Identity Numbers from a Digital Forensics Perspective

A number conforming to the format of a Turkish Republic identity number, passing its check digits, and appearing mathematically valid does not show that it has been assigned to a real citizen. More importantly, similarity between numerical patterns alone is not evidence of kinship, lineage, or inclusion in the same civil registry.

I examined algorithms shared on GitHub concerning this subject. The first part of most of these works functioned as a deterministic validation layer that could locate sequences resembling Turkish identity numbers in text and test their check digits. The second part examined an experimental hypothesis based on numerical patterns that may have arisen from the initial assignment method. I observed expected similarities in some numbers belonging to my own family. Most family records, however, did not conform to the same pattern. This observation showed that the method was not an algorithm for determining kinship, but a limited experiment capable of producing correlation under certain historical assignment conditions.

The work should therefore not be regarded as a tool for finding relatives of third parties. Such use is both technically unreliable and creates serious legal and ethical problems by processing personal data outside its intended purpose.

Historical development of MERNIS

The foundations of the Central Civil Registration System, known as MERNIS, extend back to the period of the Population Law of 1972. The project was planned in 1976, moved into academic and technical study in 1980, entered implementation after 1982, and accelerated during the second half of the 1990s. Assignment of Turkish identity numbers to civil records was completed on October 28, 2000, and infrastructure enabling district population directorates to operate online entered service in 2002.

MERNIS transferred paper-based civil records into a central database, assigned citizens a unique number, and enabled different public procedures to use a common identifier. The system is not merely a number-generation mechanism. It is an administrative record infrastructure in which civil events are maintained centrally.

According to the General Directorate of Population and Citizenship Affairs, the Turkish identity number is an 11-digit number that carries no information. Its last two digits are check fields. The same official explanation states that values in the number pool created in 2000 were assigned to citizen records sorted by district, volume, family sequence number, and individual sequence number. The General Directorate nevertheless explicitly states that one person's identity information cannot be derived from another relative's number and that the number does not contain meaningful information such as gender, age, religion, or place of birth.

These two statements are not contradictory. The record order used during assignment may have produced numerical proximity or similar transformation patterns in some record groups. This does not mean that kinship information is encoded in the number. Correlation arising from administrative ordering is different from an identifier semantically carrying lineage.

Four validation layers

In software that processes Turkish identity numbers, the word validation is often used for four distinct operations.

The first layer is formal filtering. A regular expression locates sequences in text that have the proper length, contain only digits, and meet basic format conditions. In the implementation I examined, the regular expression serves only this purpose. It does not prove that a number is valid. It is the first filter that prevents clearly irrelevant numbers in a long text from reaching later stages.

The second layer is arithmetic validation. Check digits are recalculated from the initial digits and compared with the supplied values. For a fixed-length number, this operation completes in constant time and constant memory:

Time complexity: Theta(1) Space complexity: Theta(1)

This check detects some transcription errors. A number satisfying the checksum rule, however, need not have been assigned. Values can be produced that satisfy the same mathematical conditions while belonging to no citizen record. Because local software has no access to the MERNIS database, it cannot know whether a number has been assigned.

The third layer is registry validation. Here, the number is tested against authorized civil records together with other fields such as given name, surname, and birth information. The official validation screen of the General Directorate of Population and Citizenship Affairs does not request only the number, which shows that the number alone is insufficient for person validation.

The fourth layer is validation of the real person and identity document. The Electronic Identity Verification System contains stronger mechanisms intended to verify that the card was issued by an authorized authority, that the person using it is the cardholder, and that the person is present at the relevant location during validation. This level provides a completely different assurance from a check-digit test.

These layers must not be used interchangeably:

Format conformity -> arithmetic consistency -> match with civil registry -> person and document verification

The first and second layers can operate offline. The third and fourth require authorized records or identity-verification infrastructure.

The kinship-pattern hypothesis

The experimental part of the examined code applies certain arithmetic transformations to one Turkish identity number and produces other values that pass the check-digit rules. Although function names suggest ancestors, descendants, or relative candidates, this naming does not prove that the generated values actually belong to those people. The source code itself does not query any civil registry, lineage data, or authorized service.

