Google and Apple have pulled ToTok, a messaging app from the United Arab Emirates, after The New York Times reported that it doubled as a spying tool for the Emirati state. Google took it down first. Apple followed the next day.
The app has nothing to do with China’s TikTok, whatever the name suggests. It sells itself as a simple, secure way to chat by video or text. People who already had it installed can keep using it.
The Times, citing American officials, said ToTok gives UAE spies a view of users’ conversations, movements and photos. It also named the publisher, Breej Holding Ltd, as affiliated with DarkMatter, an Abu Dhabi intelligence and hacking firm. DarkMatter is allegedly under FBI investigation over possible cyber-crimes, and according to the paper it employs Emirati intelligence officials, former National Security Agency staff and former Israeli military intelligence operatives.
The app is only a few months old, but it travels. The Times said users in the Middle East, Europe, Asia, Africa and North America have downloaded it. The Google Play Store showed five million Android downloads before the removal, and the tracking firm App Annie ranked it among the most downloaded social apps in the US the previous week.
What the analysts found
Objective-See, a security firm that worked with the Times, ran the iOS version on a jailbroken iPhone, meaning one altered to bypass the manufacturer’s restrictions. Its analysts decrypted the app and examined its network traffic. They found no backdoors, no malware and no exploits.
That, they argued, is the point. The app’s apparent legitimacy is “really the genius of the whole mass surveillance operation”, in their words.
The company’s privacy terms say it may share personal data with group companies. They do not mention the UAE government.
The company’s reply
ToTok, DarkMatter and the UAE embassy in London did not immediately answer a request for comment from the BBC. ToTok did post on its blog. “While the existing ToTok users continue to enjoy our service without interruption, we would like to inform our new users that we are well engaged with Google and Apple to address the issue,” it said.
New users with Samsung, Huawei, Xiaomi or Oppo phones can still get the app from those makers’ own stores. ToTok told users it expects to be back in the main app stores soon, with new features including payments, news, commerce and entertainment.
There is a local backdrop. WhatsApp and Skype, which offer end-to-end encryption, are restricted in the UAE. They work for messaging but not for video calls.
