Location-based games have come to the forefront of popularity in casual and mobile gaming over the past six years. However, there is no hard data on crimes that these games enable, ranging from assault to cyberstalking to grooming. Given these potential harms, we conduct a risk assessment and quasi-experiment on the game features of location-based games. Using PokemonGO as a case study, we identify and establish cyber-enabled stalking as the main risk event where in-game features such as an innocent function to share in-game postcards can be exploited by malicious users. Users obtain postcards that are unique to each Pokestop and represent gifts that can be shared with in-game friends. The number of postcards that each user can retain is limited, so they send the excess to their friends with items that boost their friends' game activities. The postcard often also unintentionally leaks the users' commonly visited locations to their in-game friends. We analyze these in-game features using risk assessment and identify cyber-enabled stalking as one of the main threats. We further evaluate the feasibility of this crime through a quasi-experiment. Our results show that participants' routine locations such as home and work can be reliably re-identified within days from the first gift exchange. This exploitation of a previously unconsidered in-game feature enables physical stalking of previously unknown persons which can escalate into more serious crimes. Given current data protection legislation in Europe, further preventive measures are required by Niantic to protect pseudonymized users from being re-identified by in-game features and (potentially) stalked.

翻译：位置类游戏在过去六年中已跃居休闲和移动游戏的前沿。然而，关于这些游戏所引发的犯罪（从攻击到网络跟踪再到诱骗）尚无硬性数据。鉴于这些潜在危害，我们对位置类游戏的游戏特性进行了风险评估和准实验研究。以PokemonGO为案例，我们识别并确立了网络辅助跟踪作为主要风险事件，其中诸如分享游戏内明信片这一看似无害的功能可能被恶意用户利用。用户获取的明信片对每个Pokestop是唯一的，代表可与游戏内好友共享的礼物。每位用户可保留的明信片数量有限，因此他们将多余的明信片连同提升好友游戏活动的道具发送给朋友。这些明信片往往还会无意中向游戏内好友泄露用户常去的位置。我们利用风险评估分析了这些游戏内特性，并确认网络辅助跟踪是主要威胁之一。通过准实验，我们进一步评估了此类犯罪的可行性。结果表明，参与者的常规位置（如家庭和工作地点）可在首次礼物交换后的数日内被可靠地重新识别。这种对先前未考虑的游戏内特性的利用，使得对陌生人的物理跟踪成为可能，并可能升级为更严重的犯罪。鉴于欧洲现行的数据保护法规，Niantic需采取进一步预防措施，以保护化名用户免受游戏内特性的重新识别及（潜在的）跟踪。