Computer Crimes in Turkish Criminal Code No. 5237 and the Amendments Made by Law No. 5377

Computer Crimes in Turkish Criminal Code No. 5237 and the Amendments Made by Law No. 5377

Murat Volkan Dülger

I. The Concept of Computer Crime and the TCK in General

A. The Concept and Definition of Computer Crime

Before turning to the types of computer crime contained in the TCK, it will be useful, for a better understanding of the subject, to set out the concepts used in this field and to define the concept of computer crime.

1. The Concept

Since computer crimes first emerged in the United States of America, where the computer was also developed, this new type of offence was also named by the lawyers of that country. In American legal scholarship and practice, these types of offence are generally referred to as “computer crime”¹.

To name these types of offence, the concepts “computermissbrauch” in German law, “la criminalitá informatica” in Italian law and “Des atteintes aux systémes de traite automatisé de données” in French law have been adopted.

In Turkey, by contrast, many concepts have been used in this respect, such as “cyber crime, virtual crime, internet crime, computer crime, computer criminal law, computer-related crime, crime committed by means of an information system, crime committed in the field of information technology”.

It should be stated that the use of the concept of “computer crime” to denote these types of offence is appropriate, because it is general and comprehensive in nature, because it avoids the criticisms levelled at the other concepts², and because legal scholarship has reached a consensus on this concept in particular.

Attorney at law; doctoral student, Department of Public Law, Institute of Social Sciences, Istanbul University.

2. Definition

A definition of computer crimes is found neither in national legal provisions nor in international legal instruments. In these instruments, the preferred approach has been to include the acts characterised as computer crime as types of offence, without giving any definition³.

In legal scholarship, by contrast, many definitions of the concept of computer crime have been put forward, but no consensus has been reached on any one definition. It has been stated that there are six criteria for defining computer crimes and that a definition containing them is a valid and sufficient definition; however, the definition based on these criteria has not led to a conciliatory and sufficient result either. Consequently, rather than formulating a definition, what has become important is which types of offence are regulated under this concept⁴.

Despite the difficulty of formulating a general and comprehensive definition of computer crimes and the reservations in this respect, computer crime may be defined as “offences committed by means of information systems against data and/or against systems connected with data processing”⁵.

B. Comparison of the Computer Crimes Regulated in TCK No. 765 and TCK No. 5237

In TCK No. 5237, computer crimes are found under the following numbers and headings:

In the ninth chapter of the part on “offences against persons”, under the heading “offences against private life and the secret sphere of life”: Art. 132 “offence of violating the confidentiality of communication”, Art. 135 “offence of recording personal data”, Art. 136 “offence of unlawfully giving or obtaining personal data”, Art.138 “offence of failing to destroy data”.

In the tenth chapter of the part on “offences against society”, under the heading “offences in the field of information technology”: Art.243 “offence of unlawfully accessing and remaining in an information system”, Art.244/1-2 “offence of hindering or disrupting the functioning of an information system and of destroying or altering data”, Art.244/4 “offence of obtaining an unlawful benefit by means of an information system”, Art.245 “offence of misuse of bank or credit cards”.

In addition, the YTCK contains types of offence that cannot be characterised solely as computer crimes but which may be committed by means of information systems as well as in other ways⁶. The following types of offence may be given as examples:

In the ninth chapter of the part on “offences against persons”, under the heading “offences against private life and the secret sphere of life”, Art.132 “offence of violating the confidentiality of communication”; in the seventh chapter of the part on “offences against persons”, the chapter on “offences against liberty”, Art.124 “offence of hindering communication”; in the eighth chapter, the chapter on “offences against honour”, Art.125 “offence of insult”; in the chapter on offences against property, Art.142 para.2 sub-para. ‘e’ “offence of aggravated theft” and Art.158 para.1 sub-para. ‘f’ “offence of aggravated fraud”; and in the seventh chapter of the part on “offences against society”, the chapter on “offences against public morality”, Art.226 “offence of obscenity” and Art.228 “offence of providing a place and opportunity for gambling”.

An article-by-article comparison of TCK No. 765 and TCK No. 5237 with regard to computer crimes is as follows:

TCK Art.525 a/1 Draft TCK Art.135, Art.136

TCK Art.525 b/1 Draft TCK Art.244/1-2

TCK Art.525 b/2 Draft TCK Art.244/4, 245, 158 para.1 sub-para.‘f’, Art.142 para.2 sub-para. ‘e’⁷.

In the regulation introduced by TCK No. 5237 with regard to computer crimes, the systematic structure, which had attracted the most intense criticism of TCK No. 765 in respect of computer crimes, has been changed; computer crimes have been regulated with regard to the legal interest protected by the offence, and the types of offence have been distinguished according to the nature of the legal interest they protect⁸.

According to the picture emerging from this comparison, although the provision on the “offence of unlawfully accessing and remaining in an information system” in Article 243 of TCK No. 5237 had no counterpart at all in TCK No. 765, it has been introduced as a new type of offence by TCK No. 5237⁹. Thus, as an important innovation, accessing and remaining in an information system has been made an offence without requiring that data be obtained¹⁰. Likewise, the “offence of failing to destroy data” in Article 138 of TCK No. 5237 has also been made an offence for the first time by this new law.

Certain other types of offence, which in TCK No. 765 were one of the acts contained in the definition of offences with alternative acts, have been regulated by TCK No. 5237 as new, independent types of offence. Accordingly, the “offence of recording personal data” regulated in Article 135, the “offence of unlawfully giving or obtaining personal data” regulated in Article 136, the “offence of misuse of bank or credit cards” regulated in Article 245, the “offence of aggravated theft” regulated in Article 142 para.2 sub-para. ‘e’ and the “offence of aggravated fraud” regulated in Article 158 para.1 sub-para. ‘f’ of TCK No. 5237 have, unlike in TCK No. 765, been regulated as independent types of offence.

The type of offence regulated in Article 525 a/2 of TCK No. 765, on the other hand, has not been included in TCK No. 5237, taking into account the criticism in legal scholarship that this type of offence was superfluous, particularly in the light of the amendments made to the FSEK by Law No. 4110, and that it had never been applied in practice¹¹.

Another appropriate change introduced by TCK No. 5237 with regard to the regulation of computer crimes is the use of the concept of “information system” in place of the expression “system that subjects information to automatic processing”, which had been criticised in legal scholarship. In this way, the confusion caused by the concept of “system that subjects information to automatic processing” can be avoided¹². Despite this positive provision in the text of the law, however, it was not appropriate that the explanatory memorandum to Article 243 defined an information system as “magnetic systems which, after collecting and storing data, make it possible to subject them to automatic operations”. The most correct approach would have been for the legislature not to define the information system and to leave this to legal scholarship; if a definition was nevertheless desired, one of the definitions found in legal scholarship, which are both more comprehensive and more accurate, should have been preferred to this definition, which is by now outdated and erroneous.

Another new and positive provision introduced by TCK No. 5237 regarding concepts is that the concept of “any other element” has been removed from the articles and only the concept of “data” is used, and that data is accepted as the material object of the offence on which all the offences are committed¹³.

II. Computer Crimes Regulated in TCK No. 5237

A. Types of Offence Regulated in the Chapter on Offences in the Field of Information Technology

1. Offence of Unlawfully Accessing and Remaining in an Information System (Art.243)

In the YTCK, this type of offence is regulated under the heading “accessing an information system” in the first article of the tenth chapter, entitled “offences in the field of information technology”, of the third part, entitled “offences against society”, of the second book, in which computer crimes are regulated under a separate heading. By this article, the legislature has made an offence the act of “unlawfully accessing the whole or a part of an information system and continuing to remain there”.

The type of offence in this article ensures conformity with the provision on “illegal access” laid down in Article 2 of the European Convention on Cybercrime¹⁴.

The most important criticism levelled in legal scholarship at the way the offence of obtaining data was regulated in Article 525 a/1 of TCK No. 765 was that, for this offence to be committed, the data in the information system had to be obtained by the perpetrator, whereas the acts of breaching the security of an information system, unlawfully accessing the system and remaining there, which constitute one of the most frequently encountered types of violation in cyberspace, went unpunished because of the way the provision was framed. It is precisely by this provision that, taking these criticisms from legal scholarship into account, Article 243 of TCK No. 5237 has made acts of unauthorised access to data an offence even where the data is not obtained¹⁵.

