Türk Ceza Muhakemesi Hukukuna Eklenmesi Gereken Depolanmış Verilerin Korunmasına İlişkin Koruma Tedbirleri

This study examines the protective measures contained in the Council of Europe Convention on Cybercrime — ratified by Türkiye in 2014 — which have no counterpart in Turkish criminal procedure law. Because of the international nature of cybercrime and the ease with which evidence can be lost, the author argues that the transposition of the modern investigative powers envisaged by the Convention into domestic law is a necessity. It is emphasised that under Article 90 of the Constitution, international conventions concerning fundamental rights and freedoms rank above statutes, and that these measures must therefore be applied in Türkiye.

The principal measures examined and proposed for insertion into the Code of Criminal Procedure are the following:

1. Expedited Preservation of Stored Computer Data (Convention, Article 16)

This measure aims to preserve the integrity of specified computer data that are the subject of a criminal investigation and at risk of loss or alteration, until the formal steps for obtaining them as evidence (a mutual-assistance request, for example) are completed. By this operation, also known as "quick freeze", a competent authority instructs a person — a service provider, say — not to delete or alter the data in its possession and to preserve them for a period of up to ninety days. The author notes that Turkish law contains no direct counterpart, and that the general data-retention obligation in Law No. 5651 does not answer the specific, instantaneous preservation the Convention requires.

2. Expedited Preservation and Partial Disclosure of Traffic Data (Convention, Article 17)

This measure is directed at establishing the path a communication has followed and the service providers along that path. A service provider is instructed both to place the relevant traffic data under preservation and to "partially disclose" information sufficient to reveal through which providers the communication passed. The competent authorities can thus reach the next link in the communication chain and deepen the investigation. The author states that this special measure of preservation and partial disclosure is likewise unregulated in Turkish law.

3. Remote Access to Stored Computer Data (Convention, Articles 19 and 32)

The Convention envisages a legal infrastructure enabling a state to search, by remote access from a computer system within its own borders, another system also within its borders (Article 19). The author notes that the Code of Criminal Procedure does not permit search by remote access, and that the regulation provision to that effect is contrary to statute.

More important still, Article 32 of the Convention permits "trans-border access" in certain cases: the competent authorities of one state may, without the assistance of another country, access data in a computer system located in that country in two situations — where the data are publicly available (open source); or where the lawful and voluntary consent of the person with authority to disclose the data has been obtained.

Conclusion and Recommendations

The author emphasises that although Türkiye is party to the Convention, it has fallen short in transposing these critical measures into domestic law. To remedy the deficiency, new articles should be added to the Code expressly regulating: the expedited preservation of stored data (quick freeze); the preservation and partial disclosure of traffic data; and search and seizure by remote access, domestic and — on the conditions of Article 32 of the Convention — trans-border. The author underlines that these arrangements must be equipped with safeguards protecting fundamental rights and freedoms: a judge's order, proportionality, a mechanism of objection, and the like.