15 ms·

Thousands of Turks accused of using Bylock app despite never having used it

321 points by plg 9y ago

empath75 9y ago
I’m pretty sure that it was the Turkish government who put hundreds of thousands of innocent Turks in jail. Installing chat software shouldn’t be a crime.
- 21 9y ago
  > Installing chat software shouldn’t be a crime. I don't think you understand how repressive regimes work. And I bet that on HN you'll find a lot of support for jailing people who install a let's say Nazi chat app on their phone.
  - acdha 9y ago
    > I bet that on HN you'll find a lot of support for jailing people who install a let's say Nazi chat app on their phone. This is pure flame-bait and will not result in any positive contributions to this conversation.
    - thrill 9y ago
      The magnitude of the down votes on his comment lend some weight to his criticism.
      - danso 9y ago
        I downvoted not just because it was an empty rhetorical statement (wouldn't upvotes also lend weight to his criticism?), but because such a claim should be supported by links to examples. For example, I can find recent discussions in which HN users have said companies like Cloudflare should feel obligated to not serve sites like Daily Stormer -- and many users who think Cloudflare should be neutral. Can't think of any significant group of users who have ever argued for jailing anyone involved in the situation, whether it be users or the Daily Stormer itself: https://news.ycombinator.com/item?id=15031922 https://news.ycombinator.com/item?id=15031922
      - acdha 9y ago
        You don’t see any middle ground between downvotes and jailing? Not even a little?
  - deleted 9y ago
    [deleted]
Rjevski 9y ago
FTFY: a shitty government is putting people in jail. Even if we ignore the horrible government and bullshit reasons why they're considering installing an encrypted chat app a "crime", they should at least use proper evidence for the convictions, like a dump of the phone's memory with the chat app installed on it, and not a simple DNS lookup/HTTP request to the chat app's domain.
- tzahola 9y ago
  No, it was a single line of code. We should ban codes like this.
  - codewithcheese 9y ago
    Do you want to throw people in jail if they use code that is banned too?
  - mseebach 9y ago
    Oh, I guarantee you that the Turkish government agrees wholeheartedly and would very much like to speak with the perpetrators.
  - simonh 9y ago
    The people who wrote the code, whatever else they may or not be guilty of and whether or not the code should be illegal or not, didn’t put anyone in jail.
- danso 9y ago
  Exactly this. People are apparently being jailed for having accessed or simply pinged a forbidden IP/server -- which seemingly could be caused by receiving an email with a hidden img tag, or visiting a website with a hidden iframe.
  - deleted 9y ago
    [deleted]
  - boosting6889 9y ago
reallymental 9y ago
Everybody hears the echos of this behavior throughout history. I wonder if Erdogan thinks he'll be the one who escapes the universal fate of tyrants. As Turkey becomes increasingly alienated from the EU, Putin looks to gain another monster.
- lawlessone 9y ago
  Wish i had your optimism , but tyrants seem to be the norm throughout history.
- tim333 9y ago
  I'm not sure what the universal fate of tyrants is supposed to be. A lot of them seem to hang in there fairly comfortably till they die of old age.
  - ryandrake 9y ago
    Minus a couple of outliers, I think history has taught us that the fate of tyrants and oppressors is a long, healthy, and comfortable life of luxury and immense wealth. As a bonus, that fate often includes admiration and support from at least 50.1% of the oppressed population.
- dang 9y ago
  Please don't post generic political rhetoric to Hacker News. When the topic is politicized, as it is here, it's important for comments to stay grounded in the specifics of the article and not take off into garden-variety politics. That kind of discussion is unable to be substantive, which HN is for, and it leads to flamewars, which is HN is not for. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
integricho 9y ago
I find it very frustrating to read about such oppressive regimes. It fills me with anger, I cannot help myself, I just hate injustice.
- txsh 9y ago
  You’re probably writing this from a country that drops bombs on people without first knowing who they are or why they are there, just that they appear to be male and over a certain height in an area of terrorist activity. No courts. No oversight. No accountability. What Turkey is doing is terrible but mild in comparison to the drone war.
  - integricho 9y ago
    Actually I'm quite close to Turkey (I'm from Serbia), though we're not yet that much oppressed.
  - tobltobs 9y ago
    And what do you want to tell us with your whataboutism?
    - yesenadam 9y ago
      Well, that's a glib remark if I've ever heard one. "Whataboutism" - so that's.. said to people who tiresomely derail discussion of seriously wrongdoing with their pat diagnosis and dismiss the original topic as naive. Unfortunately you have done that same thing by using the word. I get why it's useful to have a name for the phenomenon, but there's nothing commendable about the way you used it, it came across sounding like a jerk who thinks they're superior. And made me wonder about what you "want to tell us". edit: Could the downvoters explain why? Thanks. I tried to say something substantive, I thought successfully. (joosters, I totally agree)
      - joosters 9y ago
        IMO the person they were replying to sounded superior. There will always be a more important issue than the one being discussed. (in the eyes of someone, at least). That's no reason to prevent talking about anything else.
reificator 9y ago
The code in question had nothing to do with it. Once you're putting people in jail for network activity on the same wifi network, it's way beyond pretending you were just confused by an iframe.
danso 9y ago
Strange...the "bad" chat app is named Bylock, and downloading/installing it is apparently evidence that you are part of an treasonous political group. But the "single line" of code that the headline appears to refer to is code that causes you to access Bylock.net, kind of like an email image ping: > Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Hypothetically, people could be accused of accessing the site without having knowingly viewed it. This Bylock.net-accessing code was apparently packaged into other applications, causing people who weren't using the actual secretive chat app to be associated with the group: > Akif Demir, a self-described conservative nationalist, wished the worst on people accused of using Bylock and being associated with the Gülenists. That is, until authorities said he was one of them...In October 2016, when his wife was pregnant with their first child, Demir was called into his principal's office. He wouldn't be allowed to work at the school — or anywhere else for that matter — anymore. He had been deemed a Bylock user. The headline isn't inaccurate, but the main problem, or "bug", seems to be the government's hyper-willingness to throw people in jail for having accessed, even pinged, a forbidden server. And it wouldn't be surprising if this "bug" were being exploited by the purported outlaw group behind Bylock to mock the government's oppressive surveillance policies. edit: FWIW, previous coverage of "Bylock" focused on how the app itself was cracked in 2015: https://www.theguardian.com/technology/2016/aug/03/turkey-coup-gulen-movement-bylock-messaging-app https://www.theguardian.com/technology/2016/aug/03/turkey-co... > Starting in May 2015, Turkey’s intelligence agency was able to identify close to 40,000 undercover Gülenist operatives, including 600 ranking military personnel, by mapping connections between ByLock users, the Turkish official said. Visiting "bylock.net" currently yields an empty page: $ curl -IL bylock.net HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/html Last-Modified: Fri, 03 Nov 2017 22:47:45 GMT Accept-Ranges: bytes ETag: "4c5039c4f554d31:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 22 Jan 2018 13:35:36 GMT According to WHOIS, bylock.net was created on 2017-11-01. But that seems too small of a timeframe for the trouble mentioned. Not sure how to use the Whois-history lookups, but Internet Archive pinged the server in 2016: http://web.archive.org/web/*/bylock.net http://web.archive.org/web/*/bylock.net edit 2: Googling around for "bylock.net", it appears an IT company (Fox-IT) was asked by Turkish lawyers to analyze the government's methodology. They published a report on Sept 2017 basically saying the government's "argumentation is seriously flawed" https://foxitsecurity.files.wordpress.com/2017/09/bylock-fox-it-expert-witness-report-english.pdf https://foxitsecurity.files.wordpress.com/2017/09/bylock-fox...
