Sources shed light on how Dubai-based surveillance firm DarkMatter is helping the UAE government track, locate, and hack its citizens
n July, Simone Margaritelli, an Italian security researcher, boarded a Boeing 777 in Rome headed for Dubai, a city now billing itself as a tech startup hub. Tweets: @theintercept Tweets: The Intercept / @theintercept : “We press a button and BOOM! All the devices in the mall are infected and traceable.” http://theintercept.com/... http://twitter.com/...
Context & Ripple Effects
This 2016 investigation is the earliest data point in a now well-documented arc of UAE state surveillance. It names DarkMatter — a Dubai firm recruiting foreign security researchers, including Italian researcher Simone Margaritelli arriving via Rome — as the in-house engine helping the government track, locate, and hack its own citizens, at a moment when Dubai was marketing itself as a startup hub.
What followed confirms the report was structural rather than anecdotal: by 2019 the UAE had used an iMessage exploit called Karma against activists, diplomats, and rival leaders, DarkMatter was locked in a market battle with NSO Group for authoritarian-government business, US veterans were revealed to have built the original surveillance unit after 9/11, and IBM, Hikvision, and Huawei were found supplying a citywide biometric system.
First-order effects
- UAE citizens, activists, and journalists are directly exposed: DarkMatter gives the government device-tracking, location, and remote-hacking capability aimed at its own population.
- Foreign engineers like Margaritelli are being recruited into offensive state work under the cover of Dubai's tech-hub branding, collapsing the line between civilian tech employment and intelligence contracting.
Second-order effects
- Commercial spyware becomes a competitive market: the later NSO Group–DarkMatter rivalry shows vendors bidding for the same authoritarian-state clients, driving capability up and prices toward whoever holds zero-day inventory.
- Platform vendors are forced onto the defensive — the Karma iMessage exploit pushed messaging platforms themselves into the counter-surveillance fight, while suppliers like Hikvision and Huawei extend the same state relationship from phone hacking to city-scale biometric infrastructure.
Third-order effects
- If the pattern holds, states internalize offensive cyber through national champion firms rather than relying solely on external brokers — the lineage running from the US-built post-9/11 surveillance unit to DarkMatter suggests surveillance capacity migrating in-house over time.
- The spyware industry's growth around dual-use code creates mounting pressure for export controls and platform hardening, since the same tools sold to one government inevitably surface against dissidents, diplomats, and foreign leaders elsewhere.
The trend: State surveillance is consolidating around homegrown commercial hacking firms that compete across borders for government clients, turning offensive cyber capability from a covert intelligence function into a tradable industry.