mssv

This is an adapted and fully-annotated blog post version of my latest video essay.

Last year, Ukraine’s SBU security service published a video warning teenagers against becoming unwitting spies for Russia’s FSB security agency. Teens would receive instructions from Russian handlers via Telegram, Discord, and other social media, offering rewards, including cash and cryptocurrency. In exchange, they’d complete an escalating series of tasks. 

They’d start out spraying graffiti and putting up anti-government posters, then they’d move up to taking photos of military personnel and installations and planting GPS trackers. If they were successful, they’d move on to arson and even assassinations.

The video ends by saying that the SBU is watching and will definitely find you, and that if you’re approached by a Russian recruiter, you should contact a secure Telegram chatbot called “Burn the FSB agent”.

The reason Ukraine published this video is because in 2025, almost a quarter of the 800 people accused of sabotage and terrorism were under the age of 18. It goes without saying that this is almost unprecedented – usually spies are adults.

But what’s even more shocking is that some teens have said that they were recruited by the FSB through a fake “quest” game, which one western military official said was “like a game of Pokémon Go, but with air defence systems.”

So, I want to get into this. I’ve been designing location-based games and alternate reality games (ARGs) like Zombies, Run! and Perplex City for over twenty years, and it’s pretty wild and disturbing to see these ideas being used for real life espionage and terrorism. I want to look at just how teenagers are being recruited, not just in Ukraine but around the world, whether western spy agencies are doing the same thing, and how science fiction stories and ARGs might indicate where this is going next.

But first, let’s go back to the Pokémon Go for air defence systems. We usually don’t get a lot of details about these stories, for obvious reasons – these are teenagers and authorities don’t like sharing information about ongoing investigations and court cases. This is one of the exceptions. 

Back in 2024, the SBU discovered that two groups of teenagers in Kharkhiv, all aged 15 to 16, were taking photos and videos of air defences protecting the city, which Russia then used to carry out airstrikes. It turned out that the teenagers were doing this under the guise of a scavenger hunt game run by an FSB handler who, we can assume, did not tell the teens he worked for the FSB:

The handler gave location co-ordinates via anonymous chat, and also set them additional tasks like setting fire to military vehicles and electrical transformers used for the train network. In order to disguise their activity, the two groups operated completely independently. Like spy cells, each group didn’t know the other existed. It’s also possible that some of the teens in these groups were recruited by their peers, and not by the FSB handler directly, which makes things even more complicated.

Now, I feel obliged to point out that this isn’t really like Pokémon Go, even though that is a great headline. As far as I can tell, this was all done over existing social media with messages and images, it’s not like the FSB employed its own game designers to make a dedicated, sophisticated app. It really was more like a basic scavenger hunt game than anything else, the sort of thing school groups might get at a museum, but a lot edgier.

So we can definitely question whether the teens really thought they were playing a game, or whether that’s just an excuse – after all, just because they’re 15 doesn’t mean they’re stupid. But then we need to get into how this kind of recruitment works. Most of the cases we know about don’t involve explicit gamification like this one in Kharkhiv, but they do follow a very similar pattern that can make it difficult for some teens to figure out exactly what’s going on.

First, teens are approached through channels like Telegram, TikTok, Snapchat, Facebook, and Discord, often in communities related to video games. Recruiters target teens who are looking for jobs or are expressing anti-war sentiments or just feel bored and unappreciated in their lives. And the important thing is that even when they’re contacting kids online, it’s not as if FSB agents are all working from a single playbook.

Instead, they use an individualised approach. With one target, they’ll chat about games to try and make friends. With another person, they’ll try flirting. And so, with some, they’ll present what they’re doing as a game. 

This wide range of approaches is also because there’s a huge variety among Russian recruitment agents. The FSB handles Ukraine, while the SVR and the GRU’s Department of Special Tasks handles the rest of the world – countries like Poland, Germany, the Netherlands, and the UK. And recruiters aren’t necessarily part of the Russian state, but criminal groups co-opted by intelligence agencies. 

There are a few things these approaches have in common, though. 

The first is that recruiters don’t just come out and say, “I’m with the FSB. Unlike traditional high-value spies, practically everyone who’s recruited as a “single use” agent is apolitical. They aren’t ideologically pro-Russia or even anti-West. Of 62 people who were arrested in Poland for suspected sabotage, only two of them were primarily driven by pro-Russian sentiment.

