Lebanon’s telecommunications infrastructure is weak and constrains access. The ongoing economic crisis has impacted telecommunications services, and users have experienced service disruptions and decreased internet speeds during the reporting period.1

As of January 2022, internet penetration stood at 89.3 percent, while mobile penetration stood at 68.4 percent.2 Internet speeds slowed during the reporting period,3 with a median broadband download speed of 8.13 megabits per second (Mbps) and a median mobile download speed of 13.87 Mbps as of May 2022.4 According to the Inclusive Internet Index, Lebanon ranks 74th out of 110 countries surveyed on indicators related to availability, affordability, relevance, and readiness.5

The economic crisis, exacerbated by the currency collapse, threatens the viability of both the internet and telecommunications sector. Furthermore, rolling electrical blackouts have left people without access to the internet.6 During the coverage period, telecommunications companies have struggled to cover the price of fuel needed to run and maintain their services.7 In January 2022, a major internet station went offline for a few hours after running out of fuel. The disruption impacted around 26,000 subscribers in Beirut.8

Rural areas are often more affected by electricity blackouts than urban areas. For example, mobile networks are frequently disrupted by power outages in the Beqaa and north Lebanon. In these regions, Syrian mobile networks have taken over "amid the complete absence of Lebanese network coverage.”9 The safety of Syrian networks is questionable due to the ongoing war, and it is impossible to determine whether those who control the Syrian mobile networks are collecting user metadata.

In June 2020, newspaper Al-Akhbar reported that Touch, one of Lebanon’s two government-owned mobile service providers, failed to pay for the fuel that it depends on to operate, jeopardizing its ability to provide mobile services.10 These threats to viability led Imad Kreidieh, chairman of the state-run telecommunications company OGERO, to announce in June 2021 that the Lebanese people should not be surprised if they lose internet access.11

Recently, the Lebanese government approved two decisions concerning the telecommunications sector. The first, is to raise the price of services (see A2). The second decision concerns shutting down the second-generation (2G) network and parts of the third-generation (3G) network to cut.12 This decision will leave more than 230,000 subscribers without access to mobile services until they upgraded their devices. This will primarily impact mobile users living in rural areas, but will also put a strain on the fourth-generation (4G) network, which could lead to a decrease in the quality of mobile connectivity.13

On August 4, 2020, an explosion in the port area of Beirut (known as the Beirut Blast) caused massive damage to the surrounding infrastructure, including telecommunications infrastructure.14 Electrical and internet outages were observed in Beirut and the Mount Lebanon, North, and South Governorates. Internet service provider TerraNet was heavily impacted by the blast, but was able to recover 85 percent connectivity the day after the explosion.15

Leaders have signaled their commitment to bringing about improvements to the country’s information and communications technology (ICT) sector, including through the eventual establishment of a fiber-optic cable and the rollout of fifth-generation (5G) service. However, the ongoing economic crisis, the COVID-19 pandemic, and the extensive damage to infrastructure caused by the Beirut Blast in August 202016 have slowed these plans.17

In June 2018, work commenced on the first part of a campaign known as “FTTx,” aimed at bringing internet connection speeds of at least 50 Mbps to certain areas through fiber-optic cables.18 This came after state-run telecommunications company OGERO officially launched a new version of its national internet strategy in February 2018,19 following a $100 million allocation from the Council of Ministers for fiber-optic cable development.20 OGERO subsequently awarded contracts to three Lebanese companies to partner with international vendors: Power Tech, with Norway-based Nokia; BMB Group, with US-based Calix; and SERTA, with China-based Huawei.21 Though the project faced numerous delays due to the economic crisis, FTTx was completed in 18 locations and partially deployed in 58 locations as of June 2021.22

Lebanon has expensive communications services, which has been exacerbated by the ongoing economic crisis. A significant divide in access exists between rural and urban areas.23 Disruptions are more frequent in rural areas such as the Beqaa and north Lebanon, and rural dwellers often only have access to 2G or 3G networks (see A1).24

According to telecommunications company Cable, Lebanon ranks 169th out of 233 countries and territories for mobile data pricing.25 Internet subscription prices are set by the government, and internet service providers (ISPs) cannot lower prices unless a decree is issued by the Ministry of Telecommunications.26 According to Cable, one gigabyte (GB) of mobile data costs $3.00. 27 In 2020, the average monthly salary in Lebanon was less than $200.28

The ongoing economic crisis has impacted people’s ability to afford telecommunications services. The crisis has also affected citizens’ ability to access electricity, and frequent power cuts leave some people with only three or four hours of electricity per day in some areas (see A1).29 In May 2022, the government announced that it would be raising telecommunications prices, basing prices on the currency rate set by the government, rather than the US dollar (see A1).30 This increase could nearly quadruple the price for mobile data, making it inaccessible to many users.31

In October 2019, the cabinet proposed a series of regressive taxes, including a tax on Voice-over Internet Protocol (VoIP) services such as WhatsApp, because of a 33 percent decline in telecommunications revenues.32 Alfa and Touch would have been able to charge users up to $6 a month, or $0.20 daily, but the ministry withdrew the proposal later that month, after protests began (see A3 and B8).

