Another Authority, Same Question: Who Is Responsible When Libya Gets Hacked?

 A Governance Crisis, Not a Technology Crisis

Digital transformation in Libya is no longer a passing conversation about modern devices or imported software. It has become a deeper question that touches the very core of how the state manages its data and institutions. The real challenge is not the absence of technology, but a deep-rooted crisis of digital governance: overlapping mandates among multiple bodies whose roles intersect without a clear line separating who sets policy, who regulates, who implements, and who monitors and holds to account. As this article will show, the root of the crisis is conceptual before it is administrative: the absence of a distinction between four inherently different governance functions, a problem recently compounded by the creation of a new authority that widens the circle of overlap rather than resolving it. Moving from scattered digitisation to a genuinely integrated "digital state" requires overcoming the chaos that has turned institutions into isolated islands and focusing instead on clear governance that controls the flow of data and defines responsibilities with precision that leaves no room for ambiguity.

The urgency of this debate was underscored on 9 June 2026, when the Central Bank of Libya disclosed that a cyberattack had struck several of its systems, an intrusion the Qilin ransomware group later claimed to have carried out and threatened to leak banking data. Less than a month later, on 5 July 2026, the Cabinet created a new cybersecurity authority. The sequence is telling: Libya's response to a breach of one of its most systemically important institutions was not to clarify who is accountable for national cyber-defence, but to add a fifth body to a field already contested by at least four. That gap — between the moment an attack happens and the moment someone can be held institutionally accountable for it — runs through the rest of this article.

Digital Transformation: The Absence of Institutional Governance

Genuine digital transformation does not begin on equipment shelves; it begins with reorganising how institutions work. Without a unifying institutional vision and sound governance, digitisation becomes scattered projects, with each body operating in isolation from the others. In this context, time and money are repeatedly wasted along parallel tracks that never meet because the core problem is the absence of a single reference point to set policy and organise data flows. This largely explains the confusion in Libya's digital landscape: multiple bodies discuss digitisation from closely related angles, without a clear line separating policy from implementation, or regulation from coordination. This governance crisis turns digitisation into a tool for duplicating effort rather than integrating it.

The Conceptual Root of the Crisis

To understand why this confusion persists despite a growing stack of strategies and decrees, it is necessary to return to the concept underlying any successful digital governance system: a precise distinction between four functions that are inherently different, even when official rhetoric treats them as interchangeable:

1. Policy-making: setting the national vision and overall strategy for digital transformation.

2. Regulation: establishing standards and rules and overseeing compliance.

3. Implementation: building, operating, and maintaining digital services.

4. Assurance: cybersecurity, auditing, monitoring, and accountability.

In international digital governance frameworks, this separation is not a theoretical luxury but a structural requirement. Whoever sets policy should not also implement it or audit itself, and whoever regulates a sector should not compete with the entity it supervises. In Libya, this distinction is almost entirely absent. The same body often appears in official documents as a policy-maker, regulator, and implementer all at once, while other bodies share the very same function without coordination. This — not simply "too many institutions" — is the actual root of the overlap crisis.

This article's four-way split is an analytical framework, not a quotation from any single external model. But it echoes a consistent theme in published guidance on national cybersecurity governance. The Guide to Developing a National Cybersecurity Strategy — a 2018 joint publication of the International Telecommunication Union (ITU), the World Bank, the Commonwealth Secretariat, the Commonwealth Telecommunications Organisation, and the NATO Cooperative Cyber Defence Centre of Excellence — recommends that the body leading a country's strategy be kept distinct from the bodies that implement it, that a country's policy, regulatory, and operational environments be assessed separately, and that monitoring and evaluation be assigned to an independent entity rather than to the implementers themselves. The same guide explicitly instructs countries to map existing agencies' mandates and clarify overlapping authorities before establishing new ones, precisely the step Libya skipped in July 2026.

Contested Mandates: Who Claims Which Function?

Libya's current institutional map reveals overlaps that threaten the effectiveness of digital transformation, and this becomes clearer when the existing bodies are read through the lens of the four functions above rather than by name alone. The table below reframes the picture: instead of listing scattered, overlapping tasks, it shows which governance function each body claims and how several bodies converge on the same function.

