An operation was carried out against Ankara-based Aydo Yazılım as part of a cyber espionage investigation in a joint effort coordinated by MİT and conducted with the Cybersecurity Presidency and the Gendarmerie General Command. Five suspects, including the company owner and employees, were detained in the operation.
Numerous computers, mobile phones and digital materials were seized during searches of the suspects’ homes and workplaces.
Special query interface in union software
The investigation found that a special query interface had been added to some programs developed by Aydo Yazılım, which provides software services to trade unions, allowing access to the information of third parties who were not union members.
It was determined that data sets leaked online from various sources in earlier periods could be queried through this system. Queries made using Turkish identification numbers enabled access to individuals’ identity and population registry information, while the databases operating behind the system were found to contain more extensive personal data.
The query system was found to be used to complete membership information when adding members to trade unions. After records belonging to individuals under the age of 18 were also found in the databases, the investigation into the purposes for which the extensive data pool was used was broadened.
“NVİ” notation in system records
Examinations of the servers showed that the notation “NVİ” was used systematically in system records containing personal information. This use was assessed as creating the impression that the data originated from Population and Citizenship Affairs.
Following an examination of the technical findings, it was determined that the data in question had not been obtained directly from the systems of Population and Citizenship Affairs.
Data queries under the name of “personal data protection consultancy”
The investigation also found that Aydo Yazılım provided institutions and organizations with consultancy services under the Personal Data Protection Law under the name “Clock&Wise.”
The company was found to have provided consultancy services on personal data protection while also enabling queries of personal information through its trade union software.
The investigation into which trade unions used the system and to what extent, as well as the purposes for which the data obtained was processed, is ongoing. The investigation may be expanded in light of new findings obtained from the digital materials.
