The Legal Dimension of Monitoring Internet Usage in Türkiye

Article Content and a Brief Explanation on the Traceability of Internet Usage

In this article, I have sought to address—through the lens of the existing statutory framework—the question frequently voiced across news platforms and social media, which lingers in the minds of most internet users: "Is individuals' internet usage being monitored?"

Prior to providing explanations on this subject, I would like to emphasize that there exist numerous methodologies for monitoring communications executed by internet-connected devices via cables and electromagnetic waves. Foremost among these, the deployment of spyware (e.g., Pegasus) and analogous malware can achieve this objective without being impeded by traffic-encrypting technologies (such as VPNs, SSL, etc.). Furthermore, by virtue of network technologies capable of accessing data traffic information or packet content transmitted across the network, entities controlling backbone infrastructure systems, operating man-in-the-middle systems such as proxies, or positioning themselves as network sniffers can readily observe the activities of users.

It is self-evident that most of the aforementioned activities would engender unlawful circumstances. The point I wish to underscore here is that, absent high-level cybersecurity countermeasures, internet communications and usage are traceable without undue technical complexity.

The current legal framework in Türkiye is fundamentally directed toward the monitoring and recording of "traffic data"—such as IP address, port number, subscriber identity, timestamp, application software utilized, and data volume—rather than the substantive content of internet communications, such as the actual content of VoIP calls. Nevertheless, exceptional legal norms—however difficult their practical execution may be—do permit the monitoring of data content. However, in such exceptional scenarios, a prospective judicial warrant is strictly required.

The paramount issue regarding the matters detailed below is that this framework operates as a system that functions automatically and without requiring an individualized judicial warrant, stemming directly from statutory obligations.

I) The Legal Infrastructure Concerning the Statutory Duties of the BTK

A) The Primary Activity of the BTK in This Domain: Monitoring Internet Content and Virtual Patrols

In its capacity as a specialized administrative enforcement authority, the Information and Communication Technologies Authority (BTK) possesses significant statutory duties and powers regarding cybersecurity. The BTK does not constitute a general law enforcement agency like the police or gendarmerie; rather, it operates as a specialized administrative body and may only exercise specific normative powers conferred explicitly upon it. In this context, Law No. 5651 explicitly assigns an "oversight and prevention" mandate to the BTK. The relevant provision dictates: "To establish or cause to be established, operate or cause to be operated all necessary technical infrastructure, including an oversight and reporting center, in order to prevent the commission of offenses enumerated under Articles 8 and 8/A of this Law through the monitoring of publications in the internet environment."

The activity of "monitoring the internet environment," with which the BTK is tasked pursuant to Law No. 5651, is defined within the same statute as "the tracking of information and data without affecting the data in the internet environment." The statute further specifies that the monitoring duty assigned to the BTK must be executed "through the monitoring of publications in the internet environment." Consequently, the monitoring duty of the BTK fundamentally consists of "virtual patrols"—that is, the monitoring and listening of the virtual environment accessible to the general public on websites and applications perceivable through sensory organs. In other words, without hacking target systems, the publicly accessible internet environment may properly form the subject of virtual patrols.

Regarding content that is not publicly accessible—which may broadly be categorized as the deep web—the execution of such virtual patrols is permitted under our legal framework not by the BTK (due to the explicit statutory definitions and limitations in Law No. 5651), but rather by dedicated units within the General Directorate of Security (EGM) or intelligence structures acting within established legal bases. In such operations, resorting to hacking activities such as malware injection or brute-force attacks lacks explicit statutory authorization under our law. Indeed, such practices run counter to the core purpose of preliminary intelligence gathering, as cybersecurity countermeasures on target systems could trigger alerts, enabling perpetrators to destroy evidence and abscond. For such closed environments, legally sound methods include cooperation with internet service providers operating the application software, monitoring these spaces via undercover accounts, utilizing informants, or, where legally permissible, deploying undercover investigators or analogous methodologies.

