SMEX

Human testing: Militarised technology across Southwest Asia and North Africa

caitlinb — Thu, 06 Aug 2026 15:33:48 +0000

Human testing: Militarised technology across Southwest Asia and North Africa

Smex - What the lebanese government can do to respect users privacy while fighting Covid-19?

staff — Wed, 20 May 2020 10:54:11 +0000

Smex - What the lebanese government can do to respect users privacy while fighting Covid-19? staff Wednesday, May 20, 2020

Our partners from SMEX in Lebanon analysed surveillance measures in the country.

Lebanon, like many other countries, has launched digital tools to help diagnose and monitor the spread of the outbreak. The tools launched by the Lebanese Ministry of Public Health (MoPH) do not appear to harvest data, but they require excessive user permissions, which is particularly concerning given Lebanon’s weak legal framework for data protection.

Link: https://smex.org/what-the-lebanese-government-can-do-to-respect-users-privacy-while-fighting-covid-19/

Location

Lebanon

More about our partner

SMEX

See more examples

Apps and Covid-19

Civil society's Covid response

Identity and Covid-19

Date

Tuesday, April 7, 2020

Content

Educational

Stories

#IWD2019 Online gender-based violence: a privacy matter?

staff — Thu, 07 Mar 2019 16:33:42 +0000

#IWD2019 Online gender-based violence: a privacy matter? staff Thursday, March 7, 2019

For International Women’s Day 2019, Privacy International looks at some of the key themes around the intersection of gender rights and the right to privacy and we review the work we and our partners have done on those topics.

When dealing with cases of non-consensual sharing of intimate images, often known as ‘revenge porn,’ or doxxing, where a person’s personal details are shared publicly, the link between privacy and online-gender-based violence is very clear. Privacy violations are used to oppress women and gender diverse people. But those cases are not the only way in which privacy and gender-based violence are linked.

Gender-based online violence: No place to hide

Survivors of online gender-based violence talking about their experience tend to describe a degree of abuse that becomes impossible to escape. In a world where technology has become inseparable from the physical world and we rely on it in our everyday lives, the abuse ends up impacting every aspect of our lives. This inescapability is key to understanding how the experience of harassment and online gender-based violence is related to privacy.

The right to privacy was first addressed as such in a legal context with American lawyers Samuel Warren and Louis Brandeis defining it as “the right to be let alone.” Online gender-based is an attempt by an abuser to never let their target alone, to deny them a private space, be it online or offline, to the extent that such a distinction is even still feasible.

And with the further development and roll out of connected devices, the future of online-gender-based violence will carry new opportunities for abuse. Interviewed in Privacy International’s report on Gender and Privacy, Leonie Tanczer, lecturer at UCL’s Department of Science, Technology, Engineering and Public Policy, told us: “While now harassment can take place on platforms such as Twitter or through the interference with very distinct devices such as my tablet, in the very near future one will be able to tamper with my connected driverless car, my smart lock, or just troll me through my dozen Internet-connected devices.”

Online-gender-based violence cannot be divorced from the social context in which it happens. It is now an isolated phenomenon happening online but the reflection of patriarchal structures that allow men (in most cases) to feel entitled to harass women and gender-diverse people online.

Online harassment targeting women and LGBTIQ persons

SMEX – our partner in Lebanon – have looked at the specific context of online harassment against women and LGBTIQ individuals in Lebanon. Their report highlights the adversarial role of the authorities, which are preventing survivors – in particular LGBTIQ individual – from handling online blackmail and privacy threats in a safe and sustainable way. But most of all their interviewees believed that “that the most effective long-term solutions to online privacy threats involves changing the current societal and legal landscape and promoting an environment that is safe and inclusive both offline and online, for women and members of the LGBTIQ communities.”

Legal frameworks restricting the expression of sexuality

The Foundation for Media Alternatives (FMA) – our partner in the Philippines – noted a similar trend with a legal framework that remained gender-insensitive, sometimes “restricting full expression of one’s sexuality” despite a rise in the number of privacy violations online that target women and LGBTQIA+ individuals in the Philippines. In their report, FMA demands and change and condemns “centuries-old cultural assimilation of a patriarchal worldview, further skewed by restrictions imposed by organized religion [that] has made Filipino notions and standards of privacy inherently unfair to women and the LGBTQIA+ community.”

The need for a principle and comprehensive approach

In Chile, our partner Datos Protegidos also noted the need for a change in the legal framework in their nine recommendations (in Spanish) for a safer internet for women and the LGBTIQ+ community in Chile. In particular, they propose to change to the Chilean cybercrime law, adding new penalties for non-consensual image sharing and compensations proportional to the abuse that survivors have experienced.

Datos Protegidos also stresses the need for trainings of law enforcement to insure they are qualified to adequately handle online-gender based violence. This is an issue that Privacy International has observed across the world: civil society organisations working on the issue of online-gender-based violence all raised the issue of law enforcement’s lack of familiarity and/or capacity when it comes to responding to survivors’ complaints.

Ride sharing apps from a gender perspective

We highlighted earlier the new forms online-gender-based harassment will take, as we step into a world where the border between online and offline becomes blurry and the online/offline divide becomes irrelevant.

Our partner in Pakistan, the Digital Rights Foundation explore an aspect of this question in their report on ride-sharing apps. The report looks at the various forms of harassment consumers had experienced when using those apps and the complaint mechanisms in place. Based on surveys and interviews, the report found out complaint mechanism was the only recourse for women who feel unsafe on the apps.

The need for a gendered right to privacy

All of these cases show that with technologies transforming our experience of the world, we will need a right to privacy well suited to protect women and gender diverse people from new forms of abuses, which will keep emerging as long as the patriarchal structures that fuel gender-based violence remain unchallenged.

We want a right to privacy that will help deconstructing and smashing those structures and we are looking for your contribution to that fight, not just on women’s day, but for the years to come. Will you join us?

Learn more

Gender

Internet of Things

Our fight

Safeguarding Peoples' Dignity

Location

More about our partner

Foundation for Media Alternatives

Digital Rights Foundation

SMEX

Our campaign

When Social Media makes you a target

Content

News and Analysis

Reports

Data Privacy Week: Exposing Harms, Fighting Back

staff — Mon, 28 Jan 2019 08:04:15 +0000

Data Privacy Week: Exposing Harms, Fighting Back staff Monday, January 28, 2019

The Privacy International Network is celebrating Data Privacy Week, where we’ll be talking about how trends in surveillance and data exploitation are increasingly affecting our right to privacy. Join the conversation on Twitter using #dataprivacyweek.

It is often communities who are already the most marginalised who are at risk because of the privacy invasions of data-intensive systems. Across the globe, we see the dangers of identity systems; the harms of online violence against women and the LGBTQ+ community; and the threat of surveillance faced by activists and other communities.

But, as the Privacy International Network continues to uncover, campaign and advocate on these issues, it becomes clear that it is possible to begin to achieve change. The threats to the rights of individuals and communities are massive, and the forces against them from the public and private sectors can be immense. Yet, the efforts of civil society across the world can begin to make positive impacts on these issues.