This classification reveals the root cause of the crisis: at least four bodies lay claim to the security "assurance" function, and three share the "policy-making" function with no decisive hierarchy among them. The problem, then, is not the number of institutions, but that each one was designed to combine more than one function at once, turning the four governance functions from a logical division of labour into a field of institutional competition.

Another Layer on Top of the Chaos

On 5 July 2026, the Cabinet of the Government of National Unity issued Decision No. 359 of 2026, appointing a chairman for a new body named the "National Authority for Cybersecurity and Digital Sovereignty."

As significant as a name that signals serious intent to tackle the digital file may be, the decision — as published — is limited to appointing the authority's chairman and putting it into immediate effect, without attaching any detailed definition of the scope of its mandate or its relationship to the bodies that already hold the assurance and oversight function for security, specifically the National Authority for Information Security and Safety (originally tasked with securing data and setting security policy since 2013), and the General Authority for Communications and Informatics, which lists cybersecurity among its official services.

In other words: rather than settling the long-deferred question — who sets national security policy? — this new authority adds a fifth actor to an arena already contested by at least four parties. Sound administrative logic would resolve overlap by clarifying mandates or merging similar bodies; creating a new authority without an explicit repeal or amendment of existing bodies' powers produces the opposite: yet another governance layer stacked on top of layers that already exist. It literally repeats the very pattern this article warns against from its title onward: that the solution to institutional multiplicity is not more institutions.

The decision came less than a month after the Central Bank of Libya disclosed, on 9 June 2026, that a cyberattack had affected several of its systems; the Qilin ransomware group publicly claimed the intrusion on 22 June, threatening to leak banking data unless its demands were met. In the weeks that followed, Libyan prosecutors ordered the detention of two Central Bank IT officials in connection with the breach investigation. Against that backdrop, creating a new cybersecurity authority reads less like considered institutional reform and more like a reflexive gesture, one that, notably, still left unanswered the exact question the incident raised: who, institutionally, is accountable when a systemically important entity is attacked?

The Accountability Test

The Central Bank breach is a useful test of this article's argument because it shows what institutional overlap produces in a live crisis: not clarity, but a vacuum. At least four national bodies can plausibly claim a stake in the country's cybersecurity assurance function: the National Authority for Information Security and Safety, the General Authority for Communications and Informatics, the newly created National Authority for Cybersecurity and Digital Sovereignty, and, more loosely, the High Committee for Digital Transformation. Yet when investigators examined the breach, accountability did not travel upward through any of these bodies. It landed on two individual IT officials at the Central Bank itself, whose detention prosecutors ordered.

This is not necessarily unjust in this specific case; the investigation may well establish individual negligence. But as a pattern, it is exactly what a fragmented assurance function produces: front-line technical staff at the breached institution become the default answer to "who is responsible," while the national bodies formally tasked with setting cybersecurity policy, standards, and oversight face no defined consequence, because no single one of them can be shown to have owned the standard that failed. Overlap not only wastes budget and duplicates platforms, as argued above; it actively erodes accountability at the exact moment it matters most: during a live incident.

A citizen, a bank, or an investor asking "who is responsible for defending Libya's critical infrastructure, and who answers when that defence fails?" cannot currently get a clear answer. That is precisely the question the four-function separation proposed in this article is designed to resolve. With a single body clearly owning national cybersecurity assurance, incident response and accountability would run through one defined chain of command, instead of disappearing into the gap between four or five overlapping mandates.

The Economic and Administrative Cost of Overlap

Multiple bodies are not a flaw in themselves, provided mandates are clear and integrated under strict governance. But the problem erupts when roles intersect without genuine coordination, leading to duplicated platforms and competing rather than complementary initiatives. At that point, administrative dysfunction becomes a direct economic burden: every duplicated decision inflates costs and delays results, straining the state budget. Worse still, this overlap creates a vacuum of responsibility; when projects fail, bodies disclaim responsibility or pass it to one another, and accountability is lost among authorities, centres, and committees.

