Criminal law · Legal information

I Received a Threat Message. What Should I Do?

Author · Av. Ayşenur Konar, Avukat

Published ·

In short

On a threat message, the integrity of the evidence and the procedure of the complaint are spoken of; the element of insult is not the same in every file.

The integrity of the evidence and the procedure of the complaint are spoken of. The element of insult is not the same in every file.

The definition of insult is in a separate article.

The screen and the backup of the device want context.

Related articles: insult.

A first practical order

  1. Back it up, without deleting the message, with the date, the number, and the application.
  2. Do not answer with a counter-threat; a new act may arise.
  3. In the complaint petition, write the insult and the threat in separate sentences.

If there is an urgent danger, secure safety before the evidence

The first question of a person who received a threat message is often how they will take a screenshot. If the message shows that the person who sent it has come to the place where you are, that they are following you, that they are carrying a weapon, or that they will carry the act out in a short time, the priority is physical safety. One needs to go to a safe place, not stay alone, and reach the police through 112. One should not wait in a risky place in order to gather digital evidence.

The level of the danger is understood not from a single sentence of the message, but from the past relation of the parties and the present conditions. Violence having been experienced before, the sender knowing your location, persistent following, expressions directed at the close circle, or the sharing of information of a vehicle and a weapon, may increase the risk. This information should be told shortly and concretely in the call for emergency help.

Sharing location with a safe relative, planning the situation of the children or of the persons who live together, and changing the routine route temporarily may also be thought of according to the conditions of the event. These measures do not stand in for the legal application; they support safety until the application is completed.

Preserve the whole of the message and its digital context

On a threat message, taking a screenshot only of the sentence that looks heavy may not be enough. What came before and after the word, the time it was sent, the account information, and the context between the parties affect the legal assessment. For this reason the record should be preserved without being cropped, and if possible together with the chain of the conversation.

In preparing digital evidence, the following information may be recorded:

  • The telephone number, the user name, and the profile information that appears
  • The direct link of the profile or of the post
  • The date and the time of the message
  • The earlier and later conversations
  • The original file of a voice message
  • The information of the persons who saw the message at the same time
  • Changes that happened later, such as blocking, deletion, or closing of the account

A screen recording may help to show the context by scrolling inside the conversation. Together with this, the data on the original device and in the application should be preserved. When the message is transferred to another telephone, a loss of quality or of technical information may be experienced. Instead of resetting the device, deleting the conversation, or writing an explanation on the image, a separate working copy should be created.

A threat, an insult, and an expression of anger are not the same thing

In everyday language, every heavy word that disturbs may be named as a threat. In the legal assessment, however, it is examined whether the word contains a notification of harm, whether this harm is directed at the future, its fitness to create fear and anxiety on the victim, and its context. A separation is made, event by event, among a coarse word, a curse, an expression of argument, and a threat.

A message may contain both a threat and an insult. For example, expressions directed at the person's honour, and words that notify that harm will be done to them or to a relative, may have separate legal elements. The contents on the offence of insult and insult on social media explain the honour and digital-evidence dimension of this separation.

In the application, the full content of the word, the event before it, and why it was perceived as serious should be told, instead of trying to make the name of the offence final. The legal characterisation is made by the prosecutor's office and the court. Instead of only saying "they threatened me", where the message came from and how the risk formed should be made concrete.

Create a record even if you do not know the sender's identity

The threat may have come from a fake or an anonymous account. Not knowing the identity is not a bar to the application. The user name, the profile link, the telephone number, the time of the message, and the account's other posts may be put before the competent authority. Asking for the platform or the communications records depends on legal and technical conditions.

It is not right for the victim, in order to identify the person by themselves, to enter someone else's account, to obtain a password, or to share personal data contrary to law. Accusing the wrong person in a way open to the public may give birth to a separate responsibility too. If there is a strong guess about the identity, its basis should be told; the guess should not be presented as certain information.

Because anonymous accounts can be closed quickly, the record should be taken without delay. A definite expectation about the result of identification should not be formed, however. The platform's record policy, the access addresses, and the character of the technical data affect the result. Preserving the evidence early supports the possibility of identification; it does not guarantee it.

Prepare the application with the chronology and the risk information

For a threat message, an application may be made to the police or to the chief public prosecutor's office. For the application to be functional, not only the delivery of the screenshots but an understandable chronology of the event is required. How the parties met, the earlier disagreements, whether there was a similar word or conduct before, and why the message was perceived as serious, should be explained.

