A Guide to Gathering Evidence and Proving Defamation in Social Media Defamation and Threat Cases

The Legal Nature of Insult and Threat Crimes on Social Media

Digital Crimes within the Framework of Articles 125 and 106 of the Turkish Penal Code

Under the Turkish Penal Code, the honor, reputation, and dignity of individuals are protected in the digital realm as well as in the physical world. Article 125 of the Turkish Penal Code, concerning defamation on social media , is committed by attributing a concrete act or fact that could offend someone's honor, reputation, and dignity, or by using abusive language. Article 106 of the Turkish Penal Code, concerning threats via the internet , is committed by informing the victim that an attack will be carried out against their life, bodily or sexual integrity, or property, or that of a close relative. In cybercrime cases and complaints regarding cybercrimes, insults made via keyboard or threats made through messages are directly subject to penal sanctions under criminal law.

The Element of Publicity and Circumstances Aggravating the Punishment

The most critical aspect of crimes committed on the internet and social networks is the element of "publicity." The crime of public defamation on social media occurs when the act is carried out through profiles, public comments, live broadcasts, or posts that everyone can see, access, or interact with. If the defamation is committed publicly, the penalty is increased by one-sixth according to the law. Content sent directly via private message (DM) is considered to be directed directly at the victim.

Complaint Period and Mediation Procedure: When considering what to do if you've been insulted or threatened on social media, the key legal limits to consider are the statute of limitations. For insult offenses, a 6-month complaint period applies; this period begins from the date the act and the perpetrator's identity are learned. Basic forms of insult and threat offenses committed online are among the offenses subject to mediation on social media . During the investigation phase, the Public Prosecutor's Office refers the case to the Mediation Office to examine whether an agreement can be reached between the parties without filing a lawsuit.

What does this mean?

Swearing, insulting, or threatening someone directly or indirectly on social media is a crime, just as it is done face-to-face in real life. Furthermore, the penalty increases when the insult is posted under a publicly accessible post. The victim has six months from the date they learn of the incident and the perpetrator to initiate legal proceedings; the parties are also given the opportunity to reach a settlement before going to court.

Digital Evidence Collection: Legally Viable Means of Proof

Adequacy of Screenshots and Risk of Manipulation

In cybercrime cases, the most frequently asked questions by victims, such as "Can a screenshot be considered evidence in court?" , "Can an Instagram DM be considered evidence?" , or "Can a WhatsApp conversation be used as evidence in court?" , are answered by stating that these recordings alone are not always considered conclusive proof. Thanks to advancements in technology and digital editing software, a chat or comment can be manipulated in seconds to create fake screenshots. According to Supreme Court rulings and criminal law standards, unless there is supporting evidence or a properly conducted verification process, a simple screenshot may be insufficient due to the principle that the defendant benefits from the doubt.

Evidence Securing with the Turkish Notaries Union E-Determination System

The safest way to prevent perpetrators from deleting defamatory or threatening content in the digital environment is to legally establish evidence. Knowing how to obtain notarized documentation in the event of an online breach is crucial. Notarized reports containing screenshots and hash values obtained through the Turkish Notaries Union's e-evidence system ensure that the evidence is officially recognized as it is at that moment. Obtaining this documentation before the content is deleted eliminates concerns such as "can deleted messages be recovered by IT experts?" and strengthens the basis of the complaint.

URL, Profile ID Identification and Digital Forensics Standards

Documenting an act of insult or threat is not enough; the perpetrator's digital footprint must also be accurately recorded in the file. Attention should be paid to how to identify the URL at the time of the incident; the full link (URL) of the offending post, the account's static profile username (ID number), and the time range in which the act occurred must be recorded completely. Protecting the obtained data in accordance with the rules of digital forensics evidence chain ensures that subsequent cybercrime evidence examination processes yield positive results in favor of the victim.

Illegally Obtained Evidence Trap (CMK Article 217/2)

In the process of proving a crime, the victim must avoid resorting to illegal methods that would put them in the wrong. Unauthorized access to the perpetrator's device, using spyware, and setting traps with fabricated dialogues are all against the law. Similarly, acting on the misconception that an unauthorized audio recording can be used as evidence in an internet-related case negatively impacts the course of the trial. According to Article 217/2 of the Code of Criminal Procedure (CMK), any evidence obtained through unlawful methods cannot be used as the basis for a judgment in a trial and is considered invalid.