While the government has periodically restricted mobile and internet connectivity in past years, no restrictions were reported during the coverage period, though the Telecommunications Law provides the government with the authority to order internet shutdowns.33

During the late 2019 protests, mobile internet connections slowed across downtown Beirut, but there was no evidence of intentional throttling.34

The Lebanese government maintains a monopoly over the internet backbone, as well as over the fixed and mobile telephone industry in general, and therefore exercises tight control over ISPs. Lebanon has three international border gateways—in Tripoli, Jdeideh, and Beirut—where three underwater fiber-optic cables connect the country via the I-ME-WE (India-Middle East-Western Europe), Cadmos, and Berytar cables, respectively.35 The gateways are all operated by OGERO, the state-owned fixed infrastructure operator.

VoIP services are technically restricted under the 2002 Telecommunications Law, also known as Law 431/2002,36 but this ban has only been sporadically enforced.37 OGERO installed equipment to block VoIP services in 2010 and then used it on a handful of occasions to block the Vonage VoIP service, though not Skype or WhatsApp. However, it backed down from the Vonage block after coming under pressure from businesses, civil society, and politicians.38

The telecommunications industry is largely government-owned and is tightly regulated.39

The fixed-line telephone and internet network is owned and operated by OGERO, from which all companies must purchase services. In addition to running the backbone, OGERO sets internet prices and collectively manages online subscriptions of private ISPs, including Cyberia, Terranet Sodetel, and IDM.40 OGERO reduced the monthly fee that ISPs pay for the E1 line, which enables voice telephone calls, from $1,000 in 2014 to $110 in 2018.41

Private ISPs—of which there were 114 as of February 2020—currently obtain a permit by decree from the telecommunications ministry.42 Crucially, political influence can affect the allocation of contracts to private ISPs and mobile phone operators.43 The currency collapse has exacerbated extant financial issues within the telecommunications sector. The devaluation of the Lebanese pound also limits the viability of ISPs, which must pay to connect Lebanon to international undersea internet cables in US dollars but only receive subscriber payments in Lebanese pounds.44

Because the government sets prices and issues permits for the number of subscriptions allowed, there is little competition in the industry, and the two companies split the market evenly.45

The Lebanese government functionally controls the mobile telecommunications sector as of October 2020. Previously, the two government-owned mobile service providers, Alfa and Touch, were provisionally managed by private companies Orascom Telecom Lebanon and Zain, respectively.46 In early September 2020, the management contracts for the two companies were not renewed by the government. Later that month, Orascom announced that it had transferred management of Alfa to the Ministry of Telecommunications. In October 2020, Zain followed suit. As of May 2022, both Alfa and Touch are owned by the state, and no tender was launched during the reporting period.47

In March 2022, the two mobile service providers, Alfa and Touch, switched their subscribers’ balances from US dollars to Lebanese pounds.48 This is part of a larger strategy to eventually increase prices (see A2). While customers were alerted of this change, the conversion led subscribers to lose most of their money’s value due to the difference between the “official” and “exchange platform” rates.49

Since August 2021, the registration of .lb domains is subject to a payment in foreign currency to the Lebanese Domain Registry. Before that, registration was free of charge and .lb domains were managed pro bono by the American University of Beirut.50

Lebanese media and telecommunications laws are regulated by three semi-independent advisory bodies that report to the Council of Ministers. The National Council for Audiovisual Media and the Committee for Establishing Model Bylaws and Practices deal mainly with audiovisual media (television, radio, and satellite), while the Telecommunications Regulatory Authority (TRA) is responsible for liberalizing, regulating, and developing the telecommunications sector.51 Overall, the three bodies are limited in their power and do not have a reputation for being particularly robust or independent regulators, which makes the telecommunications ministry the de facto regulator.

The TRA is nominally independent, but in practice, influential political groups hold sway over the institution, often rendering it ineffective.52 Three past telecommunications ministers have claimed that the TRA has no real authority, given that the law establishing its powers has not yet been implemented.53 Tellingly, since its launch in 2007, many of the TRA’s objectives have not been met, including the transition from analogue to digital networks and the privatization of the telecommunications sector.

In recent years, the state has started to block more content, often related to gambling, pornography, and Israel, and has failed to provide transparency about its decisions.

Websites using web-publishing service Blogger were briefly blocked in June 2020 for users of state-owned mobile service providers Alfa and Touch. SMEX, who monitors website blockings, was alerted to the block after a user posted an article about Samir Kassir, a professor and journalist who was assassinated in 2005.54

In May 2020, the prosecutor general ordered the Ministry of Telecommunications to block 28 applications, alleging that they were spreading misinformation about the unofficial exchange rate between the Lebanese pound and the US dollar. While the ministry was implementing the block, they also blocked Google Firebase services, which many developers and entrepreneurs rely on to build their applications.55

In March 2021, top officials at an economic and financial security meeting announced that unofficial exchange rate platforms were the main reason behind the devaluation of the Lebanese pound. Subsequently, OGERO was asked by the judiciary to block all online platforms offering unofficial currency exchange. Several other ISPs followed suit, blocking applications and websites that did not reflect the government-approved exchange rate.56 It is unclear if these apps remained blocked at the end of the coverage period.

