Thousands of Turks accused of using Bylock app despite never having used it

Thank you very much for introducing me to the term and this great site! This article was very informative, and the rest of the site looks like a great reference to learn such issues.

Do you blame your grandmother for propagating popups or do you blame the ad industry?

Sure yeah they were a "almost cult-like group that favored each other" but so are freemasons, old Etonians and so on. It doesn't mean you should arrest all those. (Well, maybe Dave and Boris... but not all of them).

Hello everyone. I am one of the victims of these Bylock cases and the tracking code or advertising links etc.

I had been trialled with 15 years heavy jail time and it was definite for me to get sentenced at least 6 years 3 months if this particular iframe code was not found in an old phone’s temporary files.

Actually after the iframe code was found by one of the official Computer Forensic expert who has been employed by one of the official Bylock cases public prosecutor, he and the public prosecutor had kept it secret from the public and tried to burrow it. Until some hero got screenshot of this official finding and leak it to the one of the bravest lawyer in Turkey whose name is Ali Aktaş, we had no concrete proof of tracking codes or advertising links.

I know you cannot believe that 100,000 people are getting sentenced solely based on reverse tracking of CGNAT logs (IP access request logs kept by ISPs). Yes you are right. I myself also couldn’t imagine such thing would happen in my beautiful country, hell even in banana republics I couldn’t imagine. But one morning I wake up and anti-terror forces break into my house to arrest me and seize all of my digital devices until an unknown time. It was truly shocking experience and I had no idea how could this happen to me while I have never used that stupid, amateur and lame communication android App Bylock. Yes Bylock was very insecure APP which allowed passwords as 0, did not hash (not even MD5 but there are some claims that the very late versions of the APP were hashing user passwords and put some password restrictions such as min 8 characters) user passwords, kept all of the private keys in database so the administrator could read all of the messages, did not use any cloud server, cloud service or implemented proxy system to prevent IP tracking and so on. All of these are written in the Turkish Intelligence (MIT) official technical Bylock report.

I was lucky that I was not at home that time so I had opportunity research and prepare defence. After few days research, I found out that the our brightest brains in the Information and Communication Technologies Authority (BTK) decided to scan back all of the CGNAT logs and determine whoever had made any access request to the one of the IP address which are determined to belong Bylock server and put all of the citizens on Bylock users list who have access to these IPs. That is how ridiculously I was put on that list.

But even the preparation of list cries out loud the erroneous procedure that is being followed. First of all, our Information and Communication Technologies Authority (BTK) determines CGNAT start date after 5 months of the Bylock app release (release date is April 2014 but CGNAT scan start date is August 2014). So during this period of time whoever used Bylock APP or made access to IPs of Bylock server are not put on the list. Moreover, they found out that total 250,000 individuals have made at least 1 IP access request to the Bylock server IPs. Since 250,000 is too many to put in jail, they come up with this “fantastic” rule. They filter the list and remove citizens from the list whoever made only 1 day or 2 days access to the IPs. So they claim to the media that they have removed people who actually did not use the software. With this “so scientific” approach, the list of Bylock users reduces to 110,000 individuals from 250,000 individuals. So who has access to the IPs 1 or 2 days life continue and who has access 3 days like me, life’s turns in to hell. Also according to the Europol, CGNAT system has up to 80% error rate when tracking individuals. It wouldn’t be a push to assume that Turkish ISPs also have very crappy CGNAT logging system. Proper CGNAT logging system with proper equipment and safety brings too much cost to the ISPs with 0 economic income.

So how are the prosecutions are made in Bylock cases? It is very simple. If you are on the list, you are 100% guilty and you get to sentenced jail time no matter what from the guiltiness of being one of the member of Gulenist armed terrorist organization. No one has been granted acquittal so far whose name is on the list. Yes solely based on CGNAT logs with 3 lines you get to sentenced. Only those names get erased from the list or determined that someone else actually used that GSM phone number or used that wifi are granted to acquittal. There is no way that you can prove you didn’t use Bylock at all or you didn’t use it for crime purposes.

The list even contains so many citizens who could not technically register Bylock software. Bylock was an application similar to WhatsApp. It did periodic polling to the server to get new messages or voice calls. Tuncay Beşikçi determined it to be approximately every 15 seconds from some of the real user CGNAT logs. Also it is determined to be at least 6 IP requests are necessary to complete registration to the application. While these are technical facts, there are about 20,000 people on the list whose total CGNAT logs are lower than 20. Can you imagine the bullshitness that is happening? There is no way to use such software with total 20 IP access logs but these people who is still left on the list is getting at least 6 years 3-month jail time. My CGNAT was lower than 10 and there was only maximum 2 IP access request in the 5 minutes period (we can assume someone would complete registration in 5 minutes). So the only evidence that is used against me was actually technically 100% proving that I did not register the Bylock APP ever! But what happened in the court? The judge didn’t give acquittal to me until my name was removed from the list. There are also many other victims who are already condemned to 6 years jail time with less than 10 lines of CGNAT logs and with only evidence as CGNAT logs.

So how did Bylock become this kind of tool of mass arrests? With total and constant poisoning of media. According to the media and so for the Court of Cassation in Turkey, Bylock was following kind of software 1: It had reference and activation feature from the canter of Terrorist organization from Pennsylvania. 2: No one could make IP access requests to the Bylock server except those who had successfully registered to the application and whose registration was approved by the central command center of Terrorist organization It makes sense to arrest from CGNAT logs if the software was like this right? But both pre-acceptance are 100% wrong. Bylock was freely available software on Google Market and anyone who wanted it could download it from Google Market until 3 April 2016. Check out AppBrain Bylock page for more information. Also it didn’t have any kind of reference or activation system for registration or usage. Its usage system was very similar to Skype or Discord. What kind of system it was is properly documented in technical report of Turkish Intelligence (MIT). Moreover, no one can prevent who makes IP access request to any IP. Even your access to the particular IP is blocked by that IP’s owner, you request would fail but still it would be logged in CGNAT and CGNAT doesn’t log whether you have successfully connected to the IP, or duration of the connection or how many bytes you have transferred. At least all of these are not stored in Turkish ISPs CGNAT logs. In a Turkish ISP’s CGNAT there are only these data. Access request start date, access request destination IP, access request destination port, access request private port and private IP.

Also since you do not know the atmosphere in Turkey, you cannot correctly evaluate this article. I am sure that Tuncay Beşikçi also knows this was simply tracking code or advertising links etc. But if you tell that Bylock was advertised or used tracking codes like other Apps etc, no one would believe you and hell they would blame you and perhaps arrest you. So announcing that all these tracking codes advertising links were a clever plot of FETÖ (gulenist terrorist organization) was only way to rescue some of the people who had never used Bylock app.

This is the summary of the Bylock cases which still goes on. I am guessing that at least 60,000 people were put in jail at least 1 day due to Bylock since the beginning. There are still about 40,000 on the list waiting to be ambushed by Terror Forces until they learn they are on the Bylock list. I believe many of them even don’t know they are on the list since they didn’t use Bylock. Moreover, even though I have had full acquittal, all of my digital devices are still held seized.

Finally, I am very shocked that Bylock cases has almost 0 coverage in developed countries. They are totally blind to these cases.