uluyol 9y ago
As bad as this is, it does seem seem to be the status quo when it comes to forensic "science." I don't have any stats on hand, but it seems like more people are more worried about closing/winning cases than making sure they are not sending innocent people to jail.
- 21 9y ago
  Worse yet, many times the prosecutors find evidence that the accused is innocent, but they will still fight a appeals just to save face that they wrongly imprisoned someone.
codewithcheese 9y ago
Can someone familiar with the situation explain how the employers know they used Bylock before the police raid?
- shultays 9y ago
  It says in the article She knew the arrest was coming. She'd already lost her job, because traces of the app known as Bylock were found on her phone.
  - codewithcheese 9y ago
    Yes but whats the process? Were traces of the app found by her employer? Are employers searching employees phones?
    - shultays 9y ago
      I am assuming data is shared by mobile operators to government. And then they fired everyone on that list and works at the government
    - laurent123456 9y ago
      > Were traces of the app found by her employer? Probably that's just the journalist words as I don't think they found or even looked for "traces of the app" on the phone. Most likely the government got a log of the DNS lookups from the ISP and made their arrests based on this.
    - gazorpazorpaway 9y ago
      As others have commented, it was just a matter of the ISP identifying all clients doing DNS lookups or connecting to the Bylock domain. The government have complete control of all ISPs and mobile network operators in Turkey. They don't own them, but you can't give people Internet access without joining the government censorship/logging program. As she was a teacher she would be employed by the government, and they just fire everyone employed in the government automatically when their names show up on the blacklist. I suspected firing of family members and friends that are connected to falsely accused person is done manually. Also it doesn't really matter if the person is employed by the government or not. No employer would dare to keep anyone that is blacklisted as the employer would probably be accused themselves of helping a terrorist if they kept them. Plus, obviously, most big corps in Turkey are run by Erdoğans friends and family directly and indirectly.
phyller 9y ago
Thank God many of us live in countries where you are innocent until proven guilty, and not the other way around.
- simonh 9y ago
  cough Civil Forfeiture cough. That in a country with a written constitution guaranteeing property rights and due process, and with the legal principle of innocence until proven guilty.
  - phyller 9y ago
    Speaking of civil forfeiture made me wonder whatever happened to all the bitcoin owned by that guy that ran Silk Road. Government sold it, but with some bad timing http://fortune.com/2017/10/02/bitcoin-sale-silk-road/ http://fortune.com/2017/10/02/bitcoin-sale-silk-road/
SCHiM 9y ago
A dutch security company was asked to provide a technical review of the 'evidence'. Their conclusion: it sucks. https://www.fox-it.com/en/insights/blogs/blog/fox-debunks-report-bylock-chat-application-led-arrest-75000-turkish-citizens/ https://www.fox-it.com/en/insights/blogs/blog/fox-debunks-re... > Overall, Fox-IT concluded that the quality of the MİT report is very low, especially when it was weighed against the legal consequences of the conclusions which is the detention of 75,000 Turkish citizens.
segmondy 9y ago
This is the creepiest thing I've ever read. As a teen, I was absolutely sure the Internet would liberate us all never saw it being a weapon of oppression as much as it has become. :-(
- StavrosK 9y ago
  That's because most people don't care about privacy before it's too late. "The government can monitor what sites you access!" "Oh, I have nothing to hide." Then the government changes, and the thing that was considered okay before is now something that you need to hide, but you have no privacy because you didn't see why you'd need it. Now you're in jail because of a tracking pixel. "I have nothing to hide" implies "yet". Do you think you will never have anything to hide in the future as well? Most people don't think that far ahead.
- simonh 9y ago
  I remember people saying in the 90s that soon free software and the internet would make previous systems of politics and economics irrelevant. Still waiting.
- nekopa 9y ago
  When were you a teen? I remember having the exact same thoughts when I was a teen. I think it was in 1990 I was at college in the UK and I remember reading a Usenet thread about some student riots going on in Portugal. The media coverage at the time was completely off from what I was hearing from the students 'online'. I remember really believing that the internet really would liberate us all with unfettered access to truth and communication and so on. Fast forward a few years to 1995 and one Christmas (I was in the US then) I decided to take a look at the 'web' and the liberation it had brought so far. I called it my deep dive into the dark underbelly of the Internet. And what I found on that night over my dial-up connection stays with me to this day: facism, racism, gore, bestiality, hatred, child porn. Yes, the Internet liberates us. It allows us to freely be the humans we are, on a larger scale. Unfortunately, humanity has a rather large dark side to it. So this story doesn't surprise me in the least - but I still hold out hope that we may one day do better.
- jasonkostempski 9y ago
gambiting 9y ago
>>Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Hypothetically, people could be accused of accessing the site without having knowingly viewed it. And that's why I'm absolutely terrified of the British government requiring that all ISPs store your browsing history for a year. You DON'T know what addresses the websites that you are visiting are linking to. You go on a cat forum where someone posted a picture - but unbeknownst to you, maybe the picture is actually hosted on isis.com and now you're on a watchlist by the government. It's bonkers, and while UK is not arresting people for downloading apps, they certainly build themselves capability to do so if they ever wanted to.
lr4444lr 9y ago
It's stories like this that makes Richard Stallman start to sound sensible.
- tree_of_item 9y ago
  Stallman was always sensible; it's stories like this that make the people who made fun of him look ridiculous.
vijaybritto 9y ago
I don't see the citation of malicious single line of code in the article. That's why I clicked it in the first place.
JepZ 9y ago
> which created a window "one pixel high, one pixel wide" to Bylock.net WTF, that is like condemning everybody of murder who owns a knife.
JDT 9y ago
Essential reading for all those who say: "If you've got nothing to hide, you've got nothing to fear".
ali1ism 9y ago
there was a story of Iranian software developer whose photo-uploading software was used by a porn website, leading the author persecution and capital punishment. https://www.theguardian.com/world/2012/jan/18/iran-death-sentence-porn-programmer https://www.theguardian.com/world/2012/jan/18/iran-death-sen...
kkarhan 9y ago
Another reason why tracking pixels are really bad... They also harm others that never used the service or agreed to it's T&Cs...
mbrumlow 9y ago
This seems to be a growing trend, mostly in journalism; Blame technology. Just recently there was a article going around about how Google's search algorithm was at fault of keeping two sisters apart. And entire multi page write up on how our lives are at the whims of computers and algorithms. Then to be told that the one sister could not find the other because she changes her name online to protect her identity. Now we have this. A big pile of junk trying to set the reader up to think this single line of code is responsible for the arrest of people. Again trying to instill fear of technology and computers into the reader. I worry this type of article will sway the public's view of technology for the worst. In the end it is people who are to blame for the problem described in this article. And it all centers around lack of understanding how these technologies work. Articled like this are just going to make that worse. Further more the entire thing is bogus because the notion that one can't have access to a given technology is entirely man made and has nothing to do with any "lines of code".