Identity

The use of biometric technology in Peru has expanded, as revealed by Hiperderecho. Peru's National Registry of Identification and Civil Status (RENIEC) features biometric data including photographs and fingerprints. But the security of the system is at risk: in April 2018, Hiperderecho reported that the identity photographs of all Peruvians were left exposed. While the vulnerability was later fixed, it indicates how the security of these giant centralised biometric databases can put people at risk.

National ID cards continue to be promoted around the world. In the Philippines, a new ID system is coming into law, despite the concerns of several activists, including the Foundation for Media Alternatives (FMA). We also explored the issue in a podcast with two local transgender rights activists. Voter registration is another key aspect of debates on identity. An investigation by the Centre for Intellectual Property and Information Technology at Strathmore University revealed that there was a lack of sufficient controls to protect the data of voters in Kenya’s biometric voter registry. In our own research on the identity system in Chile, we highlighted challenges that migrants face in accessing healthcare, employment, and accommodation – all because they lack the Chilean ID card.

Gender

The issues surrounding privacy and gender have become an important field of study, with the online arena – while potentially providing a safe space for marginalised communities – also becoming a place for harassment and abuse. A report by SMEX revealed some of the online privacy threats that women and the LGBTQ+ community in Lebanon face, such as the non-consensual sharing of intimate images, blackmail and doxxing.

Online gender-based violence was also explored by the Chilean-based Datos Protegidos, who analysed the law and the experience of women activists and members of the LGBTQ + community online.

The importance of the impact of privacy issues upon gender has been developed in Privacy International’s own work on this topic.

Surveillance of activists

Government surveillance is often targeted at people who are campaigning for social change. A striking example is that of Operación Huracán (Operation Hurricane) in Chile, a case that, according to research by Derechos Digitales, involved alleged police interception of communications of Mapuche leaders (the major indigenous group in the country), which turned out to be an attempt to frame them as criminals.

The risks of surveillance are also deeply felt by activists in Kenya. A survey by the National Coalition of Human Rights Defenders found that increased digital-based media and online interactions have changed the perceived risks that human rights defenders face, causing them to fear surveillance and take measures to protect themselves.

Health and welfare

Healthcare, and welfare provision, are other areas where people can be placed in highly vulnerable situations. In Paraguay, as revealed by TEDIC, the social security system presents several privacy flaws. Issues surrounding the medical examination of workers, and who has access to their medical records and sensitive health data, including biometric information, creates the risk of discrimination in the workplace.

But change is possible. In a 2015 case explored by KELIN, plans were made to use biometric details as part of a study of people with HIV and key populations in Kenya. However, members of the community vocally objected to the use of biometrics in the study. They succeeded in achieving change and the biometric requirement was dropped. This case illustrates how unified coalitions, led by those most affected, can achieve change.

Learn more

LGBTIQ+

Social protection programmes

Biometrics

Communications Surveillance

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

ID, Identity and Identification

Realise Our Rights to Live with Dignity

Our fight

Safeguarding Peoples' Dignity

Location

More about our partner

Hiperderecho

Foundation for Media Alternatives

SMEX

Derechos Digitales

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Kenya Legal & Ethical Issues Network on HIV and AIDS

Our campaign

Demanding identity systems on our terms

Content

News and Analysis

Reports

State of Privacy Lebanon

tech-admin — Sun, 27 Jan 2019 18:04:39 +0000

State of Privacy Lebanon tech-admin Sunday, January 27, 2019

Introduction
Right to Privacy
Communication Surveillance
Data Protection
Identification Schemes
Policies and Sectoral Initiatives

Introduction

Acknowledgment

The State of Privacy in Lebanon is the result of an ongoing collaboration between Privacy International and SMEX.

Key privacy facts

1. Constitutional privacy protection: The Lebanon constitution does not explicitly mention the right to privacy.

2. Data protection law: The Electronic Transactions and Personal Data law regulates the protection of personal data, yet the legal framework remains weak.

3. Data protection authority: Lebanon does not have a data protection authority.

4. Data breaches: in the runup to the 2018 elections, it was reported that Lebanese embassies had exposed the personal data of thousands of Lebanese citizens abroad, who had registered to vote.

5. Recent scandals: EFF recently reported that malware-infected messaging apps have been operating since 2012, possibly involving a nation-state actor.

6. ID regime: Biometric passports and residence permits are being issued without a clear legal framework being in place.

Right to Privacy

The constitution

The Constitution of Lebanon does not explicitly protect the right to privacy. Article 14 only protects the inviolability of the home, stating: "The citizen's place of residence is inviolable. No one may enter it except in the circumstances and manners prescribed by Law."

Articles 8 and 13 of the Constitution indirectly guarantee individual liberty and freedom of expression, respectively. Some legal experts have interpreted that these laws could protect the secrecy of all means of communications, both mail and telephone calls, but this protection is not explicit.

Regional and international conventions

Lebanon is a signatory of a number of treaties with privacy implications, including:

the Universal Declaration of Human Rights;
the International Covenant on Civil and Political Rights;
the International Convention on the Elimination of All Forms of Racial Discrimination (with the exception of Article 22);
the Convention against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment;
the Convention on the Rights of the Child;
the International Covenant on Economic, Social and Cultural Rights;
the International Convention for the Protection of All Persons from Enforced Disappearance;
the Convention on the Rights of Persons with Disabilities;
the United Nations Convention against Transnational Organized Crime;
the Cairo Declaration on Human Rights in Islam; and
the Arab Charter on Human Rights.

Communication Surveillance

Introduction

As of 2016, approximately 76 percent of Lebanese residents and citizens use the internet and there are 53.43 broadband subscriptions per 100 inhabitants. Following a decree from the Ministry of Telecommunication in July 2014, touch and Alfa, the two telecommunications companies in Lebanon, lowered broadband prices between 44 and 68 percent. Moreover, these companies also increased the capacity of broadband packages by almost 300 percent. After a one-day boycott of the two companies in 2017, Jamal Jarrah, the telecommunications minister, promised to lower the rates. In January 2018, users are able to purchase 500 MB for $10.

Surveillance laws

Telecommunication Interception Act

Several articles in a Lebanese law limit surveillance, but there is a gap between the law and its enforcement. In 1999 Lebanon was the first Arab country to introduce a legal framework for the interception of communications, with the Telecommunication Interception Act of 27 December 1999 (thereafter referenced as Law 140/1999), although the Cabinet did not adopt the law until 2009.

Law 140/1999 relates to the protection of secrecy of communications, stipulates that the right to secrecy of communications, both internal and external, wired or wireless (landlines and mobile of all types including mobile telephone, fax, electronic mails) is guaranteed and protected by law and cannot be subjected to any forms of tapping, surveillance, interception or violation except in cases of extreme urgency and upon obtaining a judicial or administrative order.

