A Backdoor for Law Enforcement Can Let the Bad Guys in Too

Turkey threatens its own security by requiring user data on encrypted platforms.

In October 2022, the Turkish legislature passed new legislation that amends several existing laws–including the Internet Law, the Press Law and the Turkish Penal Code. This new law–dubbed the ‘censorship law’–expands the scope of the Internet Law, the Press Law and the Turkish Penal Code to cover Internet-based services, that include email, streaming, and messaging services. In common parlance, they are referred to as ‘OTT services’.

One of the most troubling new requirements introduced through this law is a requirement for Internet-based services to remove online content and disclose user data to the government. There is also secondary legislation, which is used as a way to interpret and implement this law. If providers are required to disclose users’ messages on end-to-end encrypted services, such services will need to build vulnerabilities into their systems, in order to decrypt what should be private traffic and messages. This law could force them to undermine the security of their users in order to comply.

This means that service providers would have to make an impossible choice: should they undermine their users’ security and privacy, or leave the Turkish market? Some services would choose to leave, rather than break end-to-end encryption on their platforms. They might even geo-block Turkish users from accessing their services.

The result would be that only less-secure services would be available to users in Turkey, and the privacy and security of those users would be undermined. They would not have a secure and encrypted option to choose. This would put marginalized users and communities at even greater risk, since they have an added reliance on secure and private communications. This could lead to self-censorship or even put people at risk of physical violence.