- deleted 9y ago
  [deleted]
- dingo_bat 9y ago
  Agreed. But not surprised. Journalists have been doing this for decades with other things like guns.
- thrillgore 9y ago
  This post is 100% reflection. The press is merely trying to give all of us working in the CS fields the ethical observations we've all but ignored over the past decade, as this profession has grown.
  - jsjohnst 9y ago
    I’d argue it should be more pointed towards the government using flimsy evidence to arrest people. It dances around that point without taking a hard stance that what the Turkish government is doing is essentially a human rights violation. It’s not the single line of code putting people in jail, it’s the government. While that line of code is significant, it’s not the only thing.
highdesertmuse 9y ago
Assange keeps warning of AI manipulation by corporate states like Google and Facebook. Perhaps we should listen.
kyberias 9y ago
What a horrible country.
- deleted 9y ago
  [deleted]
hi41 9y ago
>Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Kindly, could someone please explain what kind of hacking attack this is and how it works? Did this window create a browser cookie for Bylock?
- LeifCarrotson 9y ago
  It's not a "hacking attack", it's an element on a website: <iframe src=http://bylock.net width=1 height=1> or <img src=“http://bylock.net” width=1 height=1> This code, if it was a part of a page you browse, would cause your browser to load the linked site, almost exactly like clicking on this link: http://bylock.net http://bylock.net. This iframe was present in various websites and apps. The nefarious component of the attack is that the Turkish government surveils all Internet traffic within its borders and thought that the website may have helped some of its opponents commit what it believes to be treason. Its surveillance data tells it all the sites your phone looks up, and it accused people whose phones looked up that domain as being guilty of treason.
  - soared 9y ago
    Just replied to someone else: I was wondering if the pixel is just a relatively innocuous advertising pixels. Advertisers/publishers place random pixels from vendors/etc on their website all the time and rarely vet anything. I wouldn't be surprised is bylock was advertising in those apps and asked each app to place a pixel to track conversions/clicks/etc.
  - hi41 9y ago
    Thank you for your response. Why would the other apps put this line of code? Are they hand-in-hand with Bylock?
    - jdormit 9y ago
      Check out soared's comment above. Basically, 1-pixel images like these are used by companies to track when someone views their content. It's a very common practice - most of your emails probably contain tracking pixels so that whoever sent them can tell if you viewed the email. If they see a request on their server for the URL they put in the tracking pixel, they know you've opened the email. In Bylock's case, it was most likely a tracking pixel embedded in advertisements for Bylock that the other apps were displaying. The pixel helped Bylock track how many people were viewing their ads.
benmmurphy 9y ago
why did the gulenists use bylock when they could have used whatsapp or signal? it looks like they are getting rounded up because their use of an obscure app has become a strong signal that they are gulenists. though, signal might have had similar problems. not sure how popular it is in turkey.
- alpb 9y ago
  Basically poor call. They had someone code Bylock from scratch for them because they thought it would be more secure.
qwerty456127 9y ago
What is horrifying here is that people are actually forbidden to communicate securely (ByLock is a secure messenger AFAIK). IMHO the right for privacy is to be absolute, mo matter what. No kind of safety or anything is worth living under constant surveillance and being unable to chat and be sure no 3rd party can read that.
remind_me_again 9y ago
Bylock app is a closed group chat app. The people who used it heavyly in Turkey was a group called Gulenist. They staged the coup in July 15, 2016, and failed. Turkish intelligence service had already infiltrated the Bylock server at least 6 months before the coup attempt. AFAIK the server was in a Eastern Eurepean country. Since the coup attempt prosecutors using Bylock communications as one data point to identify group members. They do this going through the telecommunication logs connections from members' phones to that particular server. Gulenist as a counter measure and to dilute themselves within the general population they used another app that connects to that server. The app is simply an app that tells the prayer times (for muslims). So whoever used that app became a suspect as well. A friend of mine unfortunately lost her job because of that. She went through a big turmoil for about a year. For one, she is nothing to do with the group and has been a critic of them years before the coup attempt. Think about for a second if you go through an ordeal for the very thing you have been opposed. Fortunately, again government realized this sinister plot and has been trying to identify who is really were not affiliated with the group. And my friend, after a year later, clear of blame and reinstated by the government back to her job. She is physician. Unfortunately public either half or misinformed most of the time. This is a very sinister group who tried to overthrow a government who was elected democratically, and a very popular one. During the coup attempt 243 ordinary citizen were killed in the hands of these people. For a moment just think what would you do if your own F-16 fighter jets are bombing you, your very own rifles are showering bullets when you are demonstrating against the coup.
remind_me_again 9y ago
Article has factual errors: Number of people who was detained due to coup attempt is around 55K, this is latest number I heard 2 weeks ago. It was never 150K, but around 80K.
tim333 9y ago
>nearly 150,000 Turks detained >An estimated 30,000 are believed to be among the innocent swept up in this particular campaign I'd say an estimated 150,000 or so are innocent of anything that would be a crime in any normal country. I note Turkey is not getting anywhere with getting Gullen himself extradited because it would require showing evidence to a US court that he'd done something beyond being a political opponent of Erdogan.
- pavel_lishin 9y ago
  Yeah, I found that to be a weird phrasing on the article's part. I guess what they mean is that 120,000 were actually charged with a crime, due to an action they committed (whether those outside of Turkey would believe that action to be inherently criminal or not).
- Cyph0n 9y ago
  I'm not too familiar with the whole Gulen thing in general, but I have heard that the Gulenists were an almost cult-like group that favored each other and made sure only they got into the highest levels of power. I'm sure Erdogan did blow the story out of proportion (it benefits him to do so), but I also think that Gulen and his followers are not fault-free.
  - tim333 9y ago
    Sure yeah they were a "almost cult-like group that favored each other" but so are freemasons, old Etonians and so on. It doesn't mean you should arrest all those. (Well, maybe Dave and Boris... but not all of them).
cesarb 9y ago
This reminds me of some Bittorrent trackers which added random IP addresses to their peer list, so companies which accused people of downloading movies based only on the list returned from the tracker would make false accusations: https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-with-fake-peers-081020/ https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-...
intrasight 9y ago
Vote with your dollars - don't visit Turkey or do business with Turkey.
meaydinli 9y ago
Does anybody know of any article where somebody looked into the apk and the code?
sizzle 9y ago
This is a despicable use of technology. I hope the innocent have their names cleared.
deleted 9y ago
[deleted]
avictim 9y ago
