Slashdot Mirror


Turkish Journalist Jailed For Terrorism Was Framed, Forensic Report Shows (vice.com)

An anonymous reader quotes a report from Motherboard: Turkish investigative journalist Baris Pehlivan spent 19 months in jail, accused of terrorism based on documents found on his work computer. But when digital forensics experts examined his PC, they discovered that those files were put there by someone who removed the hard drive from the case, copied the documents, and then reinstalled the hard drive. The attackers also attempted to control the journalist's machine remotely, trying to infect it using malicious email attachments and thumb drives. Among the viruses detected in his computer was an extremely rare trojan called Ahtapot, in one of the only times it's been seen in the wild. Pehlivan went to jail in February of 2011, along with six of his colleagues, after electronic evidence seized during a police raid in 2011 appeared to connect all of them to Ergenekon, an alleged armed group accused of terrorism in Turkey. A paper recently published by computer expert Mark Spencer in Digital Forensics Magazine sheds light into the case after several other reports have acknowledged the presence of malware. Spencer said no other forensics expert noticed the Ahtapot trojan in the OdaTV case, nor has determined accurately how those documents showed up on the journalist's computer. However, almost all the reports have concluded that the incriminating files were planted. "We are not guilty," Baris Pehlivan told Andrada Fiscutean via Motherboard. "The files were put into our computers by a virus and by [attackers] entering the OdaTV office secretly. None of us has seen those documents before the prosecutor showed them to us." (OdaTV is the website Pehlivan works for and "has been critical of the government and the Gulen Movement, which was accused by Turkish president Recep Tayyip Erdogan of orchestrating the recent attempted coup.") In regard to the report, senior security consultant at F-Secure, Taneli Kaivola, says, "Yes, [the report] takes an impressive level of conviction to locally attack a computer four times, and remotely attack it seven times [between January 1, 2011, and February 11, 2011], as well as a certain level of technical skill to set up the infrastructure for those attacks, which included document forgery and date and time manipulation."

20 of 103 comments (clear)

  1. Re:Turkey is due for some DEMOCRACY by unixisc · · Score: 4, Informative

    Actually, democracy, as imposed by the EU, was what brought Turkey to this point. Under Kemal Mustafa Ataturk and his successors, Turkey was a military backed authoritarian regime that kept Islam on a leash. Then, when they wanted to enter the EU, Brussels told them that they had to become as democratic as the EU countries.

    Problem w/ that was that while geographically, Turkey may be positioned to be a part of Europe, culturally, the Turks are not European at all: they are Islamic. Their democratic underpinnings are similar to that of their Arab and Iranian neighbors: it shows in their attitudes towards the Armenians and the Kurds. Also, under Erdogan, Turkey has been only too happy to rediscover not just its Ottoman, but also its greater Turkic past - be it Seljuk, Tatar, Khwarezmid, Timuride, Moghul... pasts. Which is fine, but it doesn't lay the groundwork of a democratic Turkey being a pluralistic society the way the EU would desire.

  2. Re:America: Please end realpolitik by Rick+Zeman · · Score: 2, Funny

    For the last century America has engaged in realpolitik, propping up and supporting reprehensible regimes and tyrants like in Turkey. .

    Yes, and it all started with propping up Stalin and the Soviet Union. For shame, US, for shame.

  3. Re:In some country "terrorist" means something els by unixisc · · Score: 2, Insightful

    Previously, under its Kemalesque regimes, Turkey was not a democracy. It was a military backed authoritarian regime, which was benevolent enough in that it cared for the well being of its people, recognized Islam as a problem, and therefore did what it could to supplant the cult of Mohammed w/ the cult of Ataturk. But they never developed a pluralistic culture that embraced all their differences - religious (Armenian), cultural (Kurds) and the end result was that people either had to swear by Ataturk or by Islam.