The judicial authorisation process, as outlined in Article 2 and Article 3 of the Law, states that interception may be authorised by court order in cases of emergency, provided the targeted individual is the suspect of a crime. The court order should specify the means of communication, subject matter of the procedure, the crime subject matter of the prosecution or the investigation, and the duration of interception, which may not exceed 2 months.

In accordance with Article 9, communications interception can also occur on the basis of the administrative authorisation of either the minister of interior or the minister of defence, after obtaining the approval of the Prime Minister in order to gather information aimed at combating terrorism, crimes against state security, and organized crime. To be lawful, such decisions must be approved in writing, duly justified and approved by the Prime Minister and should specify the means of communication, subject matter of the procedure, the subject matter of the prosecution or the investigation, and the duration of interception, which may not exceed two months.

Lebanese Code of Civil Procedures

Article 98 of the Lebanese Code of Civil Procedures regulates the regime regarding searches and seizures.

Data retention

An order by the Public Prosecutor's office in 2013 required all internet service providers (ISPs), and some internet cafes that offer internet access, to retain the data of their users' activity for a period of one year. The order instructed "all landline and wireless internet service providers for homes and companies and from all cafés and stores providing their clients with devices through which they can access the Internet" to "do whatever it takes to activate and save all Internet log files going through their servers and routers, and prepare a periodical backup copy to save these files from being lost, for at least one year." The order also outlines the type of user data that must retained including the username, user's IP address, the websites to which they connected, and the protocols used in the process, in addition to specifying the user's location.

Surveillance actors

The Security Agencies

There are several state institutions with power to conduct surveillance and access user data, including the General Directorate of General Security; the Directorate of the Internal Security Forces (ISF); and the Army Intelligence Directorate. The General Directorate of General Secrutiy is overseen by the Ministry of Interior.

The General Directorate of General Security was founded in 1921, and became a branch of the Ministry of Interior in 1959. The Directorate not only gathers intelligence and attempts to uphold national security, but also "[participates] in judicial investigations within the limits of threats against internal and/or external state security." Additionally, is also responsible for issuing passports and residence permits.

The General Directorate of Internal Security Forces (ISF) are the national police and security force of Lebanon. The Intelligence unit was founded in 1991 and under Law No. 17. It directly reports to the Ministry of Interior.

The Cybercrime and Intellectual Property Rights Bureau, established in 2006, officially operates under the umbrella of the ISF but its legality is contested, given that it was established under a memorandum of service rather than by Law or Decree. The Bureau has been accused of acting as a censorship authority, mainly targeting journalists, bloggers and online activists. Its powers raise concerns as to the lack of safeguards protecting privacy and regulating the powers of the Bureau. On 2 October 2016 the leadership of the bureau changed after, Major Suzanne Hajj Hobeiche, the former bureau chief who had regularly targeted bloggers and activists, was asked to step down. Major Albert Khoury, a former lieutenant colonel in the ISF, replaced her.

Surveillance capabilities

Spyware Software

In January 2018, EFF and Lookout reported that Dark Caracal, "a prolific actor with nation-state level advanced Advanced Persistent Threat (APT) capabilities" was being "administered" out of a General Directorate of General Security building in Beirut, and has been active since 2012. While it remains unknown if General Security is running Dark Caracal, EFF was able to conclude that it has extracted "hundreds of gigabytes of data" and targeted thousands of victims in 21 countries. EFF found that Dark Caracal has obtained data from both mobile and desktop devices, with a particularly advanced focus on Android mobile devices. Dark Caracal obtained access to these devices through more traditional hacking means (eg phishing, social media pages, physical access), and it developed a surveillanceware - which EFF dubbed Pallas - that has the capability to extract information including SMS messages, texts from private messaging apps, images, screenshots, audio recording, contacts, and WiFi access points and SSIDs. The operation also used malware, including kinds never before seen by EFF, that has targeted Windows, OS X and Linux systems. Dark Caracal also used the previously-known FinFisher: malware usually installed via email or a fake software update. In the past, researchers had only observed Finfisher attacks on Desktop devices, but EFF noted that it targeted mobile devices as well.

According to EFF, Dark Caracal's targets did not fit under one umbrella, but included "military targets, utilities, financial institutions, manufacturing companies, and defense contractors" as well as "military personnel, enterprises, medical professionals, activists, journalists, lawyers, and educational institutions."

Prior to the EFF report, a 2015 report from Citizen Lab at the University of Toronto revealed that both General Security and the ISF had used FinFisher.

The Bulk Collection of Telecommunications Data

Since March 2014, the Cabinet has given the ISF and other agencies unhindered access to telecommunications data for periods of between six months and one year. When the Cabinet first awarded the ISF access to this data, Judge Awny Ramadan, head of the Lebanese accountability agency, said that the blanket and arbitrary government requests for the communication data of the approximately 5 million Lebanese citizens violated Law 140/99 given that every single citizen cannot be a suspect of a crime. Also, the decision permitted full access for a period of six months, which is far beyond the two months permitted by the Law 140/99 under Article 9. In October 2017, the Cabinet again gave security agencies full, unrestricted access to the electronic communications data of all Lebanese citizens for four months, a shorter period than any other previously granted.

This form of authorization started in December 2012, when the Information Branch of the ISF sought the interception and retention of all SMS text messages sent in Lebanon from 13 September to 10 November 2012 as part of its investigation into the car bombing that had occurred on 19 October 2012 in Beirut, which killed Wissam Al Hassan, the head of ISF. A leaked document from the Ministry of Information showed that the types of data requested included 2G and 3G data subscribers in Lebanon, including log files, IP addresses, usernames, phone numbers, addresses, names, and passwords. Lebanon's Telecommunications Minister, Nicolas Sehnaoui, refused the request but it was reported that the government nevertheless obtained access to this data.

The United Nations International Independent Investigation Commission (UNIIIC), and the Special Tribunal for Lebanon (STL), set up to investigate the assassinations that have taken place in Lebanon, and in particular that of the late Prime Minister Rafiq Hariri in 2005, have also taken advantage of communications interception powers to permit the ISF unregulated access to private data of Lebanese citizens from an array of sources including university archives, medical records, and mobile phone records. As of January 2018, there is at least one case pending before the Special Tribunal for Lebanon where the expansive access to user data is being challenged.

General Directorate of General Security's Relationship with Hacking Team

In 2015, Wikileaks revealed that General Security had been exchanging emails with Hacking Team, a surveillance company, since 2012. In February 2015, General Security emailed Gamma Group, another offensive surveillance company, and Hacking Team, inquiring specifically about Hacking Team's Galileo Remote Control System, which infects mobile devices and intercepts their communications. The firm produced a demo for the software and General Security later signed a 450,000 euro contract for hacking team to hack 50 individuals.

