From a database match to a person: the ByLock evidence lesson

Public record

The documented case and later decisions

On 26 September 2023, the European Court of Human Rights delivered its Grand Chamber judgment in Yüksel Yalçınkaya v. Türkiye, application no. 15669/20. Its official Registry summary records that the applicant had been convicted in 2017 of membership of an armed terrorist organisation, with alleged ByLock use forming decisive evidence. The Court found violations of Article 7, concerning punishment without law, and Article 6 § 1, concerning a fair trial. [1]

The Registry reported that the domestic courts had not explained the withholding of relevant raw ByLock data or addressed the request for independent examination. The applicant had also lacked an opportunity to comment on decrypted material concerning him. These were findings about safeguards and the reasoning supporting conviction; they should not be recast as a finding that every ByLock record was fabricated. [1]

The Court applied its earlier reasoning in Demirhan and Others v. Türkiye on 22 July 2025. A further decision, Korkmaz and Others v. Türkiye, dated 29 September 2026, found an Article 7 violation while expressly acknowledging that other evidence might establish an individual’s organisational involvement. Korkmaz did not separately decide the remaining complaints. The later record therefore reinforces the need to examine each inference and each person, rather than assume either guilt or exoneration from an application label. [2][3]

365 ALTERAM analysis

The forensic question: what relationship produced the match?

Our methodological question concerns the steps connecting stored data to an identified person. A database can contain account identifiers, network observations, message records and analyst-added labels. Those elements answer different questions. An account association, a device association, use by a particular person and knowledge of a criminal purpose are separate propositions requiring their own support.

A structural review should identify the original record behind a reported match and every transformation used to connect it to another source. This approach does not assert a particular database defect in ByLock. It sets out how an analogous dataset could be examined when qualified specialists receive sufficient material through authorised channels.

365 ALTERAM analysis

Reconstruct the data pathway before counting connections

Begin with a source inventory: preserved database material, acquisition records, extraction reports, available schema information and the versions of relevant decoding tools. Record which material is original, which is exported and which has been reconstructed. A hash can help establish that a supplied copy has remained unchanged; it does not establish that an interpretation of that copy is correct.

Next, examine what each row represents and how tables were joined. A hypothetical teaching example illustrates the problem: one account record joined to ten session records can yield ten output rows. That does not establish ten people or ten independent confirmations. Check whether identifiers are unique within the relevant system and period, and whether duplicate, missing or unmatched records affect the conclusion.

Where reconstruction depends on indexes, transaction artefacts or damaged fragments, distinguish directly observed bytes from decoded values and inferred relationships. A surviving fragment may omit context needed to identify its meaning. Record the assumptions and the specialist competence required to interpret it; do not present a partial reconstruction as a complete account history.

365 ALTERAM analysis

Test attribution and contrary evidence to the same standard

After checking the structure, compare the proposed attribution with independently available device, subscriber, timing and communications evidence. Ask whether those sources actually add independent support or merely repeat the same originating dataset. A consistent label across several reports can reflect one shared input rather than separate verification.

The review may confirm the reported link, narrow its meaning or leave it unresolved. Alternative access, incomplete collection and processing error require evidence rather than speculation. Equally, consistent records and corroborated communications may strengthen the original allegation. Lack of raw material limits what can be tested; it does not itself prove manipulation or identify who controlled an account.

365 ALTERAM analysis

Make every inferential step visible to counsel

For defence counsel in serious criminal proceedings, the useful output is a relationship map supported by a record-level provenance schedule, a reproducible transformation history and a proposition table. Each proposed conclusion should identify its supporting records, contrary material and unresolved assumptions. That makes clear where a technical association ends and a further inference about conduct begins.

365 ALTERAM’s role is to organise and test that evidential pathway with appropriately qualified specialists. Qualified counsel determines the legal strategy and the competent court assesses the evidence. The value of deeper structural examination is a conclusion that can be inspected and challenged, including when the result is adverse or inconclusive.