Crime of blocking, disrupting the system, destroying or altering data

The crime of blocking, disrupting the information system, destroying or changing data is regulated in Article 244 of the Turkish Penal Code under the title "Information Crimes". Two separate crimes are regulated in the article, the first in the first paragraph and the second in the 2nd paragraph. In the 3rd and 4th paragraphs of the article, the qualified forms of the crimes regulated in the first two paragraphs are included. It is aimed to ensure that crime information systems continue to operate correctly and in accordance with their function. In the justification of the article, it is stated that acts of abuse directed at systems have become a special crime.

WHAT IS AN INFORMATION SYSTEM?

The legal subject of the crime of hacking into the information system is the information system. The justification of Article 243 of the Turkish Penal Code defines the information system as "The purpose of the information system is magnetic systems that allow collecting and placing data and then subjecting them to automatic transactions." However, informatics is a broader concept that covers both the processing and transmission of data. In this respect, the concept in the justification of the law has been criticized.

Based on the definition in TDK, it is possible to define an information system as a system that automatically performs functions such as storing, organizing, evaluating, transmitting and reproducing data.

ELEMENTS OF THE CRIME OF BLOCKING, DISRUPTING THE SYSTEM, DESTROYING OR ALTERING DATA

Legal Subject of the Crime

The legal subject of the crime is generally the information system. However, in the justification of the article, the legislator considered the computer and other hardware elements included in the system as the legal subject of the crime.

Computer; It is defined as a device that can process all kinds of electronic optical, electrochemical data or high-speed information, has arithmetic processing or storage functions, and has the possibility of storing any information or directly transmitting or combining this information to the relevant places.

Any device that has the features listed in the definition of computer above constitutes the legal subject of the crime.

244/2. The subject of the crime regulated in the article is data. Data refers to the way information is transformed into a certain format.

Verb

In the first paragraph of the article, the acts of obstructing or disrupting are regulated as optional actions. The occurrence of one of the acts is sufficient to constitute the crime. Breaking a computer cannot be considered as disrupting or hindering the information system. In such cases, the crime of damaging property is mentioned. Disrupting or blocking within the meaning of TCK 244 refers to interventions made in the information system. For example, corrupting the computer by installing a program on it constitutes the crime of disrupting the information system. In addition, it is possible to commit other crimes by disrupting the information system. In such cases, the perpetrator is punished separately for his other actions. As a matter of fact, the Supreme Court ruled in one of its decisions that "in the face of understanding that the defendants stored the existing data after entering the information system of the participating institution and gained unfair advantage by selling these data, their actions constitute the crimes of disrupting the functioning of the information systems and illegally seizing personal data regulated in Articles 244/3-4 and 136/1 of the Turkish Penal Code."

Blocking or disrupting can be accomplished in various ways. Blocking the information system means temporarily interrupting the operation of the information system. For example, the central processing unit of the system may be affected and blocked by intense electromagnetic waves directed at the functioning system. In this case, both the intervention in the system and the temporary disabling of the operating system are considered obstruction crimes.

Disrupting the information system means permanently preventing the use of the system. Intervention that disrupts the system may be physical or system-related. An IT system can be corrupted by using another IT system. As a matter of fact, the Supreme Court of Appeals stated in one of its decisions, "According to the occurrence and the scope of the file; after the friendship relationship between the victim and the victim, who was his girlfriend, ended, the defendant's actions, which were proven by changing the internet password of the victim's Facebook account, which he already knew, without her knowledge and consent, publishing the sexually explicit images he recorded with the victim's knowledge during the time they were together, on the victim's Facebook account, which he logged into even though he did not have the right to do so, and blocking the victim's access to his Facebook account, could mean blocking, disrupting the system in Article 244/2 of the TCK." "There was no error in the local court's acceptance that destroying or altering data constitutes the crime of violating the privacy of private life in Article 134/2 and paragraph 134 of the same Law." He ruled as follows.

Again, the Supreme Court said, "The defendant who unlawfully enters the e-mail address of the participant and uses the e-mail address by creating a new password and blocking the participant's access should be punished for the crime of blocking, disrupting the system, destroying or changing the data." There is also a decision as follows.

If the intervention to the system prevents or corrupts the operating system, the perpetrator is subject to Article 244/1 of the Turkish Penal Code. He is punished according to article. However, if the perpetrator intervened in the data in the system, but this intervention did not prevent or disrupt the functioning of the system, this time TCK 244/2. The article will be brought to the agenda.