B) The BTK's Duty to Assist Law Enforcement and Intelligence Agencies in the Monitoring/Interception of Internet Communications Data

Because the BTK functions as a specialized administrative authority, it cannot issue interception or monitoring orders directly based on the Law on Duties and Powers of the Police (PVSK) or similar rules governing general law enforcement, nor can it apply to courts for such purposes. The BTK bears a coordination and assistance duty regarding the cybersecurity and evidence-gathering activities of general law enforcement (e.g., the police). Article 10 of Law No. 5651 tasks the BTK with coordinating with law enforcement and other relevant units regarding crime prevention, while Additional Article 7 of the PVSK stipulates: "...operations regarding telecommunications traffic and interceptions conducted within the scope of Article 135 of Law No. 5271 shall be carried out from a single centralized center within the body of the Information and Communication Technologies Authority." A similar provision is codified under Law No. 2937 on the State Intelligence Services and the National Intelligence Organization (MIT Law).

The BTK executes these functions by cooperating with access providers regarding the monitoring, interception, or recording of the content of internet communications. Both the Code of Criminal Procedure and the Electronic Communications Law contain statutory provisions obligating access providers to facilitate lawful interception and technical interventions.

II) General Practice: Monitoring Internet Traffic

A) The Pivotal Role of ISPs in These Activities

As outlined supra, the BTK primarily performs duties concerning virtual patrols and the execution of judicial or administrative interception orders regarding communication content. However, there exists a continuous operational regime through which the internet—specifically traffic data—is monitored, albeit indirectly, by the state, public institutions, and the BTK. This regime is carried out through access providers, hosting providers, and collective use providers, manifesting as the monitoring, recording, and reporting of traffic data to the BTK and judicial authorities.

Under this framework, access providers monitor and record traffic data—which they are statutorily required to track—across the backbone infrastructure they control, hosting providers do so for data flowing through or terminating on their servers, and collective use providers execute this for systems under their control, utilizing technology analogous to typical packet analysis software. It must be noted that the primary burden and broad technical capacity for monitoring rest with access providers capable of monitoring general traffic flowing across the national backbone in Türkiye.

B) The Regulatory Scheme Governing the Monitoring, Recording, and Reporting of Internet Traffic

As noted in the introduction, traffic data and the substantive content of data subject to traffic represent distinct legal concepts. To provide an illustrative example given the importance of this distinction: when X and Y communicate via application Z, the general metadata regarding the communication constitutes traffic data, whereas the substance of the communication—namely the message contents—falls entirely outside the concept of traffic data. Law No. 5651 and Law No. 5809, alongside their derivative secondary legislation, mandate that access providers, hosting providers, and collective use providers collect traffic data and retain it on their servers for a specified statutory period, ensuring immutability through hash plus timestamp technologies.

Statutory provisions do not set forth an exhaustive list of every specific data item to be recorded. For instance, while access providers operating proxy servers are explicitly required to record information regarding target systems—such as the application server Y to which subscriber X transmits data from a mobile device—explicit requirements for other scenarios remain uncodified. For example, Article 3 of the Regulation on Activity Certificates defines access provider traffic data in a non-exhaustive manner as: "Information regarding access to the internet environment, such as the subscriber's name, surname, address, telephone number, subscription start date, subscription cancellation date, system connection timestamp, system disconnection timestamp, IP address allocated for the relevant connection, and connection port numbers."

1) Monitoring of Traffic Data

The primary statutory obligations imposed upon access providers regarding the processing and transfer of traffic data relate to cybersecurity and digital forensics, codified under Law No. 5651. Pursuant to Law No. 5651 and relevant secondary legislation, access providers are obligated to retain access provider traffic data for a period of one year regarding the services they provide, in order to enable the BTK to fulfill its statutory duties. Under the applicable regulation, if an access provider offers proxy server services to its users, proxy server traffic data must likewise be retained for one year. Naturally, to retain data, traffic must first be monitored and analyzed via software tools. The implementing regulation of Law No. 5651 dictates that access providers (e.g., TTNET) are obligated to provide necessary assistance and support to the BTK in monitoring internet traffic, which support is directed toward the reporting of recorded traffic data to the BTK within the statutory framework.