Hello everyone. I am one of the victims of these Bylock cases and the tracking code or advertising links etc. I had been trialled with 15 years heavy jail time and it was definite for me to get sentenced at least 6 years 3 months if this particular iframe code was not found in an old phone’s temporary files. Actually after the iframe code was found by one of the official Computer Forensic expert who has been employed by one of the official Bylock cases public prosecutor, he and the public prosecutor had kept it secret from the public and tried to burrow it. Until some hero got screenshot of this official finding and leak it to the one of the bravest lawyer in Turkey whose name is Ali Aktaş, we had no concrete proof of tracking codes or advertising links. I know you cannot believe that 100,000 people are getting sentenced solely based on reverse tracking of CGNAT logs (IP access request logs kept by ISPs). Yes you are right. I myself also couldn’t imagine such thing would happen in my beautiful country, hell even in banana republics I couldn’t imagine. But one morning I wake up and anti-terror forces break into my house to arrest me and seize all of my digital devices until an unknown time. It was truly shocking experience and I had no idea how could this happen to me while I have never used that stupid, amateur and lame communication android App Bylock. Yes Bylock was very insecure APP which allowed passwords as 0, did not hash (not even MD5 but there are some claims that the very late versions of the APP were hashing user passwords and put some password restrictions such as min 8 characters) user passwords, kept all of the private keys in database so the administrator could read all of the messages, did not use any cloud server, cloud service or implemented proxy system to prevent IP tracking and so on. All of these are written in the Turkish Intelligence (MIT) official technical Bylock report. I was lucky that I was not at home that time so I had opportunity research and prepare defence. After few days research, I found out that the our brightest brains in the Information and Communication Technologies Authority (BTK) decided to scan back all of the CGNAT logs and determine whoever had made any access request to the one of the IP address which are determined to belong Bylock server and put all of the citizens on Bylock users list who have access to these IPs. That is how ridiculously I was put on that list. But even the preparation of list cries out loud the erroneous procedure that is being followed. First of all, our Information and Communication Technologies Authority (BTK) determines CGNAT start date after 5 months of the Bylock app release (release date is April 2014 but CGNAT scan start date is August 2014). So during this period of time whoever used Bylock APP or made access to IPs of Bylock server are not put on the list. Moreover, they found out that total 250,000 individuals have made at least 1 IP access request to the Bylock server IPs. Since 250,000 is too many to put in jail, they come up with this “fantastic” rule. They filter the list and remove citizens from the list whoever made only 1 day or 2 days access to the IPs. So they claim to the media that they have removed people who actually did not use the software. With this “so scientific” approach, the list of Bylock users reduces to 110,000 individuals from 250,000 individuals. So who has access to the IPs 1 or 2 days life continue and who has access 3 days like me, life’s turns in to hell. Also according to the Europol, CGNAT system has up to 80% error rate when tracking individuals. It wouldn’t be a push to assume that Turkish ISPs also have very crappy CGNAT logging system. Proper CGNAT logging system with proper equipment and safety brings too much cost to the ISPs with 0 economic income. So how are the prosecutions are made in Bylock cases? It is very simple. If you are on the list, you are 100% guilty and you get to sentenced jail time no matter what from the guiltiness of being one of the member of Gulenist armed terrorist organization. No one has been granted acquittal so far whose name is on the list. Yes solely based on CGNAT logs with 3 lines you get to sentenced. Only those names get erased from the list or determined that someone else actually used that GSM phone number or used that wifi are granted to acquittal. There is no way that you can prove you didn’t use Bylock at all or you didn’t use it for crime purposes. The list even contains so many citizens who could not technically register Bylock software. Bylock was an application similar to WhatsApp. It did periodic polling to the server to get new messages or voice calls. Tuncay Beşikçi determined it to be approximately every 15 seconds from some of the real user CGNAT logs. Also it is determined to be at least 6 IP requests are necessary to complete registration to the application. While these are technical facts, there are about 20,000 people on the list whose total CGNAT logs are lower than 20. Can you imagine the bullshitness that is happening? There is no way to use such software with total 20 IP access logs but these people who is still left on the list is getting at least 6 years 3-month jail time. My CGNAT was lower than 10 and there was only maximum 2 IP access request in the 5 minutes period (we can assume someone would complete registration in 5 minutes). So the only evidence that is used against me was actually technically 100% proving that I did not register the Bylock APP ever! But what happened in the court? The judge didn’t give acquittal to me until my name was removed from the list. There are also many other victims who are already condemned to 6 years jail time with less than 10 lines of CGNAT logs and with only evidence as CGNAT logs. So how did Bylock become this kind of tool of mass arrests? With total and constant poisoning of media. According to the media and so for the Court of Cassation in Turkey, Bylock was following kind of software 1: It had reference and activation feature from the canter of Terrorist organization from Pennsylvania. 2: No one could make IP access requests to the Bylock server except those who had successfully registered to the application and whose registration was approved by the central command center of Terrorist organization It makes sense to arrest from CGNAT logs if the software was like this right? But both pre-acceptance are 100% wrong. Bylock was freely available software on Google Market and anyone who wanted it could download it from Google Market until 3 April 2016. Check out AppBrain Bylock page for more information. Also it didn’t have any kind of reference or activation system for registration or usage. Its usage system was very similar to Skype or Discord. What kind of system it was is properly documented in technical report of Turkish Intelligence (MIT). Moreover, no one can prevent who makes IP access request to any IP. Even your access to the particular IP is blocked by that IP’s owner, you request would fail but still it would be logged in CGNAT and CGNAT doesn’t log whether you have successfully connected to the IP, or duration of the connection or how many bytes you have transferred. At least all of these are not stored in Turkish ISPs CGNAT logs. In a Turkish ISP’s CGNAT there are only these data. Access request start date, access request destination IP, access request destination port, access request private port and private IP. Also since you do not know the atmosphere in Turkey, you cannot correctly evaluate this article. I am sure that Tuncay Beşikçi also knows this was simply tracking code or advertising links etc. But if you tell that Bylock was advertised or used tracking codes like other Apps etc, no one would believe you and hell they would blame you and perhaps arrest you. So announcing that all these tracking codes advertising links were a clever plot of FETÖ (gulenist terrorist organization) was only way to rescue some of the people who had never used Bylock app. This is the summary of the Bylock cases which still goes on. I am guessing that at least 60,000 people were put in jail at least 1 day due to Bylock since the beginning. There are still about 40,000 on the list waiting to be ambushed by Terror Forces until they learn they are on the Bylock list. I believe many of them even don’t know they are on the list since they didn’t use Bylock. Moreover, even though I have had full acquittal, all of my digital devices are still held seized. Finally, I am very shocked that Bylock cases has almost 0 coverage in developed countries. They are totally blind to these cases.

