The Kurdish hacking movement did not begin to play a role in the Kurdish struggle for autonomy and independence until much later in the broader movement’s history. This is understandable considering Kurdish militant groups, such as the Kurdistan Worker’s Party (PKK) started their armed conflict with the Turkish state in 1979 when the internet, personal computers, and hacking were still in their nascent years. Early operations carried out by Kurdish hackers were simplistic in nature. This often came in the form of website defacements targeting Turkish organizations and aimed at the Turkish public to spread awareness of the injustices suffered by the Kurdish people at the hands of the Turkish state. Other similar hacktivist campaigns could be described as propaganda operations in which Turkish websites were defaced with images of Abdullah Ocolan, considered the leader of the revolutionary Kurdish movement who has been imprisoned by the Turkish state since 1999, as well as messages supporting the armed struggle of the PKK (1). This activity, taking place in the 2012-2013 timeframe, is representative of politically-motivated hacking groups globally in the early 2010s. Their activity was largely focused around website defacements and spreading political messaging to a target audience. Rarely were hacktivist actions disruptive or a threat to any state at large, with groups such as Anonymous being among those most effective at the time. 

In these early days of the Kurdish hacking movement, targeted cyber operations went both ways. Turkish hackers were active in trying to achieve political objectives of their own. These groups were often right-wing Turkish nationalists who targeted Kurdish organizations as well as other entities that have always been, and still remain, targets of right-wing violence such as LGBTQ+ organizations. One such example is when a Turkish nationalist group (Ayyildiz Tim) hacked the Facebook user account of a member of the Kurdish LGBTQ+ rights group, Hebun. After gaining access to the user’s account, the hackers defaced the Facebook group with Turkish nationalist symbols and videos to the group page, bragging about their successful hack. Hebun, based in the city of Diyarbakir, made statements at the time about the dangerous impact such cyber-attacks could have, notably due to the hackers’ ability to obtain personal information on the members of the group — something which could put their safety at risk in a hostile environment (2). These early hacktivist campaigns between rivaling Turkish and Kurdish groups showcased how the hacking scene in Turkey and Kurdistan was not just an online political war but a cultural one as well. This can be seen in the real world conflict of the region as left-wing and right-wing politics are leveraged by opposing sides and political struggle is matched by that of a war for culture and identity.

The early days of these hacker wars, and those of hacking more generally, seem quaint when compared to the modern capabilities of both nation-state and non-state hacking groups. Website defacements, while still a common occurrence, have mostly given way to the use of data leaks, ransomware, and cyber espionage. The capabilities of many nation-state actors have also greatly increased since the early 2010s. The Middle East in particular saw the rise of formidable military and intelligence hacking units such as those utilized by Iran and Israel. The use of cyber armies has also become a key asset for any nation seeking a level of regional or global power. The same is true of Turkey; around 2016, Turkey began to seriously improve their cyber capabilities, specifically those that came under the control of the state. In previous years, Turkey had been the target of a series of increasingly advanced cyber attacks from hacktivist groups such as Anonymous and various Kurdish hacking groups, as well as from Russian hackers as tensions between the two countries became more pronounced. Turkey consequently prioritized the improvement of its cyber defenses, by beginning an initiative to hire Turkish hackers to start testing the defenses of Turkish IT infrastructure.

While this initiative would increase Turkey’s cybersecurity, it would also improve the offensive cyber capabilities that could be leveraged by the state (3). This would allow Turkey to join a small but growing number of countries with cyber specific units at their disposal. Most importantly, it would be one of the few nations with influence in the Middle East to have such capabilities. This followed not long after Recep Tayyip Erdogan came to power as President of Turkey in 2014. Erdogan has since become known for his nationalist politics and desire to return Turkey to a position of regional power, similar to that of the times of the Ottoman Empire. 

With cyber warfare beginning to advance in the Middle East, nationalist hacktivists would become the least of the Kurds’ worries. Newly-formed military hacking units were popping up throughout the various countries in which the Kurdish population resides – primarily Iran and Turkey, both of which have vested interests in monitoring the online activities of the Kurdish population. This advancement in nation-state capabilities would mark a paradigm shift in the hacking wars of Kurdistan. 

Since the early formation of Turkey’s cyber units, the country has proven to have a widespread impact globally in cyberspace. State-backed hackers have carried out widespread operations against countries perceived to be the historical enemies of Turkey, including Greece, Armenia, Cyprus, Iraq, and Syria, along with the Kurdish population spread throughout the region (4). Iran likewise has carried out similar attacks and both countries have become known for frequently targeting journalists, human rights activists, and other critics of their respective regimes with spyware and other cyber espionage tactics to monitor their activity and suppress dissent. This activity has even extended to the United States and its western allies, who may represent a rather obvious target for the Iranian government but are at the very least supposed to be military allies to Turkey due to their membership in NATO. Despite cyber-attacks against allied countries being somewhat common, especially within what political scientist Waltz coined as 'the third image of international relations reversed', this decision from Turkey's state hackers showcases a relative degree of unpredictability. Turkey’s cyber army became so prolific that Microsoft added them to their list of the most prevalent nation-state hackers along with Russia, China, North Korea, Iran, and Vietnam (4).

Many cyber-attacks targeted against the Kurds have been espionage operations. Notable examples include the distribution of a mobile app targeting Kurdish Android users that – on the surface – appeared to provide news updates. In reality, once downloaded, the malicious app introduced spyware that allowed the attackers to record phone calls, extract files, and take screenshots in order to gather information on the user (5). Although this particular operation has not been officially attributed to a particular actor, the same tactics were used to spy on regional terrorist organizations such as al-Qaeda and the Islamic State, as well as Kurdish and Turkish organizations (6). From an analytical perspective, it hence becomes a fair deduction to suggest that the operation was an Iranian-state backed campaign. Iran is well known for their cyber espionage operations and has carried out similar attacks against critics of the regime. Similar tactics are used frequently to target the Kurdish people, with Kurdish militant and political groups being a common target for the Turkish government in particular.

Unfortunately for the Kurdish side in this cyber war, the advancement in capabilities by nation-states in the region left a wide intelligence gap between Kurdish militant groups, political activists, and hackers and their opponents. Kurdish hacktivists have increasingly been able to carry out data leak and ransomware operations against their political enemies, but the impact of such attacks have not had the disruptive impact to their targets that well-coordinated cyber espionage operations have had against the Kurdish movement.

The Kurds have seen the support of other hacktivist networks and individuals from around the world rally to their cause. The Anonymous Hacker Collective, for instance, hacked Swedish government websites after Sweden extradited a Kurdish politician to Turkey, in a bid to appease the country to approve their entry into the NATO alliance (7). Another hacker stole thousands of dollars in cryptocurrency in a cyber-attack that they then donated to the revolutionary movement in Rojava. This indicates that the Kurdish liberation struggle may have garnered the support of certain segments of the global hacking community. Unfortunately for the Kurds, their cyber forces will likely continue to struggle head-to-head against their Turkish and Iranian adversaries, so long as they lack the resources that can be mobilized by state-sponsored hacking units.