That summer, the Pokémon Go craze was in full bloom. Every day, tens of millions of Americans took to the streets, phones held aloft, impelled by the urge to “catch ’em all.” Hundreds of millions of users were playing the game worldwide.

In 2016, as Hillary Clinton was imploring her supporters to “ Pokémon Go to the polls ,” America’s spy agencies had a different message for their employees: Your hunt for Pikachu, they warned, might be endangering national security—and Beijing’s prying eyes could be behind that Bulbasaur.

In 2016, as Hillary Clinton was imploring her supporters to “Pokémon Go to the polls,” America’s spy agencies had a different message for their employees: Your hunt for Pikachu, they warned, might be endangering national security—and Beijing’s prying eyes could be behind that Bulbasaur.

That summer, the Pokémon Go craze was in full bloom. Every day, tens of millions of Americans took to the streets, phones held aloft, impelled by the urge to “catch ’em all.” Hundreds of millions of users were playing the game worldwide.

The game’s rise dovetailed with a new era of digital spying. The information users were freely surrendering to private companies to play digital games, or to use cool new apps or other online platforms, was making intelligence services drool. Spy services dove headlong into stealing, hacking, or buying data from the private sector that they could not somehow procure elsewhere—even if they didn’t really yet understand the value of that information.

But in the summer of 2016, Pokémon Go’s creators had worries other than snooping spy services—like overseeing the rollout of the game, which was an unprecedented global phenomenon.

Those responsible for the game were blindsided by its popularity. “We were all idiots,” recalled Don McGowan, the Pokémon Company’s former chief legal counsel. “You know those movies where someone is sitting on a beach when the tidal wave hits?” he asked. Before the launch, “That was me.”

The game was a huge hit for its parent company, Niantic, a San Francisco-based firm that launched as a start-up within Google before spinning off as an independent entity in 2015. (Niantic was granted the rights to develop Pokémon Go from The Pokémon Company, which manages the lucrative franchise.) But there was a steep learning curve. Neither Niantic nor The Pokémon Company had any dedicated “trust and safety” personnel thinking through some of the potential geopolitical pitfalls of the game prior to its launch, recalled McGowan. He had previously worked on cybersecurity issues in Microsoft’s government affairs division and found himself thrust into the