Cybercrime

The Turkish Penal Code regulates acts committed through, or directed against, information systems under the heading "Offenses in the Field of Information Technology." Three main types of offenses fall within this category:

• Unlawfully accessing or remaining within an information system (Article 243)
• Obstructing or disrupting the operation of an information system, or corrupting, destroying, altering, or rendering inaccessible the data within it, inserting data into the system, or transmitting existing data elsewhere (Article 244)
• Misuse of bank or credit cards (Article 245)

In addition, offenses such as fraud, theft, or the unlawful acquisition of personal data may be treated as an aggravated form of the relevant offense when committed through information systems. Which provision applies depends on the manner and purpose of the act in question.

An IP (Internet Protocol) address is a number assigned to every device connected to the internet, identifying that device's communication over the network. In investigations concerning cybercrimes, IP address records can constitute an important source of evidence in determining the connection through which an act was carried out.

However, identifying that a particular IP address belongs to a specific person does not, by itself, conclusively prove that the person committed the act; possibilities such as shared networks, VPN use, or unauthorized access must also be considered during the investigation. Proper collection and evaluation of technical evidence is therefore important for the soundness of the process.

Under Article 243 of the Penal Code, a person who unlawfully accesses the whole or part of an information system, or who remains within it, may be punished with imprisonment of up to one year or a judicial fine. For this offense to arise, the access must be unlawful, meaning it occurred without the consent of the system's owner or authorized administrator.

Where the act results in the destruction or alteration of the data contained in the system, the law provides for a heavier penalty, ranging from six months to two years of imprisonment. Whether the system constitutes a publicly accessible service available for a fee is also a factor taken into account when determining the penalty.

Under Article 244, a person who obstructs or disrupts the operation of an information system may be punished with imprisonment from one to five years. A person who corrupts, destroys, alters, or renders inaccessible the data within a system, inserts data into the system, or transmits existing data elsewhere, may be punished with imprisonment from six months to three years.

Whether these acts were committed against an information system belonging to a bank, credit institution or public institution is also taken into account when determining the penalty. Where the act results in harm to the person or another, or where an unjust benefit is obtained, additional criminal liability may arise upon the victim's complaint.

Under Article 245, a person who, by whatever means, obtains or holds a bank or credit card belonging to another, and uses it or causes it to be used without the consent of the cardholder or the person to whom the card was to be delivered, thereby obtaining a benefit for themselves or another, is subject to a specific term of imprisonment together with a judicial fine.

This offense is frequently encountered in the context of internet banking, fraudulent e-commerce sites, and phishing techniques. Victims are advised to monitor their bank account activity and promptly report any suspicious transactions to their bank and the public prosecutor's office, as this can help the process move forward efficiently. In an investigation or prosecution concerning cybercrimes, consulting an İzmir criminal lawyer for evidence gathering and legal assessment may be beneficial.

Av. Mehmet Yücesoy

İzmir Attorney & Legal Consultancy