The algorithm combines two assumptions:

1. Record order affected number distribution during the initial mass assignment.

1. This ordering may have produced repeatable numerical relations in some family records.

The first assumption is partially supported by the official history. The second is a research hypothesis that can be tested only through controlled experiments. Although the official source states that numbers were assigned according to record order, including family sequence number, it also explicitly emphasizes that a relative's number cannot be derived from another number.

In my limited examination of my own family data, I observed that some values fell into the predicted class while a substantial portion did not. This result is not unexpected. If the pattern depends on record order at the time of initial assignment, later civil events, different record groups, and new assignments cannot be expected to preserve the same numerical relationship. This assessment is an inference from the official assignment explanation, not a published kinship rule.

Check digits provide arithmetic consistency only. A candidate passing the checksum does not show that it belongs to a real person or that the person is related to the subject under examination. As the candidate space grows, it is natural to find values that appear valid by chance.

The method therefore has two fundamental error types:

False positive: Presenting an unrelated or unassigned value as a candidate.

False negative: A real relative not carrying the expected numerical pattern.

Both errors are critical in kinship inference. False positives in particular can lead to investigation of unrelated third parties' personal data and incorrect allegations. The algorithm must therefore not be used on third parties, and its results must not be presented as proof of lineage.

Legally and technically valid lineage information is obtained from authorized civil records or official genealogy services accessible after the person's identity has been verified. The requirement for identity verification in the genealogy service provided through e-Government also shows that this information is not treated as a public numerical pattern.

Algorithmic assessment

The source code contains three separate algorithmic tasks.

The operation that extracts numbers from text locates candidate regions with a regular expression and subjects each candidate to arithmetic checking. When text length is n and the number of candidates is m, the approximate cost is:

Text scanning: O(n) Candidate checks: O(m) Total: O(n + m)

Because each candidate has fixed length, checksum calculation has constant cost. Producing results lazily avoids collecting every candidate in a list beforehand.

The format and checksum test for one number runs in constant time. The regular expression is not the validator here, but only a prefilter. Arithmetic validation occurs in the next stage. This separation is suitable for reducing false positives in document and disk examination.

The experimental candidate-generation section runs in linear time for k requested candidates:

Time complexity: O(k) Auxiliary space: O(1)

The algorithm performs a fixed number of arithmetic operations at each step and yields results lazily. It is computationally efficient. Its semantic assurance is weak, however. An algorithm running quickly does not mean that its inference is correct. This work is a clear example of that distinction.

The source also includes a section intended to produce test values that appear arithmetically valid. Using such values as test data in real systems is unsafe. A generated value may coincidentally have been assigned to a real person. Secure test environments should use explicitly separated synthetic datasets, masking, or test identities designated by the institution.

Data leaks and the panel risk

The security risk associated with a Turkish identity number does not arise from public knowledge of its check-digit algorithm. The control algorithm has long been used by public institutions and software systems for formal validation. The primary risk is that this fixed, lifelong identifier can be combined with other datasets containing names, surnames, dates of birth, addresses, telephone numbers, financial information, and family records.

The Turkish Personal Data Protection Authority, KVKK, classifies the Turkish identity number as general personal data, but notes that it can cause greater harm than identifiers such as telephone numbers because it may provide access to other personal data. The Authority's guidance recommends less intrusive methods, data minimization, and appropriate technical and administrative safeguards.

Systems publicly referred to as panels generally combine personal data obtained from different sources in one search interface. In such an interface, applying a checksum to a number is merely a data-cleaning step. The main danger is use of the same identifier as a join key across different datasets.

An academic study published in 2016 showed that automatically joining a reported large-scale leaked citizen dataset with other sources could reveal personal information not directly present in the original fields. Its central conclusion was that linkability between datasets increased privacy risk more than the leaked raw fields alone.