Internet Filtering System

In January 2013, Citizen Lab published a research brief in which it reported that researchers had discovered three Blue Coat PacketShaper installations in various countries including Lebanon. PacketShaper is a technology that allows for the surveillance and monitoring of users' interactions on various applications such as Facebook, Twitter, Google Mail, and Skype. While such tools can be used for legitimate aims, such as controlling bandwidth costs, they can be used for filtering, censorship, and surveillance. Citizen Lab noted they had identified two installations of PacketShaper. One was found on "a netblock associated with IncoNet Data Management." An additional PacketShaper installation was identified by a Google search on a netblock associated with "Virtual ISP Lebanon" (VISP)." The discovery of the installations came as the government was drafting a regulation pertaining to the public morals of online content. Although this draft regulation was later abandoned, the researchers noted that this was a curious coincidence given that Lebanon did not have a history of internet filtering prior to the publication of the draft regulation.

Cameras in Beirut

In June 2016, 2,000 cameras were installed across 350 surveillance points as part of the Beirut Surveillance Project. The municipality approved the $33 million project in 2014 and the Beirut-based company Guardia Systems, a subsidiary of MG Holding, installed the cameras. Two control rooms with fifty operators monitor these cameras and two data centers are able to store up to 10,000 terabytes of video footage.

Surveillance oversight, checks and balances

The judiciary is tasked with overseeing surveillance practices under Article 16 of Law 140/99, but this rarely happens. Based on information Al-Akhbar, a Beirut-based media outlet, obtained from the retired President of the Court of Audits, it appears that the actual role of the judiciary in authorising or overseeing the administrative authorisation of interceptions is merely symbolic. In practice, the Prime Minister routinely circumvents the requirement for judicial authorisation by directly authorising intercepts himself.

As a safeguard against abuse, Article 16 stipulates that such administrative decisions must be verified by an independent judicial commission, which consists of the first president of the Court of Cassation, the president of the State Shura Council, and the president of the Court of Audits, or three judges from separate and independent judicial bodies.

Despite this safeguard, it seems this provision is not oftenrespected in practice. High-level judicial and parliamentary sources told al-Akhbar that "all security services, without exception, continue to illegally operate their own wiretapping divisions of unknown nature and scope…This means that there are no guarantees the security services are not eavesdropping on the Lebanese without any legal oversight." In addition, the media outlet quotes a senior judicial source saying, "the security services themselves do not trust each other. If they all operated through the surveillance centre run by the Ministry of Interior in accordance with the law, everyone will be able to see what other security services are up to. Because they sometimes compete, away from national interests, each agency has its own 'centre' away from the law."

Surveillance case law

Examples of surveillance

Foreign agents

There have been reports of attempts by the Israeli government to recruit people to work with them through social media, particularly Facebook, and to infiltrate the Lebanese telecommunication system. On 12 December 2017, General Security posted a warning on its Facebook page advising users to beware of fake pages like LIOR ANONYMOUS TEAM, which it had claimed were associated with Israeli Mossad and actively trying to recruit Lebanese citizens. Furthermore, in December 2011, February and July 2012, and September 2014, the Lebanese authorities announced that they had discovered Israeli spying equipment, which the Israelis subsequently destroyed.

In 2012, Kaspersky Lab, a Russian multinational computer security company, published a report showing they had discovered Flame, a nation-state created malware, in Iran and various other countries in the Middle East and the majority of the infected machines were in Lebanon. The research was unable to determine whether the bank component of the malware was used to spy on financial/banking transaction or steal money.

In May 2018, the Kaspersky Lab also reported a cyber espionage campaign, referred to as ZooPark, which targeted the Android mobile devices of users of various Middle Eastern countries, including Lebanon. Following the report, an independent hacker dumped some of the data, which indicated that 169 individuals were targeted. The Kaspersky Lab stated that the operation primarily targeted both Kurdistan Referendum supporters and employees of the UN Relief and Work Agency for Palestinians in the Near East (UNRWA). Zoopark has been active since at least June 2015 and continued to operate till as recently as May of 2018. The latest version of the malware has the capability to extract data such as SMS messages, browser data, GPS location, call log information, log in credentials, audio recordings, images, information about installed third party applications and two factor authentication messages.

In August 2018, The Telegraph reported that the UAE contacted the Israeli NSO Group, to tap into Prime Minister Saad Hariri’s telephone among a list of other targets. Although it is unclear whether the technology was able to hack his phones, the NSO Group, who repeatedly claimed its technology is only used to prevent crime, has been discovered to be actively partaking in illegal surveillance. NSO Group has also recently come under fire due to its Pegasus Spyware also alleged to be in operation in Lebanon.

Data Protection

Data protection laws

In September 2018, the Lebanese parliament passed The Electronic Transactions and Personal Data law explicitly regulating the protection of personal data, yet the legal framework remains weak. The law (E-Transactions Law), originally introduced in 2004, is the most comprehensive law regarding personal data. The five sections of Chapter 5 V (General Provisions Concerning the Protection of Personal Data, Collection and Processing of Personal Information, Actions Required to Implement Processing, Right of Access and Correction and Penal Provisions) of the law address personal data issues. The law is somewhat outdated as it does not reflect the reality of online data. The law fails to adequately protect Lebanese citizens’ and residents’ data by putting in place weak safeguards and only granting authority to the executive branch.

The Articles in the E-Transaction law are riddled with vague and open-ended provisions. Article 87, which sets out the general right to data collection, presents no clearly defined rationale behind permitted data collection. Instead, Article 94 defines specific instances that do not meet the criteria of needing a license for data processing. The law also fails to define key issues such as consent, and regulation and enforcement for the conduct of data processing officers.

There is little distribution of power as authority is almost exclusively held by the Minister of Economy and Trade, without any oversight given to judicial or legislative branches. Article 95 gives the Ministry the authority to make decisions concerning third party access to data and transfers to foreign states. The Ministry of Economy is also unprepared to process this data, according to a reputable source, as it has neither hired any additional personnel nor set up a website or other mechanism for citizens and parties to file requests for data processing. Although Article 97 of the law gives limited oversight to other ministries, such as the Ministry of Interior and Ministry of Defence, these provisions still leaves citizens and residents vulnerable to abuses of power. The two ministries are able to grant licenses to collect data regarding “external or internal security of the state,” which is undefined in the law, without informing the affected individual, meaning private companies with good ministerial connections could have easy access to data based on the authority of the Minister of Economy and Trade as well as the Ministry of Interior and Ministry of Defence.

Privacy is regulated by other various provisions including various articles in Law 140/99, Article 2 of the Banking Secrecy Law of 3 September 1956 (the Banking Secrecy Law), and the Penal Code under articles 579, 580, and 581 relating to the violation of secrets. The recent Right to Access Information Law“prevents public institutions from providing anyone with private and personal information about Lebanese citizens.” More specifically, Article 7 of the Code of Medical Ethics (Law no. 288 of 22 February 1994) protects the confidentiality of physician and patients relationships, and Articles 51 and 58 of the Consumer Protection Code (Law no. 659 of 4 February 2005) states that that suppliers must not disclose data without the consent of the consumer.

