For logs retained under Law No. 5651 to carry evidentiary weight in court, it must be provable that they have not been altered. This is precisely why electronic signatures and timestamping are indispensable.
Why Electronic Signatures?
Logs kept as plain text can be modified with any text editor. That reality:
- Destroys the evidentiary value of the logs;
- Invites the objection during a legal audit that "the records may have been tampered with";
- Can turn into a damaging piece of evidence in judicial proceedings.
An electronic signature (a signature created with a qualified electronic certificate under Law No. 5070) proves cryptographically that a log held a specific content at a specific moment in time.
What Is a Timestamp?
A timestamp is a cryptographic method that proves data existed at a given date and time by having a third-party Timestamping Service Provider seal it with trusted time information.
Authorized timestamp providers in Türkiye include:
- TÜBİTAK Public Certification Authority (Kamu SM) — the most widely used;
- E-Tuğra;
- E-Güven (TürkTrust).
How Signatures and Timestamps Work Together
- The log file is closed off for a defined time window (for example, a one-hour block).
- The file's hash value (SHA-256) is computed.
- The hash is signed with a qualified electronic certificate.
- The signed hash is sent to the timestamping service.
- The service seals the hash with its own signature and the time it was received.
- The resulting file (.tsr or .p7m) is archived alongside the log.
This makes it possible to prove, for a given log file:
- When it was created;
- Who signed it;
- Whether it was altered afterward.
Law No. 5070 on Electronic Signatures
Under Article 5 of Law No. 5070, a qualified electronic signature produces the same legal effect as a handwritten signature. For this reason, signing logs kept under Law No. 5651 with a qualified e-signature guarantees their evidentiary value in court.
SignLogger's Signing Architecture
SignLogger provides the following capabilities out of the box:
- Automatic hash chaining: Each log entry references the hash of the previous entry (a blockchain-like structure), so any retroactive change can be detected.
- Periodic electronic signing: Log blocks are signed with a qualified e-signature every hour or every day.
- TÜBİTAK Kamu SM integration: Connected directly to the timestamping service, so every signature is additionally sealed with a timestamp. When Kamu SM timestamp credit is defined, the signature and seal carry the approval of an authorized certification authority; if no credit is available, the server's own certificate and timestamp are used instead.
- Verification tool: A command-line and web tool that automatically verifies the signature and timestamp of any log file submitted to the judiciary.
- Evidence package generation: The PDF + raw log + signature file triad required for a court request, created with a single click.
Are Electronic Signatures and Timestamps the Same Thing?
The two work together but answer different questions:
| Electronic signature | Timestamp | |
|---|---|---|
| Question it answers | "Who sealed this data?" | "When did this data exist?" |
| Legal basis | Law No. 5070 on Electronic Signatures | RFC 3161 + a qualified authority (TÜBİTAK Kamu SM, etc.) |
| Role under Law No. 5651 | Binds the record's origin and integrity | Fixes the record's date via an independent authority |
In practice, the daily log package is first hashed, then sealed with a timestamp; the signature layer also binds the system that produced the package. This way, both "when" and "who" are answered cryptographically. For setting up the log-collection side, see the Law No. 5651 Logging Obligation guide.
Frequently Asked Questions
Q: Does SignLogger still work if I don't have an electronic signature certificate?
A: Yes. If no Kamu SM timestamp credit is defined, SignLogger continues to apply daily signatures using the server's own certificate and timestamp, and the logs are still archived with integrity protection. That said, because a signature approved by an authorized certification authority (Kamu SM) provides the strongest evidentiary value, obtaining Kamu SM timestamp credit is strongly recommended.
Q: Is timestamping a paid service?
A: Yes. TÜBİTAK Kamu SM sells on a credit basis; for a typical mid-sized business, the annual cost is on the order of a few thousand TL. SignLogger ships with Kamu SM integration ready to go: during the integration step you define your own Kamu SM username and password in SignLogger, and you purchase your timestamp credit from Kamu SM in your own organization's name. After that, daily signatures are applied automatically with the approval of the authorized certification authority.
How Timestamping Works (RFC 3161)
Timestamping is a method of having an independent authority certify that data existed at a specific moment. The process works as follows:
- The cryptographic digest (hash) of the daily log file is computed — the file itself is never sent out.
- The digest is transmitted to a qualified Timestamping Authority (for example, TÜBİTAK Kamu SM).
- The authority combines the digest with its trusted clock, signs it, and returns the timestamp token.
- The token is stored together with the log archive; later, the file's digest can be recomputed to prove "it existed in this exact state on that date."
Changing even a single bit completely changes the hash — which is why any subsequent tampering with a timestamped log file is mathematically detectable.
How the Daily Signing Cycle Works in Practice
In SignLogger the process is fully automated: at the end of the day, that day's logs are closed off, compressed, and hashed, a seal is requested from the timestamping authority, and the signed package is moved into the archive. The administrator simply monitors the success status of the signing jobs from the dashboard, and alerts are generated for any that fail. For the log-collection side of the process, see the Law No. 5651 Logging Obligation guide.
Proof in Audits and in Court
In a dispute, the chain of proof answers these questions:
- When was the record created? → The date in the timestamp token.
- Was the record altered? → The recomputed hash is compared against the hash in the seal.
- Who produced the record? → The signing certificate points to the organization or system.
Unsigned logs cannot reliably answer any of these three questions; faced with the objection that "the records may have been edited after the fact," their evidentiary value becomes contestable.
Frequently Asked Questions
Is each log line signed individually?
No — in practice, daily (or hourly) files are hashed and sealed as a whole, which is efficient in terms of both speed and cost.
Is timestamping paid?
Qualified timestamping works on a credit model; for daily signing the annual cost is low. Kamu SM integration comes ready in SignLogger; each customer defines their own Kamu SM account (username and password) in the system and purchases the timestamp credit from Kamu SM in their own name. When no credit is available, daily signatures are applied using the server's own certificate and timestamp.
What happens if the certificate expires during the retention period?
A seal is evaluated according to its validity at the moment it was issued; archived timestamp tokens retain their evidentiary force even after they expire. For retention policy, see the Log Retention Period article.