A prosecutor's letter arrived. What do you do in the next 15 minutes?

First, breathe: this is a request, not a penalty

Sooner or later, every business that offers guest Wi-Fi gets one. A prosecutor's office, the police or a court asks who was online through a specific IP address at a specific time. The letter is usually a small piece of a larger investigation, and the person of interest is someone who used your network, not you.

Law 5651 expects a public-access provider to keep internal IP assignment records and to produce them on request. If the records have been kept properly, the whole job genuinely takes about 15 minutes. Below is the path a business running Hotspot-Box follows through its panel.

1. Verify the request (3 minutes)

Never hand records to someone whose identity you have not confirmed. The checklist is short:

• Does the letter come from an official body? Letterhead, reference number, date and signature?
• Which channel did it arrive through? If e-mail, is the sender on the institution's official domain?
• For "urgent" phone requests, ask for a written document. Official bodies expect this.
• Is there a case or file number? You will use it in your delivery record.

If in doubt, call the institution on a number you looked up yourself, not the number printed on the letter.

2. Narrow the scope (2 minutes)

A request normally contains three things: a date (often with a time window), your public IP address and sometimes a port number. Prepare only the records that fall inside that scope.

What the letter says	What you select in the panel
A single date and time	That day's archive
A range of several days	A start day and an end day
Only a public IP, no date	Ask for a date; a request without one cannot be answered

Narrowing the scope protects both you and your guests. Handing over a day that was not asked for means sharing those guests' data for no reason. Under KVKK, that is your responsibility as the data controller.

3. Export from the panel (5 minutes)

Open the archive section of the Hotspot-Box panel, pick the day or range and press export. The box produces a ZIP file containing:

• The record rows for the selected days (device MAC address, assigned internal IP, session start and end, NAT details where present, verification type).
• Each day's SHA-256 hash chain and manifest file.
• An RFC 3161 timestamp file for each day.
• A verification report generated by the panel, summarising chain integrity and timestamp validity.

The verification report is your ready answer to "could these records have been altered later?". The chain has been linked since the day the box was installed; if a single row changed, the chain would break and the report would say so.

Every export you run is written to the audit trail: who, when and which range. That entry is useful later when someone asks who has seen the data.

4. Deliver encrypted (3 minutes)

Do not send the ZIP as a plain e-mail attachment. Two practical options:

• Encrypt the file with a password and send the password through a separate channel (phone, a separate e-mail).
• If the institution specifies its own secure delivery method (in person, an official portal, encrypted removable media), follow it.

If the letter states a delivery method, that method takes priority. If it does not, ask in writing and keep the answer.

5. Keep a delivery record (2 minutes)

The moment you deliver, note the following in your own file:

• Date, reference number and issuing institution of the letter.
• The date range you delivered and the SHA-256 digest of the file.
• Delivery method, delivery date and, where applicable, the person who received it.
• Keep an encrypted copy of the file in your own archive.

The panel's audit trail already records the export; the delivery record is its counterpart outside the box. If the same file is requested again months later, you put the two side by side.

What you cannot hand over, and what you should not

These are two separate headings.

Things you cannot provide, because the box does not have them: Hotspot-Box does not record the sites a guest visited, URLs, message content or location. If such a request arrives, the honest answer is "this data is not kept". The scope of record-keeping is internal IP assignment, not content.

Things you should not provide, because they were not asked for: records from other days, other guests' data, panel screenshots, your SMS provider account details. Deliver only the requested range, only in the exported format.

Guest phone numbers are stored encrypted in the box and shown masked in the panel. How verification details appear in the exported archive depends on your installation's settings; do not add fields beyond the record-keeping purpose.

Two situations people confuse

An administrative inspection is not a judicial request. An inspection checks whether you keep records at all; a judicial request asks for a specific record. For the first, the verification report and the panel screen are enough; the second calls for an export.

In a shopping mall unit, a residential complex or a shared office, "who is the addressee" is debated. Get legal advice on this. The box keeps the same records and exports them the same way in either case; the only thing that changes is who signs the reply.

Preparation starts today

The only condition for finishing in 15 minutes is that the records are healthy today. Once a month, verify a random day in the panel, check that no days are waiting in the timestamp queue and confirm the SFTP copy is working. You should have done all of this once already during the post-installation acceptance test.

You can read how record-keeping works inside the box on the product page. See the FAQ for common questions or contact us to arrange an installation call.

This article is general information and is not legal advice.