Article 243 of TCK No. 5237 removes the requirement of “obtaining data” for the punishment of access to information systems and makes it an offence to unlawfully access and remain in an information system, that is, to violate the security of an information system, whether or not data is obtained¹⁶. Bearing in mind that the unlawful obtaining of data is regulated as a separate type of offence by Article 136 of TCK No. 5237, it can be seen that the offence of unlawfully accessing and remaining in an information system is in fact a type of offence introduced for the first time by this new law. It should be noted at once that this provision, which may prove effective especially against hackers, is an extremely appropriate and modern provision¹⁷.

In comparative law, the offence of unlawfully accessing and remaining in an information system is found in the law of many countries, and this type of offence is generally regulated together with the offence of obtaining data. Examples include: French CC. Art.323-1, German CC. Art.202a, Danish CC. Art.193 and 263, Norwegian CC. Art.145/2, Italian CC. Art.616/2, 617quarter, 617 quinquies, 618, Luxembourg CC. Art.309, Irish Criminal Damage Act Art.5/1, and Dutch CC. Art.98, 98a, 98b, 98c and 273¹⁸.

The legal interest protected by the offence of unlawfully accessing and remaining in an information system is the security of the information system. By preventing unlawful access to an information system, numerous and diverse interests of persons who benefit from the system in some way, such as its owner or user, are protected. These interests of such persons may be different legal interests, such as the protection of the confidentiality of data, the inviolability of private life, or the sense of security needed by persons or institutions. Above all of these, however, and encompassing them, the legal interest is the security of the information system¹⁹.

Some authors in legal scholarship, by contrast, state that the legal interest protected by this offence is not the security of the information system, but do not specify what the protected legal interest is. Instead, they examine whether the offence is one with alternative acts or one with cumulative acts, which ought to be explained under the material object of the offence, and state that this offence is committed where unauthorised access and continuing to remain in the system occur together²⁰. As we have stated above, this explanation concerns the material element of the offence. Whether the type of offence is regarded as one with alternative acts or one with cumulative acts, the result does not change: the legal interest protected by this offence is the security of the information system.

The act component of the material element of this offence consists of accessing an information system, by whatever means, and continuing to remain in the information system. As can be seen, this type of offence has been framed as one with cumulative acts; therefore the perpetrator must first unlawfully access the information system and must then unlawfully continue to remain in the information system²¹;²².

2. Offence of Hindering or Disrupting the Functioning of an Information System and of Destroying or Altering Data (Art.244/1-2)

Paragraphs 1 and 2 of Article 244 of TCK No. 5237 regulate acts causing damage to an information system and to data by whatever method. Of these, the first paragraph makes an offence the acts of “hindering the functioning of an information system and disrupting the system”, and the second paragraph the acts of “corrupting, destroying, altering or rendering inaccessible the data in an information system, inserting data into the system and sending data elsewhere”.

It should be noted that this type of offence seeks to ensure conformity with the provisions on “data interference” laid down in Article 4 and “system interference” laid down in Article 5 of the European Convention on Cybercrime²³.

In TCK No. 5237, these types of offence take the place of the “offence of causing damage to data or data processing” regulated in Article 525 b/1 of TCK No. 765.

Information systems have become indispensable tools in many vital fields that form the main subjects of today’s modern way of life, such as the economy, health, education, scientific research, administration and defence, and in many parts of these fields they have irreversibly taken the place of human beings. For this reason, damage to these systems themselves or to the data they contain as a result of attacks on information systems and their data, or the inability of these systems to function, even temporarily, may cause very great harm. In particular, very skilfully produced malicious software such as computer viruses, worms and Trojan horses can spread across information networks at a geometric rate and cause more damage than even the perpetrators who prepared them and released them into cyberspace in order to damage data had foreseen. Foreseeing this great danger, the legislature has made acts causing damage to data or to data processing an offence by this article.

This provision seeks to punish the hindering of the functioning of an information system, in whatever manner, or the disruption of the system. The explanatory memorandum to the article also states that this article makes acts of damage directed against information systems a separate offence. Furthermore, the explanatory memorandum to the article, by stating that under the provision “the physical existence of the device and all other elements that enable it to function constitute the object of the offence in question”, expresses that all tangible and intangible elements of the information system will form the object of this offence. By the words “a special act of damage”, the explanatory memorandum refers to acts aimed at hindering the functioning of the information system. In an appropriate approach, and unlike the provision in TCK No. 765, the provision does not use the term “causing damage”; acts directed at the hardware of the information system with the intent of damaging property are thus kept outside the scope of this article²⁴. It can be seen that this provision has taken into account the debates that arose in legal scholarship on this issue.

Like the offence of unlawfully accessing or remaining in an information system, the offence of hindering or disrupting the functioning of an information system and of destroying or altering data is regulated in the law of almost every country. Examples include: French CC. Art.323-2, German CC. Art.303a, Austrian CC. Art.126/a1, Finnish CC. Chapter 35 Art.1/2, Australian CC. Art.76C, Danish CC. Art.279a, Norwegian CC. Art.151b, and Irish Criminal Damage Act Art.2/1 and 2/a²⁵.

3. Offence of Obtaining an Unlawful Benefit by Means of an Information System (Art.244/4)

Paragraph 4 of Article 244 of TCK No. 5237 regulates the “offence of obtaining an unlawful benefit by means of an information system”. This type of offence is framed in that paragraph by reference to the acts in paragraphs 1 and 2; when the paragraphs are read together, the type of offence in paragraph 4 of Article 244 reads as follows: “where an unjust benefit is obtained for oneself or for another by hindering or disrupting the functioning of an information system, corrupting the data contained in the system, inserting data into the system, sending existing data elsewhere, rendering it inaccessible, altering it or destroying it, and provided that this does not constitute another offence, ... a penalty of ... shall be imposed”.

In TCK No. 765, this type of offence was regulated very broadly in Article 525 b/2; this was criticised in legal scholarship and gave rise to various difficulties in practice. When computer crimes were regulated in TCK No. 5237, these criticisms from legal scholarship were taken into account, and the type of offence in the TCK was divided into four parts, as it should have been. Accordingly, the acts contained in Article 525 b/2 of TCK No. 765, namely obtaining an unlawful benefit by means of information systems, misusing bank and credit cards, fraud by means of an information system and theft by means of information systems, have been regulated as different types of offence. The type of offence under examination regulates only acts of “obtaining an unlawful benefit by means of an information system”, and the manner in which these are to be carried out is expressly stated in the type of offence.

Moreover, by using the expression “provided that this does not constitute another offence” in paragraph 4, where the type of offence is regulated, it is stated that this type of offence will not apply where an unlawful benefit is obtained by carrying out the same acts but this is regulated in another type of offence. What is to be understood by this provision, which is hardly appropriate in terms of legislative technique, is set out in the explanatory memorandum to the law: “in order for a penalty to be imposed on the basis of this paragraph, the act must not constitute another offence requiring a heavier penalty. In this respect, where the act constitutes the offence of fraud, theft, breach of trust or embezzlement, no penalty shall be imposed on the basis of this paragraph”.

4. Offence of Misuse of Bank or Credit Cards (Art.245)

One of the important and positive changes introduced by TCK No. 5237 with regard to computer crimes is that acts of “misuse of bank or credit cards” are regulated as a type of offence in a separate article, Article 245 of the law.

Various views have been put forward on whether the “offence of obtaining an unlawful benefit by means of an information system” regulated in Article 525 b/2 of TCK No. 765 also covered acts of obtaining an unlawful benefit through the use of bank cards or credit cards. Until a decision rendered by the General Criminal Assembly of the Court of Cassation on this matter²⁶, differing approaches also emerged in practice. TCK No. 5237 sought to put an end to these debates by regulating these acts expressly in a separate article; it has also been stated in legal scholarship that this provision was made in order to transpose the said decision of the General Criminal Assembly of the Court of Cassation into the law²⁷.

