I Told You Not to Bring Pokémon GO Near My Office

Rich Washburn
21 hours ago
11 min read

Pokémon NO!

20:29

The game was never the interesting part. The ability to move millions of sensor-equipped humans through physical space was.

When Pokémon GO exploded across the planet in the summer of 2016, I issued what some people considered a slightly excessive workplace policy: Do not bring that shit near me. Not near my desk. Not inside my office. Preferably not within my zip code.

People thought I was being ridiculous.

To be fair, they were seeing a wildly popular game in which adorable imaginary goblins appeared on sidewalks, in parks and occasionally somewhere near a dumpster behind a Chili's.

I was at the height of my digital-forensics career. I was seeing something else. I knew the John Hanke story. I knew the Keyhole story. I knew the In-Q-Tel story. I knew how Keyhole became Google Earth, how Hanke went on to lead Google's Geo products, and how Niantic emerged from inside Google with a platform built around mapping, location and augmented reality. More importantly, I had spent years learning that the stated purpose of a system is rarely the only purpose worth examining.

So while everybody else was trying to catch Pikachu, I was asking a different question:

What can the person controlling this platform cause its users to do?

That was the part that bothered me. And now, almost a decade later, the answer is sitting out in the open.

The Pokémon Were Database Entries

Let us begin with the most obvious technical observation imaginable: The Pokémon were not real. I apologize to anyone who has spent the last ten years maintaining hope.

There was not actually a Charizard hiding behind the synagogue. Pikachu was not waiting at the cemetery. Nobody at the Holocaust Museum had misplaced a Squirtle.

The creatures existed as database entries associated with locations and game conditions. That matters because whoever controls the application controls the fictional layer placed over the physical world. The platform can determine that something desirable appears at a particular coordinate. It can assign scarcity and value to that object. It can determine when it appears, how long it remains and what a player must do to acquire it. That creates an extraordinary capability.

You can manufacture perceived value at a physical location and cause real people to travel there voluntarily. Not one person. Potentially thousands. Each carrying a network-connected device equipped with GPS, cameras, microphones, accelerometers, gyroscopes, magnetometers, radios and considerable processing power. The player thinks he is hunting a cartoon animal. The system sees a mobile sensor package arriving at a coordinate.

That does not prove Pokémon were deliberately placed to surveil particular buildings. There is no public evidence that Niantic secretly dispatched players to synagogues or government facilities as part of an intelligence operation. Many early Pokémon GO locations were inherited from Ingress portals and crowdsourced points of interest such as churches, monuments, public art and historic sites. That distinction is important. But it does not erase the underlying capability.

Pokémon GO did not merely observe human movement. It demonstrated that software could manufacture human movement.

That was the real breakthrough.

Surveillance Was Only Half the Loop

Most privacy discussions look at information flowing in one direction:

Person → phone → platform

The application collects your location. It records your activity. It knows where you went and how long you stayed.

That is ordinary surveillance.

Pokémon GO added something more interesting:

Platform → incentive → person changes behavior → phone gathers new information

That closes the loop. The software is no longer merely watching the world through its users. It is helping arrange where those users are in the world. That is behavioral tasking.

The platform does not need to order you to inspect a location. It gives you a reason to go there that feels like your own idea.

There is a rare Pokémon over there.

There is a gym to capture.

There is a reward available if you walk another block.

There is a scanning task at that statue.

There is a fictional object placed inside a digital layer that causes a physical human to pick up a sensor array, travel to a coordinate and point the device toward the environment.

That is elegant. Possibly horrifying. But elegant. As a cybersecurity professional and proud card-carrying member of the ethically questionable humor society, I feel morally obligated to admire the architecture while objecting violently to its implications.

The Hanke–Keyhole–In-Q-Tel Lineage

This concern did not begin with a vague suspicion that phones are creepy. John Hanke co-founded Keyhole, the company that developed EarthViewer, an early three-dimensional geospatial visualization platform. In 2003, In-Q-Tel — the venture-capital organization established to support the technology needs of the CIA and wider U.S. intelligence community — announced a strategic investment in Keyhole. The announcement was not coy about the technology's value. In-Q-Tel praised Keyhole's ability to stream massive geospatial datasets and place intelligence within a powerful geographic context. The release also discussed the technology's potential value to the CIA and the National Imagery and Mapping Agency, now known as the National Geospatial-Intelligence Agency.

Google acquired Keyhole in 2004 and transformed EarthViewer into Google Earth.