    Also, under Erdogan, Turkey has been busy rediscovering its Turkic roots, and celebrating Turkic empires of the past - be it the Ottomans, Seljuks, Khwarezmids, Tatars, Timurides, Moghuls... All of those were Islamic empires. The Ottomans were a caliphate, while all the others were major champions of Islamic Jihad against non-Muslims anywhere around them. So this revivalism of Turkic culture has also been accompanied by a revival of Islam. On top of that, there's been the Shia-Sunni clash b/w Iran/Iraq/Syria vs Saudi Arabia/Qatar, and Turkey has another opportunity to lead the Sunni world, which it's grabbed w/ both hands.

    And as a Muslim country, Turkey would never describe a Jihad as terrorism. Terrorism is any opposition to Erdogan, be it by the Kurds (PKK), Fatehullah Gulen or anyone else in Turkey opposed to him

  4. Re:Turkey is due for some DEMOCRACY by Solandri · · Score: 4, Informative

    Politically, the whole fustercluck dates back to the end of the first World War. The Ottoman Empire was on the losing side, and ceased to exist after WWI. The European victors carved its territory up along arbitrary lines, without regard for the cultural and even lingual boundaries. Those lines became the modern country borders we know today. Most of the modern Middle-eastern conflicts trace their roots back to this. Iraq, Kuwait, Syria, Israel/Palestine, and Turkey.

    Culturally, it would've made a lot more sense to divide the territory up into Turkey, Kurdistan, and Arabia plus maybe a few other small countries, instead of the patchwork it is today.

  5. Contain highly technical content :) by khz6955 · · Score: 2

    Has it become Slashdot official policy to not mention Microsoft windows in relation to remote access trojan malware?

    "Spencer .. said he and his team .. examined BarıÅY Pehlivanâ(TM)s computer using a technique they developed to deal with sophisticated tampering of evidence."

    'It's called "Anchors in Relative Time," which means putting events logged by computers such as startups and shutdowns in chronological order, regardless of any associated dates and times that might had been altered by attackers'. ref

    1. Re:Contain highly technical content :) by ArsenalConsulting · · Score: 3, Informative

      You have asked a question we would like more people in our industry to ask! My (this is Mark Spencer) last two articles in Digital Forensics Magazine introduced the Anchors in Relative Time analysis technique and included examples of cases in which it was applied. I'm going to try and strike a compromise in my explanation below between my technical articles and the Motherboard article:

      What do you do if you need to analyze a Windows computer but already have reason not to trust any of its dates and times? One option is to identify events which have occurred in a particular order regardless of any associated dates and times. Let's take just two types of events (related to file system transactions) into consideration for now. File system transactions in the NTFS $LogFile and $UsnJrnl metafiles increment via Log Sequence Numbers (or LSNs) and Update Sequence Numbers (or USNs), respectively. It does not matter whether someone was manipulating the clock during these transactions or if someone manipulated dates and times in the $MFT (related to files and folders associated with the transactions) after the fact - the LSNs and USNs have still incremented in an orderly fashion.

      So where do you go now? You can start identifying "legitimate" and "illegitimate" anchors. Windows startups and shutdowns result in a flurry of activity in the $LogFile and $UsnJrnl metafiles. You could model what those flurries look like on the computer in question and determine, in relative time and regardless of any dates and times, when Windows startups and shutdowns occurred. Once you have established Windows startup and shutdown anchors (which we have done not only on Windows boot volumes but auxiliary volumes as well), you can then start putting the more entertaining stuff into context with them.

      Does this basic concept make sense? I only focused on Windows and a couple simple event types here (some others require multiple elements in order to determine an increment), but once you understand the basic concept you can do really powerful things from there. The basic concept is not that complex, but applying it can be a major hassle... in the Odatv case, the hassle was well warranted.

      On a side note, there has been enough interest in this case that I'm planning on putting a detailed case study on our website at https://arsenalexperts.com/Cas.... It also happens to be one of the few cases we're able to talk about without restrictions, so I'm motivated to drink enough coffee to get it done.

  6. Re:Turkey is due for some DEMOCRACY by unixisc · · Score: 3, Insightful

    I'd toss in Israel, since the Jews didn't have a state of their own and were dhimmis in Palestine under everybody before the Brits - be it the sultanates of Egypt or Syria, the Ottomans and so on. And Lebanon, for the sake of the Maronites.