Popular LGBT+ dating platform Grindr was briefly blocked twice in 2019.57 The telecommunications minister allegedly ordered Alfa and Touch to block the application on 3G and 4G mobile networks in January 2019, though only Touch complied.58 OGERO blocked Grindr that May in response to a telecommunications ministry directive.59

Israel-based web-hosting platform Wix has been inaccessible on mobile networks and some ISPs since December 2018 based on a judicial order citing the Israel Boycott Law. Users were not given any prior notice for the blocking.60

YouTube, Facebook, Twitter, and international blog-hosting services are freely available.

There have been incidents in which government security officials, particularly from the Cybercrimes Bureau, pressured individuals and ISPs to remove certain comments—mainly those criticizing government officials or the army—from social media pages, blogs, and websites.

During the reporting period, individuals were summoned to appear before the Cybercrimes Bureau and asked to delete certain online content. For example, Doumit Azzi, an activist, was summoned to the Cybercrimes Bureau in January 2022, and was then required to delete a Facebook video that showed a foreign worker being beaten.61 The State Security Department required Omar Layza, a comedian, to delete a video of him throwing a Lebanese passport (see C3).62

Users were also pressured into removing online content during the previous coverage period. For instance, in October 2020, Saeed Abdullah was arrested and detained for 47 days for Facebook posts that criticized the government and were “offensive to Christ” (see C3). He was charged with insulting the president and insulting religion, and authorities intimidated him into deleting his post.63 In December 2020, Lynn Tehini, a journalist and former advisor to the Ministry of Culture, appeared before investigators from the Cybercrimes Bureau after she was served with a defamation complaint regarding a post on her Facebook account in which she criticized a judge. The investigators forced her to delete her post.64

At times the government makes requests to social media platforms to remove content. Between January and June 2021, Twitter received seven legal demands to remove content from Lebanon, although the company did not comply with these requests.65 Between July and December 2020, Facebook received eight content removal requests.66 According to Google’s transparency report, 12 pieces of content were removed between January and June 2019 for reasons relating to defamation, privacy, and security.67

Government decisions to restrict platforms have not always been fully transparent.

Under the 2018 Electronic Transactions and Personal Data Law, Article 125 allows the court to order “the suspension of certain electronic services, block certain websites or cancel accounts on such websites” linked to crimes including terrorism, child pornography, gambling, fraud, money laundering, and “crimes against internal and external security,” while Article 126 gives the public prosecutor power to suspend services and accounts and block websites for up to 30 days (see C5).68

In March 2021, authorities ordered the blocking of unofficial exchange rate websites and apps for violating provisions in the National Monetary Law (see B1).69 However, the order did not specify a time limit for the blocking of the content, contradicting the 2018 Electronic Transactions and Personal Data Law.

Generally, websites are blocked through court orders: the court receives a complaint and files it with the Cybercrimes Bureau for further investigation, later issuing a final order to the Ministry of Telecommunications, which then blocks the websites through OGERO. Website owners are not notified that their websites have been blocked, but still must appeal the blocking within 48 hours in order to have the decision overturned. However, the first blocking of Grindr, which took place in January 2019, was carried out in the absence of a court order.

Social media platforms sometimes remove Lebanese activists’ legitimate content. In December 2021, the TikTok account of a sexual health advocate was suspended after she posted a video about sexual and reproductive health. Her account was reactivated a few hours later.70

Blocking orders are generally rooted in law. Escort service websites, for example, were blocked in accordance with Articles 523 and 524 of the penal code. Israeli sites have been blocked in accordance with Decree 12562 of April 19, 1963, which called for the boycotting of Israel, while gambling websites were blocked in accordance with Law 417 of 1995, which gives the “Casino du Liban” exclusive rights to the gambling industry. However, some past website blockings have been criticized for the seemingly haphazard manner in which the blocking orders were issued. 71

A draft media law is being debated in the parliament and, despite promises from lawmakers, civil society has yet to be involved in the drafting process. The only copy of the draft law available to civil society is an unofficial, leaked version from 2019. According to the Coalition for Freedom of Speech in Lebanon, if this draft is passed, it “will set Lebanon even further behind in protecting free speech and the free press.”72 While the draft prohibits pretrial detention for online publishing crimes (including on social media) it contains provisions that criminalize defamation (see C2).73

Self-censorship is common in the blogosphere and in top media outlets, which are owned by powerful figures from all sides of the political spectrum. Users often fear repercussions from the government or certain political and sectarian groups, including defamation lawsuits, if they post controversial content.