Law 431/2002, which regulates the telecommunications sector, does not address the protection of personal data at all.

Accountability mechanisms

On 19 January 2017, parliament ratified the Access to Information law, which, in theory, compels government agencies to "publish key documents such as an annual report, orders and decisions, and office expenditures" and allows both individuals and organizations to request and obtain access to government information. The law also proposed the creation of an Anti-Corruption Commission (ACC), but this still does not exist. This is a major issue because the law states that the ACC would rule on the requests that the government must fulfill and as long as the ACC does not exist, there is no independent body that is regulating these requests. When SMEX requested information about Inmobiles, the company contracted to register IMEI numbers, in August of 2017, the government did not respond.

Data breaches: case law

Our research has not yet identified any private related issues relating to examples of data breaches in Lebanon. Please send any tips or information to: research@privacyinternational.org

Examples of data breaches

Hack of OGERO, Banks and Security Services

In July, it was revealed that hacker Khalil Sehnaoui, who is a member of a powerful political family in Lebanon, and another hacker had hacked OGERO, banks, and multiple branches of the security services. They were able to obtain banking data, criminal records, and entry and exit logs at the Beirut airport. From OGERO, the hackers had the ability to “intercept fixed line calls” and were able to extract passwords for banks and credit cards as well. Sehnaoui claimed that although they had the ability to manipulate billing data in OGERO, they never took advantage of this feature. Moreover, they not only had the ability to collect this data, but in some cases he was able to manipulate it. While the hackers targeted institutions, they also targeted individuals, including a director of a security agency. Newspaper Al-Akhbar has dubbed this hack “the largest electronic privacy scandal in the history of Lebanon.”

Online voter registration

In May 2018, Lebanese citizens residing outside of Lebanon will be able to vote abroad for the first time. On 20 November, voter registration closed with over 90,000 Lebanese registering to vote. Immediately after the closure of this registration period, Shada Wehbe, a social media trainer and blogger, noticed that the site for voter registration, Lebanese Diaspora Vote (LDV), was using cookies to track visitors without asking for their consent or providing any disclosure about what this data may be used for. Double-click, a company owned by Google, and Facebook's Pixels owned the cookies attached to the LDV website. Both of these tools track users browsing habits.

Additionally, In April 2018 it had been reported that Lebanese embassies had exposed the personal data of Lebanese citizens abroad, leaving data easily accessible to third parties. The Embassy in the UAE emailed Lebanese expats a spreadsheet containing personal details of more than 5,000 Lebanese citizens who has registered to vote in the upcoming election. Similarly, the Lebanese embassy in the Hague also sent a mass email containing a spreadsheet with personal data. Furthermore, the email addresses of each recipient were visible as the embassies did not use the bcc field. The spreadsheets included each voter’s full name, mother’s name, father’s name, sex, date of birth, religion, marital status, and address. Lebanese law does not protect citizens’ data, but instead Article 32 and Article 115 of Law No. 44 actively require the dissemination of private voter information. Article 32 states that the preliminary voter list should circulated locally. Likewise, Article 115 requires list of voters abroad to be published and circulated by all available means to confirm the authenticity of the voters registered, without any regard to maintaining privacy of the voters.

American University of Beirut

In 2014, a hacker leaked information about the mismanagement of the American University of Beirut (AUB). The leaked information included data from American University Hospital (AUH), and the hacker confirmed to a reporter that they were able to access medical files from AUH, not just files about mismanagement. AUB itself had acknowledged that "the technical environment … is not secure." Moreover, a third party, FTI consulting, also noted that the information systems adequately protect patients' private information.

Personal Cell Phone Numbers

Alfa and touch, the two state-owned mobile phone operators in Lebanon, sell users' data to businesses and advertising agencies. Whether users in Lebanon buy a prepaid or postpaid line, these two companies exploit their data. Neither company provides a service to opt-out from these messages, though users can block specific numbers. SMEX found that businesses pay $11,000 to send 500,000 SMS messages and $430 to send 360,000 emails on average. These messages are not always sent en masse, as touch identifies target groups based on usage behavior, enabling businesses to send targeted advertisements.

License Plates

Information linked to license plates numbers are leaked from the vehicle registration center on an annual basis. Some of this information includes names, addresses, phone number, dates of birth and license plates numbers. The data is leaked on CD-ROMs without any form of encryption.

In an investigative report produced by Al-Jadeed TV, “The Customs Rally: The Tax Evasions Race” exposed the ease in which these CD-ROMs can be purchased. Despite the privacy and security repercussions, the government has not taken any action to prevent these continuous leaks.

Min Msakar, an application designed using the purchasable data reported by Al-Jadeed, aims to help mitigate congestion in Beirut by granting individuals access to phone numbers registered to licence plates. The intent of the application is to allow users to contact the owners of parked cars blocking traffic. This is not the first app of its kind, with previous attempts such as Cars 961, also exploiting the same data. Although these apps seem to be eventually removed, new versions pop up and the data released remains available to the public. This is a serious privacy violation as a database of phone numbers is now available. With over 100,000 downloads, this allows strangers to contact random individuals, which could lead to harassment.

Government applications

In June 2018, Eye Police, a new mobile application was launched. Created by the Ministry of Information and developed by CyberWaves, a local software company, the applications allows users to report issues or incidents which will then allegedly be published on the state-owned National News Agency. Cyberwaves is a private company with little publicly available information and no disclosure about the measures it takes to protect user data. The list of permissions required gives Eye Police great access into users private information, with no clear safeguards in place. For example, it grants access to record audio and also allows for both Cyberwaves and the Ministry of Information to track devices.

WhatsApp

Lebanese WhatsApp users have been hacked and had their information stolen, according to a June 2018 statement from the Lebanese Internal Security Forces (ISF). The unknown hackers gained access to the accounts by using the SMS activation codes. Once they gain access to the account, they prevent the owner from accessing their WhatsApp data and send abusive messages to the owner’s contacts. They, then demand payment in order to relinquish control of the account. Although WhatsApp has enabled a two-step verification process, this has not been advertised by the application and leaves users vulnerable.

Identification Schemes

ID cards and databases

Biometric passports and residence permits

In 2013, the Directorate of General Security announced that it would start using biometrics passports as a result of a request by the United Nations agency International Civil Aviation Organization (ICAO). ICAO had notified the Directorate on 31 December 2012 and set a deadline of 24 November 2015 for all of its members to adopt biometric technologies. In August 2015, the government began issuing biometric passports. The Directorate stated that it waited until 2015 because various Lebanese embassies had received noticed that their host countries were only going to accept machine-readable passports going forward.

Inkript, a Lebanon-based subsidiary of Resource Group Holding (RGH), which submitted a joint offer with Gemalto, a digital security company with its headquarters in the Netherlands, won the tender to supply Lebanon with security-print biometric passports. Inkript manages the programming and software development in-house, and Gemalto is in charge of manufacturing the passports and matching the programme's interface with the coding machines.