Particularly after the above-mentioned decision of the General Criminal Assembly of the Court of Cassation, the acts in question were assessed, both in legal scholarship and in practice, as falling within the scope of the “offence of obtaining an unlawful benefit by means of an information system” in Article 525 b/2 of TCK No. 765; this time, however, various distinctions were drawn according to the manner in which the card, as the instrument of the offence, had been obtained and used, and it was debated whether the acts in question constituted the classic offence of fraud or the offence of obtaining an unlawful benefit by means of an information system.

It is precisely by this provision that it was sought to put an end to these debates and distinctions as well²⁸, and the explanatory memorandum to the article also states that all kinds of acts of obtaining an unlawful benefit carried out with a credit or bank card will constitute this type of offence²⁹.

The offence of misuse of bank or credit cards corresponds to the “act of unauthorised use of bank or credit cards”, which under TCK No. 765 was assessed as part of the “offence of obtaining an unlawful benefit by means of an information system” in Article 525 b/2. These forms of misuse, which under TCK No. 765 were one of the acts constituting the material element of an offence, have been made an independent type of offence in Article 245 of TCK No. 5237.

By this article of the law, the legislature seeks to stop the production of counterfeit credit or bank cards at the source, and punishes the four stages from the production of these cards to their use. The first of these stages is the counterfeit production of the card, the second its sale or transfer, the third its purchase or acceptance by transfer, and the fourth their use for the purpose of obtaining an unjust benefit. Paragraphs 2 and 3 of Article 245 define these stages separately and punish them.

Article 245 of TCK No. 5237 was amended by Law No. 5377 of 29.06.2005 entitled “Law Amending the Turkish Criminal Code”. The provision that was the second paragraph in the original version of the article has become the third paragraph, and a second paragraph has been added as a new type of offence. In addition, a fourth paragraph providing for a personal ground for exemption from punishment has been added to the text of the article by this latest amendment. Although the amendment has not remedied certain shortcomings, it should be noted at once that the article has been changed for the better³⁰.

This article of the TCK was amended by Article 27 of the amending law. As a result of this amendment, the article, which originally had two paragraphs, now has four; by paragraph 2 added to the type of offence, a new way of committing the offence has been defined, and by paragraph 4 a personal ground for exemption from punishment has been created. In the unamended paragraphs 1 and 3 (formerly 2) of the type of offence, the penalties provided for have been changed.

This type of offence has been regulated in order to prevent, and where they occur to punish, acts of causing damage to the financial institutions that issue bank or credit cards, or to the persons who use them, through the misuse of these cards, which with developing technology have become one of the indispensable economic instruments of present-day life. Accordingly, the legal interest protected by this type of offence is the property of persons³¹. For this reason, it is worth stating once again the criticism we have consistently expressed with regard to the type of offence under examination³². In the TCK, offences are classified according to the legal interest they protect; although this is a type of offence that may be committed by means of information systems, since the legal interest it protects is essentially the property of persons, it ought to be placed in the chapter on “offences against property” in the law. Despite this important criticism, which we have persistently expressed since the preparatory work on the law, no change in this direction has been made by Law No. 5377 amending the TCK.

Paragraph 1 of the article, which was also part of its original version before the amendment, regulates the act of “obtaining an unlawful benefit with a bank or credit card belonging to another”, while paragraph 3, likewise part of the original version of the article, regulates the act of “obtaining an unlawful benefit with a counterfeit or falsified bank or credit card”. Accordingly, the first paragraph of the article makes an offence the act of using a bank or credit card belonging to another, by a person who has obtained or holds it in whatever manner, without the consent of the cardholder or of the person to whom the card was to be issued, and thereby obtaining an unlawful benefit for the perpetrator or for a third person. Paragraph 3 of the article, on the other hand, regulates the act of the perpetrator obtaining an unlawful benefit for himself or for another through the use of a counterfeit credit or bank card or a genuine card that has been falsified by being tampered with³³. As stated above, no change other than to the penalties has been made to these provisions.

The essential change made by Law No. 5377 to the offence of misuse of bank or credit cards lies in the second and fourth paragraphs added to the article. Of these, the second paragraph defines a different way of committing the offence, while the fourth paragraph regulates a personal ground for exemption from punishment applicable to the first paragraph.

Paragraph 2 of Article 245 defines as a type of offence the acts of “producing, selling, transferring, purchasing or accepting a counterfeit bank or credit card linked to bank accounts belonging to others”. As can be seen, this article essentially regulates the acts of “producing counterfeit bank or credit cards and distributing them”. Looking at the original version of the article before the amendment, it can be seen that the first paragraph punished the use of a card without consent and the second paragraph the use of a counterfeit or falsified card; as an important shortcoming of this original version, however, the mere production of counterfeit cards and their distribution were not punished. In Article 245 of TCK No. 5237, as reformulated by Article 27 of Law No. 5377, this important shortcoming has been remedied, and the acts in question have been included in the article and defined as a type of offence.

Accordingly, the act of the perpetrator producing, selling or transferring a counterfeit bank or credit card linked to bank accounts belonging to other persons will constitute an offence, as will the acts of purchasing or accepting cards produced in this manner. The legislature thereby seeks to stop the production of such counterfeit cards at the source, and punishes the four stages from the production of these cards to their use. The first of these stages is the counterfeit production of the card, the second its sale or transfer, the third its purchase or acceptance by transfer, and the fourth their use for the purpose of obtaining an unjust benefit. The first three of these four stages applicable to counterfeit cards are defined separately by paragraph 2 of Article 245. The article of the law draws no distinction according to whether or not the cards change hands for consideration, and seeks to punish every kind of change of hands.

By the words “linked to bank accounts belonging to others”, the type of offence introduces a precondition for the commission of the offence. But where the perpetrator accesses the information system of a card-issuing financial institution or bank and unlawfully opens a new account in his own name or in the name of a fictitious person who does not actually exist, holds money in this account through likewise fictitious transfers, and further produces a credit card linked to this account and uses or sells this card, will the perpetrator have committed the offence defined in paragraph 2 of Article 245? Because of this precondition, it is not possible to hold the perpetrator liable under this article; for in this example the perpetrator has not created a card linked to an account belonging to another, but a card linked to an account that is entirely fictitious and does not belong to another. In this case, by first unlawfully accessing the information system, opening a fictitious account and transferring money to it, the perpetrator will have committed the offence of aggravated fraud “by using information systems, banks or credit institutions as an instrument” defined in sub-paragraph f of paragraph 1 of Article 158 of the TCK. If the perpetrator uses the counterfeit card produced in this way, he may additionally be held liable under paragraph 3 of Article 245. If, however, the perpetrator does not use but sells or transfers the counterfeit card produced in this way, he cannot be punished under paragraph 2 of Article 245, because in that case the precondition defined in the paragraph will not have been fulfilled, that is, no link to an account belonging to another will have been established.

Paragraph 2 of Article 245 has been regulated and added to the text of the article in an entirely appropriate manner, and an important shortcoming in this respect has thereby been addressed. It may have a deterrent effect against acts of “phishing”³⁴, which are becoming increasingly widespread and a serious problem today in particular, and it will also ensure that those who produce counterfeit cards using this method and trade in them are punished.

However, as the example given above shows, the precondition “linked to bank accounts belonging to others” added at the beginning of the paragraph creates a gap in the type of offence. For this reason, defining the offence without this expression is necessary in order to cover all acts, as in the example given above and similar cases. If such an expression must be included at all costs, the expression “linked to any bank account” should be preferred.

In addition, another point to be noted with regard to this type of offence is that where the perpetrator first produces a counterfeit credit card and then uses the card himself, he will not be punished separately for both the acts set out in paragraph 2 and those set out in paragraph 3 of Article 245. For where the person who produces the card and the person who uses it are the same, it will be borne in mind that the counterfeit card must first be produced in order to be used, and in that case the perpetrator will be held liable only under paragraph 3 of Article 245.

