  Location-based games have come to the forefront of popularity in casual and
mobile gaming over the past six years. However, there is no hard data on crimes
that these games enable, ranging from assault to cyberstalking to grooming.
Given these potential harms, we conduct a risk assessment and quasi-experiment
on the game features of location-based games. Using PokemonGO as a case study,
we identify and establish cyber-enabled stalking as the main risk event where
in-game features such as an innocent function to share in-game postcards can be
exploited by malicious users. Users obtain postcards that are unique to each
Pokestop and represent gifts that can be shared with in-game friends. The
number of postcards that each user can retain is limited, so they send the
excess to their friends with items that boost their friends' game activities.
The postcard often also unintentionally leaks the users' commonly visited
locations to their in-game friends. We analyze these in-game features using
risk assessment and identify cyber-enabled stalking as one of the main threats.
We further evaluate the feasibility of this crime through a quasi-experiment.
Our results show that participants' routine locations such as home and work can
be reliably re-identified within days from the first gift exchange. This
exploitation of a previously unconsidered in-game feature enables physical
stalking of previously unknown persons which can escalate into more serious
crimes. Given current data protection legislation in Europe, further preventive
measures are required by Niantic to protect pseudonymized users from being
re-identified by in-game features and (potentially) stalked.
