Draft:Mor Beyin

  1. Home
  2. Wiki

The Mor Beyin case (Turkish: Mor Beyin olayı) refers to a set of mobile applications and related code that, according to Turkish prosecutorial statements and subsequent reporting, caused background connections from ordinary apps to Internet Protocol (IP) addresses associated with the encrypted messaging application ByLock. Because purported ByLock connections were widely treated by Turkish courts as incriminating after 2016, these redirections led to thousands of people being wrongly identified as ByLock users until the anomaly was disclosed and official lists were revised.[1][2][3]

Background

[edit]

Following the failed coup attempt in Turkey in July 2016, authorities relied extensively on alleged ByLock use as an indicator of membership in FETÖ/PDY. Later judicial and academic commentary noted that network metadata-based designations carried risks of error and required corroboration.[4][5]

What "Mor Beyin" was

[edit]

"Mor Beyin" ("Purple Brain") was the label used in official statements and media reports for a cluster of applications/ad components that could route devices to ByLock IP addresses in the background (e.g., through embedded code or analytics calls). Such hits could appear in traffic/CGNAT records as though the device had contacted ByLock, even if users had not installed the app.[1][6]

Discovery and public disclosure

[edit]

In late 2017, lawyers and forensic specialists publicised the anomaly and petitioned prosecutors, prompting a broad review. Reporting identified lawyer Ali Aktaş and digital forensics experts Koray Peksayar and Tuncay Beşikçi among those who brought the pattern to official attention with technical submissions; additional accounts later credited other contributors in the legal and forensic community.[7][8]

Official acknowledgement

[edit]

On 27 December 2017, the Ankara Chief Public Prosecutor's Office announced that 11,480 GSM numbers had been directed to ByLock IPs without the users' will and requested nationwide re-evaluation of those individuals' legal status.[1] The following day and in subsequent days, the chief prosecutor stated that roughly 1,000 detainees could be released if there was no other evidence against them.[9][10]

Releases and remedial actions

[edit]

In the days and weeks after the announcement, courts and prosecutors ordered releases for detainees whose only alleged link was Mor Beyin-related ByLock traffic:

In İstanbul, at least 201 people were released on 29 December 2017, according to contemporaneous reporting based on prosecutor statements.[11][12]

In Ankara, approximately 300 detainees were released on 25 January 2018 following reviews by local courts.[13][14]

Subsequent overviews (including rights-monitoring reports and later court analyses) continued to cite the 11,480 figure for removals from ByLock lists and described further case-by-case reviews nationwide.[15][16]

Significance

[edit]

The Mor Beyin episode became central to debates in Turkey about the reliability and admissibility of digital evidence derived from traffic/CGNAT records, and about the need to corroborate ByLock indicators with additional proof. The European Court of Human Rights' 2023 Yalçınkaya judgment highlighted systemic issues in the handling of digital indicators and emphasised fair-trial safeguards when such data form a decisive basis for convictions.[17][18]

See also

[edit]

References

[edit]
  1. ^ a b c TRT Haber (27 December 2017). "Ankara Cumhuriyet Başsavcılığı'ndan ByLock açıklaması" (in Turkish). TRT Haber. Retrieved 17 August 2025.
  2. ^ "Ankara prosecutor demands release of 1,000 FETÖ suspects after ByLock investigation". Hürriyet Daily News. 27 December 2017. Retrieved 17 August 2025.
  3. ^ (26 September 2023), Text.
  4. ^ (26 September 2023), Text.
  5. ^ Arslan, Ozge (2025). "Evidencing terror". American Ethnologist. 52 (2): 219–230. doi:10.1111/amet.13405. Retrieved 17 August 2025.
  6. ^ "FETÖ gerçek ByLock'çuları bu yöntemle gizlemiş". Yeni Şafak (in Turkish). 27 December 2017. Retrieved 17 August 2025.
  7. ^ "Çözen avukat anlattı: Kuzu Kuzu ByLock yüklemişler!". Gazete Duvar (in Turkish). 27 December 2017. Retrieved 17 August 2025.
  8. ^ "Avukat Aktaş, 'Mor Beyin' tuzağının detaylarını anlattı". Hukuki Haber (in Turkish). 3 January 2018. Retrieved 17 August 2025.
  9. ^ "Başsavcı Kocaman'dan ByLock açıklaması". Anadolu Ajansı (in Turkish). 28 December 2017. Retrieved 17 August 2025.
  10. ^ "Ankara prosecutor demands release of 1,000 FETÖ suspects after ByLock investigation". Hürriyet Daily News. 27 December 2017. Retrieved 17 August 2025.
  11. ^ "İstanbul'da 'ByLock'tan tutuklu 201 kişi tahliye edildi". Diken (in Turkish). 29 December 2017. Retrieved 17 August 2025.
  12. ^ "İstanbul'da 201 kişi tahliye oldu". Sözcü (in Turkish). 29 December 2017. Retrieved 17 August 2025.
  13. ^ "Ankara'da 300 kişiye 'Mor Beyin' tahliyesi". Anadolu Ajansı (in Turkish). 25 January 2018. Retrieved 17 August 2025.
  14. ^ "Ankara'da 300 kişiye "Mor Beyin" tahliyesi". TRT Haber (in Turkish). 25 January 2018. Retrieved 17 August 2025.
  15. ^ Report on the Legal and Technical Issues Around Turkey's ByLock Prosecutions (PDF) (Report). Arrested Lawyers Initiative. November 2021. Retrieved 17 August 2025.
  16. ^ Ever-Changing Evidence: ByLock (PDF) (Report). Arrested Lawyers Initiative. 4 January 2018. Retrieved 17 August 2025.
  17. ^ (26 September 2023), Text.
  18. ^ Turkut, Emre (2024). "ByLock Prosecutions and the Right to Fair Trial in Turkey after Yalçınkaya". SSRN Electronic Journal. SSRN 4778618. Retrieved 17 August 2025.