In 2017, the government began issuing biometric residence permits as well. These permits are similar to the passports, but they are for residents, not citizens.

SMEX asked the Directorate of General Security about the methods and systems it uses to protect the personal data from the biometric passports and residence permits, the parties that have access to this data, and the types of coordination between Lebanon and the countries of foreign nationals who live in Lebanon, and the data-sharing relationship between the Directorate and the UNHCR. In response to these questions, the Directorate replied the biometric passports and residence permits are a "technological and organizational development consistent with the Directorate's policy of constantly developing its work." The letter also stated that coordination with the UNHCR follows protocols outlined in a memorandum of understanding from 2003 and that "all eligible foreign nationals, including Syrians" are using the biometric passports.

In the absence of a clear legal framework regulating the adoption of biometrics as a form of identification, few safeguards exist to limit and control their use. Currently, the data can potentially be used as a tool for surveillance.

An additional concern is the use of private companies, Gemalto and InKript, which raises questions as to the ownership of this data, the responsibility, and accountability of the government to protect the data from abuse, theft, and loss. Given that Lebanon does not have a comprehensive data protection law, it is essential for the government to take necessary steps to ensure the protection of its citizens' personal data when engaging with third parties. Gemalto claimed that their office network had been the target of attacks in 2010 and 2011, "probably" by the NSA, the U.S. intelligence agency, and GCHQ, the British intelligence agency; altough in this case it was claimed by Gemalto that they only got access to the encryption keys of 2G SIM cards. It is important to note how such companies have now become the target of intelligence agencies.

Voter registration

In September 2017, the Cabinet approved biometric election cards for the May 2018 election, but due to time and resource constraints, these was not introduced in time for those elections. Nonetheless, they remain on the agenda for future elections.

SIM card registration

In December 2017, it was reported that the Cabinet planned to introduce biometric SIM card registration, which would force Lebanese citizens and residents to provide a thumbprint to purchase a SIM card. Al-Jadeed TV reported that the government is introducing this measure because 20% of the phones in the country do not actually belong to their listed owners. Al-Jadeed also reported that the government cited security reasons

Similarly, the Lebanese government reintroduced a proposal for IMEI registration, mandating that everyone who purchased a phone to have their identity attached to the IMEI number of the device. In April 2017, Jamal Jarrah, the current telecommunications minister, reintroduced the proposal and awarded the contract to Inmobiles, a subsidiary of Resource Holding Group. IMEI registration was briefly implemented in Lebanon, when Nicolas Sehnaoui, a former telecommunications minister introduced it in 2013 in an effort to prevent theft and fraud. However, Boutros Harb, the subsequent telecommunications minister, ended this policy, stating that it was ineffective and costly.

As of September 3rd 2018, a directive has come into effect which makes citizens responsible for ensuring that their IMEI registration complies with Global System of Mobile communications. Smartphones purchased outside of Lebanon can work normally for a period of 90 day, after which additional fees will be levied onto users’ monthly bill.

Policies and Sectoral Initiatives

Cybersecurity policy

Our research has not yet shown any specific examples of privacy issues related to cybersecurity policy in Lebanon. Please send any tips or information to: research@privacyinternational.org

Cybercrime

Our research has not yet shown any specific examples of privacy issues related to cybercrime in Lebanon. Please send any tips or information to: research@privacyinternational.org

Encryption

Our research has not yet shown any specific examples of privacy issues related to encryption in Lebanon. Please send any tips or information to: research@privacyinternational.org

Licensing of industry

Our research has not yet shown any specific examples of privacy issues related to the licensing of industry in Lebanon. Please send any tips or information to: research@privacyinternational.org

E-governance/digital agenda

Our research has not yet shown any specific examples of privacy issues related to e-governance and the digital agenda in Lebanon. Please send any tips or information to: research@privacyinternational.org

Health sector and e-health

Our research has not yet shown any specific examples of privacy issues related to the health sector in Lebanon. Please send any tips or information to: research@privacyinternational.org

Smart policing

Our research has not yet shown any specific examples of privacy issues related to smart policing in Lebanon. Please send any tips or information to: research@privacyinternational.org

Transport

The Uber App in Lebanon lacks a key privacy feature which keeps phone numbers of the driver and passenger anonymous. Phone numbers are not masked in the in-app calling feature as it is in other countries. Uber did not directly answer our request for comment, but a representative from the company posited that it could be because Twilio, the cloud communications company, does not operate in Lebanon or because of local Lebanese laws. Uber has not employed a different company to protect Lebanese users. The lack of an in-app calling feature has led to harassment by drivers if a passenger is thought to have filed a complaint.

Careem, a Middle East based competitor of Uber, discovered that data was compromised in January but only informed users of the breach in April. Hackers were able to access personal data of 14.5 million customers including name, phone number, email address and trip data; however it appears credit card details and passwords remained secure. The compromised data allow hackers to track where users go on a regular basis, a useful tool security forces could hope to access.

Smart cities

In September 2017 OGERO, the telecommunications service provider, and Data Consult, a privately owned technology company announced that Beit Misk was the first "smart city" in Lebanon. Beit Misk itself is a small, manufactured city, intended to replicate a traditional Lebanese village, but as a smart city it now has the capability to measure "water levels, energy consumption and environmental conditions." The decision making process did not involve civil society actors, though Marc Nader, COO of Data Consult, stated that Data Consult was not using this data for any other purpose at a launch event for the Lebanon IGF.

Migration

Our research has not yet shown any specific examples of privacy issues related to migration in Lebanon. Please send any tips or information to: research@privacyinternational.org

Emergency response

In August 2014, the government cut off access to mobile internet services in Arsal, a town in the northeast of Lebanon, after fighters from ISIS and al-Nusra entered the town. The shutdown lasted three years and mobile internet service was not made available until September 2017.

Humanitarian and development programmes

Our research has not yet shown any specific examples of privacy issues related to humanitarian and development programmes in Lebanon. Please send any tips or information to: research@privacyinternational.org

Social media

In 2015, SMEX reported that the state blocked eight gambling websites, 23 websites for offering escort services, five pornographic websites, 11 Israeli websites, two websites for breaching copyright and one LGBT website.

They have also been unconfirmed reports of extralegal methods used to identify anonymous online users, but most victims do not report these incidents and often choose to keep these incidents secret, according to a report from Open Society. Due to the nature of these incidents, the Open Society report does not go into further detail.

List Icon (DO NOT USE)

List Image (DO NOT USE)

Location

Lebanon

Global South

Related learning resources

State of Privacy

More about our partner

SMEX

Content

Reports

Summary

A study of privacy and surveillance issues in Lebanon. The State of Privacy project was last updated on January 2019, unless otherwise provided on specific pages.

Data and Control: Protecting Rights, Protecting People

melissab — Mon, 29 Jan 2018 17:40:48 +0000

Data and Control: Protecting Rights, Protecting People melissab Monday, January 29, 2018

To celebrate International Data Privacy Day (28 January), PI and its International Network have shared a full week of stories and research, exploring how countries are addressing data governance in light of innovations in technology and policy, and implications for the security and privacy of individuals.

