Encrypted Communication on the Internet and Its Legal Infrastructure (VPN-TOR-Encrypted Email, etc.)

A) What Is Encrypted Communication on the Internet?

Applications based on encryption and cryptography represent diverse methodologies practiced since antiquity to ensure that a communication or message remains intelligible solely between designated parties. Encrypted communication may occur in physical media or manifest as activities specific to cyberspace via the internet.

With technological advancement, computing systems and the internet integrated into social life, thereby granting two citizens the capability to transmit an email containing encrypted messages between themselves—much like the ciphered letters of ancient times. Moreover, technology enables the background software itself, rather than the users, to execute the encryption process seamlessly.

As technology progressed, encrypted internet communication transitioned out of the exclusive monopoly of public institutions, the military, law enforcement, or intelligence units, becoming available to virtually every segment of society. Today, encrypting a portion or the entirety of internet traffic has been simplified immensely for end-users. For instance, in its simplest form, applications such as WhatsApp execute end-to-end encryption by default under factory settings, irrespective of user preference. On websites or applications employing SSL and its derivatives, unilateral encryption is executed without imposing an additional burden on the user. Certain web browsers offer extensions that encrypt traffic directed toward accessed servers or shared files, while specific browser software such as TOR possesses this functional architecture natively. VPNs likewise constitute one of the most widespread methodologies for encrypting traffic in transit between client and server. Furthermore, operating systems prioritizing anonymity and cybersecurity are delivered to end-users pre-configured with such settings. It is also technically possible to encrypt network traffic directly via modem or router-type hardware.

Infra, encrypted communication on the internet shall be examined specifically through VPN and TOR technologies—which are most widely deployed by all categories of internet users for positive or negative ends—alongside encrypted email software predominantly utilized in corporate communications. Throughout these examinations, the legal issues engendered by the deployment of these technologies shall be elucidated in light of personal scholarly perspectives.

B) VPN-TOR and Network Traffic Encryption

(TOR possesses two primary functional dimensions: client-based data security plus anonymity, and server-based anonymity offering the capability to publish websites not widely known or accessible to the general public. In this article, solely the dimension concerning data security and anonymity shall be analyzed. TOR's .onion network falls outside the scope of this work.)

When a device operates a VPN or TOR while establishing an outbound connection from its local area network to the WAN/internet network, data traffic flowing between client and server is routed through a third-party server (or a network of multiple servers). During this transit, data traffic is enciphered/encrypted by the software operating the VPN or TOR technology across the participating devices. (This represents one of the core technical distinctions between VPN-TOR technologies and the deployment of proxy servers.)

The encryption of data traffic primarily yields a cybersecurity result, preventing the perpetrator of the offense of "interception of data" codified under Article 243/4 of the Turkish Penal Code and Article 3 of the Convention on Cybercrime from achieving their criminal objective. Indeed, through these technologies, a hacker or perpetrator intruding into network traffic—positioning themselves between client and server—cannot extract meaningful information from the communication even if they capture data packets, so long as the cryptographic cipher remains unbroken. However, actors intending to monitor internet communications are by no means limited to black-hat hackers. Leaving aside consensual penetration testing and white-hat security professionals, technologies of this nature primarily complicate digital forensics and intelligence operations—a result less concerned with serving as a cybersecurity shield against criminals than with establishing "anonymity/confidentiality against the state." Furthermore, because intermediary devices or servers enter the data stream and alter the client's IP address, the legal issue of circumventing access-blocking orders inevitably arises.

C) Software Encrypting Email, Message, or File Content Directly

Rather than encrypting partial traffic operations or the entire data stream flowing across the network, certain software applications specifically encrypt designated messages or files within a communication chain. Following the termination of the communication, the encrypted state persists until the requisite cryptographic keys are deployed. The pioneer of such software made available for private law actors is PGP, historically utilized predominantly by cyber-activists to construct secure communication networks. Diverse software tools capable of encrypting files across various formats exist, alongside applications targeting specific file types exclusively. In this direction, official add-ons for Outlook have been developed specifically for encrypted email communication. For public institutions, ASELSAN similarly maintains proprietary encrypted messaging/email technologies.[1]

Unless the recipient of the communication decrypts the message utilizing the matching decryption key, the file or message content either remains entirely unopenable or appears as unintelligible character strings, as observed in encrypted email instances. (Key deployment may manifest as a code executed directly by the receiving software, a secondary password entered manually by the recipient, or a hardware-based supplementary token as seen in electronic signatures.) Through this mechanism, a hacker or perpetrator committing the offense of "unlawful access to an information system" under Article 243/1 of the Turkish Penal Code—even if they gain access to the system—is prevented from opening data files or extracting meaningful content therefrom without executing the decryption key. (For instance, a plain-text message reading "hello" appears unintelligible as "xlsa931*-sadai" to an unauthorized individual opening the file unless decrypted.) On the reverse side of the coin, such cryptographic applications harbor the potential to impede digital forensic activities directed toward "searching static data" under Article 134 of the Code of Criminal Procedure and derivative norms.