What does this mean?

Simply taking a screenshot may not always be enough, as these images can easily be forged using software. Obtaining a notarized verification of the content via the website before it is deleted, or saving it in a way that is suitable for digital forensics along with the URL and account codes, will prevent the evidence from being discarded in court.

Detection of Anonymous, Fake Accounts and IP Address Processes

Coordination between the Cyber Crime Fighting and the Public Prosecutor's Office

Among the most frequently searched topics by those who have been subjected to insults or threats online are questions such as "I'm being threatened from a fake profile, how can I find them?" , "Who owns the fake account, can the prosecutor's office find them?" , and "How can I find the person who insulted me on Twitter?" . The Public Prosecutor's Offices, which are the investigating authorities for crimes committed through information technology, work in coordination with the General Directorate of Security's Cyber Crimes Department. In the process of identifying suspects in cybercrime cases , not only the act itself but also other criminal elements such as whether creating a fake account is a crime , or violations of privacy or unlawful use of personal data that warrant punishment, are examined within the scope of the case file.

IP Sharing Policies of Foreign-Based Platforms (Meta, X, TikTok)

The biggest questions encountered in digital investigations revolve around "Does Twitter provide IP addresses?" and "Does MetaTurkey share IP addresses?" . Foreign-based social network providers operate in accordance with their own privacy policies and international judicial cooperation principles. While data sharing in cases of direct defamation varies according to platform policies, in cases involving death threats, blackmail, child abuse, and threats to public safety, a swift response is provided to prosecutor's requests, and user login and logout logs and IP information are transmitted to judicial authorities.

Analysis of Internet Service Provider (ISP) HTS and NAT Records

When an IP address is obtained from a platform or open sources, national telecommunications records are used to identify the IP address used by the fake account for defamation . Through the prosecutor's office, Internet Service Providers (Türk Telekom, Turkcell, Vodafone, etc.) are requested to provide information on the allocation of the relevant IP address at the date and time the criminal act was committed. Especially in CGNAT structures where the same IP address is shared by thousands of users, port numbers and HTS records are meticulously matched in defamation /threat investigations, linking the identification of the anonymous account's IP address to a specific individual and address.

Tracking VPNs, Proxies, and Privacy Tools Using Computing Forensics

The answer to the frequently asked question, "Can someone using a VPN be identified?" , lies in the multi-layered structure of digital forensics. The perpetrator's use of a VPN, Tor, or proxy does not provide absolute immunity. Cybercrime experts can uncover the suspect's identity using methods such as timestamp analysis, device fingerprinting, recovery emails or phone numbers linked to the account, leaked DNS logs, and open-source intelligence (OSINT).

What does this mean?

Just because someone uses a fake name or an anonymous account doesn't mean they can't be found. Prosecutors, along with cybercrime experts, can trace the owner of the device and line back to internet service providers and related network connections (IP addresses).

The Process from Criminal Proceedings to Claims for Non-Pecuniary Damages

Prosecutor's Investigation and Criminal Court Trial

In a process initiated by the victim with a properly prepared complaint form for cybercrime cases , a public prosecution is opened after the suspect is identified and evidence is collected. When the Public Prosecutor's Office reaches sufficient suspicion, it prepares an indictment and sends the file to the competent Criminal Court of First Instance. At this stage, victims often wonder "how long does a defamation case take?" and "what is the statute of limitations for cybercrimes?" ; the trial is shaped by the judicial calendar, expert examinations, and notification processes. During the hearings, the validity of digital evidence is discussed, and judgments are made that prescribe a fine or imprisonment for the perpetrator; at the same time, the right to defense is guaranteed for parties who are wrongly accused of cybercrime .

The Impact of Criminal Conviction Decisions on Civil Courts

A conviction in a criminal court for a social media threat case or for online defamation is decisive for subsequent legal steps. While, according to the Turkish Code of Obligations (Article 74), a civil court judge is not generally bound by an acquittal decision from a criminal court, conviction decisions and factual findings that definitively establish that the perpetrator committed the criminal act are binding on the civil court. This significantly reduces the burden of proof for the victim in a subsequent compensation lawsuit.

