Unauthorised Access to Information Systems

Unauthorised access to information systems is unlawfully entering all or part of an information system or continuing to remain in it (Turkish Criminal Code Art. 243). It is the basic cybercrime encountered by companies both in external attacks and in unauthorised access by employees or former employees.

Forms of the Offence

• Basic form: Unlawfully entering or remaining in a system; up to one year’s imprisonment or a criminal fine.
• Systems available for a fee: The penalty is reduced by up to half.
• Loss or alteration of data: If data in the system is lost or altered as a result, six months to two years’ imprisonment.
• Monitoring data transfers: Monitoring data transfers within or between systems by technical means without entering the system; one to three years’ imprisonment.

Common Situations in Companies

• A former employee continuing to access company email or cloud accounts,
• An employee entering parts of a system beyond their authorisation,
• A fake payment instruction given through a compromised account,
• Initial entry in ransomware attacks.

What Should the Company Do?

1. Secure evidence by preserving system logs and images of affected devices,
2. Revoke access rights and change passwords,
3. Assess whether the incident is a personal data breach and notify the Personal Data Protection Board if required; see Cyber Incident,
4. File a criminal complaint with the public prosecutor and join the criminal case as an intervening party.

Related Offences

Going beyond access to disrupt the system or alter data constitutes interference with information systems. If the data obtained is personal data, data-related offences also arise. In cybercrimes, security measures may be imposed on the company; see Corporate Criminal Liability.