"Espionage" investigation alleges "he carried out espionage activities to secure international support"

An investigation launched by the Istanbul Chief Public Prosecutor's Office against Ekrem İmamoğlu, Necati Özkan, Merdan Yanardağ and Melih Geçek, who were suspended from their posts as Istanbul Metropolitan Municipality (IMM) Mayors after their arrest, for "espionage" is ongoing.

In the referral letter sent by the prosecutor's office to the criminal court of peace with a request for arrest within the scope of the investigation, it was stated that the content of the report by Ü.D.A., directed by the 112 Emergency Call Center, stated that the suspect Hüseyin Gün was engaged in espionage activities in favor of Israel, England and the USA and that he conducted his conversations through encrypted phones in order to comply with privacy.

Ü.D.A., who stated that Gün financed internal unrest in various countries and that he played an active role in financing a person or persons to carry out anti-government propaganda in the elections held in Türkiye, reportedly handed over Gün's digital materials (encrypted phone and handwritten documents) for examination upon being invited to testify, and an investigation was launched.

The article explained that the Financial Crimes Investigation Board (MASAK) investigation into Gün revealed that although he did not currently have any commercial enterprises, he had made large domestic and international money transfers, that 85 million liras of cash had been withdrawn from his accounts, and that no purchase or sale records were found regarding the use of this amount.

It was stated in the article that, as a result of the examination of the handwritten notebooks and documents, it was seen that the documents thought to belong to the suspect Hüseyin Gün included mentions of matters related to coup attempts and internal unrest that took place in different countries.

The article stated that Gün kept daily notes of the people or institutions he met with throughout Turkey and that he provided information on matters related to Turkey to intelligence officers considered to be operating in favor of the UK or to individuals engaged in political activities in the UK.

In the article, which stated that it was understood that Gün was operating as an intelligence agency employee under the guise of a businessman, it was explained that Gün, the suspected leader of a profit-oriented criminal organization, of which Ekrem İmamoğlu is alleged to be the ringleader, used the communication program called "Wickr", which is a crypto program similar to Bylock and used by different criminal organizations, as a result of investigations from affiliated institutions.

The article included findings regarding the suspects of the investigation, İmamoğlu, Özkan and Yanardağ.

It was noted in the article that there was a note in the notes section of the phone belonging to suspect Hüseyin Gün, which read "Wickr Jupiter1881 sehergul1950", and that there was also a different note in the same section with the phrases "Bluestar81 Necati W Handle" in a different note content.

It was stated in the article that the word "handle" in the note was understood to mean username-name in social media terms in open source research, and therefore the phrases "Bluestar81 Necati W Handle" mentioned in the note were understood to be the account with the nickname "Bluestar81" used by a person named Necati, and that the person with the nickname "Bluestar81" was determined to be Necati Özkan.

The article stated that an open-source investigation into the content of the messages between suspects Gün and Özkan revealed that they were conversations conducted over the application known as "Wickr."

The article noted that the conversation included the following points and topics: "digital intelligence gathering, matters to be considered in the work carried out for İmamoğlu, the urgent need to activate 70,000 volunteers, Murat Ongun's cell phone being infected with spyware that could allow remote access listening, and therefore it is very important for Murat not to take his phone to sensitive private campaign meetings with Ekrem Bey."

In the investigations conducted about Ekrem İmamoğlu, it was stated that Hüseyin Gün had accessed the personal information of many citizens through data found in his digital materials and determined to belong to the Istanbul Metropolitan Municipality database, and that the provision of the said data was indirectly provided by Necati Özkan.

As stated in the statement of suspect Hüseyin Gün, it was stated in the letter that many e-mail addresses and passwords belonging to the municipality, especially "ibb.gov.tr", were transferred to the digital environment, which is described as the underground of the internet world, by the suspect Necati Özkan, upon the suspect's instructions.

In the article, it was stated that the suspect Gün had accessed the data in the email contents, especially the confidential documents and internal correspondence of the municipality, using the email address and passwords, and that analysis studies were carried out with these data.