    But you are right. Iraq was an artificial country, and the only thing defining it was British occupation. Like Syria and Lebanon w/ French occupation. Instead, a few countries - Turkey, Kurdestan, Azerbaijan, Greater Arabia, Israel/Palestine (in that time, the people who were called Palestinians were the Jews, not the Arabs. Such an arrangement would have prevented the Armenian genocide, as well as the Arab-Israeli wars.

  7. Re:Turkey is due for some DEMOCRACY by flopsquad · · Score: 3, Funny

    And war hawk Hitlery will see to it !

    I know you were trying for a catchy, meme-worthy portmanteau, but all I can see is a half hour Home Shopping Network cooking demo where they're carving turkey with Hitler's cutlery. Replica war hawks on the pommels and everything!

    --
    Nothing posted to /. has ever been legal advice, including this.
  8. That is how a surveillance-state does it by gweihir · · Score: 4, Insightful

    The next step is, of course, to dispense with the need for forensic "evidence" on people's computers and do this fully with "intercepted" communications. And here is the real danger of a surveillance-state: They can send anybody, any time to prison for as long as they desire, and there is no possibility to defend yourself unless they screwed up massively (as they did in the case at hand).

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  9. Re:Access to evidence by bloodhawk · · Score: 2

    considering the amount of judges and lawyers that were all just recently rounded up by the government as supposed traitors I can see a shit load of reasons why a judge would comply.

  10. filesystem feature by kdayn · · Score: 3, Interesting

    while reading this article, it realized that it could be possible to create filesystem feature which would not encrypt but sign all files when password is provided during mounting, otherwise fs would work in read only mode, this feature could prove that files where created by owner of password and planting evidence like this would be impossible and this would not break any laws, the fs contents are always accessible in read-only mode without password. maybe something like this already exists?

  11. Re:amazing forensics? by bloodhawk · · Score: 2

    That does not prove they removed it from the case, you could do that simply by booting it from a USB key and doing that. They specifically say they can forensically prove the files were copied while it was removed from the computer case.

  12. Re:Riiight! by fredgiblet · · Score: 4, Insightful

    There's plenty of people today that seem to believe that an accusation is proof.

  13. Re:Turkey is due for some DEMOCRACY by fredgiblet · · Score: 4, Insightful

    Basically our entire world right now can be traced back to WW1 really. WW1 and WW2, which was directly caused by WW!, completely re-wrote the entirety of the world order.

  14. Re:Turkey is due for some DEMOCRACY by Anonymous Coward · · Score: 2, Interesting

    I'd toss in Israel, since the Jews didn't have a state of their own...

    That brings up a decent discussion point. Why do Jews need or deserve a specific country for their own? We don't do this for any other religion. Where is the country founded by, for, and exclusively run by Lutherans? What about Janists or Sikhs?

    Why does one and only one religion get massive support to have their own country when no other religion gets that privilege?

  15. Re:Turkey is due for some DEMOCRACY by Bongo · · Score: 5, Insightful

    I've hear that the Soviet Union went to great lengths to divide territory along cultural lines, and failed. Point is, it doesn't matter what identity you have, it matters whether you identify with it. There's a stage in psychological development that's authoritarian, and then after that... a loong time after that, comes the individual, with individual rights and freedoms.

    Jesus, oddly, managed to implant the seed of that into the authoritarian systems of his time, which took a thousand years or more to develop. Or maybe it was the Greeks.

    Anyway, point is, things like the French Revolution, Western democracy, the individual who can think for him or herself, and is given rights, all born equal, is a massive cultural change, and without it, elections don't really work. Tribes will vote for their authoritarian leaders and so on, religion remains a control freak which keeps grabbing more and more power, and individual freedom of expression is crushed, along with original thinking and invention.

    So if you are X and identify as X and are part of group X and are under the control of X's authoritarian power, well you're not modern. It makes no difference whether next door there's another group that's Y and slightly different yet also authoritarian. You're all as "bad" as each other (from a modern viewpoint).

    The fact that the two groups are not having their own lands strictly in an, you know, segregated way, is besides the point really. Lots of segregated authoritarian groups living next to each other, trying not to step on each others' toes, can only last so long. Arguably that's what happened to Lebanon.