Another change made by amending Law No. 5377 concerns the sanctions of these two paragraphs. Accordingly, while the custodial sentence in paragraph 1 has not been changed, the wording “a judicial fine shall be imposed” in the original version of the paragraph has been changed to “a judicial fine of up to five thousand days shall be imposed”. In the third paragraph, the custodial sentence has been changed and a judicial fine has also been added; accordingly, the sanction contained in the paragraph now reads “shall be punished with imprisonment from four to eight years and a judicial fine of up to five thousand days”. Limiting the judicial fine, which was indeterminate in the original version of the first paragraph, while granting the judge discretion, is positive from the standpoint of the principle of certainty in criminal law. Likewise, providing for a judicial fine in the third paragraph of the article is an appropriate provision. However, by raising the upper limit of the custodial sentence in the third paragraph from seven years in its original version to eight years, and by setting lower limits of three years in the first two paragraphs of Article 245 and four years in the third paragraph, a graduation of sorts has been created, with increasing upper limits. It must be pointed out at once, however, that the acts regulated in these paragraphs, in particular those in the second and third paragraphs, are not acts of which one is lighter or more serious than the other. The acts regulated in all three paragraphs are cases of the misuse of bank and credit cards through the commission of different acts. Whereas, however, the first paragraph does not involve forgery or fraud committed by means of an information system, the second and third paragraphs do. The penalties of the other paragraphs should therefore be heavier than that of the first paragraph. As can be seen, however, the lower limits of the custodial sentences in the first and second paragraphs are the same. On the other hand, whereas there is no need to differentiate between the penalties for the acts in the second and third paragraphs, which in a similar way are practically complementary to one another, there is no explanation for this time creating a difference in both the lower and the upper limits of the custodial sentences in these paragraphs. Indeed, the reason for which this provision was made has not been explained.

A matter that should be addressed here at this point is that the “technique of legislating without an explanatory memorandum”, which entered our legal world particularly at the stage when CMK No. 5271 was being enacted, has been continued with this law. Indeed, Law No. 5377 has no explanatory memorandum. When the law was returned to Parliament by the President of the Republic for reconsideration, a report defending only the articles indicated in the President’s reasoning was prepared by the Justice Committee of the Grand National Assembly of Turkey (TBMM). Apart from this, there are unfortunately no explanatory memoranda showing the general reason for the amendments in question, why there was a need to amend each of the amended articles, and for what purpose the amendments were made. For this reason, among the other articles, there is no explanatory memorandum showing why the upper limit of the custodial sentence in paragraph 3 of Article 245 was increased.

The last change made to Article 245 of the TCK by Article 27 of Law No. 5377 is paragraph 4, which has been added to the article. This paragraph regulates a “personal exemption from punishment” with regard to the type of offence in the first paragraph of the article. This provision is not a ground of justification. For this paragraph does not take the act out of the category of unlawful acts with respect to these persons; it merely provides that, where the act is committed by the persons specified in the paragraph, no penalty will be imposed on them. As a natural consequence of this, where the offence is committed by the perpetrator, or by one of the perpetrators, being a person defined in the paragraph, against another relative likewise defined in the paragraph, no penalty will be imposed on that person, but the other accomplices who participated in the offence will be punished for the act they committed. This paragraph regulates a personal ground for exemption from punishment because this is a situation encountered very frequently in practice. However, we consider that it would have been more appropriate here to regulate the type of offence, with respect to the persons concerned, as an offence prosecuted only upon complaint. For an unlawful act has been carried out and an offence committed by this act; although the persons specified in the paragraph are relatives, when faced with such a situation they may, for various reasons (for example, so that the perpetrator who is their relative serves his sentence, learns his lesson and never again attempts such a thing), wish the persons who carried out the act to be punished. It was therefore not appropriate to deny the victim who is a relative of the perpetrator the right to file a complaint and to provide for complete exemption from punishment for the perpetrator.

In short, this article seeks to prevent banks and cardholders from being caused damage through the unjust and unlawful use of such cards, and an unlawful benefit thereby being obtained³⁵. This is also stated clearly in the explanatory memorandum to the article³⁶.

The commission of this offence can cause great damage to the property of persons; indeed, this is clearly evident from the incidents that have occurred to date and from the acts reflected in decisions of the Court of Cassation. Accordingly, the legal interest protected by this offence is determined to be the property of the person.

Having determined the legal interest protected by the offence in this way, an important criticism must be expressed concerning the regulation of this type of offence. Although the legal interest protected by the offence of misuse of bank or credit cards is the property of the individual, this offence is regulated not in the chapter on offences against property but in the chapter on offences in the field of information technology. Since this form of regulation is contrary to the systematic structure of the law, it should be changed and this type of offence should be moved to the chapter on “offences against property”³⁷.

This article in fact regulates three different types of offence which are related to one another and practically complementary. The first paragraph defines the “offence of obtaining an unlawful benefit by using a bank or credit card belonging to another”, the second paragraph the “offence of producing and distributing counterfeit bank or credit cards”, and the third paragraph the “offence of obtaining an unjust benefit through the use of a counterfeit credit or bank card”.

B. Types of Offence Regulated in the Chapter on Offences against Private Life and the Secret Sphere of Life

Data protection law includes the right to know which personal data are obtained, by whom and for whom. In the Turkish legal order, the subject of data protection has not so far received sufficient and necessary attention. The absence of any statutory provision on this subject has made it necessary to examine it primarily under the heading of the protection of personality rights. In this context, the protection of personal data is generally assessed under Article 24 of the Civil Code (MK). Where personality rights are violated through the unauthorised obtaining of personal data, the termination of the violation under private law and compensation for the damage are effected under Article 25 of the Civil Code and Articles 41 et seq. of the Code of Obligations (BK)³⁸. Consequently, the articles of the MK and BK concerning the violation of personality rights and its consequences apply regardless of the means by which and the field in which the violation of personality occurs; for the principle of legality of offences and penalties, which prevails in criminal law, does not apply in private law³⁹.

Because of the above-mentioned principle, acts such as the violation, unlawful obtaining and misuse of personal data by means of an information system must be regulated separately in criminal law and made types of offence. In this respect, it has been stated that a special law on the protection of personal data is needed, like the legislation enacted in this field in Germany⁴⁰. It has also been stated that the offence of obtaining data regulated in Article 525 a/1 of TCK No. 765 did not provide sufficient and necessary protection in this respect⁴¹.

Another point that must be borne in mind with regard to acts violating personality rights through the obtaining of personal data is that, apart from the official security bodies of the State, many institutions and organisations also collect private information about individuals and are in a position to violate personality rights with this information. Examples include hospitals, which hold very private information about patients in their information systems, forensic medicine institutions, which carry out DNA and fingerprint analyses and store their results in information systems, and the data held by mobile telephone operators. For this reason, the regulation to be made for the protection of personal data should lay down not only the framework for the collection and use of such information by official bodies, but also the legal framework for private organisations that have the authority and the technology to store and use such information⁴².

Taking into account the views and criticisms mentioned above, TCK No. 5237 regulates the acts of unlawfully creating, using or disclosing personal data in separate articles. An important gap in the regulation of computer crimes in TCK No. 765 has thereby been filled.

A further positive aspect of this regulation with regard to computer crimes is that the types of offence relating to personal data have been regulated not together with the other types of offence in the chapter entitled “offences in the field of information technology”, but, according to the legal interest protected by these offences, in the chapter on “offences against private life and the secret sphere of life”, in which similar legal interests are protected⁴³.

The types of offence in question are examined in detail article by article below:

1. Offence of Recording Personal Data (Art.135)

Paragraph 1 of Article 135 of TCK No. 5237 makes the unlawful recording of personal data an offence. Paragraph 2 of the article regulates as a type of offence the acts of storing, as personal data, persons’ political, philosophical and religious opinions, racial origin, trade union affiliations, sexual life and state of health⁴⁴.

A type of act that is encountered very frequently with developing information technology and that at the same time constitutes an attack on personality rights is the storing of persons’ personal data in information systems without their consent.

It is known that hospitals in particular collect and use such data concerning their patients, financial institutions and insurance companies concerning the creditworthiness and solvency of their customers, and commercial companies for advertising and marketing purposes. The article under examination makes it an offence to transfer such information as data into the virtual environment without obtaining the permission of the person to whom the data relate. This is also clearly stated in the explanatory memorandum to the article⁴⁵.