The article explained that the analysis part of the work was carried out by Aaron Bar, who is the partner of the suspect Gün, and that this person is the digital projects coordinator of the US intelligence service, therefore the email contents and data belonging to the IMM were seized by the intelligence services and by creating a perception with this data, the election was manipulated in favor of the suspect Ekrem İmamoğlu.

The article emphasized that voters' social media posts and private messaging were accessed using software called "PQ," also developed by Aaron Bar and used by intelligence services. It was also emphasized that this was done under the instructions of the suspect İmamoğlu. In a letter sent to the Inspection Board on April 19, 2019, signed by the suspect Ekrem İmamoğlu, three externally appointed experts and two municipal inspectors were given the authority to access, examine, and copy all data.

It was stated in the article that this matter was carried out specifically for the purpose of providing data to foreign intelligence services during election campaigns, that the analysis processes carried out on the said data were carried out under the guidance of foreign intelligence services, and that access to confidential/private data between individuals was provided during the analysis processes.

The article noted that data obtained from intelligence service members was transferred between Hüseyin Gün, Necati Özkan, and Ekrem İmamoğlu within a hierarchical chain, and that Aaron Bar, Özkan, and Gün, members of the foreign intelligence service, acted jointly to engage in perception management activities in order to remove the "IMM 2019 Data Copying" process, which had been publicly reported in the past, from the agenda.

The article noted that the suspects carried out this work on İmamoğlu's instructions.

The article explained that the agenda regarding the "2019 Data Copying" process was created in accordance with İmamoğlu's permission letter for data copying, that İmamoğlu was also involved in the action in question, that İmamoğlu benefited from the unofficial election propaganda carried out using the personal data of citizens, and that the suspect Gün testified that İmamoğlu had knowledge and involvement in the actions taken.

It was stated in the article that the suspect was referred to as "Mayor" in the content of the crypto program called "Wickr", and that this situation was confirmed by Gün, who made a statement within the scope of effective remorse, and that a similar data leak was also present in the program called "Istanbul Senin" created by the Istanbul Metropolitan Municipality, as detected in a different investigation, and that the data was leaked using the same method.

The article stated, "After the election process, photographs of the suspect named Hüseyin Gün taken in Ekrem İmamoğlu's office were found, and when the existing evidence and the confessor's statement were considered, it was understood that the suspect named Ekrem İmamoğlu obtained the personal information of citizens within the hierarchy by using his existing influence and transferred it to foreign intelligence service members, that he aimed to gain political benefits during the follow-up process, and that this participation was carried out together with individuals named Necati Özkan and Hüseyin Gün."

The article states, "For all these reasons, it has been determined that Ekrem İmamoğlu's profit-oriented criminal organization's aim is not only to raise funds for his presidential candidacy, but also to carry out espionage acts to secure international support. It has been determined that suspects Özkan and İmamoğlu tried to gain an advantage in the 2019 elections by accessing the social media and internal correspondence of a large number of voters, especially the corporate accounts of the Istanbul Metropolitan Municipality (IMM). In this context, they acted together with Hüseyin Gün, the leader of Ekrem İmamoğlu's profit-oriented criminal organization, who is arrested for military and political espionage. In particular, with the knowledge and instructions of the suspect İmamoğlu, a person named Necati Özkan transferred data belonging to a large number of municipalities to the internet environment called Ostin. Through the suspect Hüseyin Gün, they carried out analysis and reporting operations in order to stay one step ahead with the support of foreign intelligence services."

It was stated in the article that these issues were confirmed by Gün’s statements, that the suspect Gün received support from the intelligence services during the reporting process, and that therefore the suspects were involved in espionage activities in collaboration within a certain hierarchy, and that the suspect Yanardağ, on the other hand, created the press leg of the espionage activities by using the TELE1 channel, of which he is the editor-in-chief, as a tool, with the instructions and guidance of the suspect Gün.

In the article, it was stated that Yanardağ tried to create public perception through publications made as a result of analyses and reports made under the instructions of the suspect Gün, and that in return for these actions, he regularly received financial benefits in exchange for the purpose of complying with confidentiality, and that this issue was confirmed by witness testimony.

The facts indicating the existence of strong suspicion that the suspects committed the crime attributed to them and the reason for their arrest were recorded in the letter.