Diaspora Lebanese demonstrate in Paris in October 2019. (Credit: AFP)
BEIRUT — One day after registering to vote, Nadine, a Lebanese citizen living in Montreal, received a call from a woman identifying herself as a representative of the Free Patriotic Movement.
“I only use my maiden name here, yet she called me by my husband’s family name, which can only be retrieved from my Lebanese and Canadian passports,” said Nadine, who asked to have her name changed for privacy reasons.
The person on the other end of the line wanted to know whether Nadine was going to vote for the party’s list, and when she said no, the person replied that she would put Nadine’s name down on the Lebanese Forces list instead, recalls Nadine, still baffled by that response.
“I told her that I won’t vote for either of them,” she said.
When she inquired how the party representative had gotten her number, she said, the woman on the phone told her she was calling from the consulate. (The consulate later put out a statement saying that its employees had not been calling voters to verify their voting intentions.)
Nadine is one of multiple Lebanese expats in several different countries who said they had been contacted by political parties — among them, the FPM, Amal Movement, Lebanese Forces, Marada Movement and Bahaa Hariri’s newly established Sawa — hours or days after registering to vote. Some 196,327 Lebanese from the diaspora had registered to vote as of Thursday, according to the Foreign Affairs Ministry.
This has led some voters and digital security experts to raise questions about the registration platform’s data privacy, who has access to users’ personal information and where it might have been shared.
“In order to register, we had to upload a scan of our passport as well as [our] local government ID. The online form was shockingly unsecured and terribly written. I have no idea who has [or] doesn’t have access to my info, and it’s very concerning that the parties’ overreach extends quite literally to the other side of the globe,” said Michel Fathalla, a Lebanese citizen living in Australia.
Elias Atallah, a Lebanese citizen living in Montreal for the past four years, said the same day he registered to vote, he also received a phone call from an FPM representative asking whether he would vote for the party’s candidates.
“It felt like she knew everything about me and that my vote for them was a given,” he said. “It’s not a coincidence that they called me right after I received the email confirming my registration. I’m not accusing the consulate of sending my data [to political parties], but maybe an employee who has access to the information is leaking them.”
After Atallah contacted local police alleging that his data had been leaked from the diaspora voter registration platform, a representative of the Consulate of Montreal called him two days later to insist that they had not leaked his information. He later sent a complaint to the Foreign Affairs Ministry.
Karim Bitar, the director of the Political Science Institute at Saint Joseph University of Beirut (USJ) and a co-founder of Kulluna Irada (“We Are All Determined”), a civic organization for political reform, noted that “embassies are generally linked to Lebanese political leaders, depending on the country in which the diplomat is appointed.”
Bitar said the registration process is flawed and may be promoting the spread of clientelism even abroad.
Mounir Anouti, a diplomatic counselor for the Foreign Affairs Ministry, dismissed allegations that the ministry had leaked data, saying political parties have their own mechanisms to find and collect phone numbers, whether through crowdsourcing, open sources or other means.
Some political party representatives said the same.
L'Orient Today called two phone numbers used by FPM members in Canada to contact voters.
“It’s easy to get the numbers in Canada. We can find them everywhere,” one grumbled before hanging up. The other said the party “had these numbers from the 2018 electoral lists.”
“All parties are calling — we are not the only ones,” she added. “In Canada, we have a public telephone directory, so we can contact any Lebanese resident.”
Lack of privacy protection
Even if voters’ information was not leaked, experts said the lack of privacy protection measures in the voter registration process is problematic.
The Samir Kassir Foundation, which monitors press freedom in the Middle East, flagged concerns about the protection of voters’ data in a recent study assessing the vulnerability and data privacy measures of government websites. The study notes that “the Diaspora Voter Registration Platform of the Ministry of Foreign Affairs raises serious privacy concerns. … While it is secure, the website does not provide a privacy policy or terms and conditions.”
After L’Orient Today contacted the Foreign Affairs Ministry with questions about the lack of a privacy policy and terms and conditions that show how data would be stored and used on the registration site, the ministry added one paragraph of “privacy terms” on Tuesday, four days before the deadline to register abroad.
Carole Alsharabati, the research director of Siren Associates, which developed the IMPACT e-governance platform used to register Lebanese residents for the COVID-19 vaccine, said a privacy policy “is very important, because when someone puts his information on a website he has to know right away who will see it, where it will go, what are his rights regarding the privacy policy for confidentiality.”
“It means that the institution creating the page commits to protecting the information” from commercial or political uses, she said.
Alsharabati said these practices are part of the ethics of online data governance and are particularly important in the context of official state sites dealing with elections.
“It’s a whole machine of governance,” she said.
Ayman Mhanna,the Samir Kassir Foundation’s executive director, said the ministry had breached Lebanese law by initially failing to post a privacy policy, which is required under Law 81/2018, the e-transaction and personal data protection law.
The lack of privacy measures on the voter registration sites could also run afoul of the stricter privacy laws in the European Union and United Kingdom, he noted, which “puts it [the registration site] at risk of being banned, depriving thousands of eligible diaspora [members] from their right to vote in the upcoming elections.”
Apart from that, Mhanna took issue with some of the information required of potential voters to register on the diaspora registration platform, which he described as sensitive and irrelevant to the voter registration process.
