Who Controls Security in Lebanon? Covert Operations Raise Questions Over State Authority

Lebanon’s security challenges are increasingly extending beyond assassinations, bombings and traditional espionage, as alleged cross-border intelligence operations and covert activities by foreign and domestic actors raise questions about who holds effective authority on the ground, an Annahar report said.

Some of the reported operations are attributed to foreign intelligence services, while others allegedly involve local groups operating outside official state institutions. As details emerge, a broader question is coming into focus: who has the authority and capacity to conduct security operations in Lebanon, and what role do state institutions play in them?

The latest controversy concerns Ali Kayali, a former Syrian regime officer also known as Mahrac Ural, who was reportedly taken from his home in Mansourieh, east of Beirut, to Syria.

Lebanese reports initially described the incident as an abduction. Damascus later announced that Kayali had been arrested in a security operation conducted jointly with Turkish intelligence. Lebanese authorities have yet to issue an official explanation of the circumstances surrounding the operation or clarify the nature of any coordination involved.

The conflicting accounts raise questions not only about the fate of the individual targeted, but also about how a security operation could be carried out on Lebanese territory and the extent of the authority exercised by those involved.

Concerns have also intensified following reports that Hezbollah’s security apparatus detained Americans in Beirut’s southern suburbs. The allegations have emerged alongside reports of other foreign nationals, including a Ukrainian and an Algerian, as well as Lebanese citizens, being detained.

The reports have raised questions about whether individuals are being held and questioned outside the framework of official security institutions, and whether the relevant state authorities are aware of such actions. Establishing what happened, identifying those responsible and determining the legal basis for any detention are central to clarifying the situation.

The issue extends beyond Hezbollah and operations attributed to foreign intelligence services. International media reports have also examined the disappearance in December 2025 of Ahmed Shukr, a retired captain in Lebanon’s General Security Directorate. Israeli intelligence was found to have been involved in his abduction, according to the reports.

The case recalls the 1994 abduction of Mustafa Dirani from Lebanon’s Bekaa Valley by an Israeli commando unit. Israel said the operation was linked to efforts to obtain information about Ron Arad, an Israeli air force navigator who went missing in 1986.

The Problem Goes Beyond Intelligence Penetration

Foreign intelligence agencies routinely seek to gather information, recruit sources and conduct operations against people they consider significant to their security interests. But there is a fundamental difference between intelligence activity that a state detects and attempts to disrupt and operations carried out on its territory or across its borders without a clear account of the role played by its own institutions.

In the first case, official agencies are working to defend national sovereignty. In the second, uncertainty over who authorized or carried out an operation raises doubts about the state’s ability to control its own security environment.

The situation becomes more troubling when multiple actors are reported to have the capacity to make arrests, conduct interrogations and carry out operations on the ground, while the role of the judiciary and official security agencies remains unclear to the public.

Trust in State institutions requires more than security announcements. The public needs to know who carried out an operation, under what legal authority, where a detainee was taken and which judicial authority is overseeing the case.

The accumulation of such incidents places greater pressure on the Lebanese State to establish the facts and make clear that every security measure taken within the country is governed by the law and subject to the authority of the competent institutions, regardless of the identity of the target or the party seeking the person’s detention.

In a country where regional conflicts and intelligence networks intersect, uncovering a spy ring or thwarting an operation is not enough. The deeper challenge is to ensure that the state remains the sole legitimate authority responsible for security and justice, and that citizens can be confident their safety and rights are not subject to competing centers of power.