A new regulation recently adopted by the TBMM transfers numerous authorities previously held by the Information Technologies and Communication Authority (BTK) to the Cybersecurity Presidency. Submitted by the Justice and Development Party (AK Parti) as a 30-article omnibus bill, the legislation encompasses various regulations ranging from retired pensions to the public personnel regime while introducing a radical transformation in cybersecurity.
Article 28 of the regulation directly modifies the organizational structure of the Cybersecurity Presidency, which operates under the Presidency of the Republic. The objective of this amendment is to expand the agency’s mandate and bring certain sectors directly under its control and supervision. While the bill has drawn mixed reactions from the public, it shifts many regulatory authorities previously managed by the internet regulator BTK over to the Cybersecurity Presidency. This shift has fueled discussions centered on the “centralization of cybersecurity,” as internet regulation powers move directly to an institution under the Presidency. The legislation ultimately solidifies Turkey’s approach to internet and cybersecurity governance maintained since the 2010s.
Digital Gaming and Domain Names Shift to the Presidency
Among the most widely discussed provisions of the law is the integration of cybersecurity activities related to digital gaming platforms into the Presidency’s jurisdiction. Additionally, the legislation grants the Cybersecurity Presidency the authority to determine strategies and regulate internet domain names.
In situations where delay is deemed risky, the Presidency can—upon the request of security and intelligence agencies or on its own initiative—issue precautionary measures. Access providers, data centers, and content providers are mandated to enforce these decisions within two hours. For instance, during emergencies like cyber attacks, the Presidency holds the power to enact precautionary decisions regarding internet infrastructure.
While official TBMM documents do not exhaustively list “cases where delay is risky,” the text refers to reasons outlined in the “Freedom of Communication” provision of the Constitution. Under Article 22 of the Constitution, freedom of communication may only be restricted based on the following grounds:
- National security
- Public order
- Prevention of crime
- General health
- General morals
- Protection of the rights and freedoms of others
However, the law does not explicitly detail the specific measures the Cybersecurity Presidency may utilize in such scenarios. The exact methods—such as bandwidth throttling, DNS blocking, IP blocking, or URL blocking—remain unspecified, sparking civil society concerns over “ill-defined precautionary powers”. Highlighting these worries, the internet monitoring association Engelli Web noted in a statement: “Additionally, Article 60/10 of Law No. 5809, which has been the sole explicit legal basis for bandwidth throttling until now, is being repealed. Thus, a named and specific provision-based throttling power is paved to be replaced by an ill-defined and content-unspecified ‘precautionary’ power”.
What Powers Does BTK Lose?
A striking aspect of the new law is that BTK relinquishes a substantial portion of its foundational operational authorities in the realm of cybersecurity. While the legislation does not abolish BTK, it transfers duties directly tied to cybersecurity to the newly established Cybersecurity Presidency. Consequently, BTK will maintain its existence solely as the regulatory authority for the electronic communications sector.
According to official TBMM documentation, responsibilities in the following areas will be centralized under the Cybersecurity Presidency:
- Domain name management authorities
- Cybersecurity duties concerning internet infrastructure
- Responsibilities integral to cybersecurity under communication detection and analysis
- Cybersecurity-related duties previously assigned to BTK under the Cybersecurity Law, Electronic Communications Law, and other relevant legislation
Furthermore, all IT infrastructures, data centers, software, movable assets, vehicles, equipment, electronic records, documents, rights, obligations, and personnel utilized by BTK to perform these duties will be transferred to the Cybersecurity Presidency within three months.
