Skip to main content

Cybersecurity Strategy Advice for the Trump Administration: US-Turkey Relations

January 31, 2017

Author:

Jonathan Okun

Feature Series

Cybersecurity and the Trump Administration Series

Regional Recommendations for U.S. Cybersecurity Policy in the World

Central Challenge

Turkey and the U.S. have a long history of cooperation and Turkey’s geopolitical location makes it central to the U.S.’s Middle East policy. However, Turkey’s turn to authoritarianism, actions in the region, and the presence of Gulen in the U.S. has strained relations between the two countries.

Recommendations

  1. Hold fast to values regarding the human rights of Kurds, Gulen and his followers, and others targeted by the AKP government.
  2. Improve coordination among security forces on cybersecurity issues.
  3. Monitor the online actions of the AK trolls and other known online political actors, although overt action against these forces is not recommended.
  4. Share and invest in policies and technologies pioneered by Turkish companies and the government.

Background

Between the United States’ divisive election cycle and Turkey’s coup and iron-fisted counter-coup, 2016 has been a difficult year for both countries. To make matters worse, disagreements about how to handle the wars in Syria and Iraq have negatively impacted the U.S.-Turkey relationship. Turkey fears that America’s support for Kurdish fighters in Syria and Iraq will embolden separatist minority movements within its borders.[1] Simultaneously, Turkey’s erratic behavior in its near-abroad has worried U.S. observers and its boorish insistence on fighting in Mosul[2] and Raqqa[3]—against the will of Iraqis and Syrians—has raised neo-Ottoman fears.[4]

The greatest strain on U.S.-Turkey relations is the issue of President Erdogan’s old ally turned bitter rival: Fetullah Gulen, who is currently living in the U.S. Erdogan quickly declared that Turkey’s 2016 coup was masterminded by Gulen and his wide-reaching network of followers and demanded Gulen’s extradition.[5] The U.S. is well aware that extradition would be a death sentence and has maintained that it cannot extradite Gulen until his culpability is proven.[6] Turkey has, thus far, been unable to produce anything but circumstantial pieces of evidence indicating Gulen or his organization’s involvement, but has been quick label them a ‘deep state’ terrorist movement all the same.[7]

The ruling Justice and Development Party (AKP) has taken the refusal to extradite Gulen as personal insult, and not since 2003’s “Hood Event”[8] have Turks held such an intense dislike and distrust for the United States.[9] Erdogan has not been shy about stoking populist, anti-U.S. sentiments old and new.[10] High level members of the AKP have supported or offered up conspiracy theories accusing the U.S./CIA and Gulen of colluding to destroy Turkey with a number of plots ranging from the creation Daesh and the Kurdistan Workers’ Party (PKK),[11] to the use of djinni and black magic,[12] to a plot involving the use nuclear weapons to destroy Istanbul and ruin Turkey’s economy.[13]

Turkey’s “AK trolls,” following in the footsteps of Putin’s “troll factories,”[14] have aggressively pushed these ideas in cyberspace. Formed in 2013, this 6,000-member group was initially tasked with “countering” the anti-Erdogan opinions circulating on social media during the Gezi Park Protests.[15] When the “Gas for Gold” scandal broke in the later half of 2013 and members of Erdogan’s entourage were charged with corruption, the AK trolls adopted the more aggressive ‘cyber lynch mob’ tactics we see today.[16]

The cybersecurity risk that Turkey poses to the U.S. arises from the possibility that the AK trolls and their botnets[17]  could spread disinformation or participate in hacking attacks similar to their Russian forbearers if anti-U.S. sentiment continues to be pushed by the AKP. The AK trolls appear to have launched some successful attacks in the past and likely carried out the recent July 2016 Denial of Service (DDoS)[18] attack against WikiLeaks when the whistle-blowing website tweeted that it would release “100k+ [documents] on #Turkey’s political power structure” in the wake of the coup.[19] There is also the potential for highly-motivated non-state actors to splinter from the AK trolls and take with them the tools and knowledge to carry out credible cyberattacks.

