THEBLACKBOOK AUDIT
Investigation · The Israeli Influence Hub

Toka. The Israeli firm that sells governments the ability to alter camera footage, and the American venture capital that funds it.

Where Pegasus reads your phone, Toka rewrites the visual record. The company is licensed by the Israeli Ministry of Defense, capitalized by Andreessen Horowitz, and pitching US federal agencies. This is the current-tense expression of the pipeline this hub documents.

Toka was founded in 2018 by former Prime Minister Ehud Barak and former IDF Cyber Staff chief Brig. Gen. (ret.) Yaron Rosen. Andreessen Horowitz led the seed round in the same month. Eclipse Ventures led a $37.5M Series B in 2021. In December 2022, Haaretz obtained the company's internal pitch documents. The slides carried the header Discover, Hack, Alter. Ethical hackers reviewing the materials for Haaretz described the alteration capability as leaving no forensic trace on the target device. Toka has not disputed the authenticity of the documents. In December 2024, TechCrunch confirmed the company is actively pursuing US federal agency contracts.

Primary sources include the full text of the Haaretz investigation, TechCrunch on Toka's US federal pursuit, Globes on the 2018 seed round, and the WhatsApp v. NSO Group docket.

§1 · Summary Brief

What this page is about

Toka sells governments the ability to alter surveillance camera footage. The company was founded in 2018 by former Israeli Prime Minister Ehud Barak and a former IDF Cyber Staff chief. Andreessen Horowitz led the seed round. The internal pitch deck, obtained by Haaretz in 2022, carried the header Discover, Hack, Alter. In December 2024, TechCrunch confirmed Toka is pursuing US federal agency contracts.

This page treats Toka as the current-tense expression of a longer pipeline. Israeli intelligence talent starts cyber-offensive firms. American venture capital funds them. The firms then sell into US federal agencies. NSO Group is the past-tense version of that pipeline. Toka is the version being written now.

Every capability claim on this page is graded. The foundational reporting is the Haaretz investigation by Omer Benjakob and Avi Scharf, which obtained internal company documents; TechCrunch confirmed the US federal pursuit two years later. The founding, funding, and client list are on the record in Globes, Forbes, Bloomberg, and Toka's own disclosures. Where a claim rests on the pitch deck alone, it is graded PROBABLY TRUE, not FACT.

What we are NOT saying

We are not saying any specific piece of surveillance footage has been altered by Toka. No such deployment is in the public record.

We are not saying Toka's Israeli-intelligence founder lineage means every deployment serves an Israeli state interest. The founder pipeline is documented pattern; specific customer-versus-Israel conflict, in the case of Toka, is currently an open question.

We are not saying Andreessen Horowitz knew what Discover, Hack, Alter meant when it led the seed round in 2018. The pitch deck Haaretz obtained was dated later. What is on the record is the funding relationship, and the fact that the firm continued to back Toka after the capability became public.

§2 · Thesis

Toka sells footage alteration, not phone hacking, and is funded by top-tier US venture capital.

The popular story of Israeli spyware is Pegasus. Pegasus is well-documented, sanctioned by the US government, and the subject of live litigation. Toka is different in three ways, and the three differences are the story.

First, the target. Pegasus infects phones to exfiltrate data. Toka breaks into networked cameras and IoT devices, and offers the ability to alter the footage those devices produce. If Pegasus is a wiretap, Toka is an evidence-tampering tool. A journalist whose phone is infected will eventually notice the battery drain. A camera whose recording has been altered leaves the operator no signal at all.

Second, the money. NSO's investor base is largely Israeli and Gulf. Toka's largest investor is Andreessen Horowitz, one of the most influential US venture capital firms, and Marc Andreessen personally sits on Meta's board of directors while Meta's corporate subsidiary WhatsApp is litigating against NSO Group over spyware targeting its users. That is not a hypothetical conflict. It is US venture capital simultaneously investing in one spyware firm and suing another, with the same person adjacent to both decisions.