The following may be in the file that can be prepared:

  • Identity and contact information
  • An orderly printout or a digital copy of the messages
  • The information that the original device is available
  • The suspect's known addresses and accounts
  • Earlier applications or protection decisions
  • A health report, a witness, or camera information, if there is any
  • A clear description of the continuing safety risk

Before the application record is signed, it should be checked that the messages were recorded in the right order and that the request was reflected correctly. A file number should be taken. If a new message arrives, an additional application should be made without deleting the old record.

Assess protective measures in a close relation or in persistent following

If the message was sent by a spouse, a former spouse, a partner, a family member, or someone who is in persistent following, the criminal investigation alone may not provide sufficient safety. Within the legislation on the prevention of violence, not approaching, not disturbing by means of communication, or other protective and preventive measures suitable to the concrete situation, may come onto the agenda.

In the request for a measure, data of the risk should be presented instead of an abstract fear. Facts such as earlier events of violence, coming to the home or the workplace, establishing communication through the children, writing persistently from different accounts, and information of a weapon, may carry weight. If an existing measure was breached, a copy of the decision and the time of the breach should be notified to the police at once.

A protection decision does not mean there is no longer a need for the person's own safety plan. Confidentiality of the address, informing the workplace and the school, or a need for safe transport may be planned separately according to the conditions of the event. The scope and the period of the measure should be followed according to the text written in the decision.

Do not create a new dispute while answering the message

An answer that contains a counter-threat or an insult may be the subject of a new investigation, independent of the first message. Expressions of the kind "I will find you too", even if written for the purpose of defence, may be assessed differently from the context. Continuing the argument causes the risk to rise and the chain of evidence to become complicated.

Preserving the records before giving a decision to block is important. In some situations, following new messages in a safe way may be meaningful for the investigation; the person is not expected to put themselves in danger for this, however. Physical and psychological safety comes before the wish to collect an additional message.

Trying to resolve the matter alone with an apology, money, or an offer of a meeting is unwise too. If a meeting is required, it may be moved through a legal representative or the competent authority, according to the character of the file. Publishing the message on social media and pointing at the sender as a target may give birth to problems of private life and of personal data.

Points to watch in the statement and identification proceedings in Ankara

After the application, the victim's statement may be taken, identification of the account or of the person may be asked, and an examination of the device may come onto the agenda. In the statement, what is known and what is guessed should be separated. If the sender's identity is not certain, the reasons for the suspicion should be explained, instead of saying "it is certainly this person".

In the statement record, the full content of the message, the date, the platform, the account, and the risk context should appear correctly. The record should not be signed without being read. If new evidence is found later, an additional statement may be presented. If you are asked to give a statement in the capacity of a suspect or in another capacity, rights before a statement should be assessed separately.

If delivery of the device is asked, the scope of the operation and the delivery record should be read carefully. Which device was taken, with which serial number, and for which purpose, should be entered on the record. Because of the wide scope of personal data, the procedure of the examination matters in the concrete file.

Follow the investigation and a possible trial

The prosecutor's office may research the correctness of the message record, the identity of the account, the earlier relation of the parties, and the context of the words. Correspondence with the platform or the operator, witness statements, and a digital examination may take time. Identification of the suspect does not by itself mean the elements of the offence have formed; the content and the intent are assessed separately.

If a new threat arrives while the file continues, it should be notified at once, stating its connection with the old application. If the severity or the concreteness of the message has increased, the safety measure should be taken up again. The address and the contact information should be kept current, and the services should be followed.

If sufficient suspicion is seen as a result of the investigation, an indictment may be drawn up; if sufficient evidence is not found, a decision of non-prosecution may come onto the agenda. The routes of application relating to these decisions, and the periods, should be checked from the text of the decision. It is not possible to give a definite word in advance about the result of the process.

The application and the following of the record in the Ankara context

A person living in Ankara may apply to the nearest police unit or to the chief public prosecutor's office; in an urgent event, 112 should be used instead of trying to reach a particular judicial building. Which unit the application will be conducted at takes shape according to jurisdiction and the features of the file. That a direction is made between units does not mean the application is worthless.

In a dense judicial operation, it is important to keep the file number, the application record, and the list of the records that were delivered. On which date the new evidence was put before which unit should be noted. Local density does not change the basic rights of the victim; it makes the discipline of following more important.

A final assessment

The right order in the face of a threat message is to secure urgent safety, to preserve the digital integrity of the message, to avoid a direct clash, and to make the application with the chronology. A fake account or a deleted message is not a bar to the application; a technical identification, however, may not give the same result in every file. If there is violence in a close relation, or persistent following, the need for a protective measure should be taken up separately.

This article is for general information. The content of the message, the relation of the parties, the level of risk, and the state of the evidence are assessed according to the concrete event. For a wider frame, the contents of criminal law, for expressions directed at honour the offence of insult, and for digital records insult on social media, may be examined.