Despite its solid cyber-offense, Turkey remains among the top ten most digitally vulnerable nations on Earth,[20] and the Marxist hacktivists known as RedHack have repeatedly exploited Turkey’s cyber-vulnerabilities for 26 years. As recently as September of this year, the group threatened to leak 17 GB of emails from Turkey’s Energy Minister (and Erdogan’s son-in-law) Berat Albayrak if Turkey did not release imprisoned leftist dissidents.[21] RedHack acquired this information by recovering an email sent to Albayrak from a business colleague, thereby discovering his iOS. RedHack then used keylogging spyware and software exploits to gain access to Albayrak’s iPad.[22]  The hackers discovered that Albayrak had used the same password for multiple devices and email accounts and used this knowledge to gain access to sensitive personal and government information that they used against the AKP.[23] This cyberattack serves as a case in point for several of Turkey’s cybersecurity issues. Many of the vulnerabilities exposed by this attack can be covered by simply following cybersecurity best practices such avoiding the discussion of sensitive topics on commercial servers, using varied and complex passwords, keeping software (especially security software) updated, among others.[24]

Despite the increased anti-U.S. rhetoric of the AKP, Turkey remains a valued NATO member located in a key geographical location, especially considering the current crises in the Near East. The United States and Turkey have common interests in identifying risks and developing countermeasures for shared systems such as airports and military bases. Thwarting the cyberattacks and digital infiltration from Daesh or other radical non-state actors is a priority for both countries, as is cooperating with each other and NATO members in regards to analyzing and/or enacting cyber-espionage against mutually threatening actors. In the current digital age, cybercrime transcends national borders, so improving Turkey-U.S. relations may aid in the pursuit of cybercriminal networks. Although Turko-Russian relations have slowly normalized since they tanked after Turkey’s 2015 downing of a Russian warplane,[25] Turkey’s fast growing Internet of Things (IoT)[26] is vulnerable to being enslaved as part of a botnet[27] for DDoS attacks from their more experienced Russian neighbors.

The U.S. government or U.S.-based tech giants could provide cybersecurity training and assistance to Turkey as a show of good faith, possibly improving relations and fostering further cooperation against mutual threats. However, such an offer risks the possibility that it may later be woven into another conspiracy or viewed as an insult. The U.S. is launching a trade mission to Ankara this December that will focus on cybersecurity and introduce U.S. firms to Turkey’s 250-million-dollar (and growing) data protection market.[28] If Turkey and the U.S. can set aside other issues they will be able to greatly increase defense cooperation and security,[29] including cybersecurity.

Recommendations

First, the U.S. should hold fast to its values regarding the human rights of Kurds, Gulen and his followers, and others targeted by the AKP government. At the same time, the U.S. could smooth some ruffled feathers by expressing an understanding of Turkey’s anxieties and desire to have a decisive hand in its near-abroad.

Second, the U.S. and Turkey would both benefit from better coordination among security forces, especially in terms of cybersecurity where the defense is already at a disadvantage and attribution is extremely difficult.

Third, the U.S. should carefully monitor the actions of the AK trolls and other known cyber-actors, though overt action against these forces is not recommended.  The strength of conspiracy theories is that any acknowledgement from the accused gives the theorist credibility. Cyberattacks in and of themselves are hard to defend against and highly deniable, but knowledge of the movements of these groups would enhance the U.S.’s ability to defend itself (or its allies) from these groups, make for more accurate attribution, and hasten the recovery process.

Lastly, in both the public and private realms the U.S. has superior cybersecurity to Turkey. The U.S. can improve its reputation with Turkey by sharing the policies and technologies it has pioneered with Turkish companies and the government. Although investing in emerging economies is always high-risk/high-reward, American companies willing to gamble on such markets could see large pay-offs as Turkey’s cybersecurity needs continue to grow.

