US officials say ToTok, a chat app gaining popularity around the world, is a spying tool by the government of UAE; Google and Apple have now removed the app

ToTok, an Emirati messaging app that has been downloaded to millions of phones, is the latest escalation of a digital arms race.

New York Times 2019-12-23

Context & Ripple Effects

The UAE was already in the spyware business before ToTok: reporting earlier in 2019 described Karma, an iMessage exploit used to hack iPhones of activists, diplomats, and rival leaders. ToTok represents the softer variant of the same playbook — instead of exploiting a vulnerability, a free chat app that millions voluntarily install. The story also foreshadows what became the TikTok fight: US officials weighing whether a foreign government's access to a popular consumer app is a national-security problem.

First-order effects

Millions of existing users lose distribution and updates overnight as Google and Apple pull ToTok from their stores, cutting off the app's growth funnel.
The UAE loses its most scalable collection channel — contact graphs and message metadata flowing through a consumer app — at least on iOS and Android devices that honor the takedown.

Second-order effects

Google and Apple are now cast as de facto national-security screeners, a role that raises the bar for any state-backed consumer app seeking store placement — and invites accusations of selective enforcement.
The playbook transfers directly to the China debate: the same officials who flagged ToTok apply the logic to TikTok, where an internal tool's access to pre-ban Indian users' data (reported in 2023) shows how data access outlives an app's availability.

Third-order effects

App stores consolidate into geopolitical chokepoints: when a government wants to reach foreign phones, the viable paths narrow from exploits like Karma to store-distributed apps, making the two storefronts the enforcement layer for espionage policy.
If the pattern holds, expect a standing review regime for foreign-linked consumer apps — with the unresolved question being whether scrutiny is applied by stated criteria or by which country the developer answers to.

The trend: State intelligence is migrating from exploit-based hacking toward consumer apps as collection tools, pushing Apple and Google into the role of arbiters of which governments' software reaches users' phones.

Discussion

@nicoleperlroth Nicole Perlroth on x
New: A massively popular app that has been downloaded millions of times is actually an Emirati spy tool @MarkMazzettiNYT and I confirmed. https://www.nytimes.com/...
@yashar Yashar Ali on x
ToTok, a messaging app that as of last week was one of the most popular in the Apple and Google stores, is billed as a secure way to chat by video/text message with friends/family But it turns out that it's actually a spying tool for Emirati intelligence https://www.nytimes.com/.…
@nicoleperlroth Nicole Perlroth on x
ToTok claims it was removed from the Apple and Google stores for a “technical issue.” It was removed because of our story: https://www.nytimes.com/... https://twitter.com/...
@josephfcox Joseph Cox on x
Piece says the app has been downloaded millions of times, but considering this was an intel operation wonder how many of those downloads were from real users and how many were to boost app ratings/perception of legitimacy.
@hunterschwarz Hunter Schwarz on x
ToTok is billed as a secure chat app, but it's a spying tool used by the UAE government to track every convo, movement, relationship, and image of people who installed it on their phones. https://www.nytimes.com/...
@wired @wired on x
If you're one of the hundreds of thousands of people who downloaded ToTok, delete the app immediately. It's likely a surveillance tool that can funnel data to the government of the United Arab Emirates https://www.wired.com/...
@okassim Omar Kassim on x
“..the firm behind ToTok, Breej Holding, is most likely a front company affiliated with DarkMatter, an Abu Dhabi-based cyberintelligence and hacking firm ... DarkMatter is under F.B.I. investigation” https://twitter.com/...
@amyfiscus Amy Fiscus on x
New York Times reporters were told that this popular messaging app was secretly an Emirati spy tool. They asked Apple and Google for comment. Both removed it from their app stores https://nyti.ms/2sfs6iO
@mandystadt Mandy Stadtmiller on x
Tick tock, ToTok https://twitter.com/...
@williamturton William Turton on x
nyt reports that an app, “ToTok,” downloaded millions of times on android and iphones is actually a secret spying app developed by notorious emirati spyware developer darkmatter https://www.nytimes.com/...
@chrismessina Chris Messina on x
Users searching for TikTok, downloading UAE spyware instead: https://twitter.com/... https://twitter.com/...
@profcarroll David Carroll on x
State sponsored mass data abuse camouflaged by all the regular commercial mass data abuse hidden in everyday apps #DeleteToTok https://www.nytimes.com/... https://twitter.com/...
@callumj Callum Jones on x
Still managed to jump the fence into Apple's walled garden... https://twitter.com/...
@brooklynmarie Brooke Binkowski on x
I've been thinking for awhile that we will likely come to see this time in history as a world war. We're in a cyberpunk timeline now https://twitter.com/...
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Incredible long con by the UAE. First they outlawed and blocked WhatsApp, Skype, and other VoIP/chat apps. Then they launch their own app, that of course EVERYONE instala because there's no alternative. This is the future of surveillance. https://twitter.com/...
@jennineak Jennine on x
1. “ToTok” lol 2. The Emirati government is trying to track every conversation, movement, relationship, appointment, sound and image of those who've got the app on their phone 3. The likely firm behind it employs former Israeli military spies and NSA spies https://www.nytimes.com…
@josephfcox Joseph Cox on x
ToTok, an increasingly popular chat app, turns out to be a spying tool for the Emirati government. Map contacts, location, etc it users. “Unclear whether ToTok allows the Emiratis to record video or audio calls of its users.” https://www.nytimes.com/...
@jpanzer John Panzer on x
This is really really really bad. “It has access to users' microphones, cameras, calendar and other phone data.” Basically, spyware... https://twitter.com/...
@tinybaby @tinybaby on x
We regret to inform you the duck is a CIA operative https://twitter.com/...
@ronenbergman Ronen Bergman on x
NEW: the popular messaging App ToTok, one of the most-downloaded in Apple and Google app stores during the last months, is in fact, a sophisticated hacking tool used by the government of the UAE . W\ @MarkMazzettiNYT @nicoleperlroth https://www.nytimes.com/...
@briannawu Brianna Wu on x
For all of our military spending, why the HELL are American citizens so consistently vulnerable to: ✅ electronic surveillance ✅ cyberwarfare ✅ information warfare Our information and communication infrastructure is the 21st century battle space, and civilians are combatants. http…
@lilyhnewman Lily Hay Newman on x
delete the sketchy thing 👀https://www.wired.com/ ...
@jake_hanrahan Jake Hanrahan on x
This headline “It Seemed Like a Popular Chat App. It's Secretly a Spy Tool...” applies to all of the top social media apps now though. https://www.nytimes.com/...
@surlyurbanist Keep It Surly on x
In retrospect...took nation/states a long enough time to get into this business. We really do need some form of new clearance house for this stuff. And you can't trust the national regulators. https://twitter.com/...
@nicoleperlroth Nicole Perlroth on x
This reporting entailed a ton of work and helped cut off Emirati surveillance of millions, including Americans. If you can't read it, please consider a subscription to the @nytimes Its journalism like this that I'm so proud and grateful to do. https://twitter.com/...
@naderalihashemi Nader Hashemi on x
If the UAE is such a stable/moderate/liberal/tolerant (bla, bla, bla) political system — that US officials frequently cite as a model for the Arab world — why does have to go to such extreme lengths to monitor its own citizens? https://www.nytimes.com/... @sarahleah1 @JamalsNews
@mollymckew Molly McKew on x
I feel like it's time for verified apps. https://twitter.com/...
@larryrosenthal Larry Rosenthal on x
Wait, I thought It spied for China? Maybe it's a double agent. Wait. ToTok? Tic-tac ? Which are the mints? https://twitter.com/...

Chronicles