• 0

“No doubt that Turkey has breached the Convention rights of those arrested and detained since the failed coup..”

Category : NEWS

Sept 11 (Reuters) – Legal and Forensic Report on Turkey´s Actions Post-Coup Concludes

o “No doubt” that Turkey has breached the Convention rights of those arrested and detained since the failed coup of 2016

o There are no grounds for detaining or convicting thousands of people for the alleged use of a (Bylock) messaging application

“Read More”

  • 0

An overview about illegality of using bylock application as evidence in trials

This legal opinion addresses whether the Turkish State breached the rights granted by the European Convention on Human Rights (ECHR) of those arrested since the failed coup of July 2016. Moreover, it focuses on whether Turkey contravened international criminal law, particularly considering the use of the Bylock messenger application as a proof of membership to a terrorist organization (namely, FETÖ – the organization allegedly headed by the US-based imam Fethullah Gülen – which is considered to be the organizer of the 2016 failed coup).

“Read More”

  • 0

Supreme court rules on ByLock in line with justice minister’s remarks

The Supreme Court of Appeals’ Assembly of Criminal Chambers has ruled the ByLock smart phone application to be considered evidence of membership in a terrorist organization following Turkish Justice Minister Abdülhamit Gül’s remarks on ByLock being strong evidence of terrorist organization membership.

According to the decision, ByLock will be considered evidence in and of itself for prosecution on charges of membership in the Gülen movement, accused by the government of mounting a botched coup attempt in July 2016.

“Read More”

  • 0

Scandal answer from the judge

Category : NEWS

When the  search for justice  was  continuing throughout  the  country, a  scandalous  answer from  a judge  revealed  the  seriousness  of the  situation.  The  President  of the  Court, “This  case  is  not important  for me!  This  ByLock  list  that  came  from  MIT  (natioanal  intelligence  agency  of  Turkey)  is important  for me,”  he  said.  The  letter sent  by Mustafa  Dursun, brother  of Uğur Dursun victim  of “bylock”  who was  trialed  on 15 June,  assistant  director of Kayseri  Regional  Directorate  of Forestry, to haksozhaber.net  exposes  the  unlawfulness  of the  victimization  chain  in court  phase  which is currently  increasing in  Turkey.  After the  custody and detention  process, which  is  a  complete tragedy,  it  reveals  what  kind  of legal  massacres  are  involved  in both the  indictments, the proceedings  and the  defenses.
“Read More”

  • 0

Dutch IT firm debunks Turkish intel report on ByLock that put 75K Turks behind bars

The Turkish government has been actively pursuing the prosecution of the participants of the Gülen movement in what it calls “the Fetullahist Terrorist Organization/Parallel State Structure (FETÖ/PDY)”. To this end, the Turkey’s National Intelligence Organization (Millî İstihbarat Teşkilatı or MİT in Turkish) has investigated the relation of a publicly available smart phone messaging application called ByLock to “FETÖ/PDY”, which is alleged to have been used during the failed coup attempt in Turkey on July 15, 2016.

The MİT is reported to have identified 215,092 users of the ByLock. Of which approximately 75,000 were detained. In an attempt to link a user of ByLock to a real person, the MİT has written a report on its findings which concluded that “ByLock has been offered to the exclusive use of the ‘FTÖ/PDY’ members”.

However, the investigation performed by Fox-IT contradicts the key findings of the MİT. Fox-IT also discovered inconsistencies in the MİT report that indicated manipulation of results and/or screenshots by MİT. What is more, Fox-IT found that the MİT investigation is fundamentally flawed due to the contradictory and baseless findings, lack of objectivity and lack of transparency.

Overall, Fox-IT concluded that the quality of the MİT report is very low, especially when it was weighed against the legal consequences of the conclusions which is the detention of 75,000 Turkish citizens.

This blog contains the conclusions of Fox-IT’s expert witness report. You can also download the full report of Fox-IT and the technical MİT report. The translated version of the MIT report will be made available later.


Fox-IT’s Expert Witness Report can be downloaded here.

md5: 3dac076d4e0d9d8984533bc04be336a7
sha1: 450ba8665d3a508d569bbc7ec761e9793e42d9c6
sha256: 7dbc402b8e03c311245814fb74dff699330d459f2067ecd574974538086caa7e

MIT’s Technical Report can be downloaded here.

md5: a9f18e08db62ef1c1f71101d37589157
sha1: 68a86e7b8b78c9d1493cb63318dba1f09cc62437
sha256: 17768d91bdae3e78499cb20214bf83abe49948a5d5f41c1aa35a1d1561dd0e62


1. What is Fox-IT’s opinion on the investigation methodology used by MIT in the ByLock investigation?

Multiple key findings from the MIT investigation were contradicted by open-source research conducted by Fox-IT and other findings were shown not to be supported by the evidence presented by MIT. Furthermore, the MIT investigation lacks in transparency: evidence and analysis steps were in many cases omitted from the MIT report. Multiple findings (that could be verified) were shown to be incorrect, which leaves the impression that more findings would proof to be incorrect or inaccurate if they could only be verified.