Would-be voters are required to provide, among other information and documents: their addresses abroad, contact information and picture attachments of their Lebanese identification card, civil registry or passport, in addition to their foreign identification, residency card, foreign passport, Lebanese passport with immigration or work visa, or driver license.
Gathering such data and not storing them in a secure manner could put those who register at risk of identity theft and other crimes, Mhanna said, in addition to giving political parties a tool to pressure or harass family members in Lebanon to get their overseas relatives to vote for them.
Anouti pushed back, arguing that the information requested was meant to facilitate communication between embassies and voters on missing and expired documents or data that needed to be fixed.
Mohamad Najem, executive director of the Beirut-based digital rights organization SMEX, noted that Lebanese law is generally weak on privacy protections.
“We should have a law specifically for protecting privacy in Lebanon, rather than a law subsidiary to an e-transaction law that mentions data privacy,” he said.
Was there a breach?
Data can be collected in legitimate ways, through open sources and publicly available information on websites and social media, Mhanna said, and “political parties have the right to collect information from such sources.”
But no one is allowed to sell data unless they inform concerned people before doing so and name the purchasing entity; otherwise both data collectors and data buyers would be violating privacy laws, he added.
Political party representatives who spoke with L’Orient Today said they had gathered lists of potential voters through their own membership rosters.
In France, Lebanese Forces representatives said they had called friends and family members living abroad to encourage them to register to vote.
“Then the friend that we called would contact someone he [or] she knows, who usually has the same ideology, and would ask them if they can send us the number. If they accept, we then send them a message specifying that if they do not want to be contacted again they should notify us,” explained Antoine Tannoury, who is in charge of elections for the Lebanese Forces in France.
Elena, who lives in Paris and asked that her real name not be used for privacy reasons, was surprised to receive a message from the Lebanese Forces offering to help her register to vote, although she had already registered.
“It was on WhatsApp, which is linked to my Lebanese number,” she said, adding that “they used my third name, which is only used for administrative purposes.”
In a tweet, another woman in France complained of being called by the Amal Movement.
“Even here, we do not know how to get rid of them,” she wrote.
Khalil Rammal, who represents Amal in France, said: “During elections, all we do is encourage people from our database to register to vote. We are using different channels: social networks, phone calls and SMS.”
The Amal Movement has built a database of 2,000 people in France, he said, and the phone numbers collected are only “used during elections.”
A Lebanese citizen from Akkar who lives in Kuwait and asked to remain anonymous registered to vote a month ago.
He was taken by surprise when he received a call from a Kuwaiti number this Monday asking whether he had registered.
“Why are you asking me this question? How did you get my number?” he responded.
At first the caller did not want to give details, he said, but eventually said that he had gotten the phone number from the Free Patriotic Movement in Akkar. While it is common for political parties to contact previous voters and encourage them to vote again, the Lebanese expat in Kuwait had never registered to vote before, he said.
Contacted by L’Orient Today, the person who had called him refused to give his name and denied being part of a political party, but admitted that “friends from Akkar” gave him phone numbers to call and make sure their owner is registered to vote.
An FPM spokesperson said the party has databases built over years from “communicating with people in events and gatherings or through attaining contacts from people who inform us that they have left Lebanon to another country or from people who have contacts of family and friends who follow the party but live abroad.”
She confirmed that the FPM had been contacting people, especially those who had voted for the FPM in past elections.
“But we are not contacting them to find out who they are voting for,” she said. She also denied getting information from the Foreign Affairs Ministry, saying the party already has data and is “not in need of their information.”
Meanwhile, a British phone number has been contacting Lebanese residents of Belgium and Australia asking whether they are registered.
L’Orient Today reporters tried calling the phone number, but no one picked up. After investigation, L’Orient Today was able to trace the number to a data collection agency that started making calls in November 2021.
The same number was used to contact Fathallah, who lives in Australia. “Lebanese living in Lebanon might not take online security as seriously as we do here,” he said, “but in Australia, nearly everything we do is online, and security is pretty ubiquitous and enforced.”
He added that he was “appalled that my private info got easily leaked. It includes details that could be easily used for fraud.”
While questions remain about the privacy measures in place and what data may have been shared, political parties contacting potential voters ahead of elections is not unusual in many countries. Some observers noted that the reactions of Lebanese expats reveal a deeper issue: the lack of trust in state institutions.
“Elections are about trust: if you trust the system you will trust the process,” Mhanna said. “Thus, doubtful practices will raise fears against registration and voting.”
The distrust extends to the extent that Kulluna Irada came under fire on social media for sending expats reminders to register via their work email without prior consent. A Kulluna Irada spokesperson assured L’Orient Today that the group is not affiliated with a party, but is rather a group concerned with political reforms. The group is currently working on awareness raising and capacity building for the upcoming parliamentary elections.
“We gather data from open resources such as LinkedIn and survey platforms publicly available to send emails reminding people to register to vote before the deadline for registering in the diaspora,” the spokesperson said, highlighting that they do no not lobby for political parties, nor do they mention any in their emails.”
Amid the questions around data privacy and the perceived pressure by political parties, even some registered voters are now second-guessing their participation.
Nadine, who was contacted by the FPM, said she felt that her personal life had been invaded.
“I regret registering,” she said. “Nothing will change.”
