On July 21, 2022, an online news platform Medyascope.tv published an investigation revealing how Bilgi Teknolojileri ve İletişim Kurumu (Information and Communication Technologies Authority, BTK) has been collecting private user data in a massive breach of user privacy that began in 2021. The story confirmed what Onursal Adiguzel, the vice president of the main opposition Republican People (CH) party, shared in a series of tweets a little over a month ago. Journalist @DoguEroglu has obtained the documents confirming that the Information and Communication Technologies Authority (BTK) collects hourly activity logs of internet users. https://t.co/yhU2ZIkDFg pic.twitter.com/l52J1qLSkb — Free Web Turkey (@FreeWebTurkey) July 21, 2022 The investigation, by journalist Doğu Eroğlu, says the BTK started collecting information about internet subscribers from ISPs on a monthly basis in December 2018. This collected data included subscribers’ “names, last names; ID, tax and central registry (MERSIS) numbers; gender and nationalities; parents’ names; birth places and dates; occupations; addresses; and old mobile numbers.” In December 2020, in a confidential letter, signed by VP Fethi Azakli, BTK asked local internet service providers and mobile operators for “internet traffic of all users in Turkey” on an hourly basis. In the event ISPs refused to provide this information, BTK warned they would be penalized. The letter claimed that BTK, was “tasked with detecting, monitoring, evaluating, and recording data for legal purposes in a timely and non-disruptive manner. There is a need to obtain more detailed information regarding the activities taking place on the Internet within the scope of forensic and preventive purposes.” In an interview with Medyascope.tv, Doğu Eroğlu said there was no information on where this mass data was being stored, the period the users’ private information was stored for, or which third parties had access to this data. The service providers told him that they first started delivering requested information in 2021. In 2000, the government set up the Telecommunications Authority, “to perform the regulatory and supervision duties in the electronic communication sector.” The agency was restructured in 2008, taking on a new name: the Information and Communication Technologies Authority. It operates under the Ministry of Transport and Infrastructure. In 2016, following the failed coup attempt, Turkey shut down the Department of Telecommunications and Communications (TİB) — Turkey’s leading internet censor — and handed all of its authority to the BTK. TİB was set up in 2005 with the main purpose of centralizing, “from a single unit, the surveillance of communications and execution of interception of communications warrants subject to laws No. 2559 (Law on the Duties and Powers of Police), No. 2803 (Law on the Organisation, Duties, and Powers of Gendarmerie), No. 2937 (Law on State Intelligence Services and National Intelligence Organisation), and No. 5271 (Criminal Procedural Act).” In the aftermath of the coup, the authorities claimed that “TİB was used as a hub for FETÖ [The Fethullah Gulen Terrorist Organisation] for surveillance and wiretapping purposes.” As such, with the new powers, BTK went from being a regulatory body to an authority with surveillance powers that included, “the authority to take any measure it deems necessary to uphold ‘national security and public order; prevent crime; protect public health and public morals; or protect the rights and freedoms’ and inform operators, access providers, data centers, hosting providers and content providers of the said measure, who then need to take action within two hours.” The same year authorities shut down TİB, the country adopted Law No. 6698 on the Protection of Personal Data, which prohibited the processing or storage of personal data without consent from the subject. However, according to exceptions to the law, this data could be processed and stored if it was a matter of national security. As such, the law states, in the “processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations duly authorized and assigned to maintain national defence, national security, public security, public order, or economic security,” the Data Protection Law shall not apply. In addition, three new decree laws – 670, 671, and 680 – allowed interception of any internet data, without a court order or supervision, of individuals allegedly linked to the coup. “Many of you remember the mass surveillance scandal former NSA employee, Edward Snowden made public in 2013,” wrote Onursal Adiguzel from the opposition Republican People (CH) party in a series of tweets on June 8.