Following antigovernment protests that began in October 2019, journalists and activists have increasingly become victims of intimidation campaigns, which has resulted in further self-censorship (see C7). The current media law does not provide adequate protections for journalists and online users, and those who harass or attack them often enjoy impunity, which has discouraged people from discussing certain topics online for fear of reprisal (see C2).74

Reflecting Lebanon’s political fragmentation, Lebanese media is highly partisan and controlled by the dominant politico-sectarian actors. In December 2018, the Samir Kassir Foundation and Reporters Without Borders (RSF) released the Media Ownership Monitor, which found that “the top news websites in Lebanon belong to, or mirror, the same political parties that own the country’s traditional media. The same political agendas reflected in traditional media also exist online.”75

Elite families directly involved in politics own several prominent media outlets.76 For example, former prime minister Hariri and his family own numerous outlets, including Future TV, as well as Al-Mustaqbal and the Daily Star, both print outlets with an online presence. The Daily Star stopped its operations during the coverage period.77 Speaker of Parliament Nabih Berri partially owns the National Broadcasting Network (NBN) and its affiliates, while Hezbollah controls a vast network of media outlets, including Al-Manar TV and Al-Nour radio. Prominent political figures choose the heads of these outlets, and their news content often advances a particular partisan message.

Politicians are also known to attempt to bribe the few independent news outlets and journalists that do exist, particularly during election periods.78 Online disinformation was prevalent ahead of general elections in May 2022. Specifically, Hezbollah’s electronic army flagged comments and spammed articles deemed critical of the group and its leaders, at times resulting in the content being removed.79

During the reporting period the armed wing of Hezbollah continued to spread disinformation and propaganda online, targeting both Lebanese and international audiences.80 Specifically, Hezbollah’s electronic army, known by the moniker “Lebanese Cedar,” took to social media to coordinate a defamation campaign against Tarek Bitar, the judge investigating the Beirut Blast.81 An investigation by the Telegraph found that the network, which receives support from Iran, orchestrates defamation campaigns against opponents of Hezbollah and teaches its members how to set up fake social media profiles, doctor pictures, spread propaganda, and avoid censorship by social media companies.82 The network has also been responsible for a number of cyberattacks across the region (see C8).83

Though bots have not been extensively documented in Lebanon, some outlets believe that Saudi Arabia–based bots were responsible for amplifying the “Hassan Diab is a Thief” hashtag that became popular in early 2020, when Prime Minister Diab formed a new cabinet.84

Independent digital media outlets struggle for sustainability due to Lebanon’s relatively weak digital advertising market, as the majority of advertising revenue is absorbed by television and other traditional media. One of the main obstacles in boosting the digital advertising market is Lebanon’s slow and unreliable internet, as well as the ongoing economic crisis.85

According to Lebanon’s Press Law, it is “forbidden to issue a press publication without first obtaining a license.” However, in practice, it is quite difficult and expensive to obtain a license.86

Outlets with formal or informal ties to politicians or powerful figures are financially more viable than those without connections.87

Lebanese users have access to a variety of local and international news and media. While relatively pluralistic, the media landscape is dominated by the agendas of powerful politico-sectarian leaders and their allies, often overshadowing the voices of minority groups (see B5).88 However, several new independent online media outlets launched after widespread protests took place beginning in October 2019.

Despite evidence of some filtering, taboo subjects that would normally be banned from mainstream media outlets, such as pornography, content supportive of Israel, and sectarian hate speech, are generally available online. Because Article 534 of the penal code has been used to prosecute LGBT+ individuals, content about the LGBT+ community operates in a legal grey zone and has been subject to censorship (see B1).

Certain content on taboo issues may be difficult to access or removed. During the reporting period, channels and accounts dedicated to sexual health awareness were blocked or restricted on social media, sparking controversy about sex education online and offline (see B2).89 A popular drag queen’s Instagram account was banned and then later restored following a campaign to support the account owner. Individuals and groups advocating for LGBT+ rights practice self-censorship at times so as not to lose their social media accounts (see B4).90

Social media is popular in Lebanon, and many news outlets have created dedicated social media pages to reach broader audiences.91 In 2021, the launch of the audio-only social media app Clubhouse allowed online users in Lebanon to debate and discuss social, political, and economic reforms in the country—topics that are rarely covered transparently in traditional media.92 However, some users have reported that they were targeted with harassment—including death threats—on the app for sharing anti-Hezbollah views (see C7).93

The economic crisis has led to the closure of several prominent outlets, limiting the diversity of online content. For example, the Daily Star stopped its traditional and online operations during the coverage period.94

In recent years, civil society organizations and individual actors have used the internet as a primary or secondary tool to extend the reach of their national awareness-raising campaigns.