At the core of data protection debates, there is a power play between empowering individuals to control their data and empowering those who use (or want to) use their data.

By regulating data processing it provides avenues for individuals to exercise their rights if there is any unlawful interference in this power play.

If there is no regulation, or if it is weak, inefficient or abused, personal data turns into yet another mechanism for those in power to exert and retain control of our data, and ultimately many aspects of our lives.

In the face of powerful actors, including the state, the private sector and other entities, people might feel powerless and feel a degree of resignation about how their data might be used and indeed misused. As individuals, we are being increasingly embedded, by design — not by choice — into ever-more data-intensive systems, be it the obligations to be enrolled in a mass biometric identification system to access welfare services, through to facing increased scrutiny of your identity to access from financial services.

But data protection, if well-regulated and enforced, can give us power and protection. A few days ago, as we celebrated Data Privacy Day 2018, we welcomed the fact that there are now 126 countries worldwide which have comprehensive data protection laws.

Unfortunately, the reality of the current legal and regulatory frameworks, as explored by the Privacy International Network, tells a different story. There are still many countries across the world that have yet to adopt comprehensive data protection frameworks and of the 126 that have one, many experience challenges with upholding and enforcing the highest data protection standards and need to be reformed. The majority of countries that are yet to adopt or improve their data protection frameworks are having to do so in a context of weak democratic institutions and limited rule of law, and yet they are the biggest consumers, adopters and testers of innovations in technology and policy.

Governments and private companies alike tend to frame regulation of their data intensive activities as impediments and burdens to their businesses and their profits. Any meaningful restriction to those activities tend to be portrayed as an unnecessary obstacle to achieving economic development, stability and order, or even national security. Protecting our rights over our data has yet to make it to the top of their priorities. Maybe some day.

Countries such as Argentina, India and Pakistan manage some of the largest biometric databases in the world. Others like Paraguay and Chile are implementing biometric border management systems, and Lebanon is starting to implement a smart city programme. These are only some of the many examples we have been documenting.

Yet, only half of these countries have comprehensive data protection frameworks. The other half need to urgently reform their legislation, as they fail to comply with basic data protection and privacy standards.

As outlined in various research produced by the Privacy International Network and showcased this week, there is a need to initiate legislative processes to adopt comprehensive data protection frameworks, and to reform those that already exist.

Laying Down The Foundation For Reform

Research conducted by TEDIC into nine public databases revealed that public servants in Paraguay have a poor understanding about the processing of their personal data and the measures they should be taking to protect that data. Such findings call into question the effectiveness of Paraguay’s legislation on data protection and support the need for reform to address its many loopholes.

Similarly, there is a need for reform in Chile and Argentina, both countries that have data protection laws. Research by Derechos Digitales and the Asociación por los Derechos Civiles illustrates how each respective legal framework is outdated and ill-equipped to face current and emerging data protection and privacy issues, such as the use of biometric technology and drones. This means that they are failing to provide the necessary protections to guarantee and secure individuals’ power to control their data. On the contrary, the half-hearted effort actually puts people at risk, as they are encouraged to trust in a flawed system to protect them.

Preparing For A Legislative Process

In research produced by SMEX about the current legal and policy landscape on data protection in Lebanon, they reveal that the personal data of Lebanon citizens is vulnerable to being unlawfully accessed and leaked due to the absence of a comprehensive data protection law, which would impose obligations on data processors and controllers. Currently there is little or no recourse for the victims of those data breaches and leaks.

The Centre for Internet and Society (CIS) has been at the forefront of the data protection debate in India, working for almost a decade to inform policy-makers of the need for such a law in India. With its population of 1 billion people, the Indian government has created the largest biometric database — Aadhaar — in the world. In addition to exploring issues around Aadhaar, CIS has been re-thinking, questioning and exploring internationally recognised data protection principles to understand their potential and limitations for the Indian context.

Similarly, in Pakistan, where discussions for a data protection law have been long running, Bytes for All (B4A) has been exploring the main privacy and data protection issues such as biometrics, particularly in relation to the National Database & Registration Authority (NADRA). Similar to the situation in India, civil society organisations in Pakistan have been considering what the best regulatory mechanisms would be.

Escalating Our Work To New Spaces

Over the course of our work with our international network on data-intensive systems, Privacy International also engaged with stakeholders, nationally and internationally, around the question of data protection across the world. We raised awareness about the need for the above subjects to be addressed as human rights issues by attempting to integrate them within the UN human rights monitoring mechanisms such as the Universal Periodic Review under the ambit of the Human Rights Council as well as the Human Rights Committee which oversees the implementation of the International Covenant on Civil and Political Rights. In 2017 we welcomed the recommendations made by the Human Rights Committee that Pakistan should adopt a comprehensive data protection law in line with international standards.

We also engaged with the national data protection authorities on reform of the law in Argentina and mechanisms for effective enforcement in The Philippines. In countries like Brazil, Uganda and Indonesia we have been engaging with CSOs to advocate for the adoption of data protection laws that are currently absent. Recognising the role of international entities and regulators, we have also monitored and where possible engaged with the work of the Council of Europe, the Association of Francophone Data Protection Authorities as well as the 39th International Conference of Data Protection and Privacy Commissioners.

The diverse work carried out by PI and our international network of partners highlight a wide range of urgent reforms that are needed in existing regulatory and legal frameworks on data protection, and indeed highlight the need for protections to be introduced where there are currently none — all to ensure that the individual can retain control of their data.

For further information on the State of Privacy across the world, we invite you to refer to the collaborative research project produced by the Privacy International Network.

Learn more

Data Protection

What PI is fighting for

Develop Protections Against Data Intensive Systems in the Global South

Location

More about our partner

SMEX

Bytes for All

Centre for Internet and Society

La Asociación por los Derechos Civiles

La Asociación de Tecnología, Educación, Desarrollo, Investigación, Comunicación (TEDIC)

Our impact

Building the Global Movement

Our campaign

Enhancing Data Protection Standards

Content

News and Analysis

Reports

Lebanon: It's time to turn your international position on privacy into action at the national level

melissab — Tue, 26 May 2015 11:46:15 +0000

Language English

Lebanon was part of the drafting committee for the Universal Declaration of Human Rights, and by co-sponsoring both UN General Assembly resolutions on the right to privacy in the digital age (December 2013 and December 2014), Lebanon has recently reaffirmed its commitment to its obligations to uphold the right to privacy.

And yet, Lebanon's progressive positions on the right to privacy at the UN could not be further away from the situation in the country itself.

Once seen as more liberal than its Middle Eastern neighbours, Lebanon has recently been the subject of troubling reports on attacks and threats against the right to privacy. These include the Cybercrime and Intellectual Property Rights Bureau's expansive monitoring, investigative powers oppressing online privacy and freedom of expression of Lebanese citizens, the lack of judicial authorisation and administrative oversight of surveillance conducted by the Internal Security Forces and increasing restrictions on journalists and activists, particularly in terms of their online engagement.