D) Provisions Governing Encrypted Communication in the Online Environment Under Turkish Law

In Türkiye, legislative efforts regarding cybersecurity span a broad spectrum, ranging from Cyber Incident Response Teams (SOME) and the National Cyber Incident Response Center (USOM) to sector-specific regulations and, indirectly, KVKK norms and Board decisions governing the secure electronic retention of personal data. For legally compliant, high-level cybersecurity, VPNs or file encryption technologies—if not TOR—are customarily deployed alongside collateral cybersecurity measures to ensure the integrity of information systems and data.

Although not detailed specifically under the explicit nomenclature of VPNs or derivative technologies, the deployment of cryptography-based technologies within electronic communications is regulated in a general sense within our legislation. Foremost, within the Electronic Communications Law—governing the umbrella concept of "electronic communications" which subsumes internet communications—specific norms addressing encrypted communications exist. These comprise Article 39 of the Electronic Communications Law, titled "Coded and Encrypted Communication"; Article 63/6, which criminalizes coded and encrypted communication executed in violation of Article 39; and the provisions of the Regulation on Procedures and Principles Regarding Coded or Encrypted Communications Within Electronic Communications Services by Public Institutions and Organizations, and Natural and Legal Persons, which substantiates Article 39. Pursuant to Article 2, the Regulation encompasses all public institutions, organizations, and natural and legal persons, excluding the Turkish Armed Forces, General Gendarmerie Command, Coast Guard Command, Undersecretariat of the National Intelligence Organization, General Directorate of Security, and Ministry of Foreign Affairs authorized to execute coded or encrypted communications within electronic communications services, alongside public institutions operating coded/encrypted systems belonging to these entities.

At the outset, it should be noted that Presidential Circular No. 2019/12 on Information and Communication Security Measures contains provisions structured in parallel with the Regulation, establishing overarching principles in this direction. For instance, pursuant to the Circular, "classified data sharing and communication shall not be conducted over mobile applications, excluding domestic mobile applications developed by institutions authorized under legislation for coded or encrypted communication." Furthermore, pursuant to Article 6/7 of the Regulation on Procedures and Principles Regarding Coded or Encrypted Communications Within Electronic Communications Services by Public Institutions and Organizations, and Natural and Legal Persons, the deployment of national cryptographic devices designed and manufactured in Türkiye is essential within coded or encrypted communication systems utilized by public institutions and organizations.

Article 5 of the Regulation provides that all public institutions, organizations, and natural and legal persons—excluding the exceptional institutions specified in the Electronic Communications Law—may conduct coded and/or encrypted communications, provided they comply with the provisions of the Regulation. Article 10 of the Regulation cross-references Articles 60 and 63 of the Electronic Communications Law regarding administrative and penal sanctions for manufacturers and users of coded or encrypted electronic communication devices/systems acting in violation of the Regulation.

Although Article 5 specifies that coded and/or encrypted communications may be conducted provided they conform to the Regulation, the Regulation generally sets forth norms governing the manufacture, importation, and provisioning of these devices/systems, rather than targeting end-users directly. Solely Article 7 dictates that no modification or alteration regarding hardware or software specifications may be executed on owned coded or encrypted electronic communication systems without obtaining prior authorization from the BTK, establishing that criminal complaints shall be lodged in cases of non-compliance.

Article 8 of the Regulation dictates that public institutions, organizations, and natural and legal persons establishing and operating coded or encrypted electronic communication devices/systems are obligated to adopt protective safeguards preventing unauthorized individuals from acquiring or operating the systems. The cryptographic algorithms, codes, and keys belonging to coded or encrypted electronic communication devices/systems submitted to the BTK by manufacturers pursuant to the Regulation shall be securely retained within the BTK's data center.

