July 23, 2016
Note: On July 19 we issued the following bulletin to our clients within the TRAPWIRE platform. Given recent reporting indicating that the Munich shooter may have lured victims with a social media posting, we have decided to make this threat analysis public.
Information Bulletin
Pokémon Go App
We have seen a number of suspicious activity reports detailing incidents involving individuals and groups playing the augmented reality app Pokémon Go. The app encourages users to look for “Pokemon” by exploring an area, with historically or currently significant landmarks frequently used as gathering places in the game. While the app itself could be used for malicious purposes, such as marking a specific area for the app-limited 30 minutes, it is more likely to be used as a cover story. If your site is or contains landmarks, museums, or other important public spaces, you have likely already experienced Pokémon Go players. While many of these incidents will end up being innocuous, malicious actors may use the game as cover to conduct surveillance and test security responses. If contact is made, asking one or more of the questions below may help determine if the individual is actually playing the game.
- Can I see the game or app? A screenshot of the app is shown in figure 1. The screenshot shows a Pokéstop.
- Did you catch a Pokémon or is this a Pokéstop? If the answer is that they caught a Pokémon, request to see which one. Pokéstops are the rotating blue cubes seen in figure 1.
As an example, we recently reviewed a report detailing an individual claiming that the area where a first responder was parked was a Pokéstop. Since Pokéstops are stationary and do not move, this would be highly coincidental. Asking questions to confirm/deny involvement in the game will provide law enforcement/security a better sense of that person’s intentions.
We encourage everyone to continue reporting all incidents that occur at or near your site(s). Repeated incidents involving the same individuals may be a warning/indicator for security to act on; creating reports and Threat Patterns will allow that information to be quickly shared and law enforcement/security to respond appropriately.
LE Response:
There is additional information that may be pertinent to law enforcement officers. One aspect of the Pokémon Go game is that individuals can place “lures” in the game with the goal of attracting Pokémon. These lures can be seen by other players and may result in larger than normal crowds in unusual locations. See this youtube video for an example.
Malicious actors may set lures in order to attract large crowds with the single purpose of attacking that crowd and/or the responding LEOs. Responding officers should be aware of these risks.
Additionally, due to the prevalence of the under 18 year old demographic playing the game, child predators may use these lures to attract minors to locations with the purpose of kidnapping or assaulting them.