Lebanon is currently failing failing to constitutionally uphold the right to privacy, to enforce a legal framework to protect personal data and to ensure that laws, regulations, activities, powers, policies and practices related to communications surveillance adhere to international human rights law and standards.

The Social Media Exchange (SMEX), a registered Lebanese nonprofit that conducts training, research, and advocacy on strategic communications and human rights in the digital era, collaborated with Privacy International and the Association for Progressive Communication (APC), to submit a joint stakeholder report. The report raises shared concerns about the respect, protection and promotion of the right to privacy in Lebanon before the Human Rights Council for consideration in Lebanon’s up-coming review at the 23rd session of Universal Period Review in early 2016.

During the first cycle of the Universal Period Review of Lebanon in 2010, the issue of the right to privacy remained undiscussed, but given the concerning reports that have emerged recently, it is crucial that the Human Rights Council request further information and commitment from Lebanon to address reported unlawful interferences with and violations of the right to privacy.

The main issues raised in the joint submission include:

Constitutional protection of the right to privacy

The Constitution in Lebanon does not explicitly protect the right to privacy as only the inviolability of the home is protected under its Article 14. Whereas Law No. 140 (Telecommunication Interception Act of 27 October 1999) upholds the protection of secrecy of communications carried out by all means of communication, it is concerning that there is a lack of constitutional protection of the right to privacy more broadly, to reflect the protections enshrined in Article 17 of the International Covenant on Civil and Political Rights (ICCPR) which reinforces Article 12 of the Universal Declaration of Human Rights (UDHR).

Communication surveillance

Whilst the Law No. 140 seems to provide the necessary safeguards, in practice systematic failures to abide by the law are directly threatening the right to privacy of Lebanon's citizens. Main concerns expresed in the UPR submission included:

The failure to respect the existing legal provisions requiring judicial oversight and administrative authorisation of surveillance in accordance with Article 2, 3 and 9 respective of the Law No. 140;
The unauthorised bulk interception of communications data for prolonged periods of time and unrestricted access to the electronic communications data of all Lebanese citizens by the Internal Security Forces (ISF);
The United Nations International Independent Investigation Commission (UNIIIC), and the Special Tribunal for Lebanon (STL), permitting the ISF unregulated access to private data of Lebanese citizens from an array of sources including university archives, medical records, and mobile phone records;
The presence of PacketShaper installations, surveillance technology provided by US-based Blue Coat, which allows for the surveillance and monitoring of users’ interactions on various applications such as Facebook, Twitter, Google Mail, and Skype;
The lack of oversight of agencies permitted to conduct surveillance with concerns around the legal framework overseeing the activities of the Cybercrime and Intellectual Property Rights Bureau and the failure to respect Law No. 140 which limits the powers of the Ministry of Interior to wiretap; and
A 2013 order by the Public Prosecutor's office requested all internet service providers (ISPs), and some internet cafes that offer Internet access, to retain the data of their users' activity for a period of one year.

Data protection

Lebanon does not have a law regulating the protection of personal data. With existing and emerging initiatives includingthe unique ID number e-government initiative, the impending deployment of biometric passports, and the E-transaction bill which, in its current state, would allow for warrantless search and seizure of financial, managerial, and electronic files, including hard drives, computers, etc., and the establishment of the Electronic Signature & Services Authority, a new regulatory and licensing body with practically unchecked powers, it is extremely concerning that Lebanon has yet to adopt strong legislation protecting data privacy.

Recommendations

In view of the aforementioned areas of concerns, SMEX, APC and PI submitted the following recommendations for the adoption by the UN Permanent Delegations who will intervene during the official review of Lebanon:

Recognise and take steps towards compliance with international human rights law and standards by ensuring the application of the following principles to communication surveillance as articulated in the International Principles on the Application of Human Rights to Communications Surveillance namely, legality, legitimacy, necessity, adequacy, proportionality and respecting process of authorisation from a competent judicial authority, with due process, user notification, transparency, public oversight and respect for the integrity of communications and systems as well as ensuring safeguards against illegitimate access and right to effective remedy;
Investigate claims that illegal communications interception and access to data is routinely undertaken by the security services and other state authorities; ensure that such practices are ended and responsible individuals held to account if the claims are verified, and victims are provided redress for the violation they experienced;
Ensure that there are appropriate controls to prevent the use of private surveillance industry products to facilitate human rights abuses;
Ensure that the state surveillance of online and offline activities is lawful and does not infringe on human rights defenders’ right to freedom of expression and ability to defend human rights, including through use of the information communication technologies;
Immediately enact data protection legislation that complies with international standards and establish an independent data protection authority
Make further efforts to ensure freedom of opinion and expression in the country, including by ensuring that blocked or filtered websites are based on lawful criteria.

From words to action

For the first time at the at the 21st session of the UPR earlier in 2015, some states were challenged over their surveillance practices and their lack of protection for their right to privacy, including Kenya, Sweden and Turkey.

Given Lebanon's commitment to protecting the right to privacy at the United Nations, we hope its UPR will provide it an opportunity to apply what it preaches in Geneva to its national context by ensuring the privacy of its citizens are protected from unlawful, disproportionate and unnecessary interference by the Lebanese government but also other state as well as the private sector.

Large Image (DO NOT USE)

List Image (DO NOT USE)

List Icon (DO NOT USE)

What PI is fighting for

Modernise the Rule of Law and Strengthen Surveillance Safeguards

Learn more

Communications Surveillance

Location

Lebanon

Global South

Our fight

Safeguarding Peoples' Dignity

More about our partner

SMEX

Attachment	Size
Lebanon_UPR_23rd_session_Joint_Stakeholder_submission_0.pdf	459.25 KB

SMEX

Human testing: Militarised technology across Southwest Asia and North Africa

Human testing: Militarised technology across Southwest Asia and North Africa

Smex - What the lebanese government can do to respect users privacy while fighting Covid-19?

#IWD2019 Online gender-based violence: a privacy matter?

Data Privacy Week: Exposing Harms, Fighting Back

State of Privacy Lebanon

Table of contents

Introduction

Right to Privacy

The constitution

Regional and international conventions

Communication Surveillance

Introduction

Surveillance laws

Surveillance actors

Surveillance capabilities

Surveillance oversight, checks and balances

Surveillance case law

Examples of surveillance

Data Protection

Data protection laws

Accountability mechanisms

Data breaches: case law

Examples of data breaches

Identification Schemes

ID cards and databases

Voter registration

SIM card registration

Policies and Sectoral Initiatives

Cybersecurity policy

Cybercrime

Encryption

Licensing of industry

E-governance/digital agenda

Health sector and e-health

Smart policing

Transport

Smart cities

Migration

Emergency response

Humanitarian and development programmes

Social media

Data and Control: Protecting Rights, Protecting People

Lebanon: It's time to turn your international position on privacy into action at the national level