THIS INVESTIGATION IS PART OF THE JUSTICE FOR JOURNALISTS FOUNDATION INVESTIGATIVE GRANT PROGRAMME AND WAS ORIGINALLY PUBLISHED BY DARAJ).
Thus, anyone who owns a SIM card in Lebanon becomes vulnerable to comprehensive espionage and the imminent danger of their data being accessed by unknown companies and parties. Meanwhile, they are unable to hold any security agency that might cause their data to be hacked or to be spied on under the threat of “jeopardizing national security” or “disrespecting the state’s dignity” accountable, leaving them trapped in a vicious circle of constant surveillance.
The Lebanese state heavily relies on spying on its citizens through the phone numbers purchased by citizens from the two main telecom companies, Alfa and MTC Touch. This method of spying is not as modern as the techniques developed by spy companies, but it also employs a zero click bait technique, meaning it does not require clicking on suspicious links, and it has common factors with modern spying techniques in that it is virtually undetectable. In contrast to the Dark Caracal technology, which the General Security reportedly purchased, the Lebanese state can track the movements of its citizens through a technology that cannot be eliminated by changing the phone or the number.
Hind (a pseudonym) recounts her experience with surveillance in Lebanon, saying: “I received a call one day after returning from a trip. The caller identified himself as an officer from the Intelligence Division and he likely used a pseudonym. He told me that he wanted to ask me a few questions, but refused to disclose what they were. When he sensed my hesitation, he said, they knew where I lived, in a stern tone, as a form of intimidation. He added that I was not accused, but that they wanted to inquire about other certain suspected people.”
Hind first resorted to consulting with a lawyer to ensure that her rights were protected. The lawyer, who declined to be named, explains the relevant laws: “The Criminal Procedure Code guarantees the person being investigated the right to remain silent and refrain from sharing information that may harm him. The investigator cannot force the person to incriminate himself, as the citizen can remain silent for any logical reason. At the advanced stages of the investigation, it is expected that the person would provide information and data and be cooperative.”
Hind works on agricultural development in several areas in Lebanon with local associations and international organizations. She was working in a Palestinian refugee camp when her data was accessed in May of this year and was used against her during the investigation.
The next day, Hind was accompanied by her lawyer to the investigation, which lasted for about two hours. During, Hind was asked about local and international phone numbers, and investigators scrutinized the presence of these numbers on her phone. “They found some local numbers, but they could not find others. They even asked me about the numbers of farmers I was working with at the time, which raised my concerns about them. I also worried about individuals whose names I mentioned during the investigation.” She was also asked suspicious questions: “Do you work well with associations? Do you earn money? How much? Did any foreigners enter the camp using your identity?”.
After the interrogation, Hind’s phone remained with the officer for two hours. They then ordered her to leave, and her phone remained in the possession of the Cybercrime Bureau for 24 hours. “They told me that they had a program to take the information they wanted from the phone. But I discovered later, with the help of a specialist, that they had copied all my data. The process only took 24 hours not because I deleted anything from my phone, but simply because I had nothing to hide, and also because the lawyer accompanied me. In other cases, the phone can remain with the Cybercrime Bureau for a whole week.”
After the investigation, Hind turned to SMEX, a local organization dedicated to digital rights, which confirmed that approximately 10 GB of data had been copied from her phone, including photos, emails, and personal WhatsApp conversations. Hind also confirmed that the Cybercrime Bureau changed her email password, forcing her to change it again. She added that she received several suspicious links via email that the sender might use to hack her phone and spy on it. However, the organization couldn’t confirm whether the phone was hacked before Hind was investigated or not.
Near Impossible Protection from State Spying
Samar Halal, head of the technology unit at SMEX, confirmed the hardship in protecting oneself from state spying: “We must know the technology that the state uses so that we can protect ourselves from it. In Lebanon, there is no transparency regarding this issue, as the state can acquire new technology, but we know nothing about it. The easiest way to spy is to take a phone and add spyware or send a suspicious link, known as phishing attempts, i.e., sending links carrying spyware for the phone.”
In contrast, Lebanese law guarantees the right to the confidentiality of correspondence and communications for any resident on the state’s territory, in accordance with Law No. 140 issued in 1999. Article 1 of this law stipulates that a person has the right to confidentiality of wired and wireless correspondence, as the lawyer explains. She adds that the law criminalizes spying, eavesdropping, and disclosure. However, it allows these activities in specific cases for a limited period, and in designated places under certain conditions, such as maintaining national security, and it requires an administrative order or a judicial decision.
Then an independent authority verifies the legality of the surveillance and the decision under which the Anti-Cybercrime Bureau conducted the wiretapping. The surveilled person has the right to see the decision and appeal against it after discovering the intrusion, but in general this often does not happen because citizens are unaware of the rights they are guaranteed by the law ,and they may lack trust in the judiciary to secure their rights. However, individuals who have been subjected to state surveillance have the right to turn to the administrative judiciary (specifically the State Shura Council) to claim compensation for the harm and damages caused by the surveillance. The state may compensate the individual financially if the damage and the causal relationship between the spying and the damage inflicted on the person are proven.
In practice, the state often does not provide compensation to those who file lawsuits against it. An example of this is the case of the theatre actor Ziad Itani, for whom Lieutenant Colonel Suzan Al Hajj fabricated a treason suit. As a result, Ziad was imprisoned for four months while Al Hajj was promoted to the rank of colonel after the case. Then, the Public Security filed a case against Itani for allegedly disrespecting the state’s dignity after the latter had filed lawsuits against the state on the grounds of torture, disclosing the confidentiality of the investigation, and disclosing a video for the purpose of defamation!
Investigations Violates The Laws Instead of Seeking to Enforce Them
However, the Penal Code notes in Articles 281, 282, 283 and 284, the laws related to espionage, our right to preserve data within the framework of the investigations, while the Law on Electronic Transactions of a Personal Nature issued in 2018 does not address this matter. Therefore, the investigation is subject only to the general laws regulating criminal trials, as the lawyer explains.
However, the law was broken during the investigation. The violation committed against Hind was represented by the officer’s failure to explain the reason for summoning her and the legal provisions on which the summons were based. Rather, the officer resorted to indirect threats instead of clarification, especially since no case had been filed against her.
“Until today, I still do not know why all of this happened. I feel like someone owns a part of me. All I know is that the racist Public Prosecutor, Ghassan Oweidat, issued a judicial order to investigate me. If I knew someone involved with Israel, I believe they should most certainly be apprehended. But why are they taking all this information from me? Meanwhile, we cannot ask or know how this information is used and who has access to it.”
In this regard, Samar adds: “The state usually monitors citizens through the device or the phone’s SIM card. The only solution is to change them. But even when purchasing a new SIM card, the buyer presents their identity to the state-owned Ogero company, and the military services move from monitoring one SIM card to another. That is, changing the SIM does not provide effective protection for those being tracked unless they purchase the SIM using a third-party’s identity, which creates dependence on the third party and a constant threat if they decide to divulge the information they know.”
Thus, anyone who owns a SIM card in Lebanon becomes vulnerable to comprehensive espionage and the imminent danger of their data being accessed by unknown companies and parties. Meanwhile, they are unable to hold any security agency that might cause their data to be hacked or to be spied on under the threat of “jeopardizing national security” or “disrespecting the state’s dignity” accountable, leaving them trapped in a vicious circle of constant surveillance.