Clicks Against Dissent: Turkish Cypriot Media Under Coordinated Cyber Attack Amid Cost-of-Living Uprising
As thousands stormed the parliament building in the Turkish-controlled section of Nicosia over a frozen allowance decree, an orchestrated wave of copyright takedowns and platform manipulation silenced journalists, opposition politicians, and union voices — with an Indian 'reputation management' firm emerging at the centre of the operation.
In the first two weeks of April 2026, the Turkish Cypriot community witnessed two simultaneous crises that, viewed together, reveal the contours of a creeping authoritarian playbook: on the streets, tens of thousands of workers, pensioners, and civil servants confronted a coalition government that had bypassed the legislature to freeze their cost-of-living adjustments; and in the digital sphere, an organised campaign of fake copyright complaints, coordinated mass reporting, and platform manipulation targeted every outlet — journalist, trade union, opposition politician — attempting to broadcast that confrontation to the public.
The timing was not coincidental. The attacks peaked precisely as protest coverage reached its most explosive point, and the content systematically removed from Facebook, Instagram, and YouTube was not random: it centred on footage of the strikes, references to a figure known publicly only as "Juju" — reportedly a close personal associate of Prime Minister Ünal Üstel — and, in a revealing act of self-referential censorship, the Turkish Cypriot Journalists' Union's own statement denouncing the attacks.
The Decree That Lit The Fuse
The immediate trigger of the political crisis was a Decree with the Force of Law (YGK) published on 31 March 2026 in the Official Gazette of the Turkish Republic of Northern Cyprus. The instrument, issued by the three-party coalition of the National Unity Party (UBP), the Revival Party (YDP), and the Democratic Party (DP), suspended the semi-annual cost-of-living allowance due on 1 January 2026 to public employees, workers, and retirees. Rather than the customary January and July payments, the government announced that the accumulated adjustment would instead be consolidated into two tranches: half in April 2026, and the remainder in January 2027.
The procedural move was as politically explosive as the economic impact. Because the measure had not secured a parliamentary majority, the government had resorted to executive decree — a mechanism that the opposition and trade unions immediately characterised as a calculated circumvention of democratic oversight. The Republican Turkish Party (CTP), the main opposition bloc, branded the YGK an act of contempt for both the legislature and the electorate.
"Because the measure had not secured a parliamentary majority, the government had resorted to executive decree — a mechanism the opposition branded an act of contempt for both the legislature and the electorate."
The economic stakes were not abstract. The cost-of-living adjustment (hayat pahalılığı ödeneği) functions as a mandatory inflation-linked supplement that maintains the purchasing power of fixed incomes in an economy heavily exposed to Turkish lira depreciation and imported inflation. For many households, the suspension represented a months-long real-income cut in an environment of already acute affordability pressure.
The first general strike mobilised by the main trade union confederations began on 6 April 2026. By mid-morning, crowds estimated in the thousands had converged on the new parliament building in south Nicosia. Police deployed barriers, but demonstrators breached them and entered the parliamentary forecourt. Chants of "Unity, struggle, solidarity" and "Government, resign" rang out across the building's grounds.
On 7 April, a second wave of protesters forced their way inside the parliament building itself, compelling the suspension of the legislative session then underway. The confrontation marked the most significant institutional disruption in the Turkish Cypriot north in years. The same day, the Council of Ministers invoked emergency powers to impose a 60-day postponement on strikes in the health sector, including at the Dr. Burhan Nalbantoğlu State Hospital — a move unions condemned as a punitive response to legitimate industrial action.
CTP leader Sıla Usar İncirli, addressing the crowd outside, declared that the government bore responsibility for the events unfolding before them. By 8 April, facing the prospect of sustained street pressure and institutional paralysis, the government announced the withdrawal of the contested decree. However, the new formula it offered — 50 percent of the adjustment to be paid in July 2026, the remainder at the start of 2027 — failed to satisfy the unions, who had by then extended their demands to include the calling of early elections.
The Digital Crackdown: Architecture Of An Attack
While the protests were escalating, a parallel operation was unfolding across the social media platforms on which Turkish Cypriot media organisations depend for their audiences. The Turkish Cypriot Journalists' Union (KTGB) issued a formal statement on 9 April identifying what it described as a coordinated and organised cyber attack targeting media organisations and press workers, concentrated in the period coinciding with the general strike and the parliamentary confrontations.
The methodology was distinctive — and deliberately obscure. Rather than conventional hacking techniques such as distributed denial-of-service attacks or account intrusion, the campaign operated through the abuse of legitimate platform mechanisms: mass coordinated reporting of content under intellectual property and copyright violations, causing Meta's automated moderation systems to remove or restrict the targeted material without human review. The effect was to weaponise the platforms themselves against the outlets using them.
The content categories that were suppressed were not arbitrary. Yenidüzen newspaper reported that over 16 items containing the name "Juju" were removed from its Facebook page in a single day. Juju is the personal nickname of Fatma Ünal, widely identified in Turkish Cypriot media as a long-standing intimate associate of Prime Minister Üstel. Additionally, content related to the strikes and — in a move that underlines the political coordination behind the campaign — content referencing the cyber attacks themselves was systematically targeted and removed.
The KTGB's own public statement announcing the existence of the attack was itself among the items erased from social media within minutes of publication, suggesting a real-time monitoring operation rather than a passive automated process.
The Aiplex Connection: An Indian Firm In The Frame
The most significant investigative finding of the crisis came from Yenidüzen's newsroom. The newspaper's research team identified Aiplex Software Pvt Ltd, an Indian company specialising in so-called "Online Reputation Management" (ORM) services, as an active participant in the takedown campaign. The company's name appeared in the copyright complaint filings used to remove content critical of those in power.
