RedHack leaks reveal the rise of Turkey’s pro-government Twitter trolls

There's a reason you won't read about this in Turkish media.


Efe Kerem Sozeri


Posted on Sep 30, 2016   Updated on May 25, 2021, 9:44 pm CDT

Leaked emails from the Turkish government provide new details of how Turkey’s pro-government Twitter troll army targets the opposition and silences media criticism in the media.

Last Friday, RedHack, a Marxist hacker group, claimed to have hacked personal email accounts of Turkey’s Energy Minister and President Erdoğan’s son-in-law, Berat Albayrak. They threatened to leak data if Turkey did not release leftist dissidents, including Kurdish political party HDP’s deputy, Alp Antınörs, and renowned novelist Aslı Erdoğan, from pre-trial detention.

Instead, the government banned news coverage of the leak and requested Twitter to suspend the hacker group’s account. Twitter promptly complied:

Late Monday, at the end of RedHack’s deadline, the group began leaking documents obtained from Minister Albayrak’s personal email accounts, which he reportedly used for government business.

RedHack claims they found out Albayrak’s mobile operating system, iOS, back in June via a forwarded email to him by a businessman’s account they had previously compromised. From there, they wrote a password-fetching exploit and used a keylogger and MS Office exploit tools to gain access to his iPad after two weeks of attempts. They claim Albayrak used the same password for all of his accounts, which allowed them to gain access to three of his email accounts. On Sept. 23, Albayrak reset his passwords, and probably factory reset his mobile devices. At that point, RedHack publicly revealed the hack.

The Daily Dot obtained the 17 GB data dump in full and reviewed its content. The leak is composed of 57,623 emails, dating from April 2000 to today. An Ankara court inadvertently confirmed the authenticity of the leak in an order regarding the investigation of RedHack members. (Minister Albayrak’s secretary did not respond to our request for comment. At the time of print, the government has not formally responded to the leaks, aside from the instances of censorship.)

First and foremost, the leak reveals the vulnerability of the Turkish government’s operations security (opsec). Minister Albayrak shared business deals with partners and discussed government policy documents over U.S.-hosted email servers, including those of Google, Apple (iCloud) and Yahoo, which is a highly questionable practice.

The 16-year email archive also documents recent Turkish political history and the rise of Erdoğan’s son-in-law from a business graduate to the CEO of an $8 billion conglomerate, Çalık Holding, and finally to Turkey’s cabinet.

First and foremost, the leak reveals the vulnerability of the Turkish government’s operations security.

Key to Albayrak’s success was his position between the party in power, the business elite, and the media: In 2008, under Albayrak’s term, Çalık Holding acquired popular TV channel ATV and daily newspaper Sabah for $1.1 billion U.S., the majority of which was financed by state-owned banks. It was later revealed in a graft probe that Erdoğan personally intervened in the future ownership of the media group to keep tight control over its editorial policy.

The emails show that Erdoğan’s influence over media extended beyond his son-in-law: Then-Prime Minister Erdoğan’s foreign policy advisor (later, President Erdoğan’s spokesperson) İbrahim Kalın frequently sent policy briefs and issues that “should be” published on pro-government newspapers. These emails were also addressed to Albayrak’s brother, Serhat Albayrak, CEO of the Turkuvaz Media Group, which, in addition to ATV and Sabah, owns news channel A Haber, and dailies Takvim, USA Sabah and later the Daily Sabah. (Ibrahim Kalin did not respond to our request for comment).

The milestone in Albayrak’s political career was the Gezi Protests, particularly, his ability to frame the protests as a foreign conspiracy via his media channels. Albayrak helped Erdoğan silence dissent with popular support. As revealed in his email correspondence, targeting opponents and spreading disinformation was methodical.

The Wall Street Journal first reported on the foundation of a pro-Erdoğan social media team in September 2013. The recent leak suggests that it dates back even further, to the Gezi Park protests in June, when the government was appalled by the “viral revolution” and looking for ways to discredit and harass the opposition.

The most significant email correspondence of the time takes place between Erdoğan’s close circle: Albayrak’s brother; Erdoğan’s daughters, Sümeyye Erdoğan and Berat Albayrak’s wife, Esra Erdoğan; Erdoğan’s son, Bilal Erdoğan; and another advisor of Erdoğan, Mustafa Varank. In the early days of the protests, the group made a serious effort to identify influencers among the protesters. In an email dated June 4, 2013, Berat Albayrak suggests “legal action should be taken” while quoting author Alev Scott’s email to her friends about the police violence.

At the same time, Berat Albayrak was corresponding with his U.S. contact Halil Danışmaz, head of New York-based Turkish Heritage Organization, trying to mitigate an ad in the June 7 issue of New York Times that was crowdsourced by the Turks in the U.S. and criticized Erdoğan and the police violence.