Third, the buyer. NSO's known customers include Mexico, Saudi Arabia, and the UAE, and the company was eventually sanctioned by the US Commerce Department. Toka's disclosed customer list, in the Haaretz reporting from the company's own pitch documents, includes the United States. As of December 2024, Toka was actively pursuing additional US federal agency contracts. Toka is not being kept at arm's length from Washington in the way NSO now is. That should be the operative fact of this piece.

§3 · Timeline

2018 to 2024: from Barak’s founding pitch to Techcrunch confirming US federal contracts.

  1. 2018
    Toka founded in Tel Aviv by Ehud Barak, Yaron Rosen, Alon Kantor, and Kfir Waldman. Globes.
  2. July 2018
    $12.5M seed round led by Andreessen Horowitz and Entrée Capital, with Dell Technologies Capital, Launch Capital, Ray Rothrock, and Kevin Mandia participating.
  3. 2018-2020
    Reported early client work in Israel and Chile, the latter facilitated through the Inter-American Development Bank according to MintPress News.
  4. July 2021
    $25M Series B led by Eclipse Ventures, bringing total raised to $37.5M. Fierce Electronics.
  5. December 22, 2022
    Haaretz publishes the Omer Benjakob investigation based on internal Toka pitch documents. This is the primary source for the “Discover, Hack, Alter” capability description and the client list. Full text mirror; Common Dreams summary.
  6. December 2022
    Follow-on international coverage from Der Spiegel, Heise, and Numerama.
  7. December 6, 2024
    TechCrunch reports Toka is actively pursuing US federal agency contracts, describing the company as “a16z-backed” and pitching the ability to “hack into security cameras and other IoT devices.” TechCrunch.
  8. February 2026
    Haaretz reports Toka developed CARINT, a vehicle-hacking product that can pinpoint vehicles, remotely activate microphones, and access dashcams. Toka states the vehicle-hacking tool has been dropped from its 2026 roadmap, per its own statement. Clash Report summary.
§4 · Key Personnel

The founders, the investors, and the customer list Toka has disclosed.

Ehud Barak
Cofounder and chairman, Toka

Former Prime Minister of Israel (1999-2001), former Defense Minister, former IDF Chief of Staff. Also a documented personal associate of Jeffrey Epstein, with recorded visits to Epstein's residences (which we treat separately in the Epstein hub).

Yaron Rosen
Cofounder, initially CEO

Brig. Gen. (ret.). Former Chief of the IDF Cyber Staff. Represents the state-to-private transition at the top of the org chart rather than the middle.

Alon Kantor
Cofounder

Former Vice President of Business Development at Check Point Software Technologies, a company itself founded by Unit 8200 alumni.

Kfir Waldman
Cofounder

Former CEO of Go Arc and former senior executive at Cisco and Kayhut. The commercial side of the founding team.

Marc Andreessen
Cofounder, Andreessen Horowitz; Meta board member

A16z led Toka's 2018 seed round. Andreessen sits on Meta's board of directors. Meta subsidiary WhatsApp is the plaintiff in the ongoing litigation against NSO Group. This is the operative conflict, and it has not been publicly addressed by Meta or by a16z.

Dell Technologies Capital
Seed and later investor

Corporate venture arm of Dell. Represents another axis of US institutional money invested in an Israeli offensive cyber tool.

Eclipse Ventures
Series B lead

Led the 2021 $25M round. Palo Alto based venture firm focused on industrial and physical infrastructure.

Israeli Ministry of Defense
Regulator and licensor

Licenses and oversees Toka's international sales under the 2007 Israeli Defense Export Control Law. Every foreign government customer of Toka is a customer the MOD specifically approved.

§5 · Graded Claims

Eleven claims about Toka, each graded, each cited to a primary source.

Toka was founded in 2018 by Ehud Barak, Yaron Rosen, Alon Kantor, and Kfir Waldman.

FACT

The founding is documented in the company's own materials and in contemporary Israeli business press coverage of the 2018 seed round.

Toka operates under Israeli Ministry of Defense oversight and licensing.

FACT

Confirmed in Haaretz reporting via Toka's own public statements and consistent with Israeli Defense Export Control Law (2007), which requires MOD licensing for any offensive cyber capability sold internationally. Every disclosed customer government is one the MOD approved.