Which is where the second commonality comes in: money. Typically recruiters will offer relatively small sums of money, paid in cryptocurrency, for completing tasks. A 16 year old in Kharkhiv was paid €8 for putting up some completely harmless posters, nothing to do with the war at all. But money isn’t the only motivation. Often, recruiters will come up with some story that helps justify the actions – they might say, “hey, here’s a bad man who owes us money, if you burn down his car, we’ll give you €500”. 

And that brings us to the third commonality. If you ask a teen to go and firebomb a house one day after meeting them online, they’re going to be suspicious, so recruiters build trust through a gradually escalating series of tasks. They’ll start out by asking teens to buy a SIM card or distribute anti-war leaflets, then they’ll move onto putting up posters, planting GPS trackers, taking photos of military targets, then minor arson like setting fire to an empty car, and then finally, bombs and assassination.

Most teens don’t get as far as constructing bombs, of course. By that point, they probably suspect what’s going on and are trying to get out, though Russian agents often blackmail and threaten them to keep going. But even graffiti and posters and photos can do damage and spread fear and distrust.

A really instructive example of teen espionage is the case of two teenagers in Rotterdam who were arrested for reportedly scanning around one thousand wifi networks using a packet sniffer. Some of the targets included Europol’s headquarters and the Canadian embassy. Apparently they were offered several hundred dollars in cryptocurrency for this by Russian hackers, which is not nothing, but it’s not a lot. 

So why did they do it? Maybe they were just bad kids? Well, that doesn’t seem to be true, either, at least according to the dad of one of the teens. His son had a part-time job at a supermarket, he was into games and hacking and computers, he played field hockey, and lived in a quiet, stable household. 

In fact, it’s that very stability led some to speculate that he had a craving for excitement – and going around with a packet sniffer probably felt really exciting, like a more serious version of Pokémon Go or Ingress. That chimes with what the former deputy head of Ukraine’s secret service recently said, that teenagers are motivated by money, yes, but also by the feeling of being a hero and being involved in special operations. An official from Kharkhiv’s Regional Prosecutor’s Office agrees:

[Russia is] exploiting the psychological vulnerability of teens quite effectively, tapping into their thirst for adventure, youthful idealism, and the desire to gain recognition among their peers.

No amount of video games or field hockey is going to scratch that itch, especially if you think you’re only doing some edgy hacking rather than working for Russian intelligence. 

What everyone agrees on is that for every case of teen espionage we hear about, there are many more that go undetected. That’s incredibly chilling when you consider that a lot of teens in Ukraine have been arrested for burning down train relay boxes and electrical transformers, and even building bombs.

Ukraine’s security service is taking the threat incredibly seriously and, along with their PSA video, have been running hundreds of classes at high schools teaching kids how not to fall for FSB recruitment tricks.

In the space of just 15 months, they’ve received 17,000 tips to their “Burn the FSB agent” chatbot. And across Europe, authorities have been shocked at just how quickly teenagers are being recruited, and how easily online contact is translating into real world activities.

---

A big challenge in exploring this topic is how little information is public. For all I know, there could be a dozen or a hundred more Pokémon Go-style games recruiting teen spies that no-one’s talking about. But there are other questions we can ask. For example, we know that Russia and Iran are actively recruiting teenage spies – are other countries doing the same, like the UK or US?

And this isn’t as ridiculous a question as you might think. Yes, the CIA and MI6 aren’t going around talking about what they’re up to, but sometimes ideas do slip out in unusual places. After all, the techniques Russia is using aren’t that high tech, and social networks aren’t brand new. So here’s one example of the US experimenting with these ideas almost 20 years ago.

Back in 2009, DARPA – the Defense Advanced Research Projects Agency – announced a competition to celebrate the 40th anniversary of ARPANET, the precursor of the internet:

In December of this year, ten very large balloons will fly in the continental US. For two days during daylight hours, they will be visible.
The first person or team to correctly identify all the locations and describe how they did it, wins. The prize: $40,000, payable to the person, the team, the organisation, or donated to charity.

This was the DARPA Network Challenge, and it was designed as a way to test how quickly geospatial intelligence could be gathered by online social networks. It’s different to modern Russian tactics because DARPA was setting up an overarching framework and incentive structure to gather intelligence rather than targeting individual people, but still, if you swapped the ten red balloons for, say, ten missile launchers, you can see why this was an interesting project for US defence agencies. 

