ToTok, a messaging and voice-over-IP app launched in the United Arab Emirates in 2019, rapidly gained users because the government restricted functions of services such as Skype and WhatsApp while permitting ToTok to operate. By December 2019, it had reportedly reached 7.9 million downloads and nearly two million daily users. The app was developed by UAE-based Breej Holding, which The New York Times reported was linked to DarkMatter, an Emirati intelligence contractor under FBI investigation for alleged cybercrimes. The Times also linked Breej to Pax AI, a data-mining company located in the same building as the UAE’s signals-intelligence agency.
On December 22, 2019, The New York Times reported that U.S. intelligence assessments and its own investigation indicated ToTok was used by Emirati intelligence services to collect users’ conversations, movements, relationships, appointments, sounds, images, and other smartphone data accessible through permissions. The report said the system did not require malware or an exploit; users granted access while enabling app features. Breej Holding and co-founder Giacomo Ziani denied that ToTok was a government surveillance tool. Google and Apple removed the app on December 19 and 20, 2019; it briefly returned to Google Play on January 3, 2020, before disappearing again on February 15. The removals became the lasting regulatory and platform consequence of the allegations.
