The omnibus bill has opened the door to a new era in internet governance. It is believed that the vaguely defined authority to take “measures” could provide a broader and more flexible legal basis for a range of interventions, from access blocks to throttling bandwidth

ALİ SAFA KORKUT

The Telecommunications and Communications Presidency (TİB), which was responsible for monitoring internet content and enforcing access blocking decisions, was dissolved by a Decree-Law (KHK) in August 2016. The agency’s duties and responsibilities were subsequently transferred to the Information and Communications Technologies Authority (BTK). Less than a decade later, a broad set of powers relating to internet domain names, access blocking, content regulation and electronic communications infrastructure is now being transferred from the BTK to the Cyber Security Authority (SGB). However, this should not be viewed as a “simple transfer of powers.” This is because a new area of intervention, the boundaries of which are not specified in the law, is being added to the transferred powers.

On 3 July 2026, the Justice and Development Party (AKP) submitted a new omnibus bill to the Presidency of the Grand National Assembly of Turkey (TBMM). Articles 19, 24 and 25 of the bill, which contains comprehensive changes across many areas, involve the transfer of BTK’s powers to the SGB and entail significant changes to internet governance and cyber security policies.

Indeed, Article 19 of the bill provides for the addition of Article 60/A to the Electronic Communications Act No. 5809. This article grants the SGB the authority to determine “necessary measures” either at the request of security and intelligence agencies or on its own initiative. However, the text of the law does not specify what constitutes this concept of “measures,” which could directly interfere with fundamental rights. Consequently, the type, scope, duration and technical methods of any intervention to be implemented under the term “measures” are left entirely to the discretion of the SGB.

This ambiguity in the legislative provision goes beyond a mere drafting error or poor legislative language; it is a deliberate choice made to grant the administration the widest possible scope of action. This is because when a power is not explicitly named, its boundaries are not pre-defined. Consequently, the SGB may interpret the term “measure” to include access blocking applications and protocols, traffic filtering, interference with DNS and domain name infrastructure, or the suspension of services via data centers. As the Freedom of Expression Association (İFÖD) has pointed out, such a framework could create a “digital state of emergency” authority that goes beyond mere access blocking.

This is precisely the most useful aspect of vague regulations from the government’s perspective. If it were explicitly stated that “this application may be blocked,” “this protocol may be suspended” or “under these conditions, internet traffic may be slowed down in this manner,” it would be possible to compare every intervention against the limits set out in the law. However, when the phrase “necessary measures” is used, the debate is turned on its head. The administration can now argue that its action falls within the general concept of “measures,” rather than having to demonstrate that it is specifically provided for in the law. In this way, the law ceases to be a framework that limits the government and instead becomes a flexible text that retroactively justifies the administration’s decision.

Just as in the “disinformation” law

Although the ambiguities in the draft bill prompted the writing of this article, Turkey is no stranger to this technique of “vague legislation.”

On 18 October 2022, the offense of ‘publicly spreading false information”—Article 217/A—was added to the Turkish Penal Code (TCK) under the “disinformation” law.

The text of the article favors vague concepts—such as “information contrary to the truth,” “capable of disrupting public order” and “intent to cause anxiety, fear or panic amongst the public” whose scope can be determined by those enforcing the law. It is not explicitly stated who will decide which information is “contrary to the truth,” by what method, or at what time. This has consequently granted prosecutors and judges a wide scope for interpretation. As a result, as of April, 83 journalists – some of whom possessed official documents confirming the news reports in question – have been targeted by this charge a total of 114 times. In fact, even as I write this, Alican Uludağ, a journalist at Deutsche Welle Türkçe, was taken into custody on charges of “spreading false information” and released under judicial supervision measures.

Now, the same vague legislative approach is being extended to the internet infrastructure. Moreover, this time it is not merely a matter of a specific post or individual. This “precautionary” measure, with its undefined scope, could affect the operation of a platform, protocol, domain name or data center, and render numerous services unrelated to the target inaccessible simultaneously.

The second pillar of the strategy of vagueness: Article 25

Article 25 of the omnibus bill also forms the second pillar of this strategy of vagueness.

Indeed, this article directly repeals paragraph 10 of Article 60 of Law No. 5809. This sub-paragraph has constituted the sole legal basis to date for the bandwidth throttling sanction, which is generally applied during social unrest, attacks or political developments. In place of the relevant sub-paragraph, a new Article 60/A—created by Article 19 of the same bill—is substituted, granting the SGB the authority to determine “measures” whose type, scope and applicable methods are not clearly defined.

Thus, whilst the specific provision on which bandwidth throttling was based is removed, a much broader and ill-defined authority to take “measures” in the same area is created. This paves the way for bandwidth throttling to be applied as part of a general decision on measures. Consequently, this ambiguity works in the administration’s favor not only at the time the intervention is implemented but also during subsequent scrutiny. This is because, in order to assess whether a measure is lawful, the law must first define what that measure is, under what conditions it may be carried out, and for what purpose.

The provisions of the bill that blur the boundaries of internet intervention were approved on 14 July by the Turkish Grand National Assembly’s Planning and Budget Committee. Once discussions on all the provisions have been concluded, the bill will be debated in the Turkish Grand National Assembly’s General Assembly. These debates are expected to be completed by 31 July