Endnotes

[1] Idiz, Semih. “Turkish-US Ties Face Fresh Turbulence over Iraq, Syria.” Al-Monitor. N.p., 13 Jan. 2016. Web. 08 Nov. 2016.

[2] Arango, Tim, and Michael R. Gordon. “Turkey’s Push to Join Battle for Mosul Inflames Tension With Iraq.” The New York Times. The New York Times, 23 Oct. 2016. Web. 08 Nov. 2016.

[3] Rozen, Laura. “Who Will Liberate Raqqa?” Al-Monitor. N.p., 30 Oct. 2016. Web. 08 Nov. 2016.

[4] Danforth, Nick. “Turkey’s New Maps Are Reclaiming the Ottoman Empire.” Foreign Policy Turkeys New Maps Are Reclaiming the Ottoman Empire Comments. N.p., 23 Oct. 2016. Web. 08 Nov. 2016.

[5] Calamur, Krishnadev. “Will the U.S. Extradite Fetullah Gulen?” The Atlantic. Atlantic Media Company, 23 Aug. 2016. Web. 08 Nov. 2016.

[6] Barrett, Devlin. “U.S. Not Persuaded to Extradite Imam Over Turkey Coup.” WSJ. Wsj.com, 04 Aug. 2016. Web. 08 Nov. 2016.

[7] Calamur, Krishnadev. “Will the U.S. Extradite Fetullah Gulen?” The Atlantic. Atlantic Media Company, 23 Aug. 2016. Web. 08 Nov. 2016.

[8] The ‘Hood Event’ refers to an incident when U.S. soldiers detained Turkish commandos in Northern Iraq who were preparing to assassinate the Kurdish-Iraqi governor of Kirkuk.  In images reminiscent of the Abu Ghraib scandal, the commandos had black hoods placed over their heads.  This event barely registered with Americans, but was deeply humiliating to the Turks.  Though the commandos were released soon after and the US was quick to apologize, it is still source of anger, especially among nationalist youth groups in Turkey.

[9] Howard, Michael, and Suzanne Goldenberg. “US Arrest of Soldiers Infuriates Turkey.” The Guardian. Guardian News and Media, 07 July 2003. Web. 08 Nov. 2016.

[10] The Editorial Board. “Turkey’s New Anti-Americanism.” The New York Times. The New York Times, 04 Aug. 2016. Web. 09 Nov. 2016.

[11] Tremblay, Pinar. “Turkey’s Pro-government Media Mired in CIA Conspiracy Theories.” Al-Monitor. N.p., 09 July 2016. Web. 09 Nov. 2016.

[12] “Ankara Mayor Suggests Gülen Uses Genies to.” Hürriyet Daily News. N.p., 24 July 2016. Web. 08 Nov. 2016.

[13] TM. “Ankara Mayor Claims US, Gülen Plan Artificial Earthquake in İstanbul.” Turkish Minute. N.p., 11 Sept. 2016. Web. 08 Nov. 2016.

[14] Chen, Adrian. “The Agency.” New York times. N.p., 2 June 2015. Web. 9 Nov. 2016.

[15]  Sozeri, Efe Kozerem. “RedHack Leaks Reveal the Rise of Turkey’s Pro-government Twitter Trolls.” The Daily Dot. N.p., 30 Sept. 2016. Web. 08 Nov. 2016.

[16] Sozeri, Efe Kerem. “Mapping Turkey’s Twitter Trolls.” The Daily Dot. N.p., 22 Oct. 2015. Web. 08 Nov. 2016.

[17] In this case, a ‘botnet’ refers to the use of multiple social media accounts, often automated, to falsify popular support online.

[18] A type of cyberattack where the aggressors use masses of devices or programs to repeatedly request information from a server until it can no longer deal with all the requests and crashes.

