Most of my work is finding out things that someone would rather keep quiet, using only what is already public. The trade has a name, open-source intelligence, and it sounds more spectacular than it is. There is no spying and no secret meetings with sources. The premise is that a great deal lies around in plain view, in registries and official bulletins and maps and lists, and that anyone patient enough to gather the pieces can make out the shape of the place. The premise mostly holds. In Lebanon it holds in a shape I did not expect.
What is new is scale. Open-source work always had a human ceiling. A person can read only so many pages, hold only so many sources in mind, and chase only so many threads before the day is gone, so the job meant picking a few targets and going deep on those. In the past six months I have worked on lifting that ceiling. I have built a team of AI agents that read and reason over the web the way a person would, tireless and across thousands of sites at once, and with them a very small team can map the entire information space of a country, every registry and ministry feed and map and archive, at a depth and speed that was not available even a year ago.
One of the agents, Ali, sweeps that space more or less without stopping, pulling in what is there and flagging what has moved. When a particular site needs taking apart, I hand it to him, and he goes through it the way no human could. He reads the page's code and follows the requests the page quietly makes, and he finds what the front was not built to show: a key left sitting in plain sight, an address you can increment by one to walk an entire archive, a feed that will answer anyone who asks it politely. None of this is breaking in. They are doors the owners left open, mostly without noticing. What changed is that finding them, across a whole country's worth of sites at once, used to be slow specialist work and now takes a fraction of the time. I decide where to point the team, and what the findings mean. That division of labor, the machines doing the finding and the reading, a human keeping the judgment, is Convergence.
Do this for long enough and something comes up out of the work that the work was not looking for. You stop seeing only what is reachable and begin to see the shape of it, which records open at a touch and which are bolted, and for whom. In most places that shape is dull. Public things are public, private things are private, and the line sits about where you would expect. You would think a country whose state is as broken as Lebanon's would be looser still, everything spilling out for want of anyone to lock it. It is here that the very premise of OSINT in Lebanon holds in a shape I did not expect. Information, and its protection, are captured like everything else, by the usual hands, handled case by case, the rules bypassed so routinely that the selective protection of a given fact becomes a signal in itself. Two experiences illustrate what I mean.
The first was about money. We were trying to trace who really owns a set of Lebanese companies and banks, the kind of ownership that runs back to the networks that came through the country's financial collapse intact and, in some cases, richer. The obvious place to start is the commercial registry, the official list every country keeps of who owns which company, and that Lebanese commercial law has required to be public since 1942, so that a citizen, a creditor, or an investigator can look a business up and see the names behind it [4]. I found the official site, run by the Ministry of Justice, and started searching. Or tried to. Every query came back with the same error, a few hundred bytes of nothing where the results should be, and it has come back that way for every company in the country since early 2025. At first I thought it was a temporary outage, but trying again a day, a week, a month later led to the same result. Behind the mask of a working search engine sits a database whose access has been switched off, a law suspended without being repealed, quietly, for whoever finds the suspension convenient. A thin version of what used to be there can still be reconstructed from public web archives, frozen at the early-2025 cutoff. Everything more recent sits in the dark, and I am almost certain that is the point.
The second was about people. The war had driven hundreds of thousands of Lebanese out of their homes, and we were trying to map where they had gone. What the public could see was a map, a scatter of anonymous dots you could pan around, with no button to download what lay beneath it. But a map like that is always being fed by something, and the source that feeds it answered, in a single reply, with no password and no key, the full record the map is built on and never shows: 188,956 people, every collective shelter in the country, each with its name, the number sheltering inside, its location down to the cadastral plot, and the mobile number of the person running it. The map offered a handful of dots. The thing behind it held the people themselves, open to anyone who reached past the surface to the source.
So in the same stretch of work the record a functioning state keeps open on purpose was sealed, and the record of where its most vulnerable people were sleeping lay in the open for anyone who reached the source behind a map. After a while this stops looking like mere oversight or technical malfunction.
None of this is how the rules say it should go. The instinct that a company register should be open and a list of frightened families closed is not naive. It is more or less the law. The right to reach public information is treated as a basic one, written into the same article of the international covenants that protects free speech, and by now close to a hundred countries have passed freedom-of-information statutes to put it into practice [1]. Lebanon is one of them. It passed an access-to-information law in 2017 and a personal-data-protection law the year after [2]. So this is not a country without rules about who may see what. It has the rules. It just applies them backwards, and selectively. Show me which records a ministry has quietly made unreadable and which it has left lying open, and it is not hard to deduce whom it is protecting.