    What makes a person modern is that they can think for themselves outside of their group, and know why individual rights matter. Which is a whole different thing to the Life of Bryan and the famous scene where the crowd blindly repeat everything the Messiah says.

    So point is, dividing up territory is meaningless if the people themselves don't identify with their group and are blindly moved by that group. A modern nation contains many many groups, yet they don't fragment along sectarian lines at the first bit of friction, because they are not "white" or "black" or "muslim" or "christian" or "buddhist" or "atheist"... they are citizens first, and the other stuff is secondary.

    Until the culture of the middle east moves to modern values and modern minds, they can't be citizens and their lands can't be modern nations in a democratic way.

    Thing is, that's true for everyone and it is a historical accident that modernity appeared in some parts of the world first. And the authoritarian way worked ok more or less for thousands of years, so it isn't bad as such. Just, modernity makes certain things possible. But people have to grow to get there.

    And the EU telling people to be democratic is, well, just doesn't realise what a huge change that is. If you take the Magna Carta, that started a gradual change over 800 years ago. How many countries today call themselves democratic when they obviously have fairly fascistic dictators? (Not counting the USA :-P )

  16. Re:Turkey is due for some DEMOCRACY by unixisc · · Score: 2

    Palestine was not 'taken over'. First of all, it had native Jews there even before the 7th century Arab/Muslim conquests. Then, in the late 19th & early 20th centuries, Jews, who were fleeing persecution from places like Tsarist Russia and even mainland Europe moved their and bought land from the Arabs at above market prices. (That's a sharp contrast from the way the Arabs settled in places like Syria, Egypt and much of North Africa.) And the original partition of that area was done, w/ Israel being far smaller than what it became. It was the Arabs who started the wars in 1949, and have tried terminating Israel on 5 or more occasions since then. And they encouraged Arabs to leave Israeli territory, not Israel who expelled Arabs. One more thing - there was no such thing as the 'Palestinian' people - that was a term used for Jews before the creation of Israel. It was just Arabs - from Aden to Raqqa, and Baghdad to the Mahgreb

  17. Re:Riiight! by sims+2 · · Score: 2

    Do you have something like this: http://www.okjailbirds.com/ in your state?

    --
    Minimum threshold fixed. Thanks!
  18. Persia and Iran by unixisc · · Score: 2

    Persians? The correct term is 'Iranians'. Persia - as was historically understood - was what is today the Fars province of Iran. Includes Shiraz. The ancient Median and Achaemenid empires, which were centered around Persepolis/Pasargadae, et al were Persian. The Parthian empire was what's today Khorasan. The different Islamic dynasties that ruled Iran, none of them were Persian They were either based in Khorasan or Isfahan or Teheran. None of which are in 'Persia'.

  19. Liberal democracy & Islam by unixisc · · Score: 2

    I could ignore the AC, but what the heck!!!

    I never said anything about a 'Clash of Civilizations'. For the simple reason that Islam is not a 'civilization'. I did say that Islamic countries can't have the things you describe - a liberal, democratic system that's capable of being self critical and thereby do all the things you mentioned. Reason? Islam itself!!!

    To be capable of self-correcting and self-adjusting, the core values have to be capable of self-criticism. The reason it's not possible among the Arab and Turkic people is not their race/culture - it's the underlying kernel of all that - their religion - Islam!!! Islam declares itself to be perfect and above all criticism, and this is something very well laid out in Islamic texts.

    First of all, nobody is allowed to be critical of anything that is considered as endorsed by Mohammed. As a result, no criticism of Islam is ever allowed. Once that is the baseline, there is nothing preventing other parameters from being above reproach - be it 'Turkishness' or 'Arabness'. Thereby, trying out any social reform that flies in the face of either Islamic supremacy, or even under that, Turkish supremacy (over Kurds or Armenians) e.g. any Turks condemning the Armenian genocide - would be considered treachery by the larger Turkish population, and even heresy, given that Armenian are Christians and Turks Muslims. This condemnation of self-criticism as treason is something first laid down in Islam, and then percolates to other aspects of Muslims, be it their ethnicity, culture and other attributes.