TCK 244/2; "Any person who corrupts, destroys, changes or makes inaccessible data in an information system, places data in the system, or sends existing data to another place is punished with imprisonment from six months to three years." It is shaped like. In this paragraph, optional actions such as breaking and changing are foreseen. The difference between the two paragraphs is that the 1st paragraph specifies the crimes committed on the system, while the 2nd paragraph regulates the crime committed on the data.

In a decision of the 8th CD of the Supreme Court dated 2017, it was stated that "The defendants created fake websites in the names of Akbank and Finansbank A.Ş. and opened fake site pages and sent fake e-mails to the customers of the participating banks, giving misleading information about the fake web pages and asking them to enter their personal information and passwords under the name of update VS. The verdict was established as follows: "The actions of the dragged child, consisting of storing his e-mail accounts, constitute crimes within the scope of Articles 244/2 and 136 of the Turkish Penal Code."

Perpetrator and Victim of the Crime

No specific characteristics were sought regarding the perpetrator and victim of the crime. Anyone can be the perpetrator or victim of a crime.

QUALIFIED FORM OF THE CRIME OF BLOCKING, DISRUPTING THE SYSTEM, DESTROYING OR ALTERING DATA

TCK 244/3. "If these acts are committed on the information system of a bank or credit institution or a public institution or organization, the penalty to be imposed is increased by half." There is a provision in the form.

In Article 244/4, it is regulated that a person will be sentenced to imprisonment from two to six years and a judicial fine of up to five thousand days, if obtaining an unfair advantage for himself or someone else does not constitute another crime.

PUNISHMENT FOR BLOCKING, DISRUPTING THE SYSTEM, DESTROYING OR ALTERING DATA

TCK 244

1- Any person who prevents or disrupts the functioning of an information system is punished with imprisonment from one to five years.

2- Any person who corrupts, destroys, changes or makes inaccessible data in an information system, places data in the system, or sends existing data to another place is punished with imprisonment from six months to three years.

3- If these acts are committed on the information system of a bank or credit institution or a public institution or organization, the penalty to be imposed is increased by half.

4- If the person gains an unfair advantage for himself or someone else by committing the acts defined in the above paragraphs and does not constitute another crime, he is sentenced to imprisonment from two to six years and a judicial fine of up to five thousand days.

COMPLAINT AND PROSECUTION FOR THE CRIME OF BLOCKING, DISRUPTING THE SYSTEM, DESTROYING OR ALTERING DATA

The crimes listed in Article 244 of the Turkish Penal Code are among the crimes prosecuted ex officio. It is possible for people who have been harmed by the crime to participate in the prosecution of these crimes, which are prosecuted ex officio. Victims or natural or legal persons who have been harmed by a crime can participate in a public lawsuit.

Criminal Courts of First Instance are responsible for the trial of the crime.

HOW CAN CYBER CRIMES BE DETECTED?

According to the decision of the 8th Criminal Chamber of the Supreme Court of Appeals No. 2015/2322;

For the detection of cyber crimes, help is often received from Microsoft Corporation. In this regard, first of all, it is determined whether the accessed information system belongs to the complainant, the IP addresses of the users are determined according to the nature of the cyber crime committed, and their computer hard disks are seized and examined. Cyber ​​crimes are crimes that are automatically investigated by the prosecutor's office, and therefore, the investigation of cyber crimes is not subject to complaint. In addition, the victim's declaration of withdrawal from the complaint does not cause the criminal case to be dismissed and is not considered as a crime within the scope of reconciliation.

Upon the complaint of the e-mail address user that his/her access has been blocked, it must first be determined whether the address whose access is blocked and the e-mail address claimed to belong to the defendant belongs to the defendant and the complainant, and this issue must be asked from the relevant internet provider, the date of creation of the addresses, who created them and the IP (Internet Protocol) number. Microsft Corporation should also investigate whether the complainant logged into the e-mail address on the date(s) on which access was allegedly blocked and in the following days, if access was provided, the IP information, whether the password of the e-mail address was changed as of these dates, and if so, when and with which IP number. From the IP address registration information, the address and telephone information of the users of the IP numbers who log in to the system or have failed should be requested from the relevant Telecom Directorates. Similarly, the IP numbers using the e-mail address claimed to belong to the defendant should be identified and their address and telephone information should also be requested.