Turkish National Intelligence Organization (MIT)’s cyber operation against the encrypted messaging application ByLock uncovered the internal communication network and organizational hierarchy of the Gülenist Terror Group (FETÖ), providing evidence that later became central to thousands of terrorism-related prosecutions following the failed coup attempt of July 15, 2016.
According to information compiled from judicial findings and official accounts, ByLock was developed as a dedicated encrypted communication platform used exclusively by members of FETÖ. Unlike widely available messaging applications, the system operated as a closed network that could only be accessed by users who possessed platform-generated identification numbers and mutual authorization, preventing random users from joining.
MIT first learned of the application's existence in July 2014 through intelligence sources that had infiltrated the group. Subsequent technical analysis concluded that the software had been developed in late 2013 under instructions from senior figures within FETÖ's cyber structure, shortly before the Dec. 17-25, 2013 investigations in Türkiye.
Following those findings, MIT established a specialized cyber team consisting of database experts, cryptologists, network specialists, ethical hackers and reverse-engineering analysts to identify and penetrate the application's infrastructure.
Investigators determined that ByLock's main servers were hosted by a company in Lithuania and operated through multiple internet protocol addresses leased anonymously.
A decisive operation was launched on Dec. 25, 2015, when MIT assessed that reduced staffing during Christmas holidays would lower the likelihood of detection. Intelligence officers gained access to the servers, established a covert backdoor and began transferring data to Türkiye without alerting administrators.
Investigators used social engineering techniques to maintain access while disguising the data extraction process. The operation ultimately yielded a database containing information on 215,092 users.
MIT's subsequent forensic examination found Turkish-language coding embedded within the application's software, including commands such as "file," "mail" and "voice call." Authorities said these findings indicated that the application had been specifically designed for use by members of the group operating in Türkiye.
The recovered database included more than 17 million messages, approximately 4.7 million emails, over 60,000 internet subscription records and more than 111,000 telephone numbers, according to official figures.
Analysis of the material enabled investigators to identify FETÖ's provincial and international leadership structures, including 81 provincial "imams" and 160 overseas "imams." Officials also said intelligence derived from ByLock communications helped identify approximately 600 military personnel allegedly linked to the group shortly before the July 15, 2016 coup attempt.
One of the most significant findings, involved the application's user identification system. Rather than using real names, members communicated through numerical identification codes. These ID numbers reflected users' seniority and importance within the organization instead of being assigned randomly.
The earliest identification numbers belonged primarily to senior figures and members of FETÖ's so-called "confidential ('mahrem') services" structure before the application was gradually expanded to lower-ranking members.
Among those identified with low-numbered IDs were former police chief Erol Demirhan, who held ID number 27, former Ankara deputy police chief Oğuz Kiremitçi with ID number 28, Hrant Dink assassination case defendant Serkan Şahan with ID number 40, Cengiz Özkan with ID number 43, and Mehmet Yaşa, identified by authorities as FETÖ's U.S. imam, with ID number 49.
Moreover, fugitive journalist Cevheri Güven, whom Turkish officials accuse of conducting propaganda activities on behalf of FETÖ, was assigned ID number 3320. While not among the group's earliest users, investigators said his ranking placed him among the highest-profile media figures affiliated with the group.
Turkish courts later examined the digital evidence through multiple levels of judicial review. Trial courts relied on ByLock data together with telecommunications records, forensic examinations of digital devices, user credentials and message content.
Türkiye's Court of Cassation subsequently ruled that active use of ByLock, when verified through forensic standards and corroborated with telecommunications and digital evidence, constitutes strong evidence of membership in FETÖ because the platform functioned exclusively as the group's encrypted communication system.