Pierre Bourdieu explained why a state would bother in the first place [3]. The state, he argued, holds something close to a monopoly on legitimate classification. It is the institution that fixes the official categories a society is sorted into, citizen and foreigner, this sect and that, and makes those categories real by counting in them, recording them, stamping them on an identity card. To be classified and counted, on the state's terms, is much of what it is to be governed. The reverse holds too. When a state takes care not to count something, or not to let you see the count, that is rarely simple incompetence. It is a choice about power, and the thing left in the dark is the thing someone benefits from keeping there.
It is not only the registry. Almost everywhere the state is meant to show its workings, it has found a way not to. The official gazette, where every law and decree is published, comes out as a GIF, scanned images, one photographed page after another, that no search can read. The actual text appears only on a separate, university-run site that trails a year or more behind. The war's official death toll, the single most quoted figure in the country, the health ministry releases as a picture, a chart flattened into one image inside a daily PDF, so that to read the number of women killed one has to run character recognition on a photograph of a graph. The fullest public account of how the government spends, more than eighteen thousand procurement contracts, sits not in any ministry but in the open database of a single anti-corruption group, which keeps what the ministries will not. That same group, when it asked public bodies for basic information under the new transparency law, got an answer from barely a third of them [2]. None of this is for want of ability. A government that can run a national election can run a search box. The blankness is a choice, and the law meant to prevent it goes unenforced.
Now the other direction. With the displaced, nothing had to be pried open. The difficulty was the opposite, how much the system simply showed, to anyone, by default. The shelter record was only the start. A second source, a live monitoring system run through the inter-agency coordination between the social affairs ministry and the UN, reached into the people themselves: how many in each shelter, broken down by sex and age, by disability, the women pregnant or nursing, updated through the war week by week, much of it readable by anyone with a browser. Some of what that system shows is shown on purpose. The mobile number of each shelter's focal point is published so that the displaced, and the aid meant for them, can reach it; the open line is the point, not the accident. But the pregnancy of a woman in a collective shelter is not a focal point, and no one ever decided it should stand in the open beside the phone number that is meant to. The two sit in one file, the deliberate next to the unconsidered, and nothing in the system tells them apart.
There is a law for this, and that is almost the worst of it. The same parliament that wrote the access statute wrote a data-protection law in 2018, the kind meant to decide, in advance and on principle, what may be collected, what must be guarded, and what may be shown [2]. On paper the displaced are covered. In practice the law names no working rule that anyone applies, so the questions it was written to settle, what is shown, what is shared, and to whom, are settled instead one screen at a time, by whoever happens to hold the record. The system that produces this data produces it for a reason: aid follows counting, and to be helped you must first be registered, sorted, measured, your need documented well enough that someone will fund a response to it [5]. That much is legitimate. The trouble is that once the data exists, nothing governs where it goes next. The same openness that lets an aid agency reach these people leaves no rule about who else may. Bangladesh is the warning. The UNHCR registered Rohingya who had fled the Myanmar army, taking their fingerprints and faces for aid cards; the host government then handed the names and biometrics of more than eight hundred thousand of them to Myanmar, the very state they had run from, for so-called repatriation checks, and investigators later found the agency had skipped its own risk assessment and, in case after case, never told people their data might travel at all [6]. No one there had to break in. The data moved because nothing had been set down to say it could not. That is the condition a record of 188,956 displaced Lebanese sits in: not breached, but ungoverned, open or closed at the discretion of whoever holds it, with nothing above them deciding which it should be.
This is the rule the two cases share, drawn out. Openness is not a property the information carries, the way my own field tends to talk about "open-source" material, as if it were a stamp on the file [7]. It is granted, or withheld, by whoever has power over the person the data is about. The businessman stays invisible because power protects him, and in Lebanon power prefers to work unseen. The displaced woman is wholly visible because the system that governs her governs by looking at her. The same kind of fact, a name, an address, a number, is locked or wide open depending entirely on who the person is, and not at all on what the fact says.
Openness is not a quality of the information. It is a decision someone with power has made about the person it describes.
Taking this further, the clearest illustration of what unprecedented gathering power means in Lebanon is this one. Lebanon has not counted its own population since 1932. That single census, taken under French mandate, fixed the sectarian arithmetic the whole state still runs on, the set ratios of seats and offices parceled out among the religious communities, and to count again would risk learning that the numbers no longer hold the bargain up [3][8]. So the country governs itself on a fact it has refused, for more than ninety years, to know. Knowing who your people are is the most elementary thing a state sees about itself, and Lebanon has made not knowing it a condition of its own peace.
