Turkish security forces killed a 21‑year‑old ISIS‑linked suspect during a counterterrorism operation in Istanbul’s Sultanbeyli district after he opened fire on police; one civilian was injured in the exchange. The incident, described by authorities as the foiling of an attack plot, has quickly become a focal point for assessing how Türkiye’s counterterrorism apparatus is adapting to a threat environment that, while diminished from its 2015–2017 peak, remains operationally active in urban centers.
The operation: timeline, location and outcome
The operation unfolded in the Sultanbeyli district on the European side of Istanbul, with multiple outlets placing the confrontation in the vicinity of the Sultanbeyli Bus Terminal, a high‑traffic node that underscores the potential scale of disruption had the alleged plot matured. According to the Istanbul Governor’s Office, teams from the Counterterrorism Branch, supported by the Intelligence Branch, moved to detain a person
“assessed to be linked to the armed terrorist organization Islamic State [DEAŞ/Daesh] and to be planning a terrorist attack in our country.”
During the arrest attempt, the suspect “opened fire on police officers” and was “neutralized” in return fire, the governorate said, adding that one civilian was wounded in the crossfire and that an investigation is ongoing. Turkish media identified the suspect as Berkan Ç. (Berkan C.), aged 21, and circulated footage described as capturing “the moment of the hot clash” as officers advanced and the suspect discharged his weapon.
Who was the suspect?
Public reporting settles upon a narrow yet distinctive profile: Berkan Ç., aged 21, and of Turkish nationality, evaluated as having connections to ISIS/DEAŞ and planning an attack within Turkey’s borders. The use of language by the governorate, “assessed to have connections” and “plotting a terrorist attack,” reflects a pre-emptive evaluation based on intelligence rather than a justification in retrospect, although what nature those connections had is left to the imagination – a lone wolf inspired by ISIS propaganda, a member of a cell with designated responsibilities, or even a facilitator working towards the commission of the crime. The age of the individual in question is important. Berkan Ç. is part of a generation that has grown up since the fall of the territorial caliphate proclaimed by ISIS in Syria and Iraq, although not before its network outside the region for operations and radicalization through the Internet remained very powerful.
What authorities say they prevented
The most critical part of the official message from the Istanbul Governor’s Office is that the action stopped a terrorist attack in Türkiye carried out by a person who had links with ISIS. Several local Turkish sources have reiterated this interpretation, adding in some cases that the area where the planned terrorist attack was supposed to happen was the Sultanbeyli Bus Terminal—a spot that was picked by the suspect to cause the maximum damage. At the same time, while the governorate did not disclose how exactly the terrorist planned to carry out the attack (whether it was a bombing, shooting, or a ramming attack), the choice of the wording “planning a terrorist attack” and the willingness to act in a decisive manner suggests that the police felt that the threat had evolved from the stage of planning into that of implementation. In this situation, the verb “neutralized” serves two purposes—it conveys facts as well as sends a political message: the state will apply lethal force against those suspects who resist being arrested in terrorism-related incidents.
How this fits Turkey’s counterterrorism trajectory
Türkiye’s approach to terrorism and counterterror operations has had a number of distinct phases over the past ten years. In the mid‑2010s, the ISIS-affiliated attacks in major urban centers led to wide-ranging laws and actions, such as expanded detention rights, increased surveillance, and military incursions into northern Syria. Once the territory controlled by ISIS began to decline, the threat profile changed to lone-wolf or small-cell attacks, often radicalized online, and thus difficult to identify during their planning process. The Sultanbeyli operation is indicative of this threat environment, with the arrest of a younger suspect, considered to be associated with ISIS, before the attack was carried out in an urban setting.
This case demonstrates the ongoing importance of intelligence-led policing in Türkiye, as evidenced by the terminology used in the statement by the governorate, where the use of intelligence and assessment played a role in the carrying out of the operation. At the same time, however, the example also shows the ongoing problems. Moreover, the reliance on the “assessed to be linked” formulation, while standard in early statements, invites scrutiny over evidentiary thresholds, especially in cases that end lethally and where the suspect cannot testify.
The ISIS factor: why the group still matters in Türkiye
Although ISIS no longer holds territory, its ideological footprint and operational networks have proven resilient. In Türkiye, the group has historically exploited transit routes, diaspora communities, and online ecosystems to recruit, fundraise, and plan attacks. The fact that authorities continue to encounter young suspects assessed as ISIS‑linked in cities like Istanbul indicates that the group’s appeal, however diminished, has not vanished.
This durability is reinforced by regional dynamics. Conflict zones in Syria and Iraq, while quieter than in 2014–2017, still provide spaces for training and logistical activity, while propaganda channels adapt to platform takedowns by migrating to encrypted or fringe services. For Turkish security services, the implication is clear: counter‑ISIS work cannot be treated as a legacy file; it requires sustained intelligence investment, community engagement, and cross‑border coordination.
Legal and procedural implications
The statement made by the governorate concerning the on-going investigation sets the stage for a judicial process that is likely to raise some queries about the evidence presented to make a case about the ISIS connection, the immediacy of the supposed plot, and the proportionality of the use of force during the apprehension. The Turkish law allows the use of deadly force as self-defense or defense of another individual but takes into consideration whether there was an alternative less harmful choice that could have been taken especially when civilians get involved. It would be essential for transparency to be maintained through the provision of charges filed, forensic reports, and intelligence summary.
Political and social resonance
Domestically, the operation arrives in a climate where security narratives intersect with electoral politics and public anxiety about urban safety. Government allies are likely to frame the incident as proof of effective pre‑emption, while opposition voices may press for clarity on the suspect’s profile, the intelligence trail, and the circumstances of the civilian injury.
Socially, the image of a bus terminal as a potential target resonates deeply in Istanbul, a city that has endured multiple mass‑casualty attacks over the past decade. That resonance can strengthen public support for robust counterterrorism measures, but it also raises the stakes for accountability: citizens expect protection without normalising opaque, high‑lethality policing in crowded neighborhoods.