Thus, as also stated in the explanatory memorandum to the article⁴⁶, the relevant provisions of the “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data”, one of the instruments produced by the Council of Europe, to which Turkey has also become a party by duly ratifying it, will find application in Turkish law.

2. Offence of Unlawfully Giving or Obtaining Personal Data (Art.136)

Article 136 of TCK No. 5237 regulates as an independent type of offence the acts of unlawfully giving personal data to another, disseminating it or obtaining it; this is also expressly stated in the explanatory memorandum to the article⁴⁷.

This provision will apply to acts of identity theft, which are encountered very frequently in countries such as the United States of America and the United Kingdom and are said to be the most frequently committed computer crime, and such acts will not go unpunished. Indeed, today almost all personal information and identity information is now to be found, above all, on the internet. Most of this information is given to various sites on the basis of the consent given by the persons concerned. Regulating as a type of offence the unlawful giving of this information to third persons, its dissemination, or the obtaining of these data by third persons has therefore been an appropriate provision.

3. Offence of Failing to Destroy Data (Art.138)

Article 138 of TCK No. 5237, for its part, makes it an offence for persons responsible for destroying personal data in the system to fail to perform this duty even though the statutory period has expired⁴⁸.

By this type of offence included in TCK No. 5237, a sanction is provided for those who do not remove data from the system, that is, those who neglect their duties in this respect, thereby preventing personal data lawfully held in a system from remaining permanently in those systems and thus being accessible at any time.

Human beings are by nature free beings. For this reason, they do not wish to live as individuals who are constantly monitored, about whom information is collected and who are put on file. Creating in people the feeling that they are constantly being watched may also create a sense of distrust and hatred towards the political system in which they live; in other words, people wish to live in security and freedom⁴⁹. Accordingly, where certain personal information of individuals has been entered as data into various systems at a certain period of their lives, even lawfully, this personal information must be removed from those systems after a certain time. Both the individual and the State want these data to be destroyed. For a State that constantly collects and records information about its citizens, in short, that keeps files on its citizens, can never be a pluralist, liberal and democratic State, and cannot make its citizens a society committed to these modern principles. It is precisely this that the type of offence in question seeks to prevent.

C. Other Types of Offence that May Be Committed by Means of Information Systems

Apart from the types of offence explained above, TCK No. 5237 contains other types of offence, regulated in different chapters, that may be committed by means of information systems. These types of offence, with brief explanations, are as follows:

1. Offence of Violating the Confidentiality of Communication (Art.132)

Paragraph 1 of Article 132 of TCK No. 5237 makes acts violating the confidentiality of communication between persons an offence. The act of recording the content of the communication in the course of this act is regulated as a separate type of offence in the second sentence of this paragraph. This offence may be committed by a person who is not a party to the communication. Paragraph 2 of the article makes the disclosure of communication between persons an offence. The disclosure of a communication conducted by the person himself without the permission of the other party to that communication is also made an offence in paragraph 3 of the article. The disclosure of such communication through the press and broadcasting is provided for as an aggravating circumstance in paragraph 4.

As can be seen from the text of the article, unlike the offence concerning the confidentiality of postal and telephone communication regulated in Article 195 of TCK No. 5237, this article uses only the concept of “communication”, without specifying how it is carried out. Consequently, every kind of communication falls within the scope of protection of this article.

Today, thanks to developing technology, communication also takes place through information systems, in particular via the internet, by various methods such as electronic mail, electronic chat, internet telephony or teleconferencing. These new methods of communication carried out by means of information systems are likewise placed under protection by the provision of the said article of TCK No. 5237, and those who violate such communication are also to be punished. This is also clearly stated in the explanatory memorandum to the article. Thus, the debates under Article 195 of TCK No. 765 as to whether communication by “electronic chat or electronic mail” fell within the scope of that article will come to an end, and communications conducted via data transmission networks will also be regarded as falling within the scope of protection of this article.

2. Offence of Hindering Communication (Art.124)

The “offence of hindering communication” regulated in Article 124 of the seventh chapter, entitled offences against liberty, of the second part, entitled offences against persons, of the second book of TCK No. 5237 may be committed by means of information systems. As stated above in the explanations on Article 132 of TCK No. 5237, electronic mail and chat make up the great majority of communication taking place today. Because it is both cheaper and much faster than the others, this method has now become the more preferred one. In addition, telephone calls and teleconferences conducted over data transmission networks are also regarded as other forms of electronic communication.

Since the article of TCK No. 5237 under examination refers only to communication and does not list the means of communication one by one, hindering communication will constitute the offence under examination regardless of the means by which the communication is carried out; indeed, this is also expressly stated in the explanatory memorandum to the article. For this reason, acts of hindering communication carried out by means of an information system will also be regarded as falling within the scope of protection of the type of offence regulated in Article 124 of TCK No. 5237.

3. Offence of Insult (Art.125)

The “offence of insult” is regulated in Article 125 of the eighth chapter, entitled offences against honour, of TCK No. 5237. This provision abolishes the distinction between the offences of defamation and insult adopted by TCK No. 765.

Paragraph 2 of the article provides that the offence of insult is also committed where the act is carried out by means of an audio, written or visual message addressed to the victim. Accordingly, committing the offence of insult by means of information systems will also be punished.

Furthermore, among the aggravating circumstances set out in the other paragraphs of the article, the commission of the offence of insult publicly or through the virtual press and broadcasting, in particular, very frequently takes place via data transmission networks. By this provision of TCK No. 5237, offences of insult carried out via data transmission networks that are committed publicly or through the virtual press are accepted as an aggravating circumstance.

4. Offence of Theft Committed through the Use of an Information System (Art.142 para.2 sub-para.“e”)

Article 142 of the tenth chapter, entitled offences against property, of TCK No. 5237 regulates the aggravated forms of the offence of theft. Sub-paragraph “e” of paragraph 2 of this article contains the “offence of theft committed through the use of an information system”. The daily emergence, with developing technology, of new ways of committing computer crimes has made such a provision necessary.

When this type of offence was discussed, it was stated that one of the acts regulated by the offence of obtaining an unlawful benefit in Article 525 b/2 of TCK No. 765 was acts of theft carried out by means of an information system. By this article of TCK No. 5237, this type of offence is regulated, with regard to the “legal interest protected by the offence”, in the chapter to which it relates and within the type of offence to which it relates. At the same time, an attempt is thereby made to meet the criticism, voiced in respect of Article 525 b/2 of TCK No. 765, that the statutory provision was too broad.

However, it was not an appropriate provision to include this type of offence, which may be called computer theft, as one of the aggravated forms of theft in Article 144 of TCK No. 5237. For Article 143 defines the basic form of the offence of theft, and in this definition tangible objects are indicated as the object of the offence. Although the second sub-paragraph of the same article states that electrical energy will also constitute the object of this offence, the data that form the object of computer theft are neither a tangible object nor electrical energy.

Article 144 is therefore in contradiction with Article 143. For this reason, this type of offence should likewise be regulated in the chapter on offences against property, but as an independent type of offence.

Nor can it be understood from this provision which kinds of theft committed by means of an information system will constitute this offence. Was it intended to regulate by this type of offence the theft of tangible objects through the use of an information system, or the theft of data? How can a tangible object be stolen by using an information system? If what is meant is not tangible objects but data, then the regulation of the type of offence is erroneous in turn, because the basic form of the offence, in which the type of offence is defined, clearly states that the object of the offence consists of tangible objects. On this basis, it might be said that this offence will be committed by the act of the perpetrator, acting without the person’s consent with the aim of obtaining a benefit for himself or for another, putting an end to the person’s control over a thing by means of an information system. However, this appears to be a situation that will rarely be encountered in practice, at least for the time being.

It must also be stated that regulating this offence as an independent type of offence, and stating clearly what the object of the offence is and which acts are intended to be punished, will prevent errors and confusion in application and interpretation that may arise in the future.

