Toka. The Israeli firm that sells governments the ability to alter camera footage, and the American venture capital that funds it.
Where Pegasus reads your phone, Toka rewrites the visual record. The company is licensed by the Israeli Ministry of Defense, capitalized by Andreessen Horowitz, and pitching US federal agencies. This is the current-tense expression of the pipeline this hub documents.
Toka was founded in 2018 by former Prime Minister Ehud Barak and former IDF Cyber Staff chief Brig. Gen. (ret.) Yaron Rosen. Andreessen Horowitz led the seed round in the same month. Eclipse Ventures led a $37.5M Series B in 2021. In December 2022, Haaretz obtained the company's internal pitch documents. The slides carried the header Discover, Hack, Alter. Ethical hackers reviewing the materials for Haaretz described the alteration capability as leaving no forensic trace on the target device. Toka has not disputed the authenticity of the documents. In December 2024, TechCrunch confirmed the company is actively pursuing US federal agency contracts.
Primary sources include the full text of the Haaretz investigation, TechCrunch on Toka's US federal pursuit, Globes on the 2018 seed round, and the WhatsApp v. NSO Group docket.
What this page is about
Toka sells governments the ability to alter surveillance camera footage. The company was founded in 2018 by former Israeli Prime Minister Ehud Barak and a former IDF Cyber Staff chief. Andreessen Horowitz led the seed round. The internal pitch deck, obtained by Haaretz in 2022, carried the header Discover, Hack, Alter. In December 2024, TechCrunch confirmed Toka is pursuing US federal agency contracts.
This page treats Toka as the current-tense expression of a longer pipeline. Israeli intelligence talent starts cyber-offensive firms. American venture capital funds them. The firms then sell into US federal agencies. NSO Group is the past-tense version of that pipeline. Toka is the version being written now.
Every capability claim on this page is graded. The foundational reporting is the Haaretz investigation by Omer Benjakob and Avi Scharf, which obtained internal company documents; TechCrunch confirmed the US federal pursuit two years later. The founding, funding, and client list are on the record in Globes, Forbes, Bloomberg, and Toka's own disclosures. Where a claim rests on the pitch deck alone, it is graded PROBABLY TRUE, not FACT.
We are not saying any specific piece of surveillance footage has been altered by Toka. No such deployment is in the public record.
We are not saying Toka's Israeli-intelligence founder lineage means every deployment serves an Israeli state interest. The founder pipeline is documented pattern; specific customer-versus-Israel conflict, in the case of Toka, is currently an open question.
We are not saying Andreessen Horowitz knew what Discover, Hack, Alter meant when it led the seed round in 2018. The pitch deck Haaretz obtained was dated later. What is on the record is the funding relationship, and the fact that the firm continued to back Toka after the capability became public.
Toka sells footage alteration, not phone hacking, and is funded by top-tier US venture capital.
The popular story of Israeli spyware is Pegasus. Pegasus is well-documented, sanctioned by the US government, and the subject of live litigation. Toka is different in three ways, and the three differences are the story.
First, the target. Pegasus infects phones to exfiltrate data. Toka breaks into networked cameras and IoT devices, and offers the ability to alter the footage those devices produce. If Pegasus is a wiretap, Toka is an evidence-tampering tool. A journalist whose phone is infected will eventually notice the battery drain. A camera whose recording has been altered leaves the operator no signal at all.
Second, the money. NSO's investor base is largely Israeli and Gulf. Toka's largest investor is Andreessen Horowitz, one of the most influential US venture capital firms, and Marc Andreessen personally sits on Meta's board of directors while Meta's corporate subsidiary WhatsApp is litigating against NSO Group over spyware targeting its users. That is not a hypothetical conflict. It is US venture capital simultaneously investing in one spyware firm and suing another, with the same person adjacent to both decisions.
Third, the buyer. NSO's known customers include Mexico, Saudi Arabia, and the UAE, and the company was eventually sanctioned by the US Commerce Department. Toka's disclosed customer list, in the Haaretz reporting from the company's own pitch documents, includes the United States. As of December 2024, Toka was actively pursuing additional US federal agency contracts. Toka is not being kept at arm's length from Washington in the way NSO now is. That should be the operative fact of this piece.
2018 to 2024: from Barak’s founding pitch to Techcrunch confirming US federal contracts.
- 2018Toka founded in Tel Aviv by Ehud Barak, Yaron Rosen, Alon Kantor, and Kfir Waldman. Globes.
- July 2018$12.5M seed round led by Andreessen Horowitz and Entrée Capital, with Dell Technologies Capital, Launch Capital, Ray Rothrock, and Kevin Mandia participating.
