Nuclear — Athena Trace 2026 Writeup

The challenge

Why is a photo of a Japanese motorcycle club sitting in the photo gallery of a staff canteen inside a nuclear power complex in a SAARC country? Give me the precise location of the canteen.

Flag format: trace{lat,long} — decimal degrees, exactly 4 decimal places (keep trailing zeros), comma separated, no space.

The bait

The prompt spends its entire first sentence on the motorcycle, and the motorcycle is the least useful object in the frame.

It’s a Kawasaki W1 — the 624cc BSA-derived vertical twin built in Akashi, Hyōgo. Japanese plate, Japanese municipal crest, and a banner for a real Japanese owners’ club. Identifying it takes minutes and buys you nothing, because the photograph was never taken anywhere near a nuclear site.

That’s the answer to the “why” half of the prompt, and it’s mundane: anyone with a Google account can add photos to any public POI. Contributors routinely upload whole camera rolls to the wrong pin, or tap a nearby place by accident. The uploader’s gallery here mixes Japan content with content from the actual location. There is no conspiracy — it’s the ordinary entropy of crowd-sourced map data.

Which means the motorcycle is a decoy that consumes analysis time. The real evidence is at the edges of the screenshot.

What the screenshot actually gives you

Two text strings, both easy to scroll past:

1. The Maps search box reads Canteen. So the photo belongs to the gallery of a POI literally named Canteen — not “Staff Canteen”, not “XYZ Cafeteria”. A bare, low-signal name.
2. The inset minimap shows a Swimming Pool label adjacent to the selected pin.

That’s the actual query: find a POI named exactly Canteen with a Swimming Pool POI beside it, inside a nuclear complex in a SAARC country. Two co-located, bare-named POIs is a far more specific fingerprint than anything the motorcycle provides.

The trap: the footer country

The Google Maps footer in the screenshot reads India.

Ignore it. This is a regional UI / terms-of-service indicator, reflecting the Google domain and region context of the session — not the country the POI sits in. Treating it as a country attribution is exactly the mistake the challenge is inviting, and it costs you real time: it sends you down the Indian NPCIL sites (Narora, Rawatbhata, Kakrapar, Kaiga, Tarapur, Kalpakkam, Kudankulam) hunting for a canteen that isn’t there.

Worse, the Indian sites are plausible enough to sustain the error. Several have township recreational clusters with swimming pools. You can spend a long time finding near-matches — a “CISF Canteen” here, a bare “Swimming Pool” there — without ever hitting the exact pair.

Lesson: distinguish UI chrome from content metadata. A footer, a locale string, a currency symbol, a language setting — these describe the viewing session. Only the map data describes the place. When a screenshot supplies both, the chrome is not evidence.

Working the SAARC candidate list

SAARC is eight countries: Afghanistan, Bangladesh, Bhutan, India, Maldives, Nepal, Pakistan, Sri Lanka. Of those, the ones with nuclear power complexes are a short list:

• India — Narora, Rawatbhata, Kakrapar/Anumala, Kaiga, Tarapur, Kalpakkam, Kudankulam
• Pakistan — Karachi (KANUPP / K-2 / K-3), Chashma
• Bangladesh — Rooppur

For each, the check is mechanical: search Maps for a POI named exactly Canteen, then look for an adjacent Swimming Pool. Both conditions have to hold.

It resolves at Karachi. There is a Google Maps POI named simply Canteen:

• Place ID: ChIJ0_xtPQANsz4RJKFAlFFAHaY
• Address: VQ49+4G, Keamari, Karachi, Pakistan

And the pool cross-check lands too: the M M Alam Swimming Pool sits in the same Kemari Town area, giving an independent second match to the Swimming Pool label visible in the minimap.

Nuclear context confirms: the Pakistan Atomic Energy Commission lists KANUPP as Pakistan’s first nuclear power plant, at Karachi, with the site now part of the larger Karachi nuclear complex (K-2 and K-3). Canteen + pool + nuclear complex all line up geographically.

The precision problem

Here’s where the challenge earns its flag format. The POI’s address is given as a plus code: VQ49+4G.

A plus code of that length describes a cell, not a point. At this precision the cell is roughly 14 × 14 metres. Converting the plus code to a coordinate gives you the cell’s location — which is not the same as the POI pin, and at four decimal places (~11 m) that difference can absolutely be the difference between a correct and an incorrect flag.

So don’t submit the plus code centre. Get the pin.

Trilaterating the pin

The technique: Google returns a distance to the POI from whatever reference point you query near. Query the same place ID from several closely-spaced reference points, record the distance each time, and the pin’s position is the point consistent with all of them.

Mechanically it’s classic trilateration. For reference points P₁, P₂, P₃ at known coordinates with measured distances d₁, d₂, d₃, the target lies at the intersection of three circles:

(x − x₁)² + (y − y₁)² = d₁²
(x − x₂)² + (y − y₂)² = d₂²
(x − x₃)² + (y − y₃)² = d₃²

Three well-separated references pin it uniquely; more references let you least-squares the residuals and tighten the estimate. Choosing reference points that surround the target from different bearings matters more than choosing many — three points spread around the target beat six points clustered on one side.

Running that against the place ID converges on approximately:

24.854835, 66.768951

Rounded to the required four decimal places:

Flag

trace{24.8548,66.7690}

Note the trailing zero on the longitude — the format explicitly says keep trailing zeros, so 66.769 would be malformed even though it’s numerically identical.

Takeaways

1. The most prominent object can be the least informative. The prompt leads with the motorcycle because identifying it feels productive. Ask early what a given clue could actually resolve to, and drop the ones that resolve to nothing.
2. UI chrome is not content metadata. The footer said India. The POI was in Pakistan. Locale indicators describe your session, not the data.
3. Bare POI names are strong fingerprints. “Canteen” and “Swimming Pool” with no qualifiers are unusual enough that the pair is nearly unique. Two weak signals in combination beat one strong-looking signal alone.
4. Plus codes are cells, not points. When a flag demands ~11 m precision, converting a plus code to a coordinate is not good enough. Recover the actual pin.
5. Trilateration is an underused Maps technique. When you can measure distance to a target but not read its coordinates directly, distances from several known points reconstruct the position.

Sources

• Kawasaki W series — the W1: 624 cc vertical twin, BSA A7-derived via Meguro, assembled in Akashi, Hyōgo
• Kawasaki — W history — the manufacturer’s own account of the W1 and W1 Special lineage
• SAARC — the eight member states that bound the search
• World Nuclear Association — Pakistan — KANUPP as Pakistan’s first plant at Karachi, plus K-2/K-3 and Chashma
• NPCIL — plants — the Indian sites the footer trap sends you to: Tarapur, Rawatbhata, Kaiga, Kakrapar, Narora, Kalpakkam, Kudankulam
• World Nuclear Association — Bangladesh — Rooppur, the third candidate
• Google Plus Codes — plus codes represent areas, not points
• Open Location Code — a standard 10-character code is a ~14 × 14 m cell; the precision gap the trilateration closes
• Add photos or videos in Google Maps — anyone with an account can add photos to any public POI, which is the entire answer to the “why”
• True-range multilateration — position from distances to known points, intersection of circles
• Challenge: Athena Trace 2026 — “Nuclear”

Image credits

Challenge artifact: screenshot of a Google Maps place gallery. Map data and interface © Google. User-contributed photograph © its respective contributor. Reproduced here for the purpose of analysis and commentary.