It should also be noted that acts of obtaining an unlawful benefit by means of an information system are generally constituted by “acts of manipulation” carried out on information systems, and such fraudulent conduct is assessed within the scope of the “offence of fraud”. For this reason, taking into account the explanations given above as well, it can be seen that for the time being the offence of theft committed by means of an information system will rarely be applied. However, since the ways in which such acts are committed are likely to increase with developing technology, it would have been an appropriate provision to include such a provision in TCK No. 5237 in line with the criticisms made above and in the manner explained; but the regulation of the type of offence in its present form is definitely erroneous.

5. Offence of Fraud Committed through the Use of an Information System (Art.158 para.1 sub-para.“f”)

Article 158 of the tenth chapter, entitled offences against property, of the YTCK regulates the aggravated forms of the offence of fraud. Sub-paragraph “f” of paragraph 1 of this article contains the “offence of fraud committed through the use of information systems”. The explanations given above regarding the reasons for and the method of regulating the offence of theft committed through the use of information systems also apply to this type of offence.

This article sought to regulate one of the most frequently encountered types of computer crime in practice and to punish acts of obtaining an unlawful benefit as a result of fraudulent operations carried out on information systems.

However, the criticism made above in respect of the offence of theft also applies to this type of offence. Article 157 of TCK No. 5237, which regulates the basic form of the offence of fraud, uses the expression “by deceiving a person through fraudulent conduct” and thereby states that the deception of a person is necessary for this offence to be committed. In acts of fraud carried out by means of an information system, however, the act of deception must be directed against the information system; otherwise it is a case of classic fraud, in which the information system serves merely as an instrument. Yet in sub-paragraph “f” of paragraph 1 of Article 158, the “offence of fraud committed through the use of information systems” is regulated on the basis of the basic form of the offence in Article 157. The basic form of the offence, in turn, states that the deception of a person is necessary.

As can be seen, this aggravated form of fraud has been regulated without taking into account the specific features of information systems and of acts of fraud carried out by means of an information system. In that case, the use of an information system in deceiving persons will be regarded as an aggravated form of the offence of fraud. Consequently, this provision does not regulate “acts of obtaining an unlawful benefit as a result of fraudulent operations carried out on information systems”; what it regulates is the provision for an information system as a mere instrument in fraud.

For the type of offence mentioned above, by contrast, a separate, independent type of offence needs to be regulated.

6. Offence of Obscenity (Art.226)

The “offence of obscenity” is regulated in Article 226 of the seventh chapter, entitled offences against public morality, of the third part, entitled offences against society, of TCK No. 5237. The text of the article contains provisions on obscenity and on the protection of children against such harmful publications. Since it is possible to disseminate and share such harmful publications by using information systems, in particular via data transmission networks, this type of offence may also be committed by means of information systems.

An important point that must be made here is that using the concept of “pornography” instead of the open-ended concept of “obscene”, which changes over time and requires interpretation, would make the type of offence much better and more determinable⁵⁰. Although the boundaries of neither concept can be determined precisely, the content and meaning of the concept of obscenity in particular change not only from era to era but also from country to country and even between different cultural groups within the same country⁵¹. For this reason, in accordance with the principle of certainty, the law should use the concept of pornography instead of the concept in question.

In order to avoid confusion in practice, it would have been an appropriate provision to state in the regulation in question that this offence may also be committed via data transmission networks.

In addition, the failure to regulate child pornography as a separate type of offence, modelled in particular on the relevant articles of the European Convention on Cybercrime, constitutes an important shortcoming of the YTCK.

Although this regulation of the article is inadequate, it is capable of being applied to acts of obscene publication carried out via data transmission networks.

However, this way of regulating the article also contains contradictions. In particular, while matters such as how and by what method obscene publications are to be sold or shown are regulated in detail, the provision on the punishment of those who sell, export or store such products and those involved in the other acts is not sufficient.

From this structure of the article, it cannot be clearly understood which act is subject to a sanction, why, and in what manner⁵².

6. Offence of Providing a Place and Opportunity for Gambling (Art.228)

The “offence of providing a place and opportunity for gambling” is regulated in Article 228 of the seventh chapter, entitled offences against public morality, of the third part, entitled offences against society, of TCK No. 5237. The type of offence contains no specific statement that the commission of this act in cyberspace will be punished. However, since the legal interest protected by this offence is the protection of individuals from the evils of gambling, and since the statutory definition uses the expression “providing a place and opportunity” without any restriction, organising gambling in cyberspace should also be regarded as falling within this type of offence and the perpetrators should be punished.

Today, with developing technology, organising gambling via the internet is more widespread than organising it on premises. For perpetrators, too, carrying out the act at a physical location is more difficult, both in terms of creating the place and opportunity and in terms of the risk of being caught. Moreover, organising gambling in cyberspace is more conducive to the commission of this type of offence, because of the provision of the place, the lower risk of being caught and the possibility of reaching a much larger number of people. It must therefore be accepted that the legislature also had this in mind when it framed the type of offence as one that may be committed by any act.

Nevertheless, we are of the opinion that it would be a much better provision to mention organising gambling in cyberspace separately in the text of the article and to regulate it as an aggravated form of the offence.

III. Criticisms and Views concerning Computer Crimes

It must first be stated that, in TCK No. 5237, the types of offence regarded as computer crimes are regulated, with regard to the legal interest protected by the offence, in the chapters to which they relate according to the legal interest they protect. Types of offence whose protected legal interest is of a mixed nature, on the other hand, are placed in a separate chapter, with the information system as their common denominator. However, although the offence of misuse of bank or credit cards ought, according to the legal interest it protects, to be placed in the chapter on offences against property, this has not been done and it is regulated in the chapter on offences against information systems. This situation must be corrected and the type of offence must be placed in the chapter to which it relates.

Article 525 a/1 of TCK No. 765 made the act of obtaining data an offence, but did not make it an offence to gain knowledge of the information in an information system, without obtaining it, by accessing the system without authorisation. It must be said, as a positive comment, that Article 245 of the draft has remedied this. The acts of computer pirates, described by the term “hacker”, have thereby been brought within the scope of regulation.

Both TCK No. 765 and the government bill submitted to the Grand National Assembly of Turkey (TBMM) regulated the “offence of forgery in data”. However, this type of offence was not included in the text of the bill as amended and adopted by the parliamentary sub-committee; ultimately, this type of offence was not included in TCK No. 5237 as enacted either. From the standpoint of criminal policy, since such documents may be created and used by means of an information system and public trust may thereby be violated, this type of offence should be regulated in TCK No. 5237 and placed in the chapter on offences against public trust. In the relevant chapter mentioned above, this type of offence should either be regulated independently or be regulated separately within the offences of forgery of official and private documents.

The use of information systems in organised crime and cyber terrorism must be regulated urgently, and provisions must be made on this matter in the relevant laws. In addition, provisions should also be made on acts of racism, incitement to violence, incitement of the public to hatred and hostility, incitement to crime and propaganda for terrorist organisations carried out in cyberspace by means of information systems⁵³.

In view of the phenomenon of cyber terrorism, the commission of terrorist acts by making use of data transmission networks should be regarded as an aggravating circumstance. For whereas those who carry out terrorist acts endanger even their own lives in the classic types of offence, carrying out the acts by means of information systems reduces both the risk they take and the risk of being identified and caught, and facilitates the commission of the offence.

Likewise, the acts of organised criminal organisations communicating with their members and using and transferring their financial resources should also be regulated separately and regarded as aggravating circumstances; the explanations given above on this matter also apply here. The absence of any provision on this matter in TCK No. 5237 is seen as an important shortcoming.

The act of organising gambling over data transmission networks must definitely be regulated in a separate paragraph, as an aggravated form of Article 228 increasing the penalty. There is a major legal gap in this respect. TCK No. 5237 contains no special provision to this effect. Yet while even physical casinos, which not everyone can reach, have been banned in Turkey, anyone who wishes can today gamble in virtual casinos. Although Article 228 of TCK No. 5237 uses a broad expression, “providing a place and opportunity for gambling”, it would be an appropriate provision to mention “organising gambling in cyberspace by means of information systems” in the text of the article as well, so that problems of interpretation do not arise and confusion in practice is not caused.