321 points by plg 9y ago

I’m pretty sure that it was the Turkish government who put hundreds of thousands of innocent Turks in jail. Installing chat software shouldn’t be a crime.

21 9y ago
> Installing chat software shouldn’t be a crime. I don't think you understand how repressive regimes work. And I bet that on HN you'll find a lot of support for jailing people who install a let's say Nazi chat app on their phone.
- acdha 9y ago
  > I bet that on HN you'll find a lot of support for jailing people who install a let's say Nazi chat app on their phone. This is pure flame-bait and will not result in any positive contributions to this conversation.
  - thrill 9y ago
    The magnitude of the down votes on his comment lend some weight to his criticism.
    - danso 9y ago
      I downvoted not just because it was an empty rhetorical statement (wouldn't upvotes also lend weight to his criticism?), but because such a claim should be supported by links to examples. For example, I can find recent discussions in which HN users have said companies like Cloudflare should feel obligated to not serve sites like Daily Stormer -- and many users who think Cloudflare should be neutral. Can't think of any significant group of users who have ever argued for jailing anyone involved in the situation, whether it be users or the Daily Stormer itself: https://news.ycombinator.com/item?id=15031922 https://news.ycombinator.com/item?id=15031922
    - acdha 9y ago
      You don’t see any middle ground between downvotes and jailing? Not even a little?
- deleted 9y ago
  [deleted]

Rjevski 9y ago

FTFY: a shitty government is putting people in jail. Even if we ignore the horrible government and bullshit reasons why they're considering installing an encrypted chat app a "crime", they should at least use proper evidence for the convictions, like a dump of the phone's memory with the chat app installed on it, and not a simple DNS lookup/HTTP request to the chat app's domain.

tzahola 9y ago
No, it was a single line of code. We should ban codes like this.
- codewithcheese 9y ago
  Do you want to throw people in jail if they use code that is banned too?
- mseebach 9y ago
  Oh, I guarantee you that the Turkish government agrees wholeheartedly and would very much like to speak with the perpetrators.
- simonh 9y ago
  The people who wrote the code, whatever else they may or not be guilty of and whether or not the code should be illegal or not, didn’t put anyone in jail.
danso 9y ago
Exactly this. People are apparently being jailed for having accessed or simply pinged a forbidden IP/server -- which seemingly could be caused by receiving an email with a hidden img tag, or visiting a website with a hidden iframe.
- deleted 9y ago
  [deleted]
- boosting6889 9y ago

reallymental 9y ago

Everybody hears the echos of this behavior throughout history. I wonder if Erdogan thinks he'll be the one who escapes the universal fate of tyrants. As Turkey becomes increasingly alienated from the EU, Putin looks to gain another monster.

lawlessone 9y ago
Wish i had your optimism , but tyrants seem to be the norm throughout history.
tim333 9y ago
I'm not sure what the universal fate of tyrants is supposed to be. A lot of them seem to hang in there fairly comfortably till they die of old age.
- ryandrake 9y ago
  Minus a couple of outliers, I think history has taught us that the fate of tyrants and oppressors is a long, healthy, and comfortable life of luxury and immense wealth. As a bonus, that fate often includes admiration and support from at least 50.1% of the oppressed population.
dang 9y ago
Please don't post generic political rhetoric to Hacker News. When the topic is politicized, as it is here, it's important for comments to stay grounded in the specifics of the article and not take off into garden-variety politics. That kind of discussion is unable to be substantive, which HN is for, and it leads to flamewars, which is HN is not for. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

integricho 9y ago

I find it very frustrating to read about such oppressive regimes. It fills me with anger, I cannot help myself, I just hate injustice.

txsh 9y ago
You’re probably writing this from a country that drops bombs on people without first knowing who they are or why they are there, just that they appear to be male and over a certain height in an area of terrorist activity. No courts. No oversight. No accountability. What Turkey is doing is terrible but mild in comparison to the drone war.
- integricho 9y ago
  Actually I'm quite close to Turkey (I'm from Serbia), though we're not yet that much oppressed.
- tobltobs 9y ago
  And what do you want to tell us with your whataboutism?
  - yesenadam 9y ago
    Well, that's a glib remark if I've ever heard one. "Whataboutism" - so that's.. said to people who tiresomely derail discussion of seriously wrongdoing with their pat diagnosis and dismiss the original topic as naive. Unfortunately you have done that same thing by using the word. I get why it's useful to have a name for the phenomenon, but there's nothing commendable about the way you used it, it came across sounding like a jerk who thinks they're superior. And made me wonder about what you "want to tell us". edit: Could the downvoters explain why? Thanks. I tried to say something substantive, I thought successfully. (joosters, I totally agree)
    - joosters 9y ago
      IMO the person they were replying to sounded superior. There will always be a more important issue than the one being discussed. (in the eyes of someone, at least). That's no reason to prevent talking about anything else.

reificator 9y ago

The code in question had nothing to do with it. Once you're putting people in jail for network activity on the same wifi network, it's way beyond pretending you were just confused by an iframe.

danso 9y ago

Strange...the "bad" chat app is named Bylock, and downloading/installing it is apparently evidence that you are part of an treasonous political group. But the "single line" of code that the headline appears to refer to is code that causes you to access Bylock.net, kind of like an email image ping: > Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Hypothetically, people could be accused of accessing the site without having knowingly viewed it. This Bylock.net-accessing code was apparently packaged into other applications, causing people who weren't using the actual secretive chat app to be associated with the group: > Akif Demir, a self-described conservative nationalist, wished the worst on people accused of using Bylock and being associated with the Gülenists. That is, until authorities said he was one of them...In October 2016, when his wife was pregnant with their first child, Demir was called into his principal's office. He wouldn't be allowed to work at the school — or anywhere else for that matter — anymore. He had been deemed a Bylock user. The headline isn't inaccurate, but the main problem, or "bug", seems to be the government's hyper-willingness to throw people in jail for having accessed, even pinged, a forbidden server. And it wouldn't be surprising if this "bug" were being exploited by the purported outlaw group behind Bylock to mock the government's oppressive surveillance policies. edit: FWIW, previous coverage of "Bylock" focused on how the app itself was cracked in 2015: https://www.theguardian.com/technology/2016/aug/03/turkey-coup-gulen-movement-bylock-messaging-app https://www.theguardian.com/technology/2016/aug/03/turkey-co... > Starting in May 2015, Turkey’s intelligence agency was able to identify close to 40,000 undercover Gülenist operatives, including 600 ranking military personnel, by mapping connections between ByLock users, the Turkish official said. Visiting "bylock.net" currently yields an empty page: $ curl -IL bylock.net HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/html Last-Modified: Fri, 03 Nov 2017 22:47:45 GMT Accept-Ranges: bytes ETag: "4c5039c4f554d31:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 22 Jan 2018 13:35:36 GMT According to WHOIS, bylock.net was created on 2017-11-01. But that seems too small of a timeframe for the trouble mentioned. Not sure how to use the Whois-history lookups, but Internet Archive pinged the server in 2016: http://web.archive.org/web/*/bylock.net http://web.archive.org/web/*/bylock.net edit 2: Googling around for "bylock.net", it appears an IT company (Fox-IT) was asked by Turkish lawyers to analyze the government's methodology. They published a report on Sept 2017 basically saying the government's "argumentation is seriously flawed" https://foxitsecurity.files.wordpress.com/2017/09/bylock-fox-it-expert-witness-report-english.pdf https://foxitsecurity.files.wordpress.com/2017/09/bylock-fox...

uluyol 9y ago

As bad as this is, it does seem seem to be the status quo when it comes to forensic "science." I don't have any stats on hand, but it seems like more people are more worried about closing/winning cases than making sure they are not sending innocent people to jail.