And yet it cannot quite manage not to know. The thing it refuses to count, it requires, by law, to be written down. Every voter's record carries name, parentage, identity number, date of birth, and sect, that last field the exact dimension the missing census is meant to hide. For a while the interior ministry even posted the rolls on its own website. In 2016 a magazine pulled them while they were up, added the sects together, and printed the number the whole settlement is built on not knowing: barely a third of Lebanon's voters were Christian, the Maronites who had once been the largest community down to a fifth, overtaken now by the Shia [9]. The ministry took the lists down soon after. But the rolls are still kept, still tagged by sect, and reading several million records out of hundreds of district files and adding them by confession is an afternoon's work now, for anyone. The country's most carefully unspoken fact was never truly hidden. It was only ever unassembled, and assembling is exactly what has stopped being hard.
The rolls are only the sharpest case of a single pattern. A real data policy decides three things in advance and on principle: what a state collects, what it protects, and what it publishes. Lebanon decided all three by interest. It collects each citizen's sect because the confessional system is built to need it. It protects the men behind its companies, whose names the registry quietly stopped giving, and not the displaced, whose shelters and numbers lie open to anyone. It publishes its laws and its war dead as pictures no machine can read, and its public procurement not at all, leaving the contracts to an anti-corruption group to keep. None of this is the absence of rules. It is their capture, an information order built to serve interests rather than people, and the rolls are simply its purest product: a record kept whole, down to each citizen's sect, that leaves the one count a fragile peace depends on no one drawing only a sum away. For work like mine this is, perversely, an advantage. A captured order is a legible one. Its leaks expose what power would rather hide, and its locked doors are a map in themselves, since what a ministry has quietly switched off tells you whom it means to shield. We do not fight the inversion. We read it, and the same selective secrecy that fails the country becomes, in our hands, its most dependable signal.
What is knowable about Lebanon, in the end, is not a map of data. It is a map of who power has decided may be seen: the company owner kept in the dark because he is strong, the displaced woman lit up because she is weak, the national headcount forbidden because the true answer is dangerous, and all three now within reach of the same handful of tools. The line between what cannot be found and what can was never drawn by the world. Power draws it, and it moves when the tools move. The tools have moved, and for now they sit mostly in hands like mine. We benefit from this order more than most of the people inside it ever will, and that is exactly why the last question falls to us. What is left is no longer whether we can see. It is what we are willing to do with the sight.
Notes
1. The right of access to information is recognized under Article 19 of the Universal Declaration of Human Rights and Article 19 of the International Covenant on Civil and Political Rights, as an element of freedom of expression. Close to a hundred states have since enacted freedom-of-information laws. See ARTICLE 19, International Standards: Right to Information.
2. Lebanon, Access to Information Law No. 28/2017, and Electronic Transactions and Personal Data Law No. 81/2018. On enforcement, the Gherbal Initiative's 2019 audit found roughly a third of public bodies answered information requests filed under Law 28/2017.
3. On the state's monopoly of legitimate classification and its power to constitute social categories, see Pierre Bourdieu, On the State: Lectures at the Collège de France, 1989-1992 (Cambridge: Polity, 2014), and "Rethinking the State: Genesis and Structure of the Bureaucratic Field," Sociological Theory 12, no. 1 (1994).
4. The Lebanese Commercial Register operates under the Code of Commerce (Decree-Law No. 304 of 1942, as amended), Ministry of Justice. Registration's legal function is publicity, to make a company's particulars effective against third parties.
5. Didier Fassin, Humanitarian Reason: A Moral History of the Present (Berkeley: University of California Press, 2011).
6. Human Rights Watch, "UN Shared Rohingya Data Without Informed Consent" (15 June 2021). Bangladesh transferred the data of at least 830,000 Rohingya refugees to Myanmar for repatriation assessments.
7. For the doctrinal treatment of open-source intelligence as the exploitation of "publicly available information," see the U.S. Intelligence Community OSINT Strategy.
8. On strategic ignorance as a form of power, the holding of the line between what is known and what is not, see Linsey McGoey, The Unknowers: How Strategic Ignorance Rules the World (London: Zed Books, 2019).
9. The reconstruction of the confessional balance from the voter rolls follows The Economist, "Census and sensibility" (5 November 2016), which aggregated by sect the registration lists the Interior Ministry had briefly posted online (37% of voters Christian, Maronites 21%, the Shia now largest at 29%). The lists were subsequently taken down. The same method, at district granularity, appears in L'Orient Today's "Mapping Lebanon" series and the Lebanese Association for the Democracy of Elections (lebanonelectiondata.org). The collective-shelter figure cited above (188,956 across 1,064 sites) is the count the social affairs ministry's own shelter feed exposed publicly during the war; the commercial-registry material is drawn from public captures preserved by the Internet Archive.