Strasbourg court condemns Turkey for jailing teacher for using ByLock encrypted messaging app

Getty Images/Tetra images RF

The case is expected to have implications for the use of digital evidence in prosecutions against users of other encrypted phone apps

Bill Goodwin,
Computer Weekly

Published: 28 Sep 2023 17:26

The European Court of Human Rights has condemned Turkey for jailing a teacher for downloading an encrypted messaging app the government claimed was linked to the organisers of an attempted coup in the country in 2016.

The case is likely to have implications for thousands of other people convicted in Turkey over their use of the ByLock mobile phone app, which was available on the Android and Apple app stores.

It’s also likely to have implications for the disclosure of evidence in prosecutions brought against users of other encrypted phone networks, including EncroChat, SkyECC and Anom, which were widely used by organised criminals, lawyers said.

Turkey claims that ByLock is linked to an armed terrorist organisation connected to the US-based Muslim cleric Fethullah Gülen, who Turkey’s government blames for an attempted coup on 15 July 2017.

Turkish intelligence agency MIT obtained and decrypted millions of messages sent on the ByLock app.

Phone app linked to coup

The teacher, Yüksel Yalçınkaya, was sentenced to over six years imprisonment in 2017 after being accused of using the ByLock phone application.

A forensic report from Turkey’s Information Technologies and Communication Authority found the man had connected to ByLock’s server’s IP address 380 times on six days in October 2015.

The ECtHR found the Turkish courts had equated users of ByLock with knowingly and willingly being a member of an armed terrorist organisation, regardless of the contents of the messages they sent or the people they used the app to contact.

Any Turkish citizen could be convicted of being a member of an armed terrorist organisation solely on the basis of using the app, the court found, creating an “almost automatic presumption of guilt” based on ByLock use alone.

The court also found the teacher had not been given access to digital evidence obtained by the Turkish authorities from ByLock, which meant he was unable to challenge the evidence against him.

Turkey had given no explanation to the teacher why it had withheld ByLock data collected by the Turkish intelligence services related to his case. He was also denied the opportunity to comment on the decrypted messages, or challenge the validity of the inferences drawn from them.

The prosecution was in breach of both Turkey’s national law and the European Convention of Human Rights, the court found.

The former teacher was also accused of suspicious banking activity, and membership of a trade union and a voluntary group the government claimed had links with the terrorist group.

The Strasbourg court found that his prosecution membership of a trade union and the voluntary organisation, which had been operating legally before the coup, was not “prescribed by law” and was in violation of the ECHR.

Turkish authorities had identified 100,000 ByLock users, prompting around 8,500 similar complaints to the Strasbourg Human Rights court, with further complaints expected.

Case may impact other prosecutions

Commenting on the case, German defence lawyer Christian Lödden said the ECtHR’s decision set down important points of principle over the rights of people accused on the basis of digital evidence.

This includes the right to obtain and check the integrity and completeness of raw data obtained by police infiltration of encrypted phone networks.

These statements are applicable to EncroChat, Sky ECC and the Anom phone networks, which were infiltrated by international law enforcement agencies from spring 2020 onwards, he said.

“One of the main criticisms of the defence is that we only got Excel spreadsheets with alleged chat messages and not the raw data to test and verify them,” he added.

“Another important point is that the court repeatedly states that the mere use of encrypted communications does not constitute initial suspicion for the commission of criminal offences.”

Turkey’s minister of justice condemned the decision, arguing the European Court had exceeded its authority.

Read more on Privacy and data protection

Turkcell deploys TIP distributed disaggregated backbone router