21 9y ago
Worse yet, many times the prosecutors find evidence that the accused is innocent, but they will still fight a appeals just to save face that they wrongly imprisoned someone.

codewithcheese 9y ago

Can someone familiar with the situation explain how the employers know they used Bylock before the police raid?

shultays 9y ago
It says in the article She knew the arrest was coming. She'd already lost her job, because traces of the app known as Bylock were found on her phone.
- codewithcheese 9y ago
  Yes but whats the process? Were traces of the app found by her employer? Are employers searching employees phones?
  - shultays 9y ago
    I am assuming data is shared by mobile operators to government. And then they fired everyone on that list and works at the government
  - laurent123456 9y ago
    > Were traces of the app found by her employer? Probably that's just the journalist words as I don't think they found or even looked for "traces of the app" on the phone. Most likely the government got a log of the DNS lookups from the ISP and made their arrests based on this.
  - gazorpazorpaway 9y ago
    As others have commented, it was just a matter of the ISP identifying all clients doing DNS lookups or connecting to the Bylock domain. The government have complete control of all ISPs and mobile network operators in Turkey. They don't own them, but you can't give people Internet access without joining the government censorship/logging program. As she was a teacher she would be employed by the government, and they just fire everyone employed in the government automatically when their names show up on the blacklist. I suspected firing of family members and friends that are connected to falsely accused person is done manually. Also it doesn't really matter if the person is employed by the government or not. No employer would dare to keep anyone that is blacklisted as the employer would probably be accused themselves of helping a terrorist if they kept them. Plus, obviously, most big corps in Turkey are run by Erdoğans friends and family directly and indirectly.

phyller 9y ago

Thank God many of us live in countries where you are innocent until proven guilty, and not the other way around.

simonh 9y ago
cough Civil Forfeiture cough. That in a country with a written constitution guaranteeing property rights and due process, and with the legal principle of innocence until proven guilty.
- phyller 9y ago
  Speaking of civil forfeiture made me wonder whatever happened to all the bitcoin owned by that guy that ran Silk Road. Government sold it, but with some bad timing http://fortune.com/2017/10/02/bitcoin-sale-silk-road/ http://fortune.com/2017/10/02/bitcoin-sale-silk-road/

SCHiM 9y ago

A dutch security company was asked to provide a technical review of the 'evidence'. Their conclusion: it sucks. https://www.fox-it.com/en/insights/blogs/blog/fox-debunks-report-bylock-chat-application-led-arrest-75000-turkish-citizens/ https://www.fox-it.com/en/insights/blogs/blog/fox-debunks-re... > Overall, Fox-IT concluded that the quality of the MİT report is very low, especially when it was weighed against the legal consequences of the conclusions which is the detention of 75,000 Turkish citizens.

segmondy 9y ago

This is the creepiest thing I've ever read. As a teen, I was absolutely sure the Internet would liberate us all never saw it being a weapon of oppression as much as it has become. :-(

StavrosK 9y ago
That's because most people don't care about privacy before it's too late. "The government can monitor what sites you access!" "Oh, I have nothing to hide." Then the government changes, and the thing that was considered okay before is now something that you need to hide, but you have no privacy because you didn't see why you'd need it. Now you're in jail because of a tracking pixel. "I have nothing to hide" implies "yet". Do you think you will never have anything to hide in the future as well? Most people don't think that far ahead.
simonh 9y ago
I remember people saying in the 90s that soon free software and the internet would make previous systems of politics and economics irrelevant. Still waiting.
nekopa 9y ago
When were you a teen? I remember having the exact same thoughts when I was a teen. I think it was in 1990 I was at college in the UK and I remember reading a Usenet thread about some student riots going on in Portugal. The media coverage at the time was completely off from what I was hearing from the students 'online'. I remember really believing that the internet really would liberate us all with unfettered access to truth and communication and so on. Fast forward a few years to 1995 and one Christmas (I was in the US then) I decided to take a look at the 'web' and the liberation it had brought so far. I called it my deep dive into the dark underbelly of the Internet. And what I found on that night over my dial-up connection stays with me to this day: facism, racism, gore, bestiality, hatred, child porn. Yes, the Internet liberates us. It allows us to freely be the humans we are, on a larger scale. Unfortunately, humanity has a rather large dark side to it. So this story doesn't surprise me in the least - but I still hold out hope that we may one day do better.
jasonkostempski 9y ago

gambiting 9y ago

>>Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Hypothetically, people could be accused of accessing the site without having knowingly viewed it. And that's why I'm absolutely terrified of the British government requiring that all ISPs store your browsing history for a year. You DON'T know what addresses the websites that you are visiting are linking to. You go on a cat forum where someone posted a picture - but unbeknownst to you, maybe the picture is actually hosted on isis.com and now you're on a watchlist by the government. It's bonkers, and while UK is not arresting people for downloading apps, they certainly build themselves capability to do so if they ever wanted to.

lr4444lr 9y ago

It's stories like this that makes Richard Stallman start to sound sensible.

tree_of_item 9y ago
Stallman was always sensible; it's stories like this that make the people who made fun of him look ridiculous.

vijaybritto 9y ago

I don't see the citation of malicious single line of code in the article. That's why I clicked it in the first place.

JepZ 9y ago

> which created a window "one pixel high, one pixel wide" to Bylock.net WTF, that is like condemning everybody of murder who owns a knife.

