’s behavior, to convene in large groups at particular locations at random times. Just one viewing of players flocking toward a wild Charizard in New York City’s Central Park puts the magnitude of this power into perspective.

“The ability to send a bunch of unwitting volunteers to a particular place and give them instructions is sort of an unusual one. We haven’t really tested that,” Higgins says. “It used to be very hard to convene mobs of people, and now it’s happening as emergent behavior. That becomes very interesting from a privacy perspective, even if it’s not privacy related.

Pokemon Go may well exist as an aberration in terms of its popularity, as the gaming franchise has existed for a quarter-century and experienced outsized success even when its main medium was trading cards. It’s hard to imagine any other game or application catching on as fiercely and quickly. Its benefits lay in encouraging people to get outside, interact with other players, and remain physically active. Those pursuits are noble, and were surely well thought out by the game’s designers.

Fear is a powerful emotion, and by no means is this an attempt to stoke it, nor a dissuasion against people doing things they enjoy. But as millions continue their pursuit of Pokemon across the globe, privacy and safety anxieties will remain, growing louder and clearer with each new game update.