Misquotes, wrong metadata and tweets: Turkey’s RedHack trial


At the second hearing of six Turkish journalists accused of hacking into the emails of President Recep Tayyip Erdoğan’s energy minister and son-in-law, Berat Albayrak, two more have been freed on bail after spending nearly a year in prison. This is a case that rights campaigners say reinforces the chilling effect on freedom of expression the jailing of dozens of journalists has had in Turkey.

Three of the journalists, Tunca Öğreten, Ömer Çelik and Mahir Kanaat, have been in custody since December last year, detained in dawn raids and charged with “membership of a terror organisation” and the “illegal recording and misuse of personal data”. Çelik was freed on bail after the hearing on Oct. 24, while Öğreten and Kanaat were released today.

But as Öğreten said after his release from Silivri Prison, "until the last journalist is released, journalism will remain imprisoned in Turkey."

The hack

Marxist hacker group RedHack announced in September last year that it had obtained the personal emails of Albayrak and threatened to release them to the public if “leftist dissidents”, including novelist Aslı Erdoğan, who is no relation to the president, were not released from prison.

After the deadline passed, the group followed through with its threat and leaked 17 GB of data via cloud services and torrents. In early December, WikiLeaks re-published the email dump as an indexed and searchable archive of 57,934 emails sent or received by Albayrak between 2000 and 2016.

Turkish authorities responded by temporarily blocking access to cloud services such as Google Drive, Dropbox and Microsoft’s OneDrive, as well as the code repository GitHub, where the torrent link for downloading the archive could be found.

But once leaked, Albayrak’s emails were accessible to the public, and a number of investigative journalists also received the dump from RedHack. News stories appeared based on the leaked materials, detailing Albayrak’s involvement in the transportation of Iraqi Kurdish oil, Erdoğan’s editorial pressure on the media, nepotism in the civil service, and efforts to cover up corruption during a 2013 investigation.

Shooting the messengers

Following the Dec. 25 dawn raids, the details of the accusations against the journalists first appeared in the pro-government Sabah newspaper. That article also named more journalists who had not reported on the leak, but who had been previously targeted for their stories by the government.

Deniz Yücel, the Turkey correspondent for German newspaper Die Welt, reported on the leak and was named in the Sabah article, although his name was later removed from the investigation. But Yücel has still been held in prison without charge for more than eight months, causing a diplomatic feud between Germany and Turkey.

The original six spent an extended 24 days in detention, and in January, three of the journalists, Eray Sargın, Derya Okatan and Metin Yoksu, were released on bail, while Öğreten, Çelik and Kanaat were sent to Silivri high-security prison.

The nine-page indictment also charges the journalists with “making propaganda for a terrorist organisation” and “breaching information systems”. The evidence for this is said to be from an anonymous witness, two Word documents found on one of the journalist’s phones, the email archive on one computer, and 20 public tweets.

The basis of the charges is guilt by association. In his lengthy indictment, the prosecutor asserts that extreme jihadist group Islamic State, the armed Kurdish separatist Kurdistan Workers' Party (PKK), two Marxist-Leninist Turkish armed groups and the movement of Muslim preacher Fethullah Gülen hhad been “acting in coordination” against Turkey, despite what he admits are their “different ideologies and structures”.

Last week, Albayrak filed a request on the grounds of “individual rights” to become a plaintiff in the case and the judge initially acknowledged the request as having come from his ministry, raising concerns among international observers over political interference in the case.

The (lack of) evidence

The anonymous witness accused the journalists of “being part of a project” to damage the Turkish government by publishing negative stories, such as articles alleging links between Islamic State and the Turkish ruling party. The witness noted that a Twitter account associated with RedHack had established a Twitter direct messaging group, added 19 journalists and provided them with access to the email archive. Although the indictment does not try to show that the journalists took part in the crime of hacking, it accuses them of cybercrimes for reading emails that had already been hacked.