In 2020, Lebanese people took to social media to campaign and mobilize around a number of causes, most notably following the Beirut Blast. After the explosion—and the revelation of government corruption and mismanagement that lead to the blast—the hashtag #علقوا_المشانق (“hang the nooses”) was used to demand accountability from Lebanon’s ruling parties.95 While critiques of Lebanon’s political elites mounted on social media after the blast, other users planned protests and organized online charity campaigns in the weeks following the explosion.96 However, as online mobilization turned to in-person protests, there were reports that authorities were preying on digital spaces, such as social networking sites and messaging services, to limit antigovernment demonstrations.97

Other prominent social media campaigns that gained popularity in recent years were related to former foreign minister Gebran Bassil’s invite to Davos;98 Loqman Slim’s murder (see C7);99 and the murder of Zeina Kanjo by her husband, which sparked a countrywide debate on domestic violence.100

In October 2019, protests erupted after the government announced it would institute a tax on voice calls made over WhatsApp. Though the government reversed these plans, widespread demonstrations broke out against economic deterioration, corruption, and the political system.101 During the protests, the hashtag #لبنان_ينتفض (“Lebanon rising up”) and several related hashtags spread in popularity, with users seeking to raise awareness about the protests. Some campaigns were amplified by media personalities with large followings. However, some activists participating in the protests experienced offline and online harassment during the coverage period (see C7). Furthermore, government forces used WhatsApp chat groups to identify protest leaders and activists in order to harass or arrest them (see C5).102

The constitution guarantees freedom of expression, freedom of assembly, and freedom of the press. However, articles in the penal code and the military justice code place restrictions on freedom of expression (see C2). The judiciary also lacks independence, as it is subject to considerable political influence.103

Other issues persist. While Lebanon passed a law on the right to access information in 2017,104 state agencies rarely comply. For example, when the Gherbal Initiative, a Lebanese nongovernmental organization (NGO), sent access-to-information requests to 133 administrations, they received just 34 responses.105 In the wake of the protests that began in October 2019, there has been a push for stronger enforcement of the Access to Information Law, which is now being viewed as a potential tool for reducing corruption.106

In August 2020, after the Beirut Blast, the Lebanese parliament approved a two-week state of emergency.107 The designation afforded the government broad powers, including the ability to set curfews, ban gatherings, and censor publications that threaten national security.108 Rights groups warned that this could hinder essential freedoms, including press freedom.109

The Lebanese penal code prohibits defamation of the president, public officials, and the army. Article 157 of the military code of justice also prohibits insults against the army.110

In 2016, the Court of Cassation ended the debate over which law regulates speech promulgated on social media in Lebanon, opting to place it under the jurisdiction of the penal code instead of the Publications Law.111 Because the Publications Law does not explicitly refer to electronic publishing and websites, there is some confusion about what forms of online speech are subject to restriction under the law. The Publications Court has considered journalists’ social media posts to fall under its jurisdiction, even as a number of other courts and nonjudicial bodies have prosecuted journalists for articles they had written. However, the Publications Court decided that social media posts are not subject to the regulations relating to the Publications Law, but rather to the penal code, which contains fewer protections for individuals.112

The authorities use Article 317, which penalizes those who incite sectarianism or racial strife; Articles 383 to 387, which criminalize the defamation of public officials and the insulting of national emblems; and Articles 473 and 474, which concern blasphemy and religious rituals, to prosecute legitimate online speech.

In July 2020, Lebanese and international organizations announced the creation of the “coalition to defend freedom of expression in Lebanon” to push for a new media law and ensure the protection of freedom of speech in Lebanon.113 In July 2020, members of the coalition obtained a leaked draft of a new media law that would amend existing defamation provisions in the current media law (see B3).114 As of May 2022, the draft media law had not been passed.

During the reporting period, new charges were filed against journalists and activists who “undermined the financial status of the state” on social media. Authorities often charge online users with “libel and slander” or “offending the Lebanese president,” and these new charges have similarly targeted journalists and activists who are expressing their views on online platforms (see C3).115

A significant crackdown on online freedom of expression began in late 2017 and has continued over the past three years.116 The public prosecutor has ordered security forces to detain internet users, who are sometimes subjected to multiday interrogations, particularly at the hands of Cybercrimes Bureau—which was established in 2006 without a legislative decree that outlined its mandate or defined cybercrime.117

In November 2021, Radwan Mortada, a journalist working for Al-Akhbar was sentenced to a year in prison in absentia by a Beirut military court. Mortada was charged with “defamation against the military institution” after criticizing the Lebanese military in his reporting for Al-Akhbar.118

In November 2021, an American journalist was detained and her home in Beirut was raided without a judicial warrant. The journalist, Nada Homsi, believes the raid and detention were intimidation tactics, used after she posted to Facebook about an incident earlier that year when security agents came to her apartment and asked her to remove a Palestinian flag she had hung outside her home. Homsi was released in December 2021 after various rights organizations condemned her arbitrary detention.119 In June 2021, a British reporter working for the online outlet NOW Lebanon and a German freelance journalist were arrested while covering the fuel crisis. They were arrested by members of Hezbollah, who took the journalists’ phones and press cards. They were released shortly after.120

