Türkçe
العربية
From the Notebook of a Trademark-Patent Attorney
Ms. JANSET UNDERSTANDS WHAT PROTECTION OF PERSONAL DATA MEANS
After carefully parking her car in the open parking lot, Ms. Janset started walking towards the building of the company she worked for. She was wearing a tight, pink skirt that exposed her knees and a flowing blouse made of silky fabric. The pink figures on her blouse were in harmony with her skirt. Her long, blonde hair with bangs was waving as she walked. Ms. Janset looked very happy. Today was her first day at work after her annual leave, which she had used for the first time for four weeks without a break.
The holiday was very good for Janset Hanım. She washed the stress of a year of very busy work life and the remnants of stressful days left in her soul in the clear waters of the Aegean, became cheerful, revitalized, and started to feel as lively and crazy as she did when she was a young girl. This long holiday was also very good for her relationship with her husband. They had not shared anything properly for a long time, they had not even been able to have a proper conversation with her husband for months – and she loved talking to him very much – they talked for hours, drank lots of different wines, lay on the beach, cuddled and slept, kissed under the moonlight. Almost every night, after drinking too much, they went into the sea – they loved going into the sea at night, in the dark – they went out talking, joking, then, they returned to the shallow shore again, hugged each other in the warm and shallow waters and abandoned themselves to the rhythm of the calm waves.
As she entered the main door, she was smiling for no reason, influenced by her holiday memories that were still very vivid. She was dynamic. She was cheerful. She greeted the security guards at the door with “Hi!! Kids”. She went up the stairs to the executive floor, where her room was located, without using the elevator this time. Everything was great.
However, she did not find the response she expected on the faces of her friends whom she greeted cheerfully on the floor where her room was located. It was as if there was something strange in the environment. She entered her room. She put her bag on her desk. She had just sat in her chair when the floor secretary first stuck her head in through the door, then entered talking. “Welcome Janset Hanım, I hope you had a good holiday”.
“It was very good, I left all the heavy metal residues that my soul had collected in the Aegean and came here,” said Janset Hanım. The secretary interrupted Janset Hanım with an anxious expression, “Do you know what happened?”
“Do I know about what happened and why?” asked Ms. Janset. As she said these, possibilities of what could happen were passing through her mind at lightning speed. Has our country entered a conflict? Are there abnormal increases in foreign exchange? Could the government have resigned? A hot conflict?
The secretary lady started talking without wasting any time.
“Oh!! Don’t ask!! Ms. Janset, things are very chaotic. This is a disaster we have never seen in the company before, you won’t believe it, the chairman of the board called me last night. He asked if you were coming. This was the first time I saw the chairman so nervous.”
“I was at home when the president called. My daughter’s friends had come to us. We were celebrating my daughter’s birthday. But I was so tired that I can’t even tell you. After working all day at work, I ran around to get something to eat for her birthday. After shopping, I took a taxi home and prepared something to eat.
Can you imagine? Ms.Janset , my daughter is a senior at university but her sense of responsibility has never developed. I have been telling her for a week that my daughter should prepare something for her friends to come, and that is exactly the last day…”
Janset Hanım exploded; loudly “Enough!!! Leyla Hanım, enough!!! Please stop telling me about your own life… Can you tell me what happened right away, briefly and quickly?”,
“AA, don’t ask Ms. Janset, while you were on your last days of vacation, exactly 2 days ago, our company’s data officer quit his job. He found a job at another company. Before leaving, he spoke to the Chairman of the Board of Directors and asked for severance pay and 10 gross salaries for the extra days he would be idle, even though he resigned. When the president rejected this request, he said, ‘You are making a mistake, Mr. President, this attitude of yours will have a heavy impact on you. I have given years of my life to this company. I have fulfilled a very important duty. I have worked loyally for you. Should this be the reward? I am not leaving happily, just know this’…etc.”
“You know the president. He got very angry at these threatening words. He shouted, “Get out of my presence, you are shameless.” ‘If you have served for so many years, you have received more than enough. Moreover, you suddenly appear before me and say that you have resigned. While you have not even shown the responsibility of handing over your job, you are shamelessly demanding compensation from me. Get out!! If you have any rights, go to court, get them from me through the court, get out of the company,’ he said and kicked him out of his office. Then he came to the secretariat room. His face was pale. It was the first time I have seen him so angry. He was also very anxious. ‘What days have we come to… He will blackmail me and extort money, surprise, look at his audacity,’ he grumbled.
‘Leyla Hanım, call security immediately, have them go to the data room and secure the room. The data officer has left the job. All his authorities and accesses in the company should be revoked… He should be taken out of the company as soon as possible,’ he said.