- 2018-2020Reported early client work in Israel and Chile, the latter facilitated through the Inter-American Development Bank according to MintPress News.
- July 2021$25M Series B led by Eclipse Ventures, bringing total raised to $37.5M. Fierce Electronics.
- December 22, 2022Haaretz publishes the Omer Benjakob investigation based on internal Toka pitch documents. This is the primary source for the “Discover, Hack, Alter” capability description and the client list. Full text mirror; Common Dreams summary.
- December 2022
- December 6, 2024TechCrunch reports Toka is actively pursuing US federal agency contracts, describing the company as “a16z-backed” and pitching the ability to “hack into security cameras and other IoT devices.” TechCrunch.
- February 2026Haaretz reports Toka developed CARINT, a vehicle-hacking product that can pinpoint vehicles, remotely activate microphones, and access dashcams. Toka states the vehicle-hacking tool has been dropped from its 2026 roadmap, per its own statement. Clash Report summary.
The founders, the investors, and the customer list Toka has disclosed.
Former Prime Minister of Israel (1999-2001), former Defense Minister, former IDF Chief of Staff. Also a documented personal associate of Jeffrey Epstein, with recorded visits to Epstein's residences (which we treat separately in the Epstein hub).
Brig. Gen. (ret.). Former Chief of the IDF Cyber Staff. Represents the state-to-private transition at the top of the org chart rather than the middle.
Former Vice President of Business Development at Check Point Software Technologies, a company itself founded by Unit 8200 alumni.
Former CEO of Go Arc and former senior executive at Cisco and Kayhut. The commercial side of the founding team.
A16z led Toka's 2018 seed round. Andreessen sits on Meta's board of directors. Meta subsidiary WhatsApp is the plaintiff in the ongoing litigation against NSO Group. This is the operative conflict, and it has not been publicly addressed by Meta or by a16z.
Corporate venture arm of Dell. Represents another axis of US institutional money invested in an Israeli offensive cyber tool.
Led the 2021 $25M round. Palo Alto based venture firm focused on industrial and physical infrastructure.
Licenses and oversees Toka's international sales under the 2007 Israeli Defense Export Control Law. Every foreign government customer of Toka is a customer the MOD specifically approved.
Eleven claims about Toka, each graded, each cited to a primary source.
Toka was founded in 2018 by Ehud Barak, Yaron Rosen, Alon Kantor, and Kfir Waldman.
FACTThe founding is documented in the company's own materials and in contemporary Israeli business press coverage of the 2018 seed round.
Toka operates under Israeli Ministry of Defense oversight and licensing.
FACTConfirmed in Haaretz reporting via Toka's own public statements and consistent with Israeli Defense Export Control Law (2007), which requires MOD licensing for any offensive cyber capability sold internationally. Every disclosed customer government is one the MOD approved.
Toka's product suite, marketed to governments, includes tools to identify, exploit, and alter footage on internet-connected cameras and other IoT devices.
FACTMultiple independent outlets have reported the capability from internal Toka pitch materials carrying the 'Discover, Hack, Alter' section header and the VISINT, ZONE, and CARINT product families. Toka has not disputed the authenticity of the materials.
“Discover, Hack, Alter.”
The tools leave no forensic fingerprint on the target device.
SOME SMOKEThis claim originates in Toka's own sales documents. An ethical hacker reviewed the materials at Haaretz's request and found the technical claims plausible. No independent forensic verification of a deployed alteration in the wild exists in the public record. The claim is what Toka tells its prospective customers. Whether it is fully true in every deployment is unproven.
Known client states include Israel, the United States, Germany, Australia, and Singapore.
FACTThe client list is documented in the Haaretz reporting from Toka's own internal materials, valid as of the 2022 investigation. The current customer list is likely to have grown.
Toka is backed by Andreessen Horowitz, Dell Technologies Capital, Entrée Capital, Launch Capital, and Eclipse Ventures, with $37.5M raised across seed and Series B.
FACTThe investor list and total capital raised are confirmed across multiple independent business press outlets and reflected in Crunchbase.
Marc Andreessen sits on Meta's board while a16z funds Toka; Meta subsidiary WhatsApp is simultaneously litigating against NSO Group over spyware targeting its users.
FACTThe board membership, the a16z investment, and the WhatsApp v. NSO Group litigation are all documented in official public records. The specific fact of one board director being adjacent to both the plaintiff-side spyware litigation and an investment in a different spyware firm is the point.