According to SMEX, five people were summoned to the Cybercrimes Bureau for their online activities during the coverage period. Activist Doumit Azzi was summoned after sharing a video on Facebook that showed a foreign worker being beaten. He was then required to delete the video.121 Omar Layza, a comedian, was summoned by the State Security Department after sharing a video of himself throwing a Lebanese passport (see B2).122 In May 2021, comedian Shaden Fakih was summoned to the Cybercrimes Bureau after posting a video of herself mocking COVID-19 lockdown measures.123 In the video, she called the government lockdown e-platform to ask for permission to leave her house to buy sanitary pads. No action was taken by the state following the summon.124

Seven people were arrested for online activity in 2020, and 42 were summoned by security officials for their online activity. Of those summoned, 18 were accused of libel and slander and 9 were accused of criticizing the president. Nine people were detained, including one person held for 47 days. Between January and June 2021, 2 people were arrested and 15 were summoned because of their online activity, according to SMEX’s reporting.125

A number of individuals were detained for criticizing top government officials, particularly President Michel Aoun and former foreign minister Gebran Bassil. Numerous lawsuits were filed by other public officials and religious figures, alleging defamation and other offenses. In October 2020, Saeed Abdullah was detained for 47 days for posts on his Facebook page. He was charged with criticizing the president and publishing a picture that was deemed offensive to Christ. In January 2021, the Cybercrimes Bureau again arrested Abdullah, detaining him for eight days on charges of insulting symbols of the Druze community after Unitarian Druze community leaders submitted a complaint against him for his Facebook posts. His case remains open.126

People were also arrested for their online activities in July 2019, airport security personnel arrested Mohamed Wehbi upon his arrival from Africa for commenting on a social media post which insulted President Aoun and defended Imam Sadr, a Lebanese-Iranian philosopher who helped give rise to the Amal movement. Wehbi was detained for 12 days and was then released with a residency permit.127 In May 2019, the former head of Lebanon’s General Labour Confederation, Bechara Asmar, was arrested and detained for 10 days for insulting late Maronite cardinal Nasrallah Boutros Sfeir in a leaked video.128 In February 2019, the Cybercrimes Bureau questioned Ziad Itani over posts criticizing former Cybercrimes Bureau head Suzanne al-Hajj and her family. Itani was permitted to leave after deleting the posts and pledging not to approach the family.129 In September 2020, Ziad Itani was served with a defamation, libel, and slander lawsuit by the head of the State Security Directorate for allegedly damaging the prestige of the state, spreading false accusations, threatening officers, fabricating false confessions, and misleading the judiciary.130

The government requires registration for prepaid SIM cards and has considered introducing biometric registration.131

The Ministry of Telecommunications requires individuals to register their International Mobile Equipment Identity (IMEI) number, which corresponds to their phone number, on an unsecure government website.132 In December 2017, the Ministry of Telecommunications proposed the introduction of biometric SIM cards, which would force every person who purchases a SIM card to provide biometric information. The ministry did not expand on how this plan would work in a country where people routinely purchase mobile phones from private shops, but cited “security concerns” as the reason for the proposal.133

Mass digital surveillance in Lebanon is facilitated by the weak legal framework on digital privacy, and a legal framework that gives the government a wide mandate to conduct surveillance.134

Article 14 of the constitution “ensures the inviolability of the home,” but it is unclear if this law applies to private communications.135 The Telecommunications Interception Act of 1999 nominally protects the secrecy of communications, but it has limitations and does not mention modern forms of electronic communication. Moreover, the law gives the government the right to monitor communications if a judge grants government agencies access, or if the Ministry of Interior or Ministry of Defense submits a request to the prime minister for matters concerning “combating terrorism, state security, or crimes related to state security.”136

It is suspected that authorities have access to spyware. In a 2018 report by Citizen Lab, a Canadian internet watchdog, Lebanon is listed as one of 45 countries worldwide in which devices were likely breached by Pegasus, a targeted spyware software developed by the NSO Group, an Israeli technology firm. Pegasus is known to be used by governments to spy on journalists, human rights defenders, and the opposition, though it is unclear whether the Lebanese government is a Pegasus client.137 During the reporting period, reporting by the Washington Post found that Pegasus spyware was used to target and spy on politicians, journalists, and influencers in Lebanon, most notably, former prime minister Saad al Hariri138 and Lama Fakih, a Human Rights Watch employee working on the Beirut Blast investigation.139 It remains unclear who orchestrated the attack.

In February 2020, Al-Akhbar revealed that mobile service provider Alfa purchased deep packet inspection (DPI) software from Sandvine in 2015 and used the technology to share information with security agencies. Additionally, Alfa spent $3 million on a newer DPI system, produced by NEXIUS, in 2018, but that system is still not functional.140

In January 2018, the Electronic Frontier Foundation (EFF) and mobile-security firm Lookout reported that a surveillance operation called Dark Caracal operated out of a General Directorate for General Security (GDGS) building in Beirut,141 targeting military personnel, government officials, activists, journalists, and lawyers in 21 countries. The operation relied on a unique mobile surveillance tool, dubbed Pallas, which was able to extract hundreds of gigabytes of data from Android devices and desktop devices. Using spear-phishing tactics, Dark Caracal sent malware-laden Facebook and WhatsApp URLs to users that allowed attackers to extract messages and phone calls, download applications, monitor calls, and upload files onto Android devices.