Last night, the president received an e-mail. The e-mail, the source of which the president did not know, stated that they had attacked the company’s database, that they had the personal data of 45,973 people, 2,337 contracts and 825 application files, and the credit card information of 27,000 people in the database, that they wanted only a small amount of money, only 1,000,000 USD, in return for all this valuable stuff, and that if the money they wanted was not paid, the president would be responsible for the consequences.” “That’s it, Janset Hanım. President, have Janset Hanım come to my office as soon as she arrives,” he said.
“She was very nervous.” Janset Hanım was shocked and almost frozen after what she had heard.
Moreover, the data officer was a staff member of Janset Hanım… She knew that spreading the data was a serious crime. Would this crime affect her as well?
Ms. Janset thought to herself, “How did I not sense that he was betraying her like that… Damn it, if I hadn’t gone on vacation, none of this would have happened. Damn it!!! Damn it!!!” The feeling of guilt stabbed into Ms. Janset’s brain like a spear. Wrinkles that weren’t there a few minutes ago appeared on her face and settled, a headache suddenly started, her blood pressure suddenly rose. She walked around her room aimlessly. She looked in the mirror. Her face was bright red. She thought to herself, “My God… How could something like this happen? How could that kid do something like this? This was how business life was. Just when you thought everything was going so well, a trouble, a dark cloud would come from an unexpected place and settle on top of you.” Ms. Janset’s vacation memories had also burst like a balloon. All the troubles she had left behind in the cool salty waters of the Aegean had suddenly returned.
She went to the president’s office. It was really the first time she had seen the president so worried. The man’s face had darkened. His cheeks had sunken…
“Come on, Janset Hanım, sit down,” he said.
“How was your vacation?”
Janset Hanım understood that the president was asking this question just for the sake of it. Or was the president being sarcastic? Could it have been sarcastic? While Janset Hanım was thinking about what to say in the anguish of her guilt, the president asked again without waiting for Janset Hanım’s answer, “Did you hear what happened?”
“Yes, President, I heard,” Janset Hanım said in a whisper, “I am very sorry President, how could I not have realized this guy’s intention, how did I take such a long vacation, I made a big mistake,” as if confessing her sins one after another, the president interrupted Janset Hanım.
“No! No! Ms. Janset, you have no responsibility in this incident, and if you recall, I also wanted you to take a long vacation. Please do not blame yourself. Let’s calm down. Let’s decide what to do in cold blood. First of all, we do not have any information that the Data Officer did this. Therefore, it would not be right to directly blame him. However, he is definitely at the top of our suspect list. Our systems do not allow the Data Officer or anyone else to physically enter the system and upload data to a device. Therefore, the Data Officer could not have copied any personal data during the period he worked here. This is impossible. I called the software developer friends to the company last night, they worked very hard until the morning. They say that the data may have been seized by an external attack. In other words, it is certain that we were attacked from outside… However, we are trying to find out how much damage there was. How much data we lost.”
“Ms. Leyla said it. They want 1,000,000 USD in exchange for the data. If we pay the money, they will return all the data they stole.”
Ms. Janset started talking, “President, I think we should pay this money and get the data back. Because, the cost of this job will be many times higher. We have to say that it is a profit no matter where we lose. After all, 1,000,000 USD is an amount we can give up. Then we will increase our security measures.”
“I thought about that too, Ms. Janset,” said the president.
“However, first of all, we do not know whether they will keep a copy of the data.
Secondly, it will definitely get out in some way that we have succumbed to blackmail and the hackers of the whole world will come after us. We cannot escape the attacks.
Thirdly, if a company like us that produces security software loses to hackers, it means it has ‘fallen’ in the eyes of the market. Ms. Janset, business life is a dog’s den. “It is the law to eat what is left in the dog’s den.” If we fall, our competitors will not hesitate to tear us apart. After reading that e-mail last night, I did not sleep until the morning and I thought, Ms. Janset, the conclusion I reached is; paying tribute to these blackmailers is not one of the alternatives. What else can we do? Let’s think about that.”
There was silence for a while… Anxiety dominated the atmosphere, but Ms. Janset started to think very quickly after she got rid of her guilt. “What can be done, what can be done”, no solution came to her mind. We cannot solve it, but is there anyone we can get help from? While she was thinking, she turned to the president. “President, did you call our company legal advisor, the lawyer lady in Ankara? Maybe she can help us.”
The President smiled hopelessly. “Ms. Janset, we made a big mistake, we lost our data. This is a software issue, what can the lawyer do about it?”
“Don’t say that, President, just before I went on vacation, the lawyer came to Istanbul. After our monthly meeting at the company, we went to dinner together. During dinner, the conversation turned to the subject of personal data protection. A friend’s personal data was published on the Internet by her ex-husband. I asked the lawyer about that issue, which upset me a lot, and she gave me quite detailed information, she was knowledgeable about the subject. In fact, I gave my friend the lawyer’s office phone number in Ankara. My friend called me while she was on vacation. She was very pleased. She thanked me many times…”
The President’s face brightened, he had hope. Really! Why didn’t he call the lawyer? He immediately took his cell phone from the table. He found the lawyer’s phone number. He called. After a short talk, the president got to the subject with impatience. He told the story from beginning to end.