JDT 9y ago

Essential reading for all those who say: "If you've got nothing to hide, you've got nothing to fear".

ali1ism 9y ago

there was a story of Iranian software developer whose photo-uploading software was used by a porn website, leading the author persecution and capital punishment. https://www.theguardian.com/world/2012/jan/18/iran-death-sentence-porn-programmer https://www.theguardian.com/world/2012/jan/18/iran-death-sen...

kkarhan 9y ago

Another reason why tracking pixels are really bad... They also harm others that never used the service or agreed to it's T&Cs...

mbrumlow 9y ago

This seems to be a growing trend, mostly in journalism; Blame technology. Just recently there was a article going around about how Google's search algorithm was at fault of keeping two sisters apart. And entire multi page write up on how our lives are at the whims of computers and algorithms. Then to be told that the one sister could not find the other because she changes her name online to protect her identity. Now we have this. A big pile of junk trying to set the reader up to think this single line of code is responsible for the arrest of people. Again trying to instill fear of technology and computers into the reader. I worry this type of article will sway the public's view of technology for the worst. In the end it is people who are to blame for the problem described in this article. And it all centers around lack of understanding how these technologies work. Articled like this are just going to make that worse. Further more the entire thing is bogus because the notion that one can't have access to a given technology is entirely man made and has nothing to do with any "lines of code".

deleted 9y ago
[deleted]
dingo_bat 9y ago
Agreed. But not surprised. Journalists have been doing this for decades with other things like guns.
thrillgore 9y ago
This post is 100% reflection. The press is merely trying to give all of us working in the CS fields the ethical observations we've all but ignored over the past decade, as this profession has grown.
- jsjohnst 9y ago
  I’d argue it should be more pointed towards the government using flimsy evidence to arrest people. It dances around that point without taking a hard stance that what the Turkish government is doing is essentially a human rights violation. It’s not the single line of code putting people in jail, it’s the government. While that line of code is significant, it’s not the only thing.

highdesertmuse 9y ago

Assange keeps warning of AI manipulation by corporate states like Google and Facebook. Perhaps we should listen.

kyberias 9y ago

What a horrible country.

deleted 9y ago
[deleted]

hi41 9y ago

>Beşikçi said it was due to a single line of code, which created a window "one pixel high, one pixel wide" — essentially invisible to the human eye — to Bylock.net. Kindly, could someone please explain what kind of hacking attack this is and how it works? Did this window create a browser cookie for Bylock?

LeifCarrotson 9y ago
It's not a "hacking attack", it's an element on a website: <iframe src=http://bylock.net width=1 height=1> or <img src=“http://bylock.net” width=1 height=1> This code, if it was a part of a page you browse, would cause your browser to load the linked site, almost exactly like clicking on this link: http://bylock.net http://bylock.net. This iframe was present in various websites and apps. The nefarious component of the attack is that the Turkish government surveils all Internet traffic within its borders and thought that the website may have helped some of its opponents commit what it believes to be treason. Its surveillance data tells it all the sites your phone looks up, and it accused people whose phones looked up that domain as being guilty of treason.
- soared 9y ago
  Just replied to someone else: I was wondering if the pixel is just a relatively innocuous advertising pixels. Advertisers/publishers place random pixels from vendors/etc on their website all the time and rarely vet anything. I wouldn't be surprised is bylock was advertising in those apps and asked each app to place a pixel to track conversions/clicks/etc.
- hi41 9y ago
  Thank you for your response. Why would the other apps put this line of code? Are they hand-in-hand with Bylock?
  - jdormit 9y ago
    Check out soared's comment above. Basically, 1-pixel images like these are used by companies to track when someone views their content. It's a very common practice - most of your emails probably contain tracking pixels so that whoever sent them can tell if you viewed the email. If they see a request on their server for the URL they put in the tracking pixel, they know you've opened the email. In Bylock's case, it was most likely a tracking pixel embedded in advertisements for Bylock that the other apps were displaying. The pixel helped Bylock track how many people were viewing their ads.

benmmurphy 9y ago

why did the gulenists use bylock when they could have used whatsapp or signal? it looks like they are getting rounded up because their use of an obscure app has become a strong signal that they are gulenists. though, signal might have had similar problems. not sure how popular it is in turkey.

alpb 9y ago
Basically poor call. They had someone code Bylock from scratch for them because they thought it would be more secure.

qwerty456127 9y ago

What is horrifying here is that people are actually forbidden to communicate securely (ByLock is a secure messenger AFAIK). IMHO the right for privacy is to be absolute, mo matter what. No kind of safety or anything is worth living under constant surveillance and being unable to chat and be sure no 3rd party can read that.

remind_me_again 9y ago

Bylock app is a closed group chat app. The people who used it heavyly in Turkey was a group called Gulenist. They staged the coup in July 15, 2016, and failed. Turkish intelligence service had already infiltrated the Bylock server at least 6 months before the coup attempt. AFAIK the server was in a Eastern Eurepean country. Since the coup attempt prosecutors using Bylock communications as one data point to identify group members. They do this going through the telecommunication logs connections from members' phones to that particular server. Gulenist as a counter measure and to dilute themselves within the general population they used another app that connects to that server. The app is simply an app that tells the prayer times (for muslims). So whoever used that app became a suspect as well. A friend of mine unfortunately lost her job because of that. She went through a big turmoil for about a year. For one, she is nothing to do with the group and has been a critic of them years before the coup attempt. Think about for a second if you go through an ordeal for the very thing you have been opposed. Fortunately, again government realized this sinister plot and has been trying to identify who is really were not affiliated with the group. And my friend, after a year later, clear of blame and reinstated by the government back to her job. She is physician. Unfortunately public either half or misinformed most of the time. This is a very sinister group who tried to overthrow a government who was elected democratically, and a very popular one. During the coup attempt 243 ordinary citizen were killed in the hands of these people. For a moment just think what would you do if your own F-16 fighter jets are bombing you, your very own rifles are showering bullets when you are demonstrating against the coup.

remind_me_again 9y ago

Article has factual errors: Number of people who was detained due to coup attempt is around 55K, this is latest number I heard 2 weeks ago. It was never 150K, but around 80K.

tim333 9y ago

>nearly 150,000 Turks detained >An estimated 30,000 are believed to be among the innocent swept up in this particular campaign I'd say an estimated 150,000 or so are innocent of anything that would be a crime in any normal country. I note Turkey is not getting anywhere with getting Gullen himself extradited because it would require showing evidence to a US court that he'd done something beyond being a political opponent of Erdogan.

pavel_lishin 9y ago
Yeah, I found that to be a weird phrasing on the article's part. I guess what they mean is that 120,000 were actually charged with a crime, due to an action they committed (whether those outside of Turkey would believe that action to be inherently criminal or not).
Cyph0n 9y ago
I'm not too familiar with the whole Gulen thing in general, but I have heard that the Gulenists were an almost cult-like group that favored each other and made sure only they got into the highest levels of power. I'm sure Erdogan did blow the story out of proportion (it benefits him to do so), but I also think that Gulen and his followers are not fault-free.
- tim333 9y ago
  Sure yeah they were a "almost cult-like group that favored each other" but so are freemasons, old Etonians and so on. It doesn't mean you should arrest all those. (Well, maybe Dave and Boris... but not all of them).

cesarb 9y ago

This reminds me of some Bittorrent trackers which added random IP addresses to their peer list, so companies which accused people of downloading movies based only on the list returned from the tracker would make false accusations: https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-with-fake-peers-081020/ https://torrentfreak.com/the-pirate-bay-tricks-anti-pirates-...

intrasight 9y ago

Vote with your dollars - don't visit Turkey or do business with Turkey.

meaydinli 9y ago

Does anybody know of any article where somebody looked into the apk and the code?

