Slashdot Mirror


Turkish Journalist Jailed For Terrorism Was Framed, Forensic Report Shows (vice.com)

An anonymous reader quotes a report from Motherboard: Turkish investigative journalist Baris Pehlivan spent 19 months in jail, accused of terrorism based on documents found on his work computer. But when digital forensics experts examined his PC, they discovered that those files were put there by someone who removed the hard drive from the case, copied the documents, and then reinstalled the hard drive. The attackers also attempted to control the journalist's machine remotely, trying to infect it using malicious email attachments and thumb drives. Among the viruses detected in his computer was an extremely rare trojan called Ahtapot, in one of the only times it's been seen in the wild. Pehlivan went to jail in February of 2011, along with six of his colleagues, after electronic evidence seized during a police raid in 2011 appeared to connect all of them to Ergenekon, an alleged armed group accused of terrorism in Turkey. A paper recently published by computer expert Mark Spencer in Digital Forensics Magazine sheds light into the case after several other reports have acknowledged the presence of malware. Spencer said no other forensics expert noticed the Ahtapot trojan in the OdaTV case, nor has determined accurately how those documents showed up on the journalist's computer. However, almost all the reports have concluded that the incriminating files were planted. "We are not guilty," Baris Pehlivan told Andrada Fiscutean via Motherboard. "The files were put into our computers by a virus and by [attackers] entering the OdaTV office secretly. None of us has seen those documents before the prosecutor showed them to us." (OdaTV is the website Pehlivan works for and "has been critical of the government and the Gulen Movement, which was accused by Turkish president Recep Tayyip Erdogan of orchestrating the recent attempted coup.") In regard to the report, senior security consultant at F-Secure, Taneli Kaivola, says, "Yes, [the report] takes an impressive level of conviction to locally attack a computer four times, and remotely attack it seven times [between January 1, 2011, and February 11, 2011], as well as a certain level of technical skill to set up the infrastructure for those attacks, which included document forgery and date and time manipulation."

1 of 103 comments (clear)

  1. In some country "terrorist" means something else.. by Anonymous Coward · · Score: 0, Flamebait

    In paranoid dictatorships like Turkey (yes, I know they have all the forms of democracy, but get serious), "terrorist" is a euphemism for "perceived opponent of the state."

    The usual definition of the term -- i.e., a person or group who engages in violent acts for political effect, does not apply. Violence is not required, neither threatened nor carried out. Evidence is not required - it can either be manufactured, as apparently was the case here, or else the lack thereof is simply ignored. Actual opposition to the state is not even required - just fear by the state that the opposition might be there.

    For a while it looked like Turkey would be the one exception to the rule that majority-Muslim states cannot have democracy. Apparently, that was only a brief and partial state, not a stable situation. So sad.