Pokémon Go: Protect the agency, protect yourself

You may have seen something different this week: crowds of people, mostly young (but not always), outside and randomly wandering around, looking a bit strange as they weave on sidewalks and through public spaces. They stare intently at their phones, then laugh and point excitedly at — well, what to you looks like empty space.

Before you call the police and report them for public intoxication, realize that while their reality definitely is “augmented” in these moments, it’s by Pokémon Go, a smartphone application that allows them to chase digital fantasy characters on their phones, in the real world.

We can all benefit from having a little fantasy in our lives, getting exercise and enjoying public spaces, but Pokémon Go poses two specific risks for members of our DLA community: operations and physical security.

Facilities like the ones we work in at DLA are restricted to people authorized to access our facilities. Wayne Herbert, DLA Headquarters Installation Support physical security specialist, explained the physical security risks of Pokémon Go, “The virtual Pokémon app could create risks to restricted and controlled areas on our facilities. Unauthorized photos and videos could reveal critical information, critical infrastructure and other resources that could be used to hinder the mission accomplishment here. It is important to know that all videos and pictures [taken by a government employee or from DoD property] need to be approved by the local chief of Security and Emergency Services.”

Pokémon Go also invites unauthorized individuals to try and gain access to facilities; those people may be trying to cause damage or get restricted information under the excuse of playing the app, Herbert explained. “Employees should report any suspicious activity to the DLA Police, the Security Operation Center or iWATCH. Remember, ‘If You ‘See Something Say Something’,” he said.

Matthew Baker, DLA Headquarters Information Security and Operations Security program manager, explained the OPSEC security risks Pokémon Go poses for users.

“Like any application that collects information, Pokémon Go creates a risk to users. It captures a lot of information about your location, and not just where you are currently but where you have been and even the amount of time you spent at locations. According to the game’s privacy policy, it collects any information that your privacy settings permit. This could lead to any information collected being shared with a third party without your knowledge,” Baker said.

Additionally, when Pokémon Go was unveiled, logging in with a Google account automatically gave the app access to all information associated with that Google account. Pokémon Go developers have since fixed this security risk, according to news reports, but users must first open their application settings on their phones and disable Google’s permissions.

To help with application security, DLA Intelligence has a collection of instructional cards to help users properly configure their settings.

By all means, enjoy Pokémon Go if you choose to do so; just be smart and careful with it.

Now that we understand the operations and physical security considerations risks of Pokémon Go, let’s talk about tact. You’ve probably read headlines about people playing Pokémon Go in solemn locations like the Holocaust Museum and Arlington National Cemetery.

What you do on your own time is your own business, but please think about appropriate behavior if you play Pokémon Go. As a hint, houses of worship, war memorials, weddings, funerals, national cemeteries — not cool. Have fun, get outside and explore public places, but be respectful of people and places.