“The wait is over.” With that short message on January 4, 2020, the makers of the chat app ToTok told millions of users that it was back on Google Play.
The return came a few weeks after Google and Apple pulled the app from their stores in December. For people across the Gulf and beyond who had used it for free calls and messages, it ended an abrupt disappearance. It did not settle the argument behind it.
The accusation
On December 22, The New York Times reported that experts believed the app was “used by the government of the United Arab Emirates to try to track every conversation, movement, relationship, appointment, sound and image of those who install it on their phones.” Threatpost summarised the paper’s findings further. The developer, Breej Holding, was likely a “front” for a company tied to the Abu Dhabi hacking firm DarkMatter, and the app could reach users’ location, contacts, microphones, calendars and cameras.
ToTok had grown quickly in the UAE, where other messaging platforms such as WhatsApp and Skype are partly restricted, and had been downloaded by millions. Google told the Times when it removed the app that it had “violated unspecified policies.”
The denial
The app’s co-founders, Giacomo Ziani and Long Ruan, said on December 24 that a technical analysis by a former NSA employee found ToTok “simply does what it claims to do, and really nothing more… no exploits, no backdoors, and no malware.” In a Khaleej Times interview, Ziani said: “We firmly deny this baseless accusation, and we are profoundly saddened by this complete fabrication that was thrown at us.” He added that the company felt “caught up in some vile conspiracy against the UAE.” In another interview, on December 29, he said he was unsure why the app was targeted and insisted it had no ties to any government.
What changed in the app
Google did not say why it let the app back. A spokesperson would say only that the company takes reports of security and privacy violations seriously. “If we find behavior that violates our policies, we take action,” the spokesperson said by email on Monday, January 6.
The new Play Store page lists updates, among them a redesigned dialog that asks users for permission before the app accesses and syncs their contact lists. CNET noted the changes also cover how the app makes requests for user data.
Apple had not followed. As of the reports, ToTok was still missing from the App Store, and Apple did not respond to Threatpost’s request for comment.
Not everyone was reassured. Security researcher Kim Zetter wrote that Google had let ToTok back in over the weekend “despite the fact that the intel community insists the chat app is a spy tool for the UAE.” She also said ToTok had approached her and others about posting positive, sponsored tweets.
Sources
- ToTok returns to Google Play Store after accusations of spying – CNET
- ToTok Returned to Google Play Despite 'Spy Tool' Claims – Threatpost
