Those data were leaked to the Darkweb years ago

Timur Soykan

İBB Mayor Ekrem İmamoğlu, his advisor Necati Özkan, and journalist Merdan Yanardağ were arrested on heavy charges such as espionage.

But what are the evidences behind this severe accusation?

The testimony of Hüseyin Gün is presented as the main evidence. It was portrayed as if Hüseyin Gün, benefiting from effective remorse, had confessed to spying. However, Gün does not admit to any espionage activity, nor does he accuse anyone else of it.

Despite that, the prosecutor’s office claimed there had been an espionage operation.

In short, the allegation is as follows: the İstanbul local elections won by İmamoğlu on 31 March 2019 were annulled. Twelve days before the rerun in June, Hüseyin Gün met İmamoğlu’s advisor Necati Özkan. It is claimed that the ibb.gov.tr database was given to Gün and transferred abroad. Finally, in an inexplicable way, these 2019 allegations are linked with the ‘İstanbul Senin’ application launched in 2021 and the unreleased ‘İBB Hanem’ app. The claim is that their data were also transferred abroad.

‘THEY ASKED ME TO HELP’

However, even Gün, described as a ‘confessing agent’, makes no such claim. Gün said that his spiritual mother, businessperson Seher Elçili Alaçam, supported İmamoğlu. He stated that after the election İmamoğlu had won was annulled, he met Seher Hanım and Necati Özkan in June. He said: “My spiritual mother asked me to help Necati Özkan. That was because I had a company specialising in social media analysis. But I don’t know whether that request came from Necati Özkan or from my spiritual mother.”

According to Gün’s statement, he told Özkan that through social media analysis they could identify the public’s needs and major concerns, which could be used in the campaign. He said they would deliver daily reports.

Here is where the main allegation begins. Gün said: “When I asked Necati Özkan what the social media analysis would be based on, he asked if İBB database data existed within Osint DarkWeb. I said I hadn’t checked but that my technical team could look into it.”

ASSUMPTION-BASED ACCUSATION

Osint DarkWeb is in fact an open source. Hackers or data sellers upload companies’, institutions’, and football clubs’ email addresses and passwords to the dark internet. It is impossible to determine when, by whom, and for what purpose this data was uploaded or sold.

The prosecutor assumes these data were uploaded to the Darkweb by Necati Özkan or some İBB personnel and presses charges accordingly. Gün, however, said: “Necati Özkan told me ‘İBB data might be in the OSINT system, check it’. My technical team found that they were indeed there. It’s impossible to see when data were uploaded without research. Whether İBB data was hacked or uploaded willingly by someone, I cannot know.”

Despite persistent questioning, Gün never claims that Özkan or any other accused person uploaded the ibb.gov.tr data to the Darkweb.

He says he found some İBB emails and passwords on OSINT-Darkweb and sent 20 of them to Özkan. These addresses are listed in the statement record.

DATA LEAKED DURING AKP ERA

Those email addresses reveal a crucial clue.

Because ibb.gov.tr data is constantly updated, to determine when they were uploaded, one must look at when those email owners worked there. According to this, one of the names, H.G., started working at İBB in 2005 and left in 2015. Therefore, his email could not have existed in the İBB database after 2015. That means the data must have been uploaded to Osint-Darkweb before 2015. Another person, S.P., started working at İBB in 1998 and left in 2018. His email also appears on the Darkweb, which shows the data were uploaded before 2018.

It thus appears that a leak from ibb.gov.tr to Osint-Darkweb occurred during the AKP’s administration of İstanbul Metropolitan Municipality.

Moreover, Necati Özkan denied Gün’s claims in his statement. He said Gün had made a presentation about social media analysis and asked for a fee far above the market rate. Özkan said the presentation was inadequate and that they had decided not to work with him.

Gün stated that they used an app called Wickr, which Özkan had also installed on his phone. Pro-government media portrayed Wickr as a crypto app used by spies. But Gün said it was an app similar to WhatsApp, easily downloadable from AppStore and Google Store. His username on Wickr was Jupiter1881.

He initially could not remember Özkan’s username but, after being shown screenshots, claimed that ‘bluestar81’ was Özkan. In the interrogation records, Wickr messages show Gün forwarding reports from his US partner Aaron Barr. He said Barr, whom he described as a former CIA agent, had no direct contact with Özkan. The alleged reports sent through Wickr are no different from casual political chatter at a coffeehouse. Gün claims they analysed social media data to find out what İmamoğlu needed to win the election, ideas anyone could think of. Some messages claim they accessed information about the AKP’s campaign through personal messages and emails, but their accuracy is unknown.

Özkan said he had never used Wickr, had not written those messages, and that they were fabricated.

Nevertheless, Özkan was arrested for the second time solely on these claims.

HOW IT WAS LINKED TO İMAMOĞLU

So how were these claims connected to Ekrem İmamoğlu?

In fact, they were not, yet the İBB Mayor was arrested on espionage charges.

Gün said he wanted the reports he sent to Özkan to be conveyed to İmamoğlu. “Necati Özkan said he had given them to the Mayor,” he claimed. But the only piece of evidence cited for İmamoğlu’s arrest is a single photograph.

In 2019, after winning the election for the second time, İmamoğlu was visited by Gün and Seher Elçili Alaçam. Gün said Özkan arranged the visit. The WhatsApp messages between Özkan and Gün confirming this were added to the case file. Özkan also admitted he arranged the meeting. But there are no Wickr messages about this particular visit.

Gün said he met İmamoğlu during that visit, which lasted 10 minutes. He said İmamoğlu told him, “Thank you for your support for the campaign,” and added, “At that moment I was sure he knew about our activities.”

Shown the photo during his interrogation, İmamoğlu said he remembered those visitors. He stated that he thanked everyone in the same way during congratulatory visits and said, “I have no knowledge of these people, these reports, or any of the claims mentioned.”

Note: This article is translated from the original article titled O veriler Darkweb’e yıllar önce düşmüş, published in BirGün newspaper on November 5, 2025.