“This will put us in a very difficult situation, lawyer lady. We absolutely must resolve this issue. If necessary, we are ready to spend 10 times the money the blackmailers want for this cause,” he said.
The lawyer lady listened to the president calmly as always, then said, “Don’t worry and don’t think you are helpless. Because we are not helpless. First of all, we will try to identify the defendant or defendants who attacked the company’s systems.
First of all; by law; we are obliged to inform the Personal Data Protection Board within 72 hours, starting from the date and time the data breach was detected.
Secondly, please forward the e-mail sent to you by the attackers to me. I will try to identify the IP number from which the e-mail was sent and the address where the IP number is located. I am coming to Istanbul on the first plane, I will file a criminal complaint with the Public Prosecutor’s Office.”
“Thirdly, please have the company software developers determine the method used for the attack, which data was stolen and the extent of the data theft.”
The way Lawyer Hanım took control of the situation, her self-confidence, impressed both the president and Janset Hanım. Janset Hanım noticed that the president’s face had become lively and that he had become more lively. A power that understood them had taken control of the situation. The power of law.
The president sent the blackmail e-mail to Lawyer Hanım. Then, they hurriedly left the room to go to the software developers working on the issue to convey Lawyer Hanım’s demands. Lawyer Hanım had started the procedures.
The days full of anxiety for both the president and Janset Hanım would never pass. Finally, the phone that the president could not put down rang. It was Lawyer Hanım calling.
The president’s eyes watered when he heard Lawyer Hanım’s cheerful voice saying “Congratulations”. A drop of tear rolled down his cheeks. With a trembling voice; “My God, this is such good news Lawyer Hanım, thank you… bless you…” he could not speak any more.
The case was solved. The defendants were caught. The company’s data officer and a few of his friends had formed a gang, but they were caught red-handed as a result of a close pursuit. The unsuccessful gang members had confessed to their crimes in their statements at the police station. The defendants would probably be taken to the courthouse at noon. The lawyer would attend the criminal hearing at the courthouse as the complainant’s attorney, and then come to the company and give more detailed information. She had a lot of other good news.
A few hours later, in the president’s office, the president and Janset Hanım were listening to the lawyer. They were filled with curiosity, happiness, admiration, gratitude… All positive emotions. After receiving the e-mail, the lawyer had prepared a complaint petition and applied to the Istanbul Public Prosecutor’s Office. The public prosecutor, convinced of the importance of the incident and the importance of taking action immediately, referred the documents to the cyber crimes department, then the sender’s IP numbers were used to identify their addresses, and the defendants’ correspondence in the sudden raids on their homes and the searches on the seized computers revealed their criminal plans in full detail. Seeing that the crime had been exposed, the defendants started talking in the hope of getting a reduced sentence, and everyone blamed each other.
In fact, the defendants could not achieve their goal thanks to the cleverness of a software developer in the company, in other words, thanks to a coincidence.
The incident was reduced to the crime of attempting to loot with the threat of harm. It was a serious crime. Although the gang was unsuccessful and they could not harm the company or its data, the defendants were arrested. “The data controller planned to carry out the cyber attack after leaving work,” said the lawyer. “He turned on the Debugging feature in the system for the attack and left it on.
” “What is the Debugging feature?” said Janset with astonishment in her eyes.
The President answered; “Debugging is the process of detecting and removing existing and potential bugs that may cause a software code to behave unexpectedly or crash. This process starts after the software does not work properly and ends with the problem being solved and the software being successfully tested. However, it is also a risky situation. A user who has access to this port can steal your information or send a malicious application to the device. Although Debugging is used to enable developments, if the debugging feature is turned on, malicious people can access the system via the internet and access the system with cyber attacks they will carry out. Debugging provides this opportunity.
“Very true,” said the lawyer, “The Personal Data Protection Board considers the fact that debugging is turned on as a defect on the part of the company in the event of an attack.
At this point; the data authority turned on debugging to prepare the system for the attack, but a software developer who noticed the situation found this situation problematic and turned off the debugging feature on his own. Thanks to this, the defendants were not able to infiltrate the system at all. The email they sent was completely false information that the data was in their hands.”
The lawyer continued;
“The Personal Data Protection Board, in its investigation, found that for access from outside the company, a VPN was used to connect to the Company IP for security purposes and that individuals were given a special username and VPN password, and that the attackers connected to the system via SFTP and VPN, but in the penetration test conducted, it was determined that there was no vulnerability in the system and especially in the web applications. This situation is a source of appreciation for our company,” she said.
The unpleasant incident was a test that showed that the company was functioning very well.
Although it caused the president to lose a few years from his life…