The message record is read together with the complaint. A prison period that is not in the file is not added. A screenshot is not counted as the only evidence. The separation is built from the message record. The Çankaya office does not choose the competent authority in this threat file.

Conclusion

This article is for general information. The document, the period, and the procedure of the concrete event should be read separately; there is no promise of a result from memory.

Frequently asked questions

When I receive a threat message, should I call the police first?

If the message shows a danger that is near, concrete, and likely to happen, going to a safe place and asking for emergency help through 112 has priority. If the person has come to your location, or speaks of a weapon or of following you, one should not stay alone. Even if there is no urgent risk, the message should be preserved without being deleted, and an application to the police or the chief public prosecutor's office should be assessed. A legal proceeding does not stand in for physical safety; if the level of risk changes, the channel of the application should be updated without delay.

Is a screenshot enough to prove a threat message?

A screenshot is a useful starting piece of evidence; it may not be enough by itself in every file, however. The user name, the telephone number, the date, the time, and the context of the conversation should appear in the image. What came before and after the message should also be preserved, and the original device and the application record should not be deleted. Because the account may close later, the profile address and the connection information, if there is any, may be recorded. An additional technical examination, or official records, that will show that the content was not changed and to whom the account belongs, may be needed.

Does the account that sent the message being fake bar a complaint?

No. Even if the real identity of the account is not known, an application may be made with the existing user name, the profile link, the time of the message, the telephone information, and the other technical traces. The competent authorities may ask, within the statutory conditions, that the platform or the communications records be examined. It cannot be said, however, that the owner of every fake account will certainly be identified; the character of the records and the state of keeping them matter. The victim trying, by their own methods, to enter the account or to collect personal data contrary to law may give birth to a new risk.

Should I answer a threat message?

Answers that will enlarge the argument, or that contain an insult or a counter-threat, should be avoided. Cutting communication for urgent safety is often healthier; preserving the existing records before blocking, however, is important. Whether a short message that sets a boundary is suitable changes according to the character of the event. If there is a protection decision or a ban on communication, no contact may be made at all. Provoking the person who sent the message, calling them to a meeting, or bargaining mutually is unwise from the side of safety and of the integrity of the evidence.

Can a threat and an insult be in the same message?

Yes. A message may carry both threat content that notifies a will to cause harm in the future, and expressions of insult that target the person's honour. A coarse word, a curse, criticism, and a threat in the legal sense are not the same as each other, however. The whole of the words, the relation of the parties, the earlier messages, and the conditions in which the event happened are assessed together. In the application, not only a selected sentence but the chain of messages that shows the context should be presented. The legal characterisation is made by the competent authority on the concrete event.

Can a protection decision be asked for on a threat that comes from inside the family?

On threats that come from a spouse, a former spouse, a partner, or a family member, protective and preventive measures directed at preventing violence may come onto the agenda in addition to the criminal investigation. Not approaching, not disturbing by means of communication, or other suitable measures may be assessed according to the risk of the event. In the application, the messages, the earlier events, the health records if there are any, and the continuing risk should be told openly. The scope of the measure is not automatic; the person's safety and the data of the concrete danger are taken as the basis. In an urgent danger, the police should be reached directly.

Where can I apply in Ankara for a threat message?

An application may be made to the nearest police unit or to the chief public prosecutor's office. If there is an urgent danger, 112 should be called without waiting for a place. When the application is made in Ankara, the device the message is on, the identity, the information known about the suspect, and the chronology of the event may be prepared. Jurisdiction, and which unit the file will be conducted at, is determined according to the features of the event; it is possible for the victim to be directed to the right institution. The application record and the file number should be taken, and later notifications should be followed regularly.

If the threat message was deleted, can I still apply?

That the message was deleted does not remove the right of application by itself. Other data may be found, such as a notification preview, a backup, a session on another device, a person who saw the message at that moment, or platform records. It cannot be guaranteed, however, that the deleted record can be brought back. Installing new software on the device, or trying to recover data with applications that are not trustworthy, can spoil the existing data. It is safer to put on the record, to the extent you remember, the date, the time, and the content of the event, and to assess the need for a technical examination with the competent authority.

Related reading

This article sits under one practice area. The neighbouring guides carry the detail that does not belong in this text.

Practice areas · Criminal law

AK

Author

Av. Ayşenur Konar

Lawyer on the Ankara Bar Association roll, founder of Konar Hukuk. This text is general information; a specific file is reviewed separately. Author profile · Editorial policy

A consultation

We can look at the matter with you. The path depends on the documents. This is not a promise about the result.

Call