Toka's product suite, marketed to governments, includes tools to identify, exploit, and alter footage on internet-connected cameras and other IoT devices.

FACT

Multiple independent outlets have reported the capability from internal Toka pitch materials carrying the 'Discover, Hack, Alter' section header and the VISINT, ZONE, and CARINT product families. Toka has not disputed the authenticity of the materials.

Discover, Hack, Alter.

The tools leave no forensic fingerprint on the target device.

SOME SMOKE

This claim originates in Toka's own sales documents. An ethical hacker reviewed the materials at Haaretz's request and found the technical claims plausible. No independent forensic verification of a deployed alteration in the wild exists in the public record. The claim is what Toka tells its prospective customers. Whether it is fully true in every deployment is unproven.

Known client states include Israel, the United States, Germany, Australia, and Singapore.

FACT

The client list is documented in the Haaretz reporting from Toka's own internal materials, valid as of the 2022 investigation. The current customer list is likely to have grown.

Toka is backed by Andreessen Horowitz, Dell Technologies Capital, Entrée Capital, Launch Capital, and Eclipse Ventures, with $37.5M raised across seed and Series B.

FACT

The investor list and total capital raised are confirmed across multiple independent business press outlets and reflected in Crunchbase.

Marc Andreessen sits on Meta's board while a16z funds Toka; Meta subsidiary WhatsApp is simultaneously litigating against NSO Group over spyware targeting its users.

FACT

The board membership, the a16z investment, and the WhatsApp v. NSO Group litigation are all documented in official public records. The specific fact of one board director being adjacent to both the plaintiff-side spyware litigation and an investment in a different spyware firm is the point.

Toka developed CARINT, a vehicle-hacking product that can pinpoint vehicles, remotely activate microphones, and access dashcams. In 2026, Toka stated the tool has been dropped from its roadmap.

FACT

The capability is documented in the February 2026 Haaretz reporting and corroborated in international summaries. The 'dropped from roadmap' claim is Toka's own statement to the reporter and cannot be independently verified from the public record.

Toka's Chile contracts were facilitated through the Inter-American Development Bank.

PROBABLY TRUE

MintPress News reported the IDB facilitation path in 2021. It has not been publicly contradicted, and no independent secondary confirmation is currently available. A dedicated FOIA or IDB records request would upgrade this to FACT.

Toka does not disclose exploits it discovers back to affected vendors (Amazon Echo, Google Nest, Ring, and others), meaning vulnerabilities Toka uses remain open to other attackers.

PROBABLY TRUE

Toka has publicly stated a 'no disclosure' posture consistent with the offensive-cyber industry standard. This is the same posture NSO and its peers have publicly acknowledged. Not independently confirmed on a per-vulnerability basis.

Toka has actively pursued contracts with US federal agencies.

FACT

TechCrunch's December 2024 reporting documents Toka's US business development pipeline and the a16z backing, and the story has not been publicly disputed by Toka.

§6 · Record vs Narrative

What the public record shows about Toka, and what remains unverified.

The mainstream US press has almost entirely missed this company. The Haaretz scoop was the story of the year in European tech-privacy reporting, picked up promptly in Germany, France, and elsewhere. In the United States, the piece was mostly summarized once and then dropped. Common Dreams and MintPress covered it as an advocacy story, TechCrunch returned to it two years later on the US-federal angle, and that is roughly the extent of American coverage of a company whose disclosed customer list already includes the United States. That editorial gap is a fact worth recording, separately from the underlying capability.

Where the record does not, at the moment, support strong claims is deployment. There is no documented case in the public record of Toka's product being used to alter footage that then influenced a specific public event. What exists is the sales pitch, the client list, the capability description, and Toka's own statement that its tools leave no forensic trace. That is enough to matter. It is not enough to attribute specific outcomes. If a reader wants to draw a causal line from Toka to any particular altered surveillance video, the reader is drawing that line ahead of the primary evidence.

