Türkiye’s Cybersecurity Legislation: A Threat to Press Freedom?
- Türkiye’s new cybersecurity law gives the state broad powers, raising press freedom concerns.
- Critics say one provision could be used to punish reporting on data leaks.
- The government says the law is needed for national security.
- Press freedom groups have warned it could be used for censorship.
- The debate over security versus free expression continues.
Introduction
Governments everywhere are trying to defend against cyberattacks without trampling civil liberties. Türkiye’s new cybersecurity law, passed by parliament in March 2025, has become the latest flashpoint. Critics say it gives the state too much power and puts journalists at risk.
What the Law Does
The law sets up a central Cybersecurity Presidency that reports to the president’s office. It gives the new body wide powers to set rules for public and private organizations, inspect their systems and demand data from them, all in the name of protecting the country’s critical infrastructure.
The most controversial part is a new crime. Anyone who creates or spreads content falsely claiming that a cyberattack has leaked data, in a way meant to cause panic or target institutions, can face two to five years in prison. Press freedom advocates say that wording is vague enough to be used against journalists who report on real breaches the government would rather deny.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Security Tool or Weapon Against Dissent?
Supporters say the law is necessary. The government argues Türkiye faces constant cyberattacks and needs a single authority with real power to respond. Without it, they say, national security would suffer.
Critics see it differently. Journalists and international watchdogs say the law adds to existing pressure on the press in Türkiye. Reporting on a breach could become legally risky. Officials could simply call a story false.
International Reactions
The law drew criticism abroad as well as at home. Human rights and media groups warned that it could chill reporting on data breaches and government failures.
The Committee to Protect Journalists and Reporters Without Borders have both raised concerns about press freedom in Türkiye. They argue that limits on reporting in one country can encourage other governments to copy them.
What the EU Has Said
Türkiye is still formally a candidate to join the European Union, and the EU has repeatedly pressed it on press freedom and the rule of law. Laws like this one make those talks harder.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Other governments are watching too. Some see the law as a model for centralizing cyber defense. Others see a warning about how easily security powers can spread into control of information.
Where This Leaves Türkiye
Türkiye’s cybersecurity law has set off a sharp debate about national security and individual freedom. How it is enforced will matter more than its text. The first prosecutions will show which way it goes.
Türkiye does face real cyber threats. The question is whether this law protects the country’s networks or mainly protects officials from embarrassing news. That is still unclear. The tension between security and liberty is not going away.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Thursday’s brief: APT can install a swapped package, then Rails uploads, Xen hosts and old phones
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.