According to the official project report, many US intelligence analysts thought it would be practically impossible to locate ten relatively small balloons that could anywhere in the contiguous United States, at least using conventional intelligence methods. 

But if you created a “distributed human sensor approach”, connected by online social networks, then maybe you could do it.  Remember, Twitter was only three years old at this point, so people didn’t know what was possible yet. And by turning the challenge into a competition, they could get members of the public to come up with ideas that experts might otherwise dismiss as too risky or foolish.

DARPA made the Network Challenge even harder by compressing the timeline. The announcement was made on 29th October 2009 and the balloons went up just 37 days later. Most teams who took part didn’t hear it for a few days, meaning they had barely a few weeks to organise. 

In the end, somewhere between 50 to 100 teams gave it a serious go, with around 350,000 individual participants. And while the challenge wasn’t designed for teens, you can bet that teenagers took part. While there are huge legal differences in terms of how teens and adults are treated, in reality, there isn’t a bright line separating what teens and adults enjoy doing or are capable of doing.

I’m going to focus on three of the most successful teams to give you an idea of the different strategies. 

First up is George Hotz, aka “geohot”, who was infamous for hacking the iPhone when he was just 17 years old. Hotz had almost 50,000 followers on Twitter, which was pretty huge at the time, so even though he only learned about the challenge the day before the balloon launch and only announced his involvement an hour beforehand, he still managed to locate eight balloons. Four of them were spotted by his followers, and he got the other four through swaps with other teams. Hotz basically used what DARPA would describe as the “existing network hierarchy”.

Next, we have Georgia Tech Research Institute. While they didn’t have Hotz’s 50,000 followers, they launched their website really early and got a bunch of press coverage, partly by promising to donate all their winnings to the American Red Cross. This meant they were one of the first results on Google searches, and in the end they got nine balloons. DARPA described this as a “mass broadcast network hierarchy”.

And then finally we have MIT Media Lab, and as you’ve probably guessed, they were the winners. While MIT had name recognition, they only launched their website less than two days before the balloons went up, which put them at a major disadvantage to Georgia Tech. What they did have was a really smart recruiting strategy, which I’ll let project leader Riley Crane explain:

One of the the members of the [MIT] team said, “Well, there’s this famous paper on search in social networks, but what we they conclude in that is that the solution will depend heavily on individual incentives.” 

And so we took that and we thought, “Okay, there’s ten balloons, there’s $40,000. We’re going to give $4,000 to each balloon. So that means that if you sign up and you find a balloon, I’ll give you $2,000. And we’re going to give the rest to charity. So everyone feels good, right? And I have this great audience here, there are a couple hundred people, so I can tell you all about it and you’re going to go out and you’re going to find these balloons for me?” 

But there’s a problem, because if I tell you, then you don’t really want to tell anyone else, because maybe your friend’s going to find the balloon and then you lose out on your $2,000, right? So we had to rethink this and we said, “Well, let’s do one step further. I want to tell you and I want you to tell your friend. So if you sign up and you tell your friend, and your friend finds the balloon, we’re going to give him the $2,000 because he did the hard work, but we’re going to give you half of the remaining amount. We’re going to give you $1,000 because you referred him to us.”

And you can continue this so on and so on just having that remaining amount until you end up splitting pennies.

This pyramid scheme meant participants were incentivised to recruit as many friends as possible because if any of them spotted the balloon, or any of the people their friends recruited spotted the balloon, they’d get a slice of the winnings. And so within 36 hours, MIT got over 5000 people to sign up. 

Thanks to this, and to CNN coverage, they spotted all ten balloons in just under nine hours – way faster than DARPA had expected. As a 2011 paper noted:

The Challenge demonstrated that geospatial intelligence is potentially available to anyone with an Internet connection, not just to government intelligence analysts. Social media and crowdsourcing practices have given almost any individual the potential to tap the inherent power of information.

But just because it was now possible to crowdsource intelligence using social networks didn’t mean anyone could do it. You needed the right strategy and the right message. Appealing to people’s sense of virtue, like Georgia Tech did with its promised donation to charity, wasn’t enough. Instead, the MIT team made each participant feel like they had agency in their own success, and they were still supporting charity, too. Money and virtue – now that’s a potent mix, and one that Russian handlers exploit.