Acts of sending unsolicited electronic mail (spam) are made offences, above all in the United States of America and Australia. This is a situation that is genuinely disturbing, increases the volume of traffic on data transmission networks and occupies very large amounts of space in the electronic mail of organisations and individuals, thereby impeding international trade. This act should also be regulated as a type of offence in TCK No. 5237.

Taking into account in particular the regulations on unsolicited electronic communications adopted in other countries, a solution should be found to this problem and the sending of unsolicited electronic communications should be made an offence. In this context, in harmony with the provisions of the European Convention on Transfrontier Television, provisions should be introduced against advertisements in cyberspace that are deceptive, misleading, exploitative or endanger the safety of property and life⁵⁴, and in particular the production of advertisements that intentionally endanger the safety of life and property and their publication over the internet should be made an offence⁵⁵.

Today, even many classic types of offence, such as homicide, can be committed by means of an information system over data transmission networks (for example, killing a patient by accessing a hospital’s computer network and stopping a life-support unit connected to the system). In these acts, the use of information systems and data transmission networks makes it more difficult to detect both the offence and the perpetrator, while for the perpetrator it makes the commission of the offence extremely easy and reduces the risks he takes and the likelihood of being caught. For this reason, with regard to the types of offence that can be committed by means of information systems, the use of these systems should be provided for as an aggravating circumstance in respect of the relevant types of offence.

Provisions must definitely be made concerning the criminal liability of persons acting in cyberspace. At present there is a complete legal gap in this respect in Turkey, and even where offences and perpetrators are uncovered, these persons cannot be punished because of the legal gap. These provisions may be made in a separate statute, as in the German Teleservices Act, or in the laws relevant to the subject; there are also differing views on this matter in legal scholarship⁵⁶. When making these provisions, however, the universal principles concerning freedom of thought must be taken into account, and in particular the regulation must be made within the framework of the “right to freedom of expression” in Article 10 of the ECHR and of the cases in which this right may be restricted under paragraph 2 of that article⁵⁷. Determining the criminal liability of persons acting in cyberspace must not mean curbing freedom of thought⁵⁸.

As stated above, the legislation in force in Turkey contains no provision setting out the criminal liability of persons arising from their acts on the internet⁵⁹. For this reason, the criminal-law liability of the internet actors, namely internet service providers, access providers and content providers, should be regulated separately in a separate law⁶⁰. However, since content providers in particular may be press organisations or organisations active in the field of online journalism, their liability should be regulated in such a way that individuals’ right to receive information is not impeded.

It should also be noted here that the provision introduced into the former Press Law (Bas. K.) No. 5680 of 15.07.1950 by the Additional Article 9 added by Article 26 of Law No. 4756 on 15.05.2002, under which the provisions of that law were to apply to those publishing on the internet with regard to pecuniary and non-pecuniary damage arising from false news, insult and similar acts, was not compatible with the inherent nature of cyberspace and the internet. Moreover, since there are major differences in every respect between online publication and printed publication, the law was not an appropriate provision. Whereas the freedom and pluralism of the virtual press carried out via the internet ought to be protected in the face of a written press that is today moving towards monopolisation and is almost single-voiced, that statutory provision was in fact impeding it⁶¹.

This article of the law was not suited to its purpose, either in terms of protection against the damage caused by such publications or in terms of identifying the perpetrator, and it had been stated many times that it should be repealed. Taking these intense criticisms into account, the legislature appropriately did not include these internet-related provisions at all in the new Press Law No. 5187 of 09.06.2004, and kept in mind the important difference between internet publishing and printed publishing.

When regulating the legal liability of internet actors, a distinction should be drawn between sites acting as a virtual press via data transmission networks and sites created by individuals that do not aim to engage in online publishing. For example, the owner of a site who runs a forum room has no duty to monitor the posts sent to the site and to read all of them, nor should such a duty be created by law; for this reason, the site owner should not be held liable for posts sent to the site where they contain an offence. A provision should be made that takes this distinction into account.

In combating computer crimes, a result can be achieved by addressing substantive criminal law and the law of criminal procedure together. The international nature of computer crimes, owing to their characteristics, gives rise to problems regarding the place where the offence was committed, which in turn leads to the problem of where the offence is to be prosecuted. These problems can be overcome only by making international cooperation effective. The European Convention on Cybercrime contains detailed provisions on this matter. It may be possible to overcome this problem if Turkey becomes a party to this Convention and the necessary provisions, in line with the Convention, are made in the articles of TCK No. 5237 concerning the place of commission of the offence⁶².

Where personality rights are attacked by means of information systems over data transmission networks, the offences of defamation and insult committed via the internet in particular come to mind⁶³. Committing these acts via the internet allows them to come to the knowledge of a very large number of people in a very short time; moreover, where these acts are carried out in particular on news sites or forums, the Press Law contains no measures to remedy the consequences of the act for the internet, as it does for printed works. For these reasons, measures relating to this field should be regulated, and the use of cyberspace, in particular the internet, in the commission of offences such as defamation, insult, threats and violation of the freedom of communication should be accepted as an aggravating circumstance, and the problems of concurrence of offences that may arise between these provisions and the existing computer crimes should be resolved by express provisions⁶⁴.

Another important provision that needs to be made with regard to computer crimes is to make the sexual exploitation of children in cyberspace for commercial purposes an independent type of offence⁶⁵. Making children, under coercion by persons such as their parents or guardians, the subject of material such as pornographic pictures and films, and the marketing and purchase of such material over the internet, should be made a type of offence⁶⁶. In addition, possessing any material containing child pornography in information systems, making it available for sharing, transmitting it and using it should be regulated as a type of offence.

In particular, “all acts relating to child pornography” carried out over the internet should be made offences. What these acts are is set out one by one in the European Convention on Cybercrime. Although these acts need to be made offences as a matter of great urgency, Article 226, the provision on this matter in the YTCK, is extremely inadequate in this respect.

Finally, it must be stated that all provisions to be made should be made with a positive and constructive approach, in such a way that freedom is the rule and restriction the exception; and there must be no compromise on the principle of the rule of law, the principle of legality of offences and penalties, the principle of the essence of the fundamental rights and freedoms set out in our Constitution, or the criterion of necessity in a democratic society laid down in the ECHR and in the judgments of the ECtHR.

BIBLIOGRAPHY

Alpaslan, Mehmet Şükrü, “Avrupa İnsan Hakları Sözleşmesi Uygulamasında Düşünce ve Basın Özgürlüğü”, Prof. Dr. Sahir Erman’a Armağan, İstanbul, İÜHF Eğitim Öğretim ve Yardımlaşma Vakfı Yayını, 1999, s.27-35.

Akbulut, Berrin, “Türk Ceza Hukukunda Bilişim Suçları”, Yayınlanmamış Doktora Tezi (Selçuk Üniversitesi Sosyal Bilimler Enstitüsü Kamu Hukuku Anabilim Dalı Ceza ve Ceza Usul Hukuku Bilim Dalı), Konya, 1999.

Artuk, Mehmet Emin/Ali Rıza Çınar, “Yeni Bir Ceza Kanunu Arayışları ve Adalet Alt Komisyonu Tasarısı Üzerine Düşünceler”, Türk Ceza Kanunu Reformu: İkinci Kitap: Makaleler, Görüşler, Raporlar, Der: Teoman ergül, Ankara, Türkiye Barolar Birliği Yayını, 2004, s.37-84.

Başalp, Nilgün, Kişisel Verilerin Korunması ve Saklanması, Ankara, Yetkin Yayınları, 2004.

Başalp, Nilgün, “Kişisel Verilerin Korunması ve İnternet”, İnternet ve Hukuk, Der: Yeşim M.

Atamer, İstanbul, İstanbul Bilgi Üniversitesi Yayını, 2004, s.5-36.

Cerrah, İbrahim, “Bilişim Teknolojileri ve Etik: Bilişim Teknolojilerinin Güvenlik Hizmetlerinde Kullanımının ‘Etik Boyutu’ ve ‘Sosyal Sonuçları’”, Polis Bilimleri Dergisi, Ankara, C:4, S:1-2, Ocak-Haziran 2002, s.137-155.