[19] MEE Staff. “Wikileaks Hit by Hackers after Threat to Release Turkey Cables.” Middle East Eye. N.p., 19 July 2016. Web. 02 Nov. 2016.

[20] Ware, By Tony. “Commerece Rebrands Turkey Trip as ‘Cyber Security Mission”” Federal Times. N.p., July 2016. Web. 08 Nov. 2016.

[21] Sozeri, Efe Kozerem. “RedHack Leaks Reveal the Rise of Turkey’s Pro-government Twitter Trolls.” The Daily Dot. N.p., 30 Sept. 2016. Web. 08 Nov. 2016.

[22] Sozeri, Efe Kozerem. “RedHack Leaks Reveal the Rise of Turkey’s Pro-government Twitter Trolls.” The Daily Dot. N.p., 30 Sept. 2016. Web. 08 Nov. 2016.

[23] Sozeri, Efe Kozerem. “RedHack Leaks Reveal the Rise of Turkey’s Pro-government Twitter Trolls.” The Daily Dot. N.p., 30 Sept. 2016. Web. 08 Nov. 2016.

[24] Senturk, Hakan, C. Zaim Cil, and Seref Sagiroglu. “Cyber Security Analysis of Turkey.” International Journal of Information Security Science 1.4 (2012): 112-25. Google Scholar. Web. 8 Nov. 2016.

[25] Hume, Tim. “Turkey, Russia Reset Relationship after Jet Shootdown.” CNN. Cable News Network, 9 Aug. 2016. Web. 09 Nov. 2016.

[26] A term that refers to all devices capable of sending and receiving data, including devices not generally thought of internet capable like recently released refrigerators, alarm clocks, thermostats, etc.

[27] In this context, a ‘botnet’ refers to a conglomeration of devices with internet connectivity that have been infected with malware by a hacker, allowing the controller to use multiple devices to execute DDoS attacks.

[28] Ware, Tony. “Commerece Rebrands Turkey Trip as ‘Cyber Security Mission”” Federal Times. N.p., July 2016. Web. 08 Nov. 2016.

[29] Tol, Gonul, and W. Robert Pearson. “Turkey-U.S. Relations and the Next Administration.” Middle East Institute. N.p., 3` Nov. 2016. Web. 09 Nov. 2016.

Work Cited

Albayrak, Ayla. “Turkey’s Government Forms 6,000-Member Social Media Team.” WSJ. Wsj.com, 16 Sept. 2013. Web. 08 Nov. 2016.

“Ankara Mayor Suggests Gülen Uses Genies to.” Hürriyet Daily News. N.p., 24 July 2016. Web. 08 Nov. 2016.

Arango, Tim, and Michael R. Gordon. “Turkey’s Push to Join Battle for Mosul Inflames Tension With Iraq.” The New York Times. The New York Times, 23 Oct. 2016. Web. 08 Nov. 2016.

Barrett, Devlin. “U.S. Not Persuaded to Extradite Imam Over Turkey Coup.” WSJ. Wsj.com, 04 Aug. 2016. Web. 08 Nov. 2016.

Barrett, Devlin. “U.S. Not Persuaded to Extradite Imam Over Turkey Coup.” WSJ. Wsj.com, 04 Aug. 2016. Web. 09 Nov. 2016.

Bertrand, Natasha. “‘A Critical Watershed’: The US Is Underestimating the One Thing That Could Ultimately Destroy Its Relationship with Turkey.” Business Insider. Business Insider, Inc, 03 Aug. 2016. Web. 09 Nov. 2016.

Calamur, Krishnadev. “Will the U.S. Extradite Fetullah Gulen?” The Atlantic. Atlantic Media Company, 23 Aug. 2016. Web. 08 Nov. 2016.

Chen, Adrian. “The Agency.” New York times. N.p., 2 June 2015. Web. 9 Nov. 2016.

