ARI SHAPIRO, HOST:
Last week, Apple and Google removed a new messaging app from their app stores. It's called ToTok, and it's been growing in the Middle East and the U.S. The government of the United Arab Emirates is accused of using ToTok as a spying tool. That's according to a new report from The New York Times which cites American intelligence officials. NPR tech correspondent Shannon Bond joins us now. Hi, Shannon.
SHANNON BOND, BYLINE: Hi, Ari.
SHAPIRO: I confess, when I saw the name of this app, ToTok, I thought it was a typo and people meant TikTok. That's not what it is. What is ToTok?
BOND: That's right. I think a lot of people probably made that mistake. So ToTok is a messaging app. It allows people to chat by video or text sort of like Facebook Messenger or WhatsApp. And it's now, as you said, unavailable from Apple and Google in their app stores. That's because of this story in The New York Times that ToTok is being used by the Emirati government to spy on people. Now, NPR hasn't independently confirmed this, and ToTok hasn't responded to the allegations. It says the app is temporarily unavailable from Google and Apple because of a technical issue right now.
SHAPIRO: How popular is it?
BOND: Well, it's new but very popular. It was launched in August. Since then, it has been downloaded by about 8 million people globally, according to App Annie, a mobile analytics company. It's been especially popular in the Middle East and India, but it's also been getting downloads here in the U.S. Around 240,000 people here have downloaded it. In the UAE, it seems to have really benefited from the fact that the government there heavily restricts communications apps, so there's lots of limits on using other apps you might think of for voice and video calls like FaceTime, Skype, WhatsApp. And ToTok's emerged as an attractive alternative, and as the more people started using it, that drove more and more downloads in the UAE and elsewhere.
SHAPIRO: I think a lot of people are used to their devices spying on them. What are intelligence officials specifically worried about with ToTok?
BOND: Right. So like many apps, ToTok collects a lot of information about its users, and this wasn't about malicious code or spyware. These were standard permissions that people were agreeing to. Its privacy policy says it may share data, and we know people tend to agree to those policies without reading them. But like I said, people don't necessarily have access to other apps that might be - have encrypted communications, so this has been popular. I spoke to Patrick Wardle. He's a security researcher at a company called Jamf, and he looked into the app for the Times. He found that ToTok asked for access to location, photos, calendars, contacts.
PATRICK WARDLE: So for example, when you launch the app for the first time, it asks you if you want to be connected with your friends. If you click allow, the application will access your address book, collect everyone in your address book and attempt to send that out to a server.
BOND: And not only can it see who you're talking to. It can see the contents of those messages, so it can see sort of, you know, the contents of your conversation.
SHAPIRO: So does that mean that if - I don't know - democracy activists were planning to meet up or LGBTQ people were connecting, that the government would know about that in the UAE? Is that the concern?
BOND: Yeah, that is the concern. The Times reports the Emirati government is basically behind the app and is getting this data, and it's known for cracking down on dissent. According to Human Rights Watch, it regularly surveils dissidents and their families. And Wardle says the kind of data that ToTok is collecting is a powerful tool.
WARDLE: You're able to push out an application that becomes very popular, that millions of people are going to download and start sharing their contacts and chatting. I mean, that's really a goldmine from a surveillance and intelligence operation point of view.
BOND: So I think this is a reminder to all of us. As we're going around every day using our smartphones, we're leaving trails of data behind about ourselves. And we know companies might use this data to target us with ads, but here's an example of how governments may be using it to watch us as well.
SHAPIRO: That is NPR tech correspondent Shannon Bond. Thanks, Shannon.
BOND: Thanks, Ari. Transcript provided by NPR, Copyright NPR.