If we zoom out even further though, I think another aspect of framing of the challenge becomes important. DARPA didn’t announce this as some super-serious research project looking into the power of social networks, but a bit of harmless fun. As the official project report says:

the success of social networks in locating and reporting balloons during the [DARPA Network Challenge] may have stemmed as much from the fun, game‐like aspect of the Challenge as from the financial incentive of the prize money.

And many of the most successful teams used the same framing, calling it a game or a scavenger hunt. So at the very least, DARPA – and anyone else who read the report – learned that if you call something a game and make it look like fun, you can get people to look for red balloons when money alone might not have done the job. The similarities with the Kharkhiv scavenger hunt for air defence photos are really striking, and I wouldn’t be surprised if the organisers of that one improvised some kind of MIT-style referral scheme.

The report also makes a few recommendations for future experiments. The first one suggests running a balloon geo-location experiment in another country like Turkey, but restricting team leaders to a different country:

This might reveal how foreign interests can motivate, recruit, and mobilize people from other cultures, languages, and religions. Another interesting observation would be how observer networks in the balloon country organize and mobilize and how they interact with each other and the foreign participants.

Yes, that would be interesting, wouldn’t it?

A variation on this idea happened in 2012 when the US State Department and the US Embassy in Prague sponsored the Tag Challenge. This was a “social gaming competition” where participants had to find five “suspects” in five cities across North America and Europe using only their mugshot in a single day. To make things a lot easier, each suspect was wearing a T-shirt with the event logo. The winners got $5000 and in the end, the winning group used an identical strategy to MIT’s for the Network Challenge. Boring! 

The funny thing is how the official website says the Tag Challenge was conducted in a spirit of “fun and curiosity”. Oh really?! 

Another recommendation from the DARPA report was to repeat the Network Challenge but without a financial reward. This is much closer to what I would call “pure gamified espionage” and I don’t know of any projects that attempted this, outside of whatever Russia is up to nowadays.

Before I move on from the Network Challenge, I need to reveal that I played a small part in it, too. In the project report, there’s a timeline listing key moments in the leadup to the balloons launching. The first event is the announcement of the challenge on 29th October. The same day, there’s a Huffington Post article about it. And the very next moment in the timeline happens two days later, when I wrote about the Network Challenge on my blog:

Yes, the US Defense Advanced Research Projects Agency thinks I’m “very thoughtful”. 

In my post, I pointed out that $40,000 wasn’t actually a lot of money and suggested giving the prize to charity – which is what a lot of the teams ended up doing – recognise useful contributors, and make stars out of hard-working ones. I thought it was probably going to be solved pretty quickly with teams in the tens of thousands of players, and that there’d be a lot of false flags, which there were. But I didn’t predict MIT’s winning strategy.

Looking back, it’s strange to realise I inadvertently influenced the growth of gamified espionage on social networks. Anyway, let’s not think about that too hard.

---

I previously mentioned the Kharkhiv scavenger hunt was more like a challenge than a complex game, and the same is true of the DARPA Network Challenge. Neither of the organisers, and not even any of the Network Challenge teams, programmed a sophisticated app. But what if they did?

There was a recent discovery that AR scans players made in Pokémon Go were used to train a Niantic spatial AI model that is now being used for military purposes (I’m quoted in it!), but I’m not aware of any other video games that are designed to get teens or adults to do real life espionage. Of course, they wouldn’t admit to it even if they did, but it’s not like there are very many popular location-based games out there beyond Pokémon Go.

So, I’m going to turn to science fiction now. I have to step carefully here, because by definition, it’s not real. At the same time, science fiction can predict the future, and in some cases, it informs the future, for better and worse. The reason why everyone got obsessed with the metaverse a few years ago is largely down to stories like Snow Crash and Ready Player One. Sure, it didn’t go well, but it also didn’t stop companies like Microsoft and Facebook from investing literally billions in “metaverse” technology. So we might imagine that certain science fiction stories might also predict or inform the future of gamified espionage.

But even if you look at fiction, it’s hard to find serious treatments of using teens for spying, especially when they’re unwitting. It’s just too sensitive for a lot of writers – just look at Ender’s Game. Still, there are a few examples I want to share with you that, in retrospect, predicted the future incredibly well.