Toka developed CARINT, a vehicle-hacking product that can pinpoint vehicles, remotely activate microphones, and access dashcams. In 2026, Toka stated the tool has been dropped from its roadmap.
FACTThe capability is documented in the February 2026 Haaretz reporting and corroborated in international summaries. The 'dropped from roadmap' claim is Toka's own statement to the reporter and cannot be independently verified from the public record.
Toka's Chile contracts were facilitated through the Inter-American Development Bank.
PROBABLY TRUEMintPress News reported the IDB facilitation path in 2021. It has not been publicly contradicted, and no independent secondary confirmation is currently available. A dedicated FOIA or IDB records request would upgrade this to FACT.
Toka does not disclose exploits it discovers back to affected vendors (Amazon Echo, Google Nest, Ring, and others), meaning vulnerabilities Toka uses remain open to other attackers.
PROBABLY TRUEToka has publicly stated a 'no disclosure' posture consistent with the offensive-cyber industry standard. This is the same posture NSO and its peers have publicly acknowledged. Not independently confirmed on a per-vulnerability basis.
Toka has actively pursued contracts with US federal agencies.
FACTTechCrunch's December 2024 reporting documents Toka's US business development pipeline and the a16z backing, and the story has not been publicly disputed by Toka.
What the public record shows about Toka, and what remains unverified.
The mainstream US press has almost entirely missed this company. The Haaretz scoop was the story of the year in European tech-privacy reporting, picked up promptly in Germany, France, and elsewhere. In the United States, the piece was mostly summarized once and then dropped. Common Dreams and MintPress covered it as an advocacy story, TechCrunch returned to it two years later on the US-federal angle, and that is roughly the extent of American coverage of a company whose disclosed customer list already includes the United States. That editorial gap is a fact worth recording, separately from the underlying capability.
Where the record does not, at the moment, support strong claims is deployment. There is no documented case in the public record of Toka's product being used to alter footage that then influenced a specific public event. What exists is the sales pitch, the client list, the capability description, and Toka's own statement that its tools leave no forensic trace. That is enough to matter. It is not enough to attribute specific outcomes. If a reader wants to draw a causal line from Toka to any particular altered surveillance video, the reader is drawing that line ahead of the primary evidence.
The other place we hold the line is on the founders. Barak, Rosen, Kantor, and Waldman all have Israeli intelligence and defense backgrounds. That is the story of the founder pipeline the Unit 8200 investigation traces. It is not itself evidence that any specific Toka deployment has served an Israeli state interest at the expense of a foreign customer's interest. The founder pipeline is documented pattern; specific customer-versus-Israel conflict, in the case of Toka, is currently a open question.
Why Toka matters now: Israeli intelligence talent, US venture capital, US federal contracts.
Every historical case on this hub records some version of the same pattern: capability developed under Israeli military authority, moved through a state-approved private channel, and sold or deployed abroad with US complicity of one kind or another. The interesting part of Toka is how compressed the pattern has become. A former Prime Minister and a former Cyber Staff chief cofound the company. A16z leads the seed round in the same year. The company is licensed by the MOD. Six years later, it is pitching US federal agencies with a a16z partner still on the cap table and Andreessen still on Meta's board. Between the founders' state exit and the pitch to Washington, everything happens inside a single decade, and inside a single institutional friend group.
What this piece does not claim is that Toka has caused any specific downstream harm we can document. What it does claim is that the pipeline the hub tracks now runs, at this specific firm, from the Israeli state to Meta's board to a US federal procurement pitch in seventy-two months. That fact, all by itself, is a thing US regulators and the US press would treat as a national-security news story if the source country were China. It is not being treated that way when the source country is Israel, and that asymmetry is itself part of the story.
Questions worth taking seriously
Is Toka actually selling to the US government?
Has Toka’s alteration capability ever been used?
How is Toka different from NSO Group?
Why has the US press mostly ignored this?
If you are named on this page
If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.
This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.
The Toka research brief and the primary sources it cites.
Every claim on this page grades to one of FACT · PROBABLY TRUE · SOME SMOKE · PURE SPECULATION · FALSE / MISLEADING. The grade badge hedges. The prose does not. Nothing false is asserted here as accepted claim.
The full research brief, with all sourcing and notes on editorial judgment, is in the knowledge base at /knowledge-base/programs/_research_briefs/toka.md.
Full method: Methodology. Related hub: Israeli Influence. Cross-cut hubs: Surveillance State(s) and Self-Dealing.
Last updated July 13, 2026. If a link 404s or a date is wrong, tell us and we will fix it publicly.