Dede, Şeref, “Topluma Karşı Suçlar”, Türk Ceza Kanunu Tasarısı: Türk Ceza Hukuku Derneği Toplantısı (10 Temmuz 2004): İstanbul Barosu-Türk Ceza Hukuku Derneği Toplantısı (10 Eylül 2004): Kurumsal Raporlar-Toplantılara Sunulan Raporlar-Bilimsel Raporlar, İstanbul, İstanbul Barosu-Galatasaray Üniversitesi-Türk Ceza Hukuku Derneği Ortak Yayını, 2004, s.59-68.

Değirmenci, Olgun, “Bilişim Suçları”, Yayınlanmamış Yüksek Lisans Tezi (Marmara Üniversitesi Sosyal Bilimler Enstitüsü Hukuk Anabilim Dalı Kamu Hukuku Bilim Dalı), İstanbul, 2002.

Dursun, Selman, “İnternetten Kaynaklanan Ceza Sorumluluğundaki Gelişmeler”, MHB Prof.

Dr. Gülören Tekinalp’a Armağan, Y.23, S.1-2, 2003, s.256-290.

Dülger, Murat Volkan, “Banka ve Kredi Kartlarının Kötüye Kullanılması Suçu”, Güncel Hukuk Dergisi, İstanbul, S:23, Kasım 2005, s.28-30.

Dülger, Murat Volkan, “Yeni Türk Ceza Kanunu’nda Düzenlenen Bilişim Suçları ve Bu Suçlarla Mücadelede Alınması Gereken Önlemler”, 2. Polis Bilişim Sempozyumu, Ankara, Emniyet Genel Müdürlüğü Bilgi İşlem Dairesi Başkanlığı, 2005, s.201-207.

Dülger, Murat Volkan, “Bilişim Suçları ve Yeni Türk Ceza Kanunu”, Kazancı Hukuk, İşletme ve Maliye Bilimleri Dergisi, S.5, Ocak 2005, s.114-120.

Dülger, Murat Volkan, Bilişim Suçları, Ankara, Seçkin Yayıncılık, 2004.

Dülger, Murat Volkan, “Avrupa İnsan Hakları Sözleşmesi’nde Düşünce Özgürlüğü”, Prof.

Dr. Çetin Özek Armağanı, İstanbul, Galatasaray Üniversitesi Yayınları, 2004, s.283-298.

Dülger, Murat Volkan, “Avrupa Konseyi ve Avrupa Birliği Düzenlemelerinde Çocuk Pornografisinin İnternet Aracılığıyla yayılmasına Karşı Yapılan Düzenlemeler”, İstanbul Barosu Dergisi, İstanbul, S.4, 2004, s.1485-1496.

Dülger, Murat Volkan, “Bilişim Suçlarına İlişkin Düzenlemelerin Eleştirisi”, Türk Ceza Kanunu Tasarısı: Türk Ceza Hukuku Derneği Toplantısı (10 Temmuz 2004): İstanbul Barosu-Türk Ceza Hukuku Derneği Toplantısı (10 Eylül 2004): Kurumsal Raporlar- Toplantılara Sunulan Raporlar-Bilimsel Raporlar, İstanbul, İstanbul Barosu-Galatasaray Üniversitesi-Türk Ceza Hukuku Derneği Ortak Yayını, 2004, s.109-113.

Ippolito, Carlo Sarzana di S., “Bilişim Alanındaki Yeni Teknolojilerin Hukuksal Yansıması, İtalya’daki Durum” Çev: Vesile Sonay Daragenli, İÜHFM Prof. Dr. Türkan Rado’ya Armağan Sayısı, İstanbul, C:LV, S:3, 1997, s.389-405.

İçel, Kayıhan, “Avrupa Konseyi Siber Suç Sözleşmesi Bağlamında Avrupa Siber Suç Politikasının Ana İlkeleri”, İstanbul Üniversitesi Hukuk Fakültesi Mecmuası, İstanbul, C.LIX, S.1-2, s.3-10.

İlkiz, Fikret, “İkinci Bilişim Şurası 2004”, Güncel Hukuk, S:6, İstanbul, Haziran 2004, s.13, 14.

İnal, Emrehan, Reklam Hukuku ve Aldatıcı Reklamlar, İstanbul, Beta Yayıncılık, 2000.

Karagülmez, Ali, Bilişim Suçları ve Soruşturma – Kovuşturma Evreleri, Ankara, Seçkin Yayıncılık, 2005.

Karaoğlu, Erol, “İnternet Ortamından Gerçekleştirilebilecek Bir İhlal Türü Olarak Asılsız İsnat”, (Çevrimiçi) http://www.bilisimhukuku.net/index.php?option=content&task= view&id=337&Itemid=40 20.04.2004.

Kurt, Levent, Tüm Yönleriyle Bilişim Suçları ve Türk Ceza Kanunundaki Uygulaması, Ankara, Seçkin Yayıncılık, 2005.

Meran, Necati, Yeni Türk Ceza Kanununda Sahtecilik – Malvarlığı Bilişim Suçları ile Ekonomi ve Ticaret Alanında Suçlar, Ankara, Seçkin Yayıncılık, 2005.

Orwell, George, Bin Dokuz Yüz Seksen Dört, Çev: Nuran Akgören, İstanbul, Can Yayınları, 1999.

Özel, Cevat/M. Gökhan Ahi, “Bilişim Suçlarında Usul ve Sorumluluk Sistemi Üzerine Öneriler”, Güncel Hukuk, S:6, İstanbul, Haziran 2004, s.21.

Özel, Cevat, “Bilişim Suçları İle İletişim Faaliyetleri Yönünden Türk Ceza Kanunu Tasarısı”, İstanbul Barosu Dergisi, İstanbul, C.LXXV, S.7-8-9, Eylül 2001, s.858-872.

Özel, Sibel, Uluslararası Alanda Medya ve İnternette Kişilik Hakkının Korunması, Ankara, Seçkin Yayıncılık, 2004.

Schauer, Frederick, İfade Özgürlüğü: Felsefi Bir İnceleme, Çev: M. Bahattin Seçilmişoğlu, Ankara, Liberal Düşünce Topluluğu Yayını, 2002.

Schjolberg, Stein, “The Legal Framework – Unauthorized Access to Computer Systems:

Penal Legislation in 44 Countries” (Çevrimiçi) http://www.mosstingrett.no/info/legal.html#37, 08.02.2004.

Sınar, Hasan, “Avrupa Konseyi Siber Suç Sözleşmesi Üzerine Bir Deneme”, Prof. Dr. Çetin Özek Armağanı, İstanbul, Galatasaray Üniversitesi Yayınları, 2004, s.765-800.

Sınar, Hasan, “İnternet’in Ortaya Çıkardığı Hukuki Sorunlara Bir Ceza Hukuku Yaklaşımı”, MHB Prof. Dr. Yılmaz Altuğ’a Armağan, Y: 17-18, S:1-2, 1997-1998, s.355-372.

Ünver, Yener, “Türk Ceza Kanunu’nun ve Ceza Kanunu Tasarısının İnternet Açısından Değerlendirilmesi”, İstanbul Üniversitesi Hukuk Fakültesi Mecmuası, C.LIX, S.1-2, İstanbul 2001, s.51-153.

Ünver, Yener, “Federal Almanya’da Terör ve Organize Suçluluk ile İlgili Düzenlemeler”, Prof. Dr. Nurullah Kunter’e Armağan, İstanbul, İÜHF Eğitim Öğretim ve Yardımlaşma Vakfı Yayını, 1998, s.385-464.

Yarsuvat, Duygun, “Müstehcenliğin Neresindeyiz”, Güncel Hukuk, S:9, İstanbul, Eylül 2004, s.49.

Yazıcıoğlu, Yılmaz, “Bilişim Suçları Konusunda 2001 Türk Ceza Kanunu Tasarısının Değerlendirilmesi”, Hukuk ve Adalet: Eleştirel Hukuk Dergisi, İstanbul, Y:1, S:1, Ocak- Mart 2004, s.172-185.