The other place we hold the line is on the founders. Barak, Rosen, Kantor, and Waldman all have Israeli intelligence and defense backgrounds. That is the story of the founder pipeline the Unit 8200 investigation traces. It is not itself evidence that any specific Toka deployment has served an Israeli state interest at the expense of a foreign customer's interest. The founder pipeline is documented pattern; specific customer-versus-Israel conflict, in the case of Toka, is currently a open question.

§7 · Why It Matters Now

Why Toka matters now: Israeli intelligence talent, US venture capital, US federal contracts.

Every historical case on this hub records some version of the same pattern: capability developed under Israeli military authority, moved through a state-approved private channel, and sold or deployed abroad with US complicity of one kind or another. The interesting part of Toka is how compressed the pattern has become. A former Prime Minister and a former Cyber Staff chief cofound the company. A16z leads the seed round in the same year. The company is licensed by the MOD. Six years later, it is pitching US federal agencies with a a16z partner still on the cap table and Andreessen still on Meta's board. Between the founders' state exit and the pitch to Washington, everything happens inside a single decade, and inside a single institutional friend group.

What this piece does not claim is that Toka has caused any specific downstream harm we can document. What it does claim is that the pipeline the hub tracks now runs, at this specific firm, from the Israeli state to Meta's board to a US federal procurement pitch in seventy-two months. That fact, all by itself, is a thing US regulators and the US press would treat as a national-security news story if the source country were China. It is not being treated that way when the source country is Israel, and that asymmetry is itself part of the story.

§8 · FAQ

Questions worth taking seriously

Is Toka actually selling to the US government?

Toka is actively pursuing US federal agency contracts, per TechCrunch's December 2024 reporting. Toka's own disclosed customer list already includes the United States. Whether any specific agency has signed on remains outside the public record.

Has Toka’s alteration capability ever been used?

Not in the public record. What exists is the sales pitch, the client list, the capability description, and Toka's own statement that its tools leave no forensic trace on the target device. That is enough to matter. It is not enough to attribute any specific altered surveillance video to Toka.

How is Toka different from NSO Group?

NSO Group's Pegasus reads a target's phone. Toka goes further: it markets the ability to alter footage on cameras and other IoT devices, not just read from them. Same founder pipeline, same investor universe, different category of capability.

Why has the US press mostly ignored this?

The Haaretz scoop was picked up promptly across European tech-privacy reporting but summarized once and dropped in the American mainstream. Common Dreams and MintPress covered it as an advocacy story. TechCrunch returned to it two years later on the US-federal angle. The editorial gap is a fact worth recording, separately from the underlying capability.
§9 · Standing Invitation

If you are named on this page

If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.

This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.

§10 · Sources

The Toka research brief and the primary sources it cites.

Every claim on this page grades to one of FACT · PROBABLY TRUE · SOME SMOKE · PURE SPECULATION · FALSE / MISLEADING. The grade badge hedges. The prose does not. Nothing false is asserted here as accepted claim.

The full research brief, with all sourcing and notes on editorial judgment, is in the knowledge base at /knowledge-base/programs/_research_briefs/toka.md.

Full method: Methodology. Related hub: Israeli Influence. Cross-cut hubs: Surveillance State(s) and Self-Dealing.

Last updated July 13, 2026. If a link 404s or a date is wrong, tell us and we will fix it publicly.

▶ Dossier mode

The same investigation, restaged one beat at a time. Built to be presented.

Present this →
▦ Ledger gaps

Help us fill these lines.

This entry is graded on what’s on the public record. These are the blanks we know about. If you can source one, you’re rebuilding the ledger with us.

  • OpenHas any Toka deployment ever altered footage in a real public event, and if so, which event and which customer?Help fill this →
  • OpenWhich governments beyond the disclosed client states (Israel, the United States, Germany, Australia, and Singapore) have purchased Toka's products, and what do Israeli Ministry of Defense export licenses show about the full customer list?Help fill this →

Notify me when a gap is filled

We'll email you when we fill one of the gaps above.

By signing up you agree to receive emails from The Black Book Audit. Unsubscribe anytime.