On June 14, Sabah’s U.S. editor-in-chief, Serdar Öztürk, shared screenshots of tweets supportive of the protests made by employees of Turkish ad agencies. The next day, the tweets were published on the front page of the daily newspaper, Takvim, which is owned by Albayrak, claiming ad agencies were part of a “global conspiracy.”

Two days later, one of Albayrak’s producers in the Turkuvaz Media, Yalçın Şen, sent a screenshot of an online news article under which he wrote a comment in support of Erdoğan’s crackdown on Gezi protesters. This was, perhaps, the very first astroturfing attempt in the post-Gezi period, similar to Putin’s trolls who flooded news websites with pro-Putin comments. But the real mass-scale effort was still in the making.

Key to Albayrak’s success was his position between the party in power, the business elite, and the media.

On an email dated June 18, 2013, Halil Danışmaz from Turkish Heritage suggested Albayrak set up a team of professional graphic designers, coders, and former army officials who received training in psychological warfare. Based on the advice of U.S.-based Turkish analyst Cüneyt Arvasi, Danışmaz suggested that such a team would be necessary to counter critical narratives in foreign media outlets and could weaken the protest networks on social media. Three days later, Arvasi came with a detailed document titled “Feasibility Etude” about how the youth can be influenced by humor and slang while delivering a message and how opposition media organizations can be undermined by attacking their employees. His method to discredit influencers in the opposition was black propaganda, such as “exposing their drug use.” In the document, he requested a $209,000 budget for the technical equipment and core members of this team.

Mr. Danışmaz and Mr. Arvasi did not respond to our requests for comment.

Simultaneously, Albayrak’s wife, Esra, who is a Ph.D. graduate from the University of California, Berkeley, arranged a social media monitoring agency for sentiment analysis of online content about the government, according to a June 22 email. The agency’s presentation, attached to that email, offered to set up a 60-member team for PR and crisis management on social media.

On another email from June 28, the core team initiated one of its first planned hashtag campaigns “#DirenÇözüm,” using protest’s keyword “diren” (“resist”), while also suggesting that government wants a peaceful solution. AKP lawmakers tweeted the exact phrases that were suggested on the email: “6 aydır kan akmıyor, insanlar ölmüyor” (“no blood is shed since 6 months” referring to Erdoğan’s peace process with the Kurds, which later failed).

Within a week, the government began targeting the opposition. On Aug. 5, narcotics police raided houses of 55 celebrities, movie stars, and directors who joined the resistance at the Gezi Park or expressed support for the protests. Pro-government newspapers spread their photos widely on social media. Albayrak’s daily Takvim made a photo gallery of celebrities’ images taken under police custody. (After two years of trials, none of them were jailed.)

The rest is the history we know.

Within months after the nationwide protests that brought 2.5 million people to the streets, AKP managed to set up a 6,000-member social media team mostly from its youth branch. While the team was fully functional in harassing journalists, they evidently failed in the face of growing evidence revealed by an investigation on the corruption scandal in December 2013. As a last resort, Erdoğan government banned Twitter and YouTube days before the local elections in March 2014. Erdoğan’s control over traditional media also increased; public broadcaster, TRT, was fined for giving 125 times more coverage to him than all of the other candidates combined in the run up to presidential elections on August 2014. Erdoğan eventually became Turkey’s president.

The next summer, after AKP lost the super majority in the general elections of June  2015, the interim AKP government started military operations on the Kurdish armed group, PKK, and banned Kurdish media outlets. In September, an angry mob led by AKP deputy Abdurrahim Boynukalın, attacked daily Hürriyet’s headquarters after Erdoğan lashed out at the paper for criticizing his security policy. The attack, organized online, had all the footprints of the pro-Erdoğan social media network.

Due to wide censorship and clientelism in Turkey’s media ownership, there were no media channels left to host Kurdish opposition party’s co-chairs in the campaigning period for the snap elections on Nov. 1. According to a Council of Europe report, the mainstream media “blatantly favoured the ruling party.” Days before the elections, the Koza-İpek media group was seized by the government. Offices of Bugün TV and Kanaltürk TV stations were raided by the police to take channels off air, while Bugün and Millet newspapers were converted into pro-government line by appointing trustees as new editors.

According to the emails from that time, Albayrak was lobbying to keep the media group at the control of the government or to be sold to a business group close to the government, instead of being returned to its rightful owners.

In March 2016, the government seized another rival media group, the Feza Media, once the owner of Turkey’s highest circulating newspaper, Zaman, and its English edition, Today’s Zaman. Seized TV channels and newspapers were later shut down by government-appointed trustees, citing economic troubles. With the closure of and websites, nearly 9 million news articles published in the last 21 years were also made inaccessible to the public.

Albayrak maintains a tight grip on the media in Turkey, but the RedHack leak exposes his tactics and his rise to power. 

Share this article
*First Published: Sep 30, 2016, 8:26 am CDT