Danforth, Nick. “Turkey’s New Maps Are Reclaiming the Ottoman Empire.” Foreign Policy Turkeys New Maps Are Reclaiming the Ottoman Empire Comments. N.p., 23 Oct. 2016. Web. 08 Nov. 2016.

DeYoung, Karen. “Turkish Evidence for Gulen Extradition Pre-dates Coup Attempt.” Washington Post. The Washington Post, 19 Aug. 2016. Web. 08 Nov. 2016.

The Editorial Board. “Turkey’s New Anti-Americanism.” The New York Times. The New York Times, 04 Aug. 2016. Web. 09 Nov. 2016.

Howard, Michael, and Suzanne Goldenberg. “US Arrest of Soldiers Infuriates Turkey.” The Guardian. Guardian News and Media, 07 July 2003. Web. 08 Nov. 2016.

Hudson, John. “Turkey Concedes: No Evidence Linking Gulen to Coup Sent to Washington.” Foreign Policy Turkey Concedes No Evidence Linking Gulen to Coup Sent to Washington Comments. N.p., 25 Aug. 2016. Web. 08 Nov. 2016.

Hume, Tim. “Turkey, Russia Reset Relationship after Jet Shootdown.” CNN. Cable News Network, 9 Aug. 2016. Web. 09 Nov. 2016.

Idiz, Semih. “Turkish-US Ties Face Fresh Turbulence over Iraq, Syria.” Al-Monitor. N.p., 13 Jan. 2016. Web. 08 Nov. 2016.

MEE Staff. “Wikileaks Hit by Hackers after Threat to Release Turkey Cables.” Middle East Eye. N.p., 19 July 2016. Web. 02 Nov. 2016.

Pike, John. “Military.” U.S./Turkey: Ties Hit New Low After Raid On Turkish Forces. N.p., 7 July 2003. Web. 17 Nov. 2016.

Rozen, Laura. “Who Will Liberate Raqqa?” Al-Monitor. N.p., 30 Oct. 2016. Web. 08 Nov. 2016.

Senturk, Hakan, C. Zaim Cil, and Seref Sagiroglu. “Cyber Security Analysis of Turkey.” International Journal of Information Security Science 1.4 (2012): 112-25. Google Scholar. Web. 8 Nov. 2016.

Sindelar, Daisy. “The Kremlin’s Troll Army.” The Atlantic. Atlantic Media Company, 12 Aug. 2014. Web. 08 Nov. 2016.

Sozeri, Efe Kerem. “Mapping Turkey’s Twitter Trolls.” The Daily Dot. N.p., 22 Oct. 2015. Web. 08 Nov. 2016.

Sozeri, Efe Kozerem. “RedHack Leaks Reveal the Rise of Turkey’s Pro-government Twitter Trolls.” The Daily Dot. N.p., 30 Sept. 2016. Web. 08 Nov. 2016.

“Ankara Mayor Claims US, Gülen Plan Artificial Earthquake in İstanbul.” Turkish Minute. N.p., 11 Sept. 2016. Web. 08 Nov. 2016.

Tol, Gonul, and W. Robert Pearson. “Turkey-U.S. Relations and the Next Administration.” Middle East Institute. N.p., 3` Nov. 2016. Web. 09 Nov. 2016.

Tremblay, Pinar. “Turkey’s Pro-government Media Mired in CIA Conspiracy Theories.” Al-Monitor. N.p., 09 July 2016. Web. 09 Nov. 2016.

United States of America. Department of Commerce. International Trade Administration. By Gemal Brangman. N.p., 17 Aug. 2016. Web. 8 Nov. 2016.

Ware, By Tony. “Commerece Rebrands Turkey Trip as ‘Cyber Security Mission”” Federal Times. N.p., July 2016. Web. 08 Nov. 2016.

This publication was made possible in part by a grant from Carnegie Corporation of New York. The statements made and views expressed are solely the responsibility of the author.