Your Location Is the Most Dangerous Data You Generate
Governments and intelligence agencies have long understood something the public is only beginning to grasp: precise, continuous location data is more revealing than the content of your communications. A transcript of your phone calls tells investigators what you said. Your movement history tells them where you live, where you worship, who you sleep with, what doctor you see, what protests you attend, and when you're not home.
The modern surveillance challenge — for states and private actors alike — is that citizens have been convinced to carry precision location beacons voluntarily, in their pockets, at all times. Smartphones, fitness trackers, smart watches, and — critically — consumer apps generate a continuous stream of GPS-precise location data that is harvested, sold, purchased, subpoenaed, and in some cases simply stolen by actors ranging from police forces to foreign intelligence services.
What "Spatial" Surveillance Actually Means
Spatial surveillance goes beyond simply knowing where someone is. Modern geospatial intelligence (GEOINT) tools allow analysts to:
- Pattern-of-life analysis: Map a person's regular movements over weeks or months — home, workplace, places of worship, medical facilities, regular contacts, anomalies
- Co-location analysis: Identify all devices present at a given location at a given time — who was at a protest, a meeting, a hotel room
- Social graphing from movement: Infer relationships between people from overlapping location histories without ever reading a single message
- Predictive profiling: Use movement history to predict future behaviour — where someone will be, who they're likely to meet, when they're vulnerable
- Identity resolution: De-anonymise supposedly anonymous location datasets by correlating home and work locations with public records
The Pokémon Go Database — A Case Study in Weaponised Play
Pokémon Go is the world's most successful augmented reality game — and one of the most extensive civilian location-data collection operations ever conducted. Players move through the physical world to catch virtual creatures, battle at "gyms," and visit "PokéStops." Every movement is logged, timestamped, and transmitted to Niantic's servers.
The Niantic / In-Q-Tel / Google Connection
Niantic was not an independent startup. It was founded in 2010 as an internal startup within Google by John Hanke — who had previously led Google Maps and Google Earth. In 2015, Niantic spun out as an independent company with Google as one of its primary investors.
Critically: Hanke's earlier mapping project at Keyhole Inc. — the company whose technology became Google Earth — was funded in part by In-Q-Tel, the CIA's venture capital arm. Keyhole's geospatial database technology was of direct intelligence interest, and In-Q-Tel's investment gave US intelligence agencies insight into and influence over the development of foundational geospatial mapping technology.
While Niantic itself has not been publicly confirmed as an In-Q-Tel portfolio company, the organisational lineage — from In-Q-Tel-backed Keyhole, through Google Maps, to Niantic — represents a continuous thread of intelligence-community-adjacent geospatial data development.
The Large Geospatial Model — Player-Sourced Training Data at Scale
In November 2024, Niantic publicly announced its Large Geospatial Model (LGM) — a foundation AI model trained on visual data uploaded by Pokémon Go and Ingress players through the in-app scanning features (Wayfarer / "Scan PokéStop" / Scaniverse). Niantic disclosed that the model had been trained on:
- Over 10 million scanned locations worldwide
- More than 1 million activated Visual Positioning System sites
- Approximately 50 million neural networks of place-specific data
- Roughly 150 trillion parameters of trained geospatial intelligence
In effect, the world's Pokémon Go players have been crowdsourcing — for free, often unknowingly — a high-resolution 3D model of every park, street corner, school playground, place of worship, government building and private property near which the game is played. The LGM is exactly the kind of street-level, ground-truth dataset that satellite imagery cannot produce — and that an intelligence service would otherwise have to build using its own operatives.
Beyond the documented LGM disclosures, it is alleged that the underlying corpus — billions of images and short videos uploaded by Pokémon Go users — has been made available (or replicated) to US intelligence-aligned partners. Specifically:
- Google retains continuing equity and infrastructure ties to Niantic from its 2015 spin-out, and Niantic's image/video pipeline historically ran on Google Cloud infrastructure
- Mandiant — acquired by Google in 2022 for $5.4bn and now part of Google Cloud Security — sits inside the same corporate structure that hosts that data, and routinely works alongside US government clients including CISA, FBI Cyber, and Five Eyes partners
- Independent commentary has alleged that on the order of 30 billion images and videos of users and their surroundings have been collected through Pokémon Go's scanning ecosystem since launch — a corpus that, if true, dwarfs any single state-run image database
Niantic has not publicly confirmed any intelligence-community data-sharing arrangement, and the 30-billion figure is not stated in Niantic's own published LGM materials. It is included here as an allegation requiring further evidence, not as an established fact.
