Is Lebanon prepared for the growing threat of cyberattacks?

As cyberattacks become a growing concern around the world, Lebanon is taking steps to strengthen its digital security through new legislation. Minister of State for Technology and Artificial Intelligence Kamal Shehadeh recently highlighted plans for a cybersecurity law aimed at improving the protection of critical infrastructure and sensitive information.

But can a new law protect a country where public institutions already struggle with outdated technology, limited resources, and weak enforcement?

“Lebanon remains highly vulnerable to cyberattacks and that legislation alone will not solve the problem,” Cybersecurity and AI consultant Roland Abi Najem told The Beiruter. Nonetheless, "the law is extremely important and fundamental," he explained. "But if you don't have the necessary foundations and cannot enforce it, then the law has no value."

Weak infrastructure and untrained employees

Abi Najem explained that cybersecurity is often viewed as a technical issue involving protective equipment, software, and security programs. However, he said Lebanon's problems extend beyond technology. "We don't have the minimum required infrastructure for cybersecurity, and we don't have the necessary investments in this field," he said.

He pointed to Ogero, Lebanon's main public telecommunications operator, explaining that its work largely focuses on updates and maintenance needed to keep internet services running, rather than cybersecurity. He also referred to telecommunications companies and other institutions, arguing that Lebanon lacks the minimum infrastructure needed for adequate cybersecurity protection.

According to Abi Najem, "the weakest point in cybersecurity is the human factor".

He raised concerns about government employees, saying that many are hired through political connections rather than based on their qualifications. He believes that many lack proper cybersecurity training and have little knowledge of how to deal with cyber threats. Abi Najem stressed that even if an institution introduces cybersecurity measures, they will not be effective if employees are not properly trained or qualified.

He also emphasized the need for clear governance procedures defining what is permitted and prohibited, alongside incident-response plans specifying what should happen when a cyberattack occurs.

As an example, he recalled the cyberattack targeting Beirut's airport. He said that following the incident, the Minister of Public Works announced that the results of an investigation would be released within five days. However, he questioned why the public had not received clear answers about the circumstances of the attack.

"Governments have changed, and Lebanese citizens still don't know what happened during that cyberattack, how it happened, or whether it came from inside or outside the country," he said.

Which sectors face the greatest risks?

Asked which sectors in Lebanon are most exposed to cyberattacks, Abi Najem said that the risks extend across the country.

All of them, without exception

He identified the central bank, commercial banks, government institutions, ministries, municipalities, and telecommunications providers among the sectors facing cybersecurity risks.

However, he noted a difference between the public and private sectors.

"The private sector is in a slightly better position because, to a certain extent, these companies are investing in their own cybersecurity," he explained.

He said banks have also made some investments in protecting their systems, although he continued to identify them among the sectors exposed to cyber threats.

Government institutions, meanwhile, remain particularly vulnerable. He claimed that Lebanese ministries have already experienced cyberattacks and described the public sector as exposed to serious cybersecurity weaknesses.

To explain the broader risks, Abi Najem referred to major international institutions, including the FBI, CIA, and White House, noting that even organizations with significant resources can experience cyber breaches. He also cited Binance as an example of a major platform that had experienced a cyberattack.

An organization can do everything it is supposed to do and still get hacked. So imagine Lebanon, where we haven't done anything

A law without enforcement

For Abi Najem, introducing a cybersecurity law is an important step, but its effectiveness depends on whether Lebanon can implement it. He pointed to the country's existing legislation, questioning how many laws are actually enforced.

"If you look at Lebanon, we have countless laws. But how many of these laws are actually being implemented?" he asked.

He explained that legislation must be accompanied by the ability to enforce it, a governance framework, and proper institutional organization. Without these elements, he argued, a cybersecurity law would have little practical value.

According to the expert, the law should address data privacy, data security, the use of information in artificial intelligence systems, and the reporting of cybersecurity incidents within a short timeframe.

One of the main questions he raised concerned responsibility for enforcing the legislation."If this law is introduced, who will enforce it? Which official authority will say that it is responsible for implementing this law?" he asked.

Abi Najem emphasized that legislation is necessary but insufficient without investment, qualified personnel, proper infrastructure, and enforcement mechanisms.

"The law is an essential and necessary component, and it's a very positive step," he said.

"But all the other factors show just how far Lebanon remains from proper cybersecurity."