sizzle 9y ago

This is a despicable use of technology. I hope the innocent have their names cleared.

deleted 9y ago

[deleted]

avictim 9y ago

Hello everyone. I am one of the victims of these Bylock cases and the tracking code or advertising links etc. I had been trialled with 15 years heavy jail time and it was definite for me to get sentenced at least 6 years 3 months if this particular iframe code was not found in an old phone’s temporary files. Actually after the iframe code was found by one of the official Computer Forensic expert who has been employed by one of the official Bylock cases public prosecutor, he and the public prosecutor had kept it secret from the public and tried to burrow it. Until some hero got screenshot of this official finding and leak it to the one of the bravest lawyer in Turkey whose name is Ali Aktaş, we had no concrete proof of tracking codes or advertising links. I know you cannot believe that 100,000 people are getting sentenced solely based on reverse tracking of CGNAT logs (IP access request logs kept by ISPs). Yes you are right. I myself also couldn’t imagine such thing would happen in my beautiful country, hell even in banana republics I couldn’t imagine. But one morning I wake up and anti-terror forces break into my house to arrest me and seize all of my digital devices until an unknown time. It was truly shocking experience and I had no idea how could this happen to me while I have never used that stupid, amateur and lame communication android App Bylock. Yes Bylock was very insecure APP which allowed passwords as 0, did not hash (not even MD5 but there are some claims that the very late versions of the APP were hashing user passwords and put some password restrictions such as min 8 characters) user passwords, kept all of the private keys in database so the administrator could read all of the messages, did not use any cloud server, cloud service or implemented proxy system to prevent IP tracking and so on. All of these are written in the Turkish Intelligence (MIT) official technical Bylock report. I was lucky that I was not at home that time so I had opportunity research and prepare defence. After few days research, I found out that the our brightest brains in the Information and Communication Technologies Authority (BTK) decided to scan back all of the CGNAT logs and determine whoever had made any access request to the one of the IP address which are determined to belong Bylock server and put all of the citizens on Bylock users list who have access to these IPs. That is how ridiculously I was put on that list. But even the preparation of list cries out loud the erroneous procedure that is being followed. First of all, our Information and Communication Technologies Authority (BTK) determines CGNAT start date after 5 months of the Bylock app release (release date is April 2014 but CGNAT scan start date is August 2014). So during this period of time whoever used Bylock APP or made access to IPs of Bylock server are not put on the list. Moreover, they found out that total 250,000 individuals have made at least 1 IP access request to the Bylock server IPs. Since 250,000 is too many to put in jail, they come up with this “fantastic” rule. They filter the list and remove citizens from the list whoever made only 1 day or 2 days access to the IPs. So they claim to the media that they have removed people who actually did not use the software. With this “so scientific” approach, the list of Bylock users reduces to 110,000 individuals from 250,000 individuals. So who has access to the IPs 1 or 2 days life continue and who has access 3 days like me, life’s turns in to hell. Also according to the Europol, CGNAT system has up to 80% error rate when tracking individuals. It wouldn’t be a push to assume that Turkish ISPs also have very crappy CGNAT logging system. Proper CGNAT logging system with proper equipment and safety brings too much cost to the ISPs with 0 economic income. So how are the prosecutions are made in Bylock cases? It is very simple. If you are on the list, you are 100% guilty and you get to sentenced jail time no matter what from the guiltiness of being one of the member of Gulenist armed terrorist organization. No one has been granted acquittal so far whose name is on the list. Yes solely based on CGNAT logs with 3 lines you get to sentenced. Only those names get erased from the list or determined that someone else actually used that GSM phone number or used that wifi are granted to acquittal. There is no way that you can prove you didn’t use Bylock at all or you didn’t use it for crime purposes. The list even contains so many citizens who could not technically register Bylock software. Bylock was an application similar to WhatsApp. It did periodic polling to the server to get new messages or voice calls. Tuncay Beşikçi determined it to be approximately every 15 seconds from some of the real user CGNAT logs. Also it is determined to be at least 6 IP requests are necessary to complete registration to the application. While these are technical facts, there are about 20,000 people on the list whose total CGNAT logs are lower than 20. Can you imagine the bullshitness that is happening? There is no way to use such software with total 20 IP access logs but these people who is still left on the list is getting at least 6 years 3-month jail time. My CGNAT was lower than 10 and there was only maximum 2 IP access request in the 5 minutes period (we can assume someone would complete registration in 5 minutes). So the only evidence that is used against me was actually technically 100% proving that I did not register the Bylock APP ever! But what happened in the court? The judge didn’t give acquittal to me until my name was removed from the list. There are also many other victims who are already condemned to 6 years jail time with less than 10 lines of CGNAT logs and with only evidence as CGNAT logs. So how did Bylock become this kind of tool of mass arrests? With total and constant poisoning of media. According to the media and so for the Court of Cassation in Turkey, Bylock was following kind of software 1: It had reference and activation feature from the canter of Terrorist organization from Pennsylvania. 2: No one could make IP access requests to the Bylock server except those who had successfully registered to the application and whose registration was approved by the central command center of Terrorist organization It makes sense to arrest from CGNAT logs if the software was like this right? But both pre-acceptance are 100% wrong. Bylock was freely available software on Google Market and anyone who wanted it could download it from Google Market until 3 April 2016. Check out AppBrain Bylock page for more information. Also it didn’t have any kind of reference or activation system for registration or usage. Its usage system was very similar to Skype or Discord. What kind of system it was is properly documented in technical report of Turkish Intelligence (MIT). Moreover, no one can prevent who makes IP access request to any IP. Even your access to the particular IP is blocked by that IP’s owner, you request would fail but still it would be logged in CGNAT and CGNAT doesn’t log whether you have successfully connected to the IP, or duration of the connection or how many bytes you have transferred. At least all of these are not stored in Turkish ISPs CGNAT logs. In a Turkish ISP’s CGNAT there are only these data. Access request start date, access request destination IP, access request destination port, access request private port and private IP. Also since you do not know the atmosphere in Turkey, you cannot correctly evaluate this article. I am sure that Tuncay Beşikçi also knows this was simply tracking code or advertising links etc. But if you tell that Bylock was advertised or used tracking codes like other Apps etc, no one would believe you and hell they would blame you and perhaps arrest you. So announcing that all these tracking codes advertising links were a clever plot of FETÖ (gulenist terrorist organization) was only way to rescue some of the people who had never used Bylock app. This is the summary of the Bylock cases which still goes on. I am guessing that at least 60,000 people were put in jail at least 1 day due to Bylock since the beginning. There are still about 40,000 on the list waiting to be ambushed by Terror Forces until they learn they are on the Bylock list. I believe many of them even don’t know they are on the list since they didn’t use Bylock. Moreover, even though I have had full acquittal, all of my digital devices are still held seized. Finally, I am very shocked that Bylock cases has almost 0 coverage in developed countries. They are totally blind to these cases.