Key Takeaways
- Turkey’s Cyber Security Presidency (Siber Güvenlik Başkanlığı) has been given sweeping authority over wiretapping, internet access, censorship and communications infrastructure, moving these powers from the independent telecom regulator BTK to an executive‑controlled body.
- The changes were enacted via Law No. 7590, an omnibus bill passed in July 2026 that bundled unrelated policy areas, limiting substantive parliamentary debate.
- The law allows the Presidency to issue immediate “measures” (e.g., site blocks, throttling) that take effect within two hours, with judicial review only after the fact and within a 72‑hour window—effectively permitting pre‑emptive restriction.
- Vague language (“measure”) grants broad discretion, raising concerns about legal certainty, potential abuse, and insufficient safeguards for freedom of expression.
- Metadata definitions were expanded to include source and destination port information, enabling detailed reconstruction of users’ online activity even without accessing content.
- The Presidency now controls the technical means for lawful interception, a function previously handled by the BTK, thereby giving the presidency visibility into surveillance targets pursued by police, intelligence and the gendarmerie.
- The head of the new agency, Ümit Önal, has close ties to Erdogan‑aligned media outlets, reinforcing perceptions of political loyalty over institutional independence.
- Critics warn the reform transforms cybersecurity from a defensive shield into a tool for domestic political control, undermining judicial independence and the operational autonomy of security agencies.
Overview of the Legislative Overhaul
Turkey’s parliament passed Law No. 7590 on July 24 2026, publishing it in the Official Gazette a week later. The bill is an omnibus package that stitches together measures on taxation, nuclear energy, education, transportation, postal services and, crucially, a comprehensive re‑allocation of powers over the country’s digital infrastructure. By burying the cybersecurity provisions within unrelated topics, the government limited the depth of committee scrutiny and prevented specialized debate on the implications for civil liberties and surveillance.
Transfer of Authority from BTK to the Cyber Security Presidency
At the core of the reform is the shift of key responsibilities from the Information and Communication Technologies Authority (BTK)—a regulator nominally independent of the executive—to the Cyber Security Presidency (Siber Güvenlik Başkanlığı). Established by presidential decree in January 2025, the Presidency reports directly to President Recep Tayyip Erdoğan and sits within the national‑security apparatus. The law explicitly states that cybersecurity is no longer a purely technical concern but a matter of “digital sovereignty,” justifying the concentration of domain‑name management, internet‑infrastructure oversight, and communications‑analysis functions under this single entity.
Immediate Powers and the “Measure” Mechanism
Article 60/A of the amended Electronic Communications Law empowers the Cyber Security Presidency to issue urgent “measures” on its own initiative or at the request of security/intelligence agencies. Once an order is made, telecom operators, ISPs, data centers, content providers and hosting firms must comply within two hours. The decision is then forwarded to a judge, who has 48 hours to rule; if no ruling is issued, the measure lapses after 72 hours total. This sequence allows the government to impose restrictions first and obtain judicial authorization afterward, effectively enabling pre‑emptive censorship or throttling without prior judicial oversight.
Judicial Review and the Lack of Genuine Safeguards
Because the Erdoğan‑dominated judiciary has a record of rubber‑stamping government‑imposed restrictions, the prospect of meaningful independent review is slim. The law’s 24‑hour notification and 48‑hour judicial window do little to curb abuse when judges are predisposed to approve executive actions. Consequently, politically sensitive content—such as investigative reports or opposition campaigns—can be suppressed during the critical news cycle, with any later court reversal arriving too late to mitigate reputational or informational harm.
Vagueness of the Term “Measure” and Legal Certainty Concerns
The legislation never exhaustively defines what constitutes a “measure,” leaving the scope of permissible interventions—ranging from site blocking to bandwidth throttling to deep‑packet inspection—open to interpretation. This ambiguity contravenes the principle that restrictions on fundamental rights must be foreseeable and precisely delineated in law. A parliamentary committee report issued during the bill’s consideration warned that the undefined authority could erode freedom of expression and weaken judicial safeguards, yet no amendments were adopted to narrow the powers or introduce clearer criteria before enactment.
Expanded Metadata Collection and Surveillance Capacity
Beyond content‑level controls, the law revises the definition of “internet traffic information” to include source and destination port numbers. While port data does not reveal message content, it provides granular metadata about which services a device contacts and when. Combined with connection timestamps and other identifiers, this metadata enables the reconstruction of a user’s digital footprint—revealing habits, service preferences, and relational patterns—without ever reading the actual communications. Critics argue that such detailed profiling poses a significant privacy threat, as it allows the state to infer behavior and associations with high confidence.
Control Over Lawful Interception (Wiretapping) Infrastructure
The Presidency now assumes responsibility for providing the technical means required for lawful interception and intervention—commonly known as wiretapping—a function previously managed by the BTK. Under the earlier system, police, the National Intelligence Organization (MİT) and the gendarmerie obtained court warrants and then relied on the BTK’s neutral infrastructure to carry out interceptions. By moving this capability into an entity directly answerable to the president, the reform creates a potential early‑warning system: the presidency could learn who is under investigation by security forces before or during the inquiry, thereby enabling political interference, obstruction, or redirection of sensitive cases.
Personnel Loyalty and Institutional Independence
Although the law mandates the transfer of BTK’s cybersecurity‑related systems, data centers, equipment and assets worth roughly 30 billion Turkish lira, it does not automatically transfer BTK staff. Existing employees may request reassignment, but the Cyber Security Presidency must approve them, and the agency may hire contracted experts under criteria set by the Cyber Security Board (which is chaired by the president). This provision allows the government to staff the new presidency with politically trusted individuals, further eroding any pretense of institutional independence and reinforcing a loyalty‑based hierarchy.
Critiques of the Omnibus Legislative Process
Opposition lawmakers and civil‑society groups objected to the embedding of far‑reaching cybersecurity reforms within an omnibus bill that also addressed pensions, private schools, tourism, aviation and nuclear energy. The parliamentary committee report noted that combining unrelated subjects undermined legislative quality, prevented specialist committees from exercising proper oversight, and reduced the ability of lawmakers to assess complex, technical provisions. By restricting debate to the Planning and Budget Committee and rejecting motions to refer the cybersecurity clauses to relevant specialist committees, the ruling bloc curtailed meaningful scrutiny and facilitated the swift passage of measures with profound implications for digital rights.
Implications for Democracy and Security Autonomy
Taken together, the reforms convert cybersecurity from a defensive shield against external threats into an instrument for domestic political control. The concentration of surveillance, censorship, metadata collection, and wiretapping capabilities within an executive‑controlled presidency undermines judicial independence, limits the operational autonomy of police and intelligence agencies, and places powerful tools for monitoring and shaping public discourse directly in the hands of the president. As Turkey moves forward under this new architecture, the balance between security and liberty appears increasingly tipped toward the former, with substantial risks to free expression, privacy, and the integrity of criminal investigations.