Security agencies also used surveillance technologies such as FinFisher and International Mobile Subscriber Identity (IMSI) catchers.142 WikiLeaks exposed the government’s use of FinFisher, which is sold exclusively to law enforcement agencies and allows them to exploit system updates on targets’ computers.

During the 2019 protests, Internal Security Forces (ISF) officers infiltrated protesters’ WhatsApp groups and made arrests based on information shared in these groups.143 SMEX also received reports of security agencies confiscating detainees’ phones for unusually long periods of time. Technical analyses revealed attempts at surveillance and unlawful searches during the reporting period.144 In response to these seizures, a circular was issued by the General Prosecutor in December 2019, which emphasizes the detainees’ basic rights to privacy however, it did not effectively rein in the search and seizure of devices.145

In October 2017, the cabinet gave security agencies renewed, unhindered access to all telecommunications metadata for a period of four months (see C6).146 Additionally, intelligence agencies have links to different politicians or parties, and in turn their own agendas, which has led to privacy violations. In October 2018, the parliament passed the Electronic Transactions and Personal Data Law, which fails to adequately safeguard personal data (see C6).

Authorities have increasingly been using biometric technologies, leading activists to call for a stronger data protection law. The GDGS adopted biometric passports in 2016,147 and a year later, the government announced that it would begin issuing biometric residence permits to foreigners (see C4).148 Without a strong data protection law or a judiciary committee, it is unclear if biometric data could be used to increase surveillance.149

Lebanon does not have comprehensive data protection laws.

The Electronic Transactions and Personal Data Law, which was passed in October 2018, fails to provide adequate safeguards to protect user data and privacy. The law designates the Ministry of Economy and Trade as Lebanon’s data protection authority. While the law includes certain provisions around data rights, transparency requirements, data retention limitations, and security measures, it fails to adequately protect user data due to vague language, inadequate safeguards for user data, and the lack of an independent oversight authority.150 Article 97 gives the Ministers of Interior, Defense, Justice, and Health the authority to license data related to state security, court proceedings, and health, placing even more power in the executive branch. Moreover, the law only mentions the instances where a license is not required, rather than clearly outlining all the instances in which entities must obtain a license. Additionally, it does not define a number of key terms, such as “consent,” and fails to place limits on data storage.151

The government continued to request user account information from major companies. Between July and December 2021, Facebook received two requests for user data and Twitter received one request.152 In recent years, the cabinet has passed motions giving the security agencies temporary but unhindered access to all telecommunications metadata (see C5). Alfa and Touch are compelled to comply because they are owned by the government.

In October 2021, the prime minister formed a committee of ministries to investigate the possibility of “granting security agencies and armed forces full access to all telecommunication data.” The reason behind this potential move remains unclear, however activists raised the alarm at the possibility of security agencies accessing this data given the GDGS’s history of surveillance through operation Dark Carcel (see C5).153

In January 2022, the Lebanese General Security’s Passport Renewal Platform was launched. This platform allows citizens to make online appointments to renew their passports but the platform lacks data security and privacy measures. A detailed technical analysis by SMEX showed that the platform was not secure and could be easily exploited.154

Amid the COVID-19 pandemic, state-owned COVID-19-management platforms emerged in an attempt to contain the pandemic. The Lebanese Ministry of Public Health and the Central Inspection partnered with donors to invest in the Inter-Ministerial and Municipal Platform for Assessment, Coordination, and Tracking (IMPACT) to better respond to the pandemic.155

IMPACT was used to issue mobility permits during pandemic-related lockdowns. Another platform, COVAX, was used to track vaccine registrations. Following a 2021 report from SMEX that criticized the platforms for lacking privacy policies, IMPACT published a privacy policy. Both platforms are owned and coordinated by the state and as such they are not subject to the data protection or user consent requirements in the Electronic Transactions and Personal Data Law.156

In September 2020, the Ministry of Public Health launched Ma3an Together Against Corona, a contact-tracing application. Based on a preliminary review, SMEX found that the application collects limited personal data but contains a few security flaws.157 Another problematic COVID-19-related platform is the Ministry of Public Health (MoPH) Pass, which collects data from people traveling to Lebanon from abroad. According to SMEX, the platform is not secure and is very vulnerable to hacking as it runs on an unencrypted internet protocol address.158 While the MoPH did not initially inform data subjects of these vulnerabilities, the MoPH took suggestions from civil society organizations and the platform now collects fewer personal data than before.159

During the COVID-19 pandemic, Lebanese authorities gave licenses to private companies for vaccine distribution. One of these companies, Pharmaline, which sent out virtual contracts to people seeking vaccinations, was found to have had major privacy and data protection issues. In their consent form, Pharmaline required applicants to agree in advance to have their personal data and any vaccine-related information shared with pharmaceutical and insurance companies as well as the country’s vaccination centers. This request to process data without a license from the Ministry of Economy contradicts the Electronic Transactions and Personal Data Law (see C5).160