Aiplex Software is not an obscure actor: the Hyderabad-based firm has a documented history of pursuing mass content removal operations on behalf of paying clients, exploiting the automated copyright enforcement pipelines maintained by platforms such as Meta and YouTube. Its methods typically involve filing large volumes of copyright claims — regardless of their legal validity — knowing that platform algorithms will act on them without individual human adjudication.
"The company's name appeared in the copyright complaint filings used to remove content critical of those in power — with reports suggesting a monthly retainer of approximately $50,000."
Yenidüzen reported that the arrangement involved a monthly retainer of approximately 50,000 US dollars. The newspaper's own front-page reporting on Fatma Ünal was removed twice from Facebook — the second removal occurring after the first had been restored and reshared — demonstrating the persistent and active nature of the monitoring.
The Aiplex model illustrates a broader vulnerability in the global content moderation infrastructure. ORM services of this type are not illegal: they operate in the grey zone between legitimate intellectual property enforcement and targeted censorship, exploiting the scale and automation of platform moderation to achieve political outcomes that could not be obtained through legal channels. The fact that a small island polity experiencing a domestic political crisis was apparently willing and able to engage such a service points to a normalisation of digital repression as a tool of governance.
Who Was Targeted
The scope of documented targets underlines the operation's breadth. Hüseyin Özbarışcı, web editor of Yenidüzen, had his personal account suspended. Live streams by Kıbrıs Postası and Haber Kıbrıs were disrupted in real time during the protest coverage. Broadcasts by Genç TV were removed. Kanal Sim, a channel with seventeen years of uninterrupted operation, had its YouTube account shut down without prior notice on 26 February — a date that may indicate the operation began earlier than the April escalation suggests.
Former Prime Minister and former Speaker of the Assembly Sibel Siber reported that a targeted attack on her accounts resulted in the near-complete deletion of her digital archive. She called for the perpetrators to be identified and held accountable. Kudret Özersay, the former Foreign Minister of the unrecognized entity “Turkish Republic of Northern Cyprus” and leader of the People’s Party, also announced that his Facebook account had been targeted. The systematic nature of the targeting, which includes independent journalists, television channels, a long-established broadcaster, and senior opposition politicians, is inconsistent with the profile of opportunistic or criminal cybercrime.
Meta confirmed to the KTGB that it had independently detected coordinated inauthentic behaviour originating from fake accounts and had opened its own investigation into the campaign, a disclosure that lent institutional credibility to the union's characterisation of the attacks as organised rather than spontaneous.
The response of Turkish Cypriot state institutions to the crisis exposed a significant gap between political rhetoric and technical capacity — and, in the case of the Information Technologies and Communications Authority (BTHK), an admission of fundamental institutional impotence.
BTHK Deputy Board Chair Tayfun Aydınlı stated publicly that the operations complained of did not constitute a cyberattack in the technical sense of the term, since they involved the internal enforcement mechanisms of the social media platforms themselves rather than external intrusion into systems. He acknowledged that the BTHK had no legal or technical basis to intervene directly with the platforms on behalf of affected parties.
The admission, while technically defensible, was politically damaging: it confirmed that the Turkish Cypriot state possessed no institutional instrument to defend the digital rights of its journalists and citizens against platform-mediated censorship campaigns, whether externally contracted or domestically organised.
Transport and Public Works Minister Erhan Arıklı moved to fill the gap through an unusual channel: he disclosed that the matter had been raised with Ankara, and that Turkey had been formally requested to provide technical assistance. He further confirmed that Turkish Vice President Cevdet Yılmaz had instructed Turkey's Cybersecurity Presidency to cooperate with the BTHK, and that a technical delegation from Ankara was expected to travel to northern Cyprus in the coming days.
The decision to invite Turkish state cyber expertise into what is effectively a domestic media freedom dispute carries implications that extend well beyond the immediate crisis. Critics of the arrangement — including opposition parties and press freedom organisations — noted that the very power being called upon to investigate the suppression of dissent was a government whose own record on media freedom and digital rights is extensively documented.
President Tufan Erhürman, for his part, declared that the attacks were being monitored at state level and that the necessary steps were being taken through the BTHK, while insisting that the democratic culture of the Turkish Cypriot people would not yield to such pressures.
Political Fallout: Even The Coalition Cracks
The political reverberations of the cyber campaign were felt even within the governing coalition. The Democratic Party (DP), a coalition partner of the UBP-YDP administration, issued a statement through its Secretary-General Serhat Akpınar that was remarkable in its candour. Akpınar described the attacks as a serious threat to freedom of expression, democratic communication, and the public's right to information. Crucially, he called for the urgent development of an institutional cyber-security framework that would guarantee what he termed northern Cyprus's own digital sovereignty — an implicit acknowledgement that reliance on Ankara was not a sufficient or acceptable long-term solution.
The main opposition CTP was more bluntly accusatory. The party declared that allegations that public funds had been used to finance the suppression of dissent were "extremely grave," equating the practice — if confirmed — with "attacking the people with their own money." CTP announced it would initiate legal proceedings if the allegations were substantiated by the ongoing investigations.
"Allegations that public funds were used to finance the suppression of dissent were 'extremely grave' — equating the practice with attacking the people with their own money." — CTP Statement, 13 April 2026
Opposition MP Mehmet Oygar (UBP), while speaking in a different register, nonetheless framed the protection of freedom of information as a state obligation, further muddying any effort by the governing coalition to present a unified front on the issue.