(While this represents the primary operational scheme, certain data categories required to be retained for one year under Law No. 5651 overlap with personal data required to be processed under the Electronic Communications Law and its derivative legislation, where retention periods under the latter framework remain partially indeterminate under norms specifying retention "until the completion of the relevant process.")

The core principle to understand within this regime is as follows: Access providers are legally obligated to report to the BTK, upon request, traffic data logs stored on their servers whose immutability is guaranteed via hash plus timestamp technologies. The BTK, in turn, must issue such requests strictly within the bounds of necessity arising from its statutory duties. Furthermore, access providers are required to submit to the BTK, as text files accompanied by explanatory log formats and subscriber registry records, all traffic data records covering the one-year period prior to the closure date notified to the BTK at least three months in advance of ceasing operations. Additionally, every access provider is obligated to transmit regularly to the BTK, on a monthly basis from the commencement of operations, the access numbers utilized for each access methodology and information regarding subscribers receiving wholesale services.

2) Prohibition on Monitoring and Recording Traffic Content / Substantive Data Under This Regime

The monitoring of substantive communication data falls strictly outside the scope of Law No. 5651 and the general monitoring and recording duties of access providers. Interception, monitoring, or recording of communication content transmitted over internet communications may solely be conducted for intelligence purposes or the acquisition of judicial evidence pursuant to explicit statutory warrants under the MIT Law, the PVSK, and the Code of Criminal Procedure (CMK). Where encryption in communications can be lawfully bypassed without resorting to hacking—pursuant to orders rendered under these exceptional statutory provisions—the monitoring or recording of, for instance, a WhatsApp communication could theoretically be legally permissible. However, resorting to hacking activities or malware injection in the execution of such measures poses a profound legal problem, as a statutory lacuna exists regarding the procedural framework, creating a significant imbalance between the means employed and the objective sought.

It should be emphasized that our domestic legal framework lacks statutory provisions authorizing the execution of such activities through access providers via Deep Packet Inspection (DPI) or analogous technologies. Nevertheless, if technical impediments regarding encrypted communications can be overcome, deploying a technology that intercepts traffic exclusively through a single application software—such as WhatsApp—to access substantive data without monitoring collateral communications could be considered legally compliant and proportionate. Nonetheless, in my view, the most constitutionally sound mechanism to render such interventions lawful is to conduct judicial proceedings directly through cooperation with the ISP operating the application software—namely, directly with entities such as WhatsApp—or via mutual legal assistance treaties (MLAT) with relevant foreign jurisdictions.

C) What Is the Objective of Monitoring Internet Traffic?

Traffic data logs maintained by access providers, hosting providers, and collective use providers are utilized in investigations, judicial proceedings, and intelligence activities from a digital forensics and cybersecurity perspective, with access providers routinely submitting this data to the BTK, which subsequently transmits it to competent authorities. Failure to comply with these obligations regarding traffic monitoring, recording, and data sharing entails administrative or criminal sanctions.

Across most legal systems within the democratic world that I have examined, statutory norms governing the monitoring of traffic data originate both from the necessity to delineate concrete boundaries restricting fundamental rights and freedoms, and the imperative to establish a legal framework for evidence gathering. While the categories of data subject to monitoring are narrowly circumscribed in certain jurisdictions, other countries, including Türkiye, define a broader statutory framework. Certain jurisdictions, such as Russia, maintain explicit legal frameworks authorizing DPI technologies beyond mere traffic data. Operating under an entirely distinct model, jurisdictions such as Germany have enacted statutory frameworks authorizing official hacking operations (online searches / online-durchsuchung) to lawfully hack target systems for evidence gathering in major criminal offenses.

Across all these methodologies—ranging from the least to the most intrusive—the fundamental legal objective is the acquisition of evidence concerning unlawful acts and offenses, identifying the devices utilized in crime alongside their perpetrators—thereby ensuring the efficacy of digital forensic processes—and ultimately remedying grievances to achieve justice. (My personal view remains that hacking operations constitute disproportionate mechanisms for evidence gathering.)

Atty. Alp Öztekin, LL.M.