The first is Charlie Stross’s 2007 novel Halting State. If you’ve read it, you’ve probably been shouting at your screen about it, and don’t worry, you aren’t alone. Halting State is set in 2017, and a main theme is that everyone is now playing alternate reality and augmented reality location-based games. So, to be clear, these games take place in the real world, a bit like larps. One of the most popular games is called SPOOKS; here’s how Stross describes it in the book:

It’s ten thirty and you’re glumly contemplating an early night and a seven o’clock session in the gym when your phone rings. You look at the display with a sinking feeling: it’s a particularly tedious LARP called SPOOKS, a real-time game in which you’re acting your parts in a shadowy pan-European intelligence agency locked in a struggle for global hegemony with the forces of Chinese military intelligence, the Russian FSB, and, of course, the CIA.

‘Yes?’ You try not to snap.

‘Elaine Barnaby? This is Spooks Control. Are you busy right now?’

Elaine’s in-game operator gives her a job to pick up an actual physical parcel from her hotel lobby and deliver it to an address ten minutes walk away…

Outside, the evening air is cool and smells faintly of the cherry blossom that’s piling up in the gutters at the side of the pavement. You pull on a disposable plastic glove then pull the tab on the parcel. This recording will self-destruct in thirty seconds. Rumour has it that the first SPOOKS campaign got the beta-testers arrested and questioned for a week under the Terrorism Act before the police realized it was a game; that’s why you carry a special endorsement on your ID card.

The parcel turns out to contain a bland-looking matte black plastic box about the size of an old-time DVD case, and some heavy-duty outdoor bonding pads. There’s also a brief, printed note on paper. ‘Attach to front of building above eye level facing the street. When attached, initiate pairing with your phone to “unnamed device 1142.” Passcode is 46hg52Q. Once paired, dial ##*49##*, and leave the area. When home, text Control.’

Bloody typical. You pocket the bugging device, or whatever it is, key the co-ordinates into your specs, and let the overlay guide you along the pavement towards the target building. This sort of nonsense is partly why you’ve been thinking of retiring from SPOOKS; it’s almost tediously realistic. Not James Bond swigging cocktails by the pool in Grand Cayman, just ‘pick up package X, transport to location Y, phone number Z.’

Spoilers: the reason SPOOKS is so tediously realistic is because it was designed by British intelligence to train unwitting players into becoming spies and doing actual espionage work. As they point out:

Would you believe it used to cost us ten thousand euros a day to put a full surveillance team on a suspect? Now we’ve got volunteers who’ll pay us to let them do our leg work!

Stross is arguing that if you make espionage sufficiently thrilling, like in his fictional SPOOKS game, then you don’t need the monetary incentives in DARPA’s Network Challenge or Russia’s espionage tasks. Of course, to do that, you need really good game designers, and that’s not something DARPA or Russia are doing, at least not yet. 

But it is something everyone in the intelligence community implicitly understands – remember the Ukrainian official who said that teens were drawn into espionage because they wanted adventure, they wanted to feel like a hero.

The second example is Vernor Vinge’s novel Rainbows End, published in 2006, just a year before Halting State. If you’ve heard of the AI singularity or cyberspace or augmented reality or fake online news, then you’ll find Vinge writing about them decades before they became widely known. The guy had an incredibly good record when it came to predictions. 

It’s quite hard to summarise Rainbows End – it’s basically a technothriller set in 2025 where someone is trying to take over the world using mind control technology, though most of the story has nothing to do with that. Instead, he spends a lot of time imagining what the internet and games would look like twenty years in “the future”.

The main thing he gets wrong is that everyone in his future is now wearing augmented reality glasses. These are only just coming out now and they look and work like shit. But it’s what people are doing with those glasses that’s really interesting. Essentially, everyone in the world is playing augmented reality games, games that layer a fictional reality on top of the real world. One game, Scooch-a-mouti, is a thinly veiled take on Pokémon:

[Miri] overruled the anime imagery [on her AR glasses] to view what was most popular today. Ugh. It was mostly Scooch-a-mouti nonsense. Salsipueds and baba llagas were everywhere. A year ago, no one had heard of the Scoochis, and now they were bigger than some of the corporate names. They had even dented the mega release of the latest Cretaceous Returns. There were hundreds of different types of Scoochi characters. Some were slyly stolen intellectual property. The rest were from folklores at the edge of the world. The imagery was very, very cheap, without any creative center. Maybe that’s why little kids were the biggest fans.

Pokémon Go wouldn’t come out for another ten years.