In particular, Öğreten, the former editor of independent online news website Diken, is charged with “breaching information systems” for having the email archive on his personal computer. However, the indictment does not consider that, at the time of their detention, the email dump had already been shared widely online and was readily available on WikiLeaks.

Öğreten is further charged with “committing crimes on behalf of a terrorist organisation” and linked with both the Marxist Revolutionary People’s Liberation Party-Front (DHKP-C) and also the Islamist Gülen Movement. The prosecutor said the “DHKP-C and RedHack are linked to each other” and that therefore Öğreten’s communication with RedHack associates him with the DHKP-C.

The prosecutor said Öğreten’s previous employment at Taraf newspaper until 2015 was credible evidence of links to the Gülen movement. Taraf was one of 184 media outlets shut down by Turkish authorities after the failed July 2016 coup attempt, which they accuse the Gülen movement of having carried out.

The missing context

The prosecutor also said that if journalists were following Twitter accounts associated with RedHack and they in turn were followed by other accounts  linked to RedHack, this amounted to a direct connection with the hacker group.

The 20 tweets make up the bulk of the evidence, but most are misquoted, or quoted out of context. Out of 20 tweets, eight are news headlines from media outlets provided with hyperlinks to stories, but in the indictment, the quotation marks and contexts are dropped. A further six tweets are news updates, but are quoted out of context. The last six are personal opinions and some of them had not even been retweeted once. Defence lawyers denied these tweets met the criteria for inciting violence.

The prosecutor accuses Derya Okatan of “making propaganda for a terrorist organisation” for sharing the logo of the Marxist-Leninist Communist Party (MLKP) on Twitter, though the tweet was an auto-shared news article from a leftist news agency’s Twitter account quoting a statement by the armed group.

Similarly, Eray Sargın is accused of the same crime for sharing news articles about PKK statements on the Twitter account of the leftist newspaper Gazete Yolculuk, where he is the chief editor. Another reporter, Metin Yoksu, is charged for using the word “guerrilla” in his coverage of a PKK member’s funeral, instead of the government’s preferred term, “terrorist”.

The European Court of Human Rights has issued multiple rulings on Turkey’s violation of freedom of expression, in particular, for criminalising the publication of statements by armed groups.

The wrong metadata with the wrong conclusion

While five of the six defendants are accused of “making propaganda for a terrorist organisation”, only Mahir Kanaat, an employee of the left-wing BirGün newspaper, is charged with “membership of a terrorist organisation”, a crime that carries a longer jail sentence. Kanaat is not a reporter, but an accountant at BirGün, and there are no tweets from him referred to in the indictment. Instead, the prosecutor lists two Word documents found on Kanaat’s phone after his arrest. The documents are police investigation reports into ministers and pro-Erdoğan businessmen for alleged corruption that led to a string of arrests in December 2013. The indictment says the creation date of the documents was before the date the suspects were detained, that therefore Kanaat must have received the documents in advance, and concludes that this means Kanaat was a member of the Gülen movement.

Kanaat’s lawyers said the original police reports of the 2013 scandal were leaked on the internet in 2014, and they preserve the original metadata, such as their creation date. Those original files, hosted by Google Drive, are linked to in many news stories, including in the popular left-wing Cumhuriyet daily, and had probably been downloaded by thousands of people. BirGün even prepared a video to show that when the leaked original Word documents were downloaded, they displayed the original creation date of the document.

The hearing: free after a year in jail

At October’s hearing, Çelik was freed on bail, while the court has decided to discuss pretrial detention of Öğreten and Kanaat on Nov. 22. They were not released on that date, but only today, at the second hearing. The third hearing in Turkey's dead slow justice system will be held on April 3, 2018.

According to a calendar compiled by independent journalism platform Punto24, Turkey's near future is full of trials for journalists and human rights defenders.

In the meantime, attention from European outlets towards the case has also been growing. Belgian Mondial Nieuws, Italian Articolo21, German TAZ, and France’s Mediapart all have reported updates from the hearings.

Mediapart’s founder and editor Edwy Plenel sent this video in defence of the journalists.