Hanke then led Google's Geo organization, overseeing products including Google Earth and Google Maps. Niantic began as an internal Google project before becoming an independent company. None of that proves a conspiracy. It does, however, establish provenance. This was not a group of traditional game developers who accidentally discovered maps. This was a geospatial technology lineage that eventually discovered games. That is a very different sentence.

The World Became the Game Board

Pokémon GO succeeded because it placed a digital world over the real one. That sounds innocent enough. But once a platform can assign digital meaning to physical coordinates, the physical world becomes programmable. A park can become a gathering point. A church can become a gym. A storefront can become a PokéStop. A temporary event can change the movement of thousands of people in a city.

The creatures may be imaginary, but the resulting human behavior is entirely real. This is where the game starts to resemble the "arms race of tiny things" I once wrote about after watching a man paste malicious QR-code stickers over legitimate ones. The sticker was tiny. The behavioral exploit was enormous. The code did not physically force anyone to open a website. It presented a small, familiar symbol that caused the user to complete the operation voluntarily. Pokémon GO worked through a similar layer of digital trust.

The platform supplied the signal. The person supplied the transportation, power, camera, network connection and curiosity. You do not have to break into the sensor.

You make the human carry it where you want it.

Many Angles Make a World

One person standing near a building with a phone gives you a limited observation.

Multiple people arriving from different directions, at different times and under different lighting conditions create something else. They create a mosaic.

The exact technical language here is not literally interferometry, although that remains a useful analogy. In computer vision, the relevant concepts include multi-view geometry, photogrammetry, structure from motion, visual-inertial odometry and sensor fusion.

One image gives you a flat projection. Images captured from different positions allow software to infer depth, scale, orientation and three-dimensional structure. The value does not increase only because there are more images. It increases because there are more angles. A hundred photographs from the same position may add less useful information than one additional image taken from behind the object.

Each viewpoint helps resolve uncertainty hidden from the others. The phone also knows more than what the camera sees. Depending on the application, device permissions and implementation, it can associate imagery with location, direction, movement, orientation, altitude and time. Once enough overlapping observations are assembled, you are no longer collecting pictures. You are constructing a machine-readable representation of physical space. And that is exactly where Niantic ultimately went.

Then They Asked Players to Scan the World

It is important not to rewrite history. Simply walking around playing Pokémon GO in 2016 did not automatically train the Large Geospatial Model Niantic later announced. Niantic explicitly says that its player-contributed scanning feature was optional: users had to visit a specific public location and deliberately initiate a scan. Merely walking around playing the game did not train the model. That is a meaningful limitation. It is also not particularly comforting.

Once players had been conditioned to accept a game built around location, camera access, movement and real-world landmarks, asking them to perform an environmental scan in exchange for an in-game reward was not an enormous behavioral leap. The sensor network was already deployed. The trust model was already established.

The reward loop already worked. The company merely needed to ask some users to point the phone around for a few seconds.

Niantic later stated that user-generated scans from Pokémon GO, Ingress and Scaniverse contributed to its Large Geospatial Model. Niantic Spatial now describes that model as being trained on one of the world's largest collections of real-world spatial imagery, citing more than 300 million user-contributed scans and 30 billion posed images. Its products promise high-fidelity digital twins, precise positioning and the ability for machines to reason about physical space. That is a long journey from throwing a red-and-white ball at a cartoon rat. But it is not an illogical one. It is the same fundamental business viewed at progressively higher resolution: Map the world. Localize within it. Understand it. Make it navigable to machines.

The Game Was Sold. The Spatial Intelligence Was Not.

In May 2025, Scopely completed its $3.5 billion acquisition of Niantic's game business, including Pokémon GO, Pikmin Bloom and Monster Hunter Now. The gaming operation went one way. Niantic Spatial went another. That separation is revealing, although it should not be overstated. It does not prove Pokémon GO was secretly created as a disposable intelligence-gathering front. Companies routinely separate business units, sell mature products and retain technologies they believe have greater long-term potential. But the transaction tells us what the marketable game was worth — and what Niantic considered important enough to continue building separately. The Pokémon were valuable. The ability to give machines spatial understanding of the real world may be considerably more valuable.

Niantic Spatial now markets capabilities for robotics, autonomous systems, industrial environments, defense and intelligence. Its website does not hide this behind a Snorlax. "Defense and Intelligence" is right there in the navigation menu. Subtle.

And Then Came GPS-Denied Military Navigation

In December 2025, Niantic Spatial announced a partnership with Vantor to create an integrated air-to-ground visual-positioning system for environments where GPS is unavailable, jammed or spoofed.