Pursuant to Article 4 of the Regulation, cryptography denotes the enciphering of messages for secure data transmission and retention, whereas coded communication denotes the transmission of messages modified according to a pre-agreed code to prevent comprehension by third parties. An argument could be advanced that technologies facilitating encrypted email/file transmission, such as VPNs or TOR, fall within the scope of these statutory definitions. However, the provisions under the Electronic Communications Law and the relevant Regulation are not drafted around cryptography and coded communications in the abstract; rather, the regulations are narrowed to a restricted operational sphere of coded/encrypted communication. Indeed, statutory and regulatory provisions structure rules specifically around "wireless/radio systems" and "electronic communication devices and/or systems." When the normative definitions of these concepts under the Electronic Communications Law and the definition of an encrypted electronic communication device under Article 4 of the Regulation are analyzed, it becomes evident that software-based technologies facilitating encrypted email/file transmission via VPNs, TOR, or derivative tools do not constitute an electronic communication system or device per se, thereby falling outside the scope of existing regulations. Conversely, router-type hardware or other physical equipment operating in integration with firewall systems may be deemed to fall within the literal scope of existing regulations. Nevertheless, in our personal view, these hardware devices deployed for network/data security fall outside the legislative intent underlying the Regulation on Procedures and Principles Regarding Coded or Encrypted Communications Within Electronic Communications Services by Public Institutions and Organizations, and Natural and Legal Persons.

We submit that these regulations target not specialized software, but dedicated physical devices manufactured specifically to execute encrypted communications—such as encrypted radios or telephones directly facilitating communication—and dedicated electronic communication infrastructure systems supporting them. (For instance, the internet itself does not constitute an encrypted network; users may encrypt their traffic via various software applications. However, specific wired or wireless network architectures may inherently possess an encrypted structure per se.)

E) Evaluations and Observations

The general regulations governing encrypted internet communications—focusing predominantly on communication security and domestic technology imperatives for state entities—have been outlined supra. Aside from these framework regulations, more detailed cryptographic norms may exist across derivative secondary regulations governing law enforcement, the military, intelligence units, or other state institutions. From an internet law perspective, the paramount issue concerns norms governing the acquisition and deployment of these technologies by end-users. Our current legislation contains few explicit provisions in this specific direction. Although no immediate statutory imperative appears manifest, we submit that establishing more nuanced normative frameworks governing software applications that directly encrypt specific file or message contents (rather than general data traffic) in the hands of private law end-users—distinct from technologies deployed by public institutions, law enforcement, the military, or intelligence units—could properly be evaluated.

For instance, an application software establishing an encrypted messaging network can currently be downloaded free of charge from the App Store, Google Play, or alternative marketplaces and websites far beyond these platforms. At the primary stage, this poses no inherent legal problem; indeed, facilitating accessible data security could be viewed as yielding a positive effect. However, regarding certain applications offered free of charge, no official disclosure or accountable corporate entity may exist concerning data center locations, key generation and retention mechanisms, the ultimate intent of the underlying ISPs, or the entities with whom keys and data are shared. This engenders specific security risks. Upon the materialization of these risks, establishing the identity of the ISPs operating behind closed-box applications—particularly those distributed via alternative marketplaces—and determining whether they will cooperate in national or international digital forensic data-sharing activities gives rise to substantial procedural impediments.

The fundamental principle requiring emphasis here is that software must ensure data security against unlawful acts originating from hackers or state actors falling under the Convention on Cybercrime, while simultaneously respecting lawful national and international digital forensic activities—or, broadly stated, refraining from operating as an application designed purely for counter-forensic objectives. Software backed by an undisclosed entity may lack genuine data security, operating contrary to its ostensible purpose to exfiltrate user data directly, or may be developed by specific groups solely for counter-forensic deployment rather than corporate data protection. Therefore, to ensure that prospective digital forensic operations do not encounter extreme impediments—and, more importantly, to safeguard user data security—a perspective favoring the enactment of restrictive normative regulations governing the development, certification, and commercial distribution processes of such software to end-users may be advanced. Because software of this nature does not harbor inherently destructive potential like malware, spyware, or ransomware, establishing restrictive regulations governing end-user operations—such as usage, acceptance, purchase, download, or distribution—remains unnecessary.

Finally, as noted supra, VPNs and encrypted email communications fall outside the scope of these specific regulatory restrictions in our view. However, we submit that normative regulations ought to be enacted mandating the deployment of VPNs and encrypted messaging/file-sharing technologies for cybersecurity purposes across public institutions (including work-related communications executed by personnel via personal devices), while stipulating that the technologies deployed must constitute domestic software products.