Unusually, the games in Rainbows End are all organically co-created by the players themselves, a bit like the lore behind the Backrooms or SCP. They’re so powerful and popular that they can draw tens of thousands of people to real world locations – again, a bit like Pokémon Go. 

So rather than create their own dedicated games that would struggle to find an audience, intelligence agencies just subvert existing ones, like Scooch-a-mouti, for their own ends. This happens multiple times in the story, like when someone recruits a teenager to spy on adults at their school, and later, when various parties engineer a massive battle between two different games in order to conceal a heist.

In some ways I find this pretty realistic. Intelligence agencies and security services don’t have unlimited budgets – the FSB certainly doesn’t – and trying to operate an entire game is not exactly in their skillset. It’s far easier to just co-opt ones that already exist, something that spies have plenty of experience in.

Another thing Vinge nails is the power of referrals, or what he calls “affiliances”, when it comes to building incentives within games. Like the winning DARPA Network Challenge team, players can receive payment shares for completing tasks from people higher up them in the hierarchy. Here’s what happens when a teen named Juan playing a Jurassic Park-knockoff game gets tapped to become an affiliate and spy for them:

“Besides [Cretaceous Returns], I have other things going. How would you like to take an affiliate status on a little project?” 

Except for local games, no one had ever asked Juan to affiliate on anything. His mouth twisted in bogus contempt. “Affiliate? A percent of a percent of… what? How far down the value chain are you?”

The saurian shrugged and there was the sound of ginkgoes creaking against its shoulders. “My guess is I’m way, way down. That’s how it is with most affiliances. But I can pay real money for each answer I pipe upwards.” The creature named a number; it was enough to ride the freefall every day for a year.

As we discover later, Juan was actually recruited by his teacher, who in turn was recruited by a freelance agent who may or may not be an AI; and that agent was hired by the head of India’s External Intelligence Agency on a rogue mission.

---

What’s interesting about both Halting State and Rainbows End is that both stories assumed that location-based games would require augmented reality glasses, even though Pokémon Go doesn’t. But to be fair to them, Pokémon Go is basically the only really successful location-based smartphone game. Lots of companies tried to make similar games based around Harry Potter and Jurassic Park and The Walking Dead, and not a single one worked.

So if we had really good AR glasses like in the movies, you might imagine the games that could run on them would be much more popular. Certainly, when I was designing ARGs like Perplex City back in 2005, it would’ve been a lot easier to run our live events if we could’ve used augmented reality helicopters than having to pay for a real life black helicopter.

During one event we embedded an actor playing a mole as fake player. Along with the hundreds of people who came to London, we had thousands of people supporting them online around the world, and they uncovered the mole’s identity just after he fled into that helicopter. Perplex City as whole was suspected of being an MI5 recruitment drive after we promoted it with a series of cryptic newspaper adverts.

This really shows just how powerful the appeal of going on secret missions is. In fact, one of the very first ARGs was all about being a secret agent, albeit one that mostly worked from home. It launched back in 2001 and was called Majestic:

The idea behind Majestic was to blur the lines between real life and fiction, such that the game used every channel it could to engage people. As creator Neil Young noted: 

The Internet’s connected to so many other devices that you use every day. So your telephone, maybe your fax machine, your email, your instant messaging, your chat. And what Majestic does is it uses all of these devices to kind of keep you at the very center of your own mystery, own suspense thriller. 

…So in Majestic, if you connect with a character and that character says they’ll get back to you tomorrow, they’re going to literally get back to you tomorrow. And of course what you won’t know is whether they’ll call you on the phone or send you a fax or send you an email. And that sets up a tremendous sense of anticipation.

Unfortunately, Majestic didn’t do very well – reportedly fewer than 14,000 people subscribed, way under their projections. From what I recall, a big problem was that people didn’t think there was enough content in the game, plus people actually found it kind of inconvenient when the game called them on the phone in the middle of a meeting or class. Also, the subscription cost $10 per month. In today’s money that’s almost $20, which is a lot.

And those problems still hadn’t been solved a decade later. In 2012, an iPhone game called CodeRunner was published. Unlike Majestic, this was a true location-based spy game where players went to real world locations to “hack” security cameras and ATMs, and even better, it only cost $2:

Just look at what this player is doing – he’s putting a thing next to an actual electrical cabinet and being told to “cut power to the security”! He’s doing dead drops and taking photos! It’s literally what the FSB is asking Ukrainian teens to do!

