The Need-to-Know Principle and Personal Data Security: The TÜGVA Scandal

As is well known, we live in the age of digitalisation and shape our lives to a significant extent according to it. Or, put another way, we are obliged to behave this way. In this context we encounter very important and varied concepts: data security, personal data, network, cybersecurity, cyber attack, the physical and hardware security of the digital environment, and the need-to-know principle are examples. In this article we will discuss data security and the need-to-know principle by examining the example of TÜGVA (the Türkiye Youth Foundation).

The need-to-know principle means that the data or information about any subject or event is held only by authorised persons, and likewise that this information is shared only with authorised institutions or persons within the legal framework. To explain with an example: within any ministry there are units such as directorates and departments with different functions and duties. All these units hold only data related to their own areas of responsibility, and they share, or may share, data with other units within the legal framework only when needed. In such sharing, no data beyond the requesting unit’s need, outside its request, may be shared. This is how things should be done. Otherwise ensuring the security of data would be difficult, even impossible.

The need-to-know principle cannot be separated from data security and data integrity. In the field of cybersecurity, for data to be accepted as secure and reliable, it must meet three basic conditions: confidentiality, integrity and availability. As can be understood from these definitions and explanations, the need-to-know principle and data security are very important concepts and closely concern not only official institutions but also people’s private lives. Breaches of data security are vitally important enough to turn people’s lives upside down.

When the leaked documents about TÜGVA are examined from the standpoint of these technical issues, the existence of a very serious and grave situation is clearly visible. In particular, the presence of data from the General Directorate of Population and Citizenship Affairs in the ERP system used within TÜGVA is an outright scandal, and the incident must be investigated swiftly and those found negligent, at fault or in error must be brought before the courts.

On the other hand, for now only the information that TÜGVA held citizens’ identity and residence information has come to light. The question of what other information the foundation has obtained, or is obtaining, from which other institutions could take the incident to an even more critical point.

The ERP system that came onto the media agenda with the TÜGVA incident is the abbreviated form, used in the market, of Enterprise Resource Planning. It is a type of software institutions use to manage daily business activities, bringing together many business processes and enabling data flow between them. In this way, the different departments within an institution can be harmonised, business processes improved and significant savings achieved. Because the ERP system creates a common database, it both eliminates data duplication and ensures data accuracy. In short, ERP helps integrate the employees, processes and technologies in an institution, so that data can be current, accurate and complete.

Naturally, an ERP system is institutional and belongs to institutions. It should contain only data belonging to the institution and the processes it manages. The presence of data belonging to another official institution within a foundation’s own ERP system is therefore not normal. This incident can be assessed from two angles: first, the breach of data confidentiality concerning the General Directorate of Population and Citizenship Affairs, and second, the risk to data security concerning TÜGVA. Both are serious problems. An official state institution (the General Directorate of Population and Citizenship Affairs) shared citizens’ personal data with a foundation, violating the need-to-know principle, above all the principle of data confidentiality.

On the other hand, it has also emerged that the capacity and capability of a private foundation to protect the critical personal data of all citizens that it included in its own system are unknown, and that it is open to cyber attacks. This too undoubtedly reveals a very troubling situation in terms of risk assessment.

Weakened institutional identities and the presence of unqualified bureaucrats, as seen in the TÜGVA and General Directorate of Population and Citizenship Affairs examples, form the basis of the scandals that have happened and may happen. We can say that the main cause of the problem is the violation of the “need-to-know principle”. So has this principle been violated for the first time, and only at TÜGVA? Of course not!

We can also cite here what happened in the recruitment of cadets to the War Academies and NCO Vocational Schools as another example on the subject. We learned from information reported in the press recently that retired officers, NCOs and public servants were among those appointed as members of interview commissions. This practice continued for three years. The justification given for appointing people from outside the institutional hierarchy was the lack of trained personnel after 15 July. Somehow a coup attempt that, despite so many trials, has not been clarified to the public’s satisfaction has been skilfully used as justification for all kinds of lawlessness and issues that are hard to explain.

In this particular case, first of all, commissions set up to select candidates for a profession should include experts versed in the subtleties of the profession and with experience. It is not enough for these experts merely to be from the same profession. They must also currently be on active duty as practitioners of that profession, so that a realistic, sensible and appropriate selection can be made, taking current needs into account.

It is clear that the retired military personnel and other public servants appointed to the commissions caused weaknesses in applying the need-to-know principle that is the subject of this article. Indeed, they led to unauthorised access to the data of the applicants concerned. This put data security at risk. The need-to-know principle was practically ignored, and the personal data of candidates of institutions that train personnel for the TSK were opened to access by unauthorised persons. Not to mention the inhumane and immoral situations such as favouritism and candidate rigging in these selection commissions.