Fox-IT finds the MIT investigation lacking in objectivity, since there is no indication that MIT investigated the alternative scenario: namely that ByLock has not exclusively been offered to members of the alleged FTÖ/PDY. Investigating alternate scenarios is good practice in an investigation. It helps prevent tunnel vision in cases where investigators are biased towards a predefined outcome. Fox-IT’s examination of the MIT investigation suggests that MIT was, in advance, biased towards the stated conclusion and that MIT has not shown the required objectivity and thoroughness in their investigation to counter this bias.

Fox-IT concludes that the MIT investigation as described in the MIT report does not adhere to the forensic principles as outlined in section 3.1 of this report and should therefore not be regarded as a forensic investigation. The investigation is fundamentally flawed due to the contradicted and unfounded findings, lack of objectivity and lack of transparency. As a result, the conclusions of the investigation are questionable. Fox-IT recommends to conduct a forensic investigation of ByLock in a more thorough, objective and transparent manner.

2. How sound is MIT’s identification of individuals that have used the ByLock application?

The MIT report contains very limited information on the identification of individuals. Fox-IT has shown that ByLock user accounts are, on their own, difficult to attribute to an individual: it is easy to impersonate other individuals when registering a ByLock account and MIT is limited to an IP address from the ByLock server log to identify individuals. Attributing this IP address to actual individuals is not straightforward and error-prone; therefore, possibly leading to identification of the wrong individuals as ByLock users.

Fox-IT is unable to assess the soundness of the identification method, since the MIT report does not provide information on this method. The omission of a description of this method is troubling. Any errors in the method will not be discovered and the reader is left to assume MIT does not make mistakes. While transparency is one of the fundamental principles of forensic investigations, this critical part of the investigation is completely opaque.

3. What is the qualification of soundness on MIT’s conclusion regarding the relation between ByLock and the alleged FTÖ/PDY?

The conclusions and findings of the MIT report were examined by Fox-IT. It was shown that the argumentation is seriously flawed and that seven out of nine stated arguments are incorrect or questionable (see conclusion 6.1). The remaining two arguments are, on their own, not sufficient to support MIT’s conclusion. As a result, the conclusion of the MIT report, “ByLock has been offered to the exclusive use of the members of the terrorist organization of FTÖ/PDY”, is not sound.

4. Are there any other issues identified by Fox-IT that are relevant to the ByLock investigation?

Fox-IT encountered inconsistencies in the MIT report that indicate manipulation of results and/or screenshots by MIT. This is very problematic since it is not clear which of the information in the report stems from original data and which information was modified by MIT (and to which end). This raises questions as to what part of the information available to MIT was altered before presentation, why it was altered and what exactly was left out or changed. When presenting information as evidence, transparency is crucial in differentiating between original data (the actual evidence) and data added or modified by the analyst.

Furthermore, Fox-IT finds the MIT report implicit, not well-structured and lacking in essential details. Bad reporting is not merely a formatting issue. Writing an unreadable report that omits essential details reduces the ability for the reader to scrutinize the investigation that lead to the conclusions. When a report is used as a basis for serious legal consequences, the author should be thorough and concise in the report as to leave no questions regarding the investigation.
Fox-IT has read and written many digital investigation reports over the last 15 years. Based on this experience, Fox-IT finds the quality of the MIT report very low, especially when weighed against the consequences of the conclusions.

  • 0

An Independent technical report by a Forensic Company about bylock application

Digital Forensic Corp tarafından ByLock Uygulaması için hazırlanan rapor uygulamanın detaylarını bir kez daha ortaya çıkardı ve iddiaları tekrar çökertti.

“Read More”

  • 0

Arbitrary Use of ByLock as an Instrument of False Accusation

Category : QUOTATION


As observed by all international human rights NGOs as well as EU and Venice Commission, Parliamentary Assembly (PACE), Human Rights Commissioner of the Council of Europe with deep concern, there is a shocking setback in Turkey in terms of democracy and human rights in the aftermath of 15 July 2016 failed coup attempt.

“Read More”

  • 0

An Independent technical report by Daniel Walter about bylock application

Amerikalı tarafsız bilişim uzmanı Walter McDaniel tarafından hazırlanan ve ByLock hakkında ki iddaaları inceleyen rapor aşağıda sunulmuştur.

“Read More”