The proposed system combines Niantic Spatial's ground-based Visual Positioning System with Vantor's aerial positioning technology. Cameras from drones, vehicles, augmented-reality glasses and field assets can be aligned within a shared coordinate system, allowing people and machines to determine their positions and coordinate without relying entirely on satellite navigation. Niantic Spatial describes its VPS as using ground-, air- and space-derived two- and three-dimensional data, onboard sensors and real-time computer vision to generate precise location estimates in GPS-challenged and GPS-denied environments.

Let us pause here and appreciate the arc. A company descended from an intelligence-funded three-dimensional mapping platform builds a game that teaches millions of people to navigate toward fictional objects placed on top of physical geography.

It later invites some of those users to scan public locations. Those scans help train spatial models. The game business is sold. The spatial business continues. That spatial business then partners to develop positioning technology for autonomous systems, drones, vehicles and personnel operating when GPS cannot be trusted. I am not saying every Weedle was working for the CIA. I am saying I was not insane to ask questions.

Capability Matters More Than Present Intent

This is where people consistently misunderstand cybersecurity.

They ask: Are they doing something malicious right now?

That is often the wrong question.

The better question is: What does the architecture make possible?

Intent changes. Ownership changes. Leadership changes. Governments become customers. Companies are acquired. Datasets that appeared commercially unimportant become enormously valuable when new machine-learning techniques arrive. A system built for entertainment can later support logistics. A logistics platform can support autonomous navigation. An autonomous-navigation system can support military operations.

That does not mean the original game was built with every future application already planned. It means technological capability has a way of escaping the narrow box written on the original product brochure. RAM was not designed as a radio, yet researchers have demonstrated ways to manipulate its electromagnetic emissions into a covert communication channel. DNS was not designed for data exfiltration, yet attackers can hide information inside domain queries. Pizza deliveries were not designed to reveal military activity, yet patterns of late-night orders around government facilities can expose operational tempo. Pixelation was designed to obscure information, yet multiple imperfect frames can sometimes be combined to recover what was supposedly hidden.

A firewall exists to protect the boundary, until the adversary occupies the firewall. A secure communications platform protects criminals, until law enforcement secretly owns the platform. The stated function is only the visible system. The interesting question is what second system lives inside it.

The Second System Inside Pokémon GO

The visible system was a game. The second system was a behavioral and geospatial platform. Its components were individually ordinary: - a map - a database - a camera - location services - motion sensors - network connectivity - rewards - scarcity - social competition.

Combined, they produced something extraordinary: A platform capable of assigning artificial value to physical coordinates and motivating people to carry powerful sensor packages to those locations. That is not ordinary surveillance. It is the beginning of a command surface for human movement. No coercion is required. No official instruction appears. The person experiences the behavior as voluntary because the platform engineered the reason rather than issuing the order. That may be the most important lesson in the entire story.

The future of surveillance is not merely watching people. It is shaping the incentives that determine where they go, what they point at, what they photograph and how long they remain.

No Victory Lap Required

When Pokémon GO launched, I told people to keep it away from me. They laughed.

That was fine. I had spent enough years in digital forensics to know that sounding slightly unreasonable is occasionally the occupational cost of noticing a capability before the intended use becomes obvious. I was not predicting every detail of Niantic Spatial's eventual business model. I did not possess a classified PowerPoint explaining that Pikachu would one day contribute indirectly to GPS-denied autonomous navigation.

My concern was simpler: A geospatial company with intelligence-community lineage had created a platform capable of directing millions of sensor-equipped people through physical space using fictional rewards.

That seemed worthy of attention. It still does. There are probably a hundred people to whom I explained this in 2016 who quietly concluded that I had finally spent too many hours imaging hard drives in windowless rooms. Some of them will read this. At least one particular federal prosecutor may call me. I sincerely hope he does. There will be no gloating. No unbecoming victory dance. No prolonged recitation of the words "I told you so." Just a restrained and professional conversation between two adults. Followed, perhaps, by the slightest rhetorical rubbing of the facial region.

Because the Pokémon were never the point. The point was that somebody controlled where everyone believed they were. And once you can control the fictional layer placed over the physical world, you can begin to control how people move through it.

The game did not have to surveil the world by itself. It persuaded the world to pick up the cameras and do the walking. And somewhere, buried beneath a decade of colorful creatures, gym battles and cheerful corporate language, the real platform continued doing what it had always been built to do: Map the world.