Former IDF intelligence personnel likely tied to UAE spy app

Former Israeli military intelligence personnel are likely tied to an Emirati messaging app that was secretly spying on its users in a mass surveillance campaign, according to a Sunday report.

The United Arab Emirates government uses the ToTok service to monitor users’ location, conversations, relationships and other information, the New York Times reported, citing its own investigation into the app and American officials with knowledge of a classified US intelligence report.

ToTok has been downloaded by millions of users through the Apple and Google app stores since it debuted several months ago. Most users are in the UAE, but it has been downloaded by people worldwide, and this month was one of the top social apps in the US, according to the App Annie research firm.

The app, which is separate from, but apparently named after the popular Chinese TikTok app, also ranked highly in Saudi Arabia, the UK, India and Sweden.

State-backed publications started advertising ToTok in the UAE in recent months as a “free, fast and secure” messaging tool, in a country where many messaging apps are restricted by the government.

Both Google and Apple have removed the app from their stores, but users who have downloaded it already are still able to use it.

It is the latest in a string of digital weapons that wealthy governments have developed to spy on their adversaries and citizens.

Saudi Arabia, the UAE and Qatar have in the past used private firms staffed by Israelis and Americans for such operations.

The company operating ToTok, called Breej Holding, was probably tied to the Abu Dhabi cyberintelligence company DarkMatter.

In October, Hebrew media reported that DarkMatter was actively recruiting graduates of Unit 8200, the elite Israel Defense Forces intelligence unit.

According to a Yedioth Ahronoth report, graduates of the vaunted intelligence unit are regularly offered $100,000-plus a month salaries, signing bonuses and luxury homes in Cyprus.

Yedioth said several firms were recruiting the Israelis, but only named DarkMatter. Israel and the UAE do not have formal diplomatic ties, but are said to have close security cooperation largely focused on Iran, their common foe.

A second report published in TheMarker business daily said that DarkMatter maintains an office in Cyprus that employs Israeli software developers.

One defense official identified as ‘Y’ warned the TheMarker about the “de facto smuggling of Israeli intellectual property without any supervision of the Defense Ministry.”

“They’re taking these young people to Cyprus, buying them off with huge salaries,” he said, adding that he knows of researchers who were offered positions at DarkMatter with salaries of close to $1 million a year.

It wasn’t clear if the IDF veterans obtained permission to work on foreign intelligence projects from the Defense Ministry, which declined to comment on both TheMarker and Yedioth reports.

The vaunted 8200 unit — roughly equivalent to the National Security Agency in the US — is highly regarded for its computer prowess and seen as a major incubator of Israel’s high-tech startup culture.

DarkMatter, which bills itself as a private intelligence firm, is being investigated by the FBI for suspected cybercrimes.

The UAE is an ally to the US, with both seeing Iran as a threat, but has in the past stifled dissent with cutting edge technology, targeting journalists, critics and rights activists.

It has handicapped other popular social apps, including WhatsApp and Skype, which bolstered ToTok’s popularity.

It’s unclear whether US intelligence has confronted the UAE about the app, or when it became aware of its use as a spy tool, the New York Times report said.

ToTok is likely based on a Chinese app called YeeCall and operates like other smartphone apps that have access to users’ location, contacts, microphones, cameras and calendars.

While advanced phone hacking tools cost some $2.5 million, the app gives the UAE a way to essentially hack users’ phones for free, with users willingly signing up to divulge their own information.

It was unclear whether the UAE is able to record video or audio from the phones.