Law Enforcement Use of Gaming Location Data — Documented Cases
Federal law enforcement has used geofence warrants — demanding all device identifiers and location data from a specific area during a specific time window — against gaming and app companies including Niantic. A geofence warrant requires no individual suspicion; it sweeps up every user who happened to be in a location. This has been used at protest sites, crime scenes, and political events. Users of Pokémon Go who happened to play near a relevant location have been caught in geofence dragnets.
In one of the earliest documented cases, a murder suspect was located partly through his Pokémon Go play history. Law enforcement obtained his in-game location logs, which placed him near the crime scene and helped establish a timeline. The case demonstrated that gaming data — which users rarely think of as surveillance-relevant — is fully subject to criminal subpoena.
Vice's Motherboard investigation revealed that the US military — including Special Operations Command and US Marine Corps — had purchased commercially available location data harvested from consumer apps including weather apps, games, and prayer apps used by Muslim communities. The data, sold by brokers like X-Mode and Babel Street, included location traces precise enough to track individuals' daily movements. X-Mode's SDK was embedded in hundreds of apps — potentially including gaming apps — collecting location data that users had no awareness was being sold to government clients.
The Department of Homeland Security purchased location data from broker Venntel — which sourced data from consumer apps, including games — to track migrants crossing the US-Mexico border. The data identified devices inside private homes as well as vehicles. No warrant was obtained; DHS argued commercial purchase of data requires no Fourth Amendment compliance.
How Spatial Spyware Works — Beyond Gaming
Consumer apps are only one vector. State-grade spyware tools combine spatial tracking with full device compromise:
The Geofence Warrant Pipeline — How Your Game Data Reaches the FBI
Intimidation and Coercion via Location Data — The Documented Pattern
Beyond straightforward criminal investigation, location data has been documented as a tool of intimidation and extrajudicial pressure:
- Confrontational disclosure: Law enforcement or intelligence officers confront targets with precise details of their movements — "we know you were at X on date Y" — without disclosing how they know, to signal surveillance capability and induce compliance or self-censorship
- Constructing compromising narratives: Movement data showing a target at a sensitive location (a clinic, a hotel, a political meeting) is used to build pressure files — not as evidence in court, but as leverage in informal encounters
- Identifying journalist sources: Law enforcement has used geofence warrants at newspaper offices and journalist meeting locations to identify who visited — effectively identifying confidential sources without accessing communications
- Chilling protest: The documented use of geofence warrants at protest locations creates a deterrent effect — individuals who know (or suspect) their game data and phone location is logged avoid protests for fear of being identified
- Domestic abuse: Access to commercial location data has been exploited by abusers with law enforcement connections — who use police-adjacent tools or subpoena access to track victims
"Location data is not metadata. It is not less sensitive than the content of a call. Knowing where you go, when you go there, and who you go with tells an investigator almost everything about your life — and you gave them that data because you wanted to catch a Pikachu."
— Jennifer Granick, ACLU Surveillance and Cybersecurity Counsel (paraphrased, 2021)
Primary Sources & Further Reading
- Vice / Motherboard, "How the U.S. Military Buys Location Data from Ordinary Apps" (2020)
- Wall Street Journal, "Government Agencies Buy Vast Quantities of Location Data" (2020)
- ACLU, "How Fog Reveal Lets Cops Conduct Warrantless Surveillance" (2022)
- Citizen Lab, "Pegasus: How a Spy in Your Pocket Threatens the End of Privacy" (multiple reports 2018–2024)
- Amnesty Tech, "Forensic Methodology Report: How to Catch NSO Group's Pegasus" (2021)
- EFF, "Geofence Warrants and the Fourth Amendment" (2020–2024)
- Federal Trade Commission, "Data Brokers: A Call for Transparency and Accountability" (2024)
- Privacy International, "IMSI Catchers in the UK" (2022)
- The Guardian, "Met Police using Palantir software to fight crime" (2020)
- Niantic, Inc. Privacy Policy (current version — niantic.com)
- In-Q-Tel / Keyhole Inc. investment history — public record
- Nathan Sheard, EFF, "Geofence Warrants: The Dragnet in Your Pocket" (2022)