Journalists and ordinary citizens sometimes face intimidation for their online comments. Political parties and armed groups have been known to target their critics through online harassment campaigns, which have at times led to offline attacks.161

During the reporting period, high-profile journalists and activists were targeted through online harassment. For example, Hezbollah supporters launched online harassment and social media smear campaigns against Riad Kobeissy, a prominent journalist who was reporting on corruption and the Beirut Blast investigation.162 In addition to these online attacks, Kobeissy was subject to physical violence for his work investigating the ISF. In September 2021, his car window was smashed in a town south of Beirut, likely in response to his investigative journalism.163

Another online defamation campaign on social media was launched against the judge assigned to investigate the Beirut Blast. Supporters of Hezbollah and Amal orchestrated a smear campaign to “electronically assassinate” judge Tarek Bitar after he summoned and accused two Hezbollah politicians of being involved in the blast. Numerous Arabic hashtags attacking Bitar have gained traction on social media.164

Ordinary social media users, particularly women and members of the LGBT+ community, have experienced online harassment and doxing.165 For example, Dalia Ahmad, a journalist for independent television station Al Jadeed, received racist threats from online trolls after she criticized Lebanese political leaders, including Hezbollah’s Hassna Nasrallah.166 During the coverage period, many women running for Lebanon’s parliamentary elections faced harassment campaigns online as a form of intimidation. Rayan Charara, a candidate in the South district, received misogynistic comments from trolls during her campaign.167 In April 2022, the Maharat Foundation recorded around 831 comments characterized as online gender-based violence in a sample of accounts owned by female candidates.168

While not common, physical violence over online content has occurred in the past. In February 2021, political activist and publisher Loqman Slim was assassinated, allegedly for his political views and critiques of Lebanese political parties and militias, particularly Hezbollah. Slim was a prominent Hezbollah critic and had received death threats from the group in 2019, although no group took responsibility for his murder.169 He was active on social media and was frequently quoted and interviewed by online news outlets.170

In November and December 2020, Lebanese journalist and known Hezbollah critic Mariam Seifeddine and members of her family were violently assaulted, and both she and her family have received death threats.171 Seifeddine attributed the threats to her criticism of Hezbollah, which is published in newspapers and on social media. Seifeddine, who is known for firmly opposing the ruling class, lives in a Hezbollah-controlled area.172

Luna Safwan, a journalist, received threats from multiple social media accounts belonging to supporters of the Amal party and Hezbollah in October 2020.173 Safwan believes these attacks occurred in retaliation for a tweet she posted criticizing Hezbollah; it was retweeted by an Israeli governmental agency, prompting internet users to accuse Safwan of collaborating with Hezbollah’s enemy.174 Also in October, investigative reporter Mahassen Moursel was the victim of a social media hate campaign after false information circulated online alleging that she had been arrested for treason and collaboration with Israel.175 In December 2020, journalist Ghadi Francis was stalked by one of her social media followers.176

During the protests that began in October 2019, a number of activists were doxed and harassed. The doxing efforts often targeted activists who were recorded on video as participating in or leading protests (see B8). Detractors often insinuated that the activists used illegal drugs, were sexually promiscuous, or had links to foreign countries. Harassers also sometimes highlighted activists’ sympathy for Syrian refugees.

Cybersecurity breaches, cyberwarfare, and criminal hacks have been worrying trends in recent years.

In recent years, the Quds Force of Iran's Islamic Revolutionary Guard Corps has provided Hezbollah with sophisticated cyberattack technology. Hezbollah’s cyber army, known as “Lebanese Cedar,” has gathered intelligence on Lebanese government institutions and has orchestrated cyberattacks against financial institutions in Lebanon and abroad.177

During the reporting period, suspected Iranian hackers targeted Lebanese internet users through a variety of malware attacks. In one case, the attackers sent information about job opportunities that would deploy malware once the user clicked the infected link.178 While it is unclear who the specific targets of this attack were, it is suspected that the Iranian hacking group was targeting financial, energy, telecommunications, and government institutions.

In 2021, a group of hackers linked to Hezbollah’s cyber army breached 250 servers in different countries, including Lebanon, and stole sensitive data (see B5). According to cybersecurity reports, the hackers relied on a custom, remote access virus, and the victims included individuals, companies, and institutions.179

A committee of ministry, military, intelligence, and private-sector representatives was established in November 2018 by former prime minister Saad Hariri and was tasked with presenting recommendations to the parliament on establishing a national cybersecurity agency in 2019.180

In May 2018, Kaspersky Lab reported that it identified a cyberespionage campaign, with servers based in Iran, that targeted Android users in Egypt, Jordan, Lebanon, Morocco, and Iran.181 The operation had the capability to record audio and extract messages, browser data, GPS information, and images. While the Kaspersky Lab report provided no information about the Lebanese targets, it noted that the operation specifically targeted employees of international NGOs.