Coderunner was not successful. There wasn’t much gameplay to speak of – you just went to a location and pressed a button to hack something – and people complained that the missions got repetitive and it wasn’t possible to reach some of the locations the game asked you to. Clearly, it didn’t have the kind of mapping or routing data that Niantic would crowdsource through Ingress and Pokémon Go. 

Ultimately, it wasn’t responsive or personalised enough to justify the extra effort it demanded of players to go outside into the real world. I can speak to that directly. I remember downloading Coderunner right when it came out and the very first thing it asked me to do was walk down the road. I was already winding down for the evening and it was raining outside, so I just closed it and never looked back. An actual FSB or GRU handler would at least work their way up to that.

But today, it’s not hard to imagine how you could improve on Majestic and Coderunner’s limitations, even without AR glasses. I hate to say it, but AI chatbots would make these games way more conversational and personalised. If you got it right, they wouldn’t ask you to go out for a walk in the rain, they’d be much better at gauging your capabilities and motivation, giving players tasks that gradually escalated in difficulty. God knows enough people spend countless hours using their AI as their therapist or romantic partner, it doesn’t seem at all impossible that AI could do a convincing imitation of a spy handler, at least for some people.

---

Let’s put this all together. In 2009, the DARPA Network Challenge demonstrated that a game-like competition could get social networks to crowdsource geospatial intelligence far faster than conventional methods. In the 2020s, Russia and Iran and who knows what other countries have recruited thousands – maybe tens of thousands – of adults and children for intelligence and sabotage and terrorism. 

They’ve done this by personalising their approach to individual targets through social media, and in at least some of those cases, they’ve explicitly used game mechanics as a frame for missions. In almost every case, they aren’t relying on pro-Russia or pro-Iran sentiment, but rather on money and on people’s thirst for adventure and status, just as DARPA predicted. 

I don’t want to overstate this, but if this is what Russia can accomplish just by talking to people on Telegram and Discord one at a time, we really need to start thinking about what’ll be possible with more advanced methods, whether that’s using AI chatbots or AR glasses or simply getting actual game developers involved. 

So, what’s the solution? In Ukraine, they’re using a combination of education and enforcement. They’re going into high schools, they’re making PSA videos, they’re setting up chatbots for teens to anonymously report FSB agents, and they’re making sure people know exactly how much prison time they could get for working with Russia. It’s all very sensible stuff, though it’s too early to know whether it’s actually working.

Ukraine has not banned social media for teens, though it is being considered. That said, it’s not clear whether a ban would work. Australia’s social media ban doesn’t include Discord, and the UK’s proposed ban won’t include WhatsApp or Signal. More importantly, most teens have figured out ways of getting around these bans, whether that’s by using VPNs or just tricking the age verification process.

And actually, the funny thing about teens going out with their phones and laptops to take photos of air defences or packet sniff wifi networks is that they’re doing exactly what adults are saying they should do – they’re going outdoors, away from their screens, and getting some exercise. Now, to be clear, I am not endorsing teens spying for a foreign power in any way, but I am also not surprised that some teens end up doing that when it feels more exciting and adventurous and rewarding than the other activities available to them.

Because let’s face it, over the past century, we’ve systematically eliminated almost every outdoor activity for teens that feels even a little bit dangerous and exciting. We turned games into sports, and we turned sports into work. We paved over half the open spaces where people could play and we privatised the rest.

The experts who’ve studied this agree that teens are drawn to spying because it feels cool and fun, at least to begin with. So along with education and enforcement, a serious strategy to shut this down would be to create safer real world alternatives that are just as cool and fun. That means we can’t just tell teens to kick a ball around a non-existent football pitch. It means giving them spaces where they can do things that feel a bit secretive and dangerous. 

In the past, these were places like adventure playgrounds – not the sanitised ones like we have today, but ones where teens were allowed to set things on fire and build multistorey towers.

Today, they might look like extreme sports or high-stakes volunteering. And in the future, they might be augmented reality games like Charlie Stross and Vernor Vinge wrote about, games where teens can become make-believe spies or warriors or magicians or dinosaur hunters. None of these things will provide exactly the same feeling as being a real spy, but they will satisfy at least some of the demand that’s driving teens there. 

When Russia recruits teens and children to spy for them, they’re pushing at an open door. If we don’t take this problem seriously right now, it’s only going to get a lot worse.