Protection of Personal Rights and Claims for Non-Pecuniary Damages

As seen particularly in recent news regarding celebrity social media lawsuits and the search for information on how to file defamation lawsuits against artists , filing a defamation lawsuit and a claim for moral damages in the Civil Court of First Instance, in addition to criminal proceedings, is a fundamental way to restore the rights of the victim. The loss of reputation, psychological distress, and attack on the victim's personal values suffered in the digital environment constitute the subject of the compensation claim.

The answer to the question "How much is the compensation amount in an online defamation lawsuit?" , which is frequently asked by citizens, is determined by the court based on the economic and social status of the parties, the degree to which the defamation or threat was made publicly, and the severity of the impact created.

What does this mean?

The process doesn't end when the perpetrator receives a sentence in criminal court. The victim, suffering distress, loss of reputation, and psychological trauma, can also file a lawsuit in civil court to claim compensation.

The Role of Professional Support in Information Technology Law Processes

Filing Digital Evidence in Accordance with Technical Regulations

In crimes committed on social networks and messaging platforms, the most critical stage is securing the evidence before it is destroyed. Victims frequently encounter situations such as "Can a lawsuit be filed if a comment is deleted?" or "Is defamation in a story a crime?" , where there is a risk of content being deleted or disappearing after 24 hours. Properly documenting the evidence, obtaining hash values, performing time-stamped notarized e-evidence procedures, and filing it without disrupting the digital forensic evidence chain prevents dismissals due to insufficient evidence in later stages.

International Judicial Assistance and Negotiation Processes

In digital crime investigations, prosecutor's requests must be made using accurate technical terminology and complete data. Identifying the perpetrator, particularly in cases involving insults in group messaging , insults and threats during live broadcasts , or profanity in in-game chat , depends on requesting accurate server logs, NAT/IP mappings, and user account data, depending on the platform type. Proper execution of international judicial assistance (requests for judicial assistance) and international data requests directly increases the likelihood of identifying the perpetrator.

Technical Review of Expert Reports and Objections

During the investigation and prosecution phases, the case file is referred to forensic IT experts. The resulting expert reports may reveal technical errors such as IP address conflicts, dynamic IP assignments, time discrepancies in modem logs, or errors in device image (forensic copy) analyses, all of which can affect the outcome of the case. A thorough technical and legal review of these reports, timely objection to erroneous findings, and requesting additional reports if necessary, will prevent loss of rights.

Managing the Balance Between Statute of Limitations and Penalties/Compensation

In cybercrime cases, meticulous attention is required to the 6-month complaint period and the statute of limitations for prosecution. The process should not only focus on the criminal aspect but also encompass a holistic legal plan that includes monitoring reconciliation negotiations, strategizing for compensation claims following convictions, and ensuring the perpetrator faces sanctions for cyberbullying .

Have you been subjected to insults or threats in the digital environment?

In cybercrimes, evidence can be deleted or altered in seconds. To avoid loss of rights, to ensure proper technical evidence collection, and to manage the legal process correctly, it is recommended that you consult with a lawyer specializing in information technology law from the very beginning of the process.

Online Appointment Request

Frequently Asked Questions (FAQ)

Can a screenshot be considered evidence in court?

Simple screenshots, being susceptible to manipulation and editing, may not constitute conclusive evidence on their own. For evidence to be considered valid, it must be verified through a Notary Public's E-Verification system and recorded in the digital forensics database along with URL and profile ID information.

Is it possible to find the person who is posting the insults from a fake or anonymous account?

Yes. Prosecutors and Cybercrime Units can identify the real person behind fake accounts by tracing IP addresses, CGNAT port mappings, and Internet Service Provider (ISP) log records.

What is the time limit for filing a defamation lawsuit on social media?

In defamation cases under Article 125 of the Turkish Penal Code, the statute of limitations for filing a complaint is 6 months from the date the act and the identity of the perpetrator are learned.

Can a lawsuit be filed if insulting and threatening messages are deleted?

If the messages were notarized before being deleted, or if screen recordings were submitted to forensics along with URL/account data, a case can be opened. Furthermore, identification can be made through system logs and device examinations via the prosecutor's office.

Is it possible to win compensation for moral damages in a defamation case on social media?

Yes. After the crime is proven in criminal court, the victim whose personal rights have been violated can file a lawsuit for moral damages in the Civil Court of First Instance to claim monetary compensation.