Not every claim about a panel proves that a new leak occurred directly from MERNIS or the e-Government system. The General Directorate of Population and Citizenship Affairs and the then Presidential Digital Transformation Office stated regarding specific claims raised in 2022 that no data leak had been detected in their infrastructure and that some circulated images had been produced for phishing or forgery.

KVKK decisions, on the other hand, document real breaches involving Turkish identity numbers in banking, insurance, transport, healthcare, and technology systems. In a decision concerning an insurance company, insufficient protection of a test server, absence of strong authentication, and failure to encrypt personal data were listed among explicit security deficiencies.

This landscape makes it difficult to attribute panel data to one definite source. The data may come from breaches in different periods, unauthorized employee queries, publicly available documents, phishing incidents, or combinations of older datasets. The presence of an apparently current record in an unverified interface does not by itself prove compromise of the central civil registry.

From a cybersecurity perspective, the database is not the only asset requiring protection. Query privileges, employee behavior, test environments, logs, exports, documents, and API clients must be included in the same threat model. KVKK decisions describing bank employees performing unauthorized queries using identity numbers received from third parties show that insider threats are at least as important as external attacks.

Offline use in digital forensics

An identity-number validation algorithm can be useful in an authorized digital-forensics examination without connecting to a central database. Its purpose is not to identify a person conclusively, but to separate artifacts worthy of investigation from a large volume of data.

Disk images, memory dumps, email stores, application logs, configuration files, and document collections can contain many 11-digit numbers. A regular expression selects initial candidates. The checksum then eliminates a substantial portion of unrelated values such as telephone, order, barcode, or arbitrary counter numbers.

This process produces the following conclusion:

This sequence may conform to the structure of a Turkish identity number.

It does not produce this conclusion:

This sequence certainly belongs to a specific citizen.

For forensic attribution, the context of the artifact is required. File path, record time, application type, surrounding name and contact fields, database schema, log source, and chain of events must be considered together. Arithmetic validation is only a supporting finding.

This method can be used particularly in data classification and breach-scope assessment. An incident-response team, for example, can estimate how many records resembling Turkish identity numbers exist in exported files. Raw numbers should not be written unnecessarily into reports. Masking should be applied, and unmasked evidence should remain in a repository accessible only to authorized personnel.

The Identity Sharing System determines through authorization which queries institutions may perform and which information they may access, and maintains audit records of operations. Offline forensic-analysis tools should approach the same principles: purpose limitation, access control, query logging, and auditability.

The proper boundary of the research

The validation and text-scanning sections of the examined implementation solve a defined technical problem clearly and efficiently. Constant-time checksum validation, linear text scanning, and lazy result production are strong algorithmic choices.

The kinship-pattern section does not have the same degree of certainty. It is an experimental hypothesis derived from historical assignment order. Observing some matches in my own family data is not sufficient to generalize the method. The sample is small, selected, and confined to one family environment. No accuracy rate can be claimed without comparison against a control group, records assigned in different periods, and official lineage data.

At minimum, an academic study of this subject would require:

Explicit knowledge of everyone whose data is used and an appropriate legal basis

No publication of raw numbers

Separation of family and non-family control groups

Reporting both false-positive and false-negative rates

Examination of assignment period and registry structure as confounding variables

No use of results as proof of kinship

Data minimization and a secure destruction plan

The defensible use of the work is to examine the historical and algorithmic properties of identity-number structure, develop a local validation layer, and classify possible personal-data artifacts in authorized digital-forensics work. Investigating third-party family relationships or generating candidate numbers for querying falls outside this scope.

The last two digits of a Turkish identity number assist data integrity. Initial assignment order may have left numerical correlations in some records. Combining these two properties does not create a lineage system. A check digit is not identity verification, numerical proximity is not kinship, and finding a record in a panel does not prove the source of the data.

The most important algorithmic conclusion is therefore this: Finding a pattern in a data structure does not show that the pattern represents the phenomenon being sought. Computation can generate candidates. Kinship and identity can be established only through authorized records, lawful access, and independent verification.