Security Risks and the Absence of Unified Leadership

Cybersecurity in a fragmented institutional environment does not suffer only from weak technical capacity, but primarily from the absence of unified leadership and digital-security governance. Distributing data across multiple bodies without unified standards makes the state's environment more exploitable in the event of attacks or data leaks — as the Central Bank breach illustrated — and the new National Authority for Cybersecurity and Digital Sovereignty, given the overlap of its very name with existing mandates, is more likely to add conflicting standards than to unify them, unless its position is clearly resolved soon. Cybersecurity ultimately rests on governance, clarity of roles, and speed of decision-making, and any fragmented institutional landscape weakens all three at once.

A Missing Dimension: Citizens First

The debate over institutional overlap is often reduced to a dispute among administrative elites, but its real impact lands directly on the citizen.

This overlap does not affect institutions alone; it affects citizens directly. When government bodies work in isolation, citizens must submit the same data repeatedly, service procedures take longer, and trust in the state's ability to deliver integrated, secure digital services declines.

Any solution to institutional overlap must therefore ultimately be measured by its impact on the citizen's experience of digital services, not merely by its administrative tidiness.

Ethical Responsibility and Building Trust

In the age of artificial intelligence and the digital economy, technical competence alone is no longer enough. Errors in data management or digital governance can become errors in the production of knowledge itself; AI can support decision-making, but it can just as easily become a vehicle for misinformation if built on uncoordinated or conflicting data. This responsibility is not purely technical but fundamentally administrative: how can citizens be asked to trust a digital system when the bodies running it cannot agree on the boundaries of their own authority?

A Lesson from International Experience

Libya is not alone in facing this challenge, and published guidance on national cybersecurity governance converges on a consistent lesson: authority should be concentrated and clearly assigned, not multiplied. The ITU/World Bank/NATO CCD COE guide cited above recommends that countries designate a single, clearly empowered national cybersecurity authority, anchored at the highest level of government, to provide direction and coordinate action; precisely because cybersecurity cuts across so many separate government functions that, left uncoordinated, tend to duplicate and compete rather than complement one another. The same guide calls on countries to map overlapping mandates among existing agencies and resolve them before creating new ones, and to keep the entity that leads a strategy's development distinct from the entities that implement it and from the independent body that monitors and evaluates it. Read against that guidance, Libya's pattern — accumulating cybersecurity-adjacent bodies rather than consolidating their mandates — sits closer to the opposite of recommended practice than to it.

Toward Unified Governance

What Libya needs today is not another authority added to an already long list—precisely what happened again with the decision creating the National Authority for Cybersecurity and Digital Sovereignty—but a fundamental reordering of that list around four functions: who sets policy? Who regulates? Who implements? And who monitors and holds to account? On this basis, a practical reform path can be laid out in five steps:

1. Clarify institutional mandates: review the founding decisions of every body (including the new authority) and resolve any textual overlap through an explicit legislative amendment, not by adding new institutions.

2. Separate policy-making from implementation: concentrate policy and strategy-setting in a single sovereign body, and concentrate technical implementation in a single implementing body that operates under that policy rather than alongside it.

3. Build a national interoperability framework: mandatory, unified standards for data exchange among government bodies, ending duplicate databases and sparing citizens from resubmitting the same data.

4. Adopt a national data governance framework: clearly defining who owns the data, who controls access to it, and unified privacy and information-sovereignty standards that apply to every body without exception.

5. Establish a permanent coordination mechanism reporting to the highest executive level: a coordinating (not executive) council bringing together representatives of existing bodies, with binding authority in the event of conflicting decisions, reporting directly to the head of government to ensure disputes are resolved quickly.

6. Define a national incident-accountability chain: specify in law, before the next attack, which single body leads the technical response to a national-level cyber incident, which body communicates with the public, and what institutional — not only individual — accountability follows when defences fail.

The Digital State Begins with Governance

The governance crisis and overlapping mandates are the single most important obstacle to digital transformation in Libya, and their root is the missing separation between policy-making, regulation, implementation, and assurance. The Central Bank breach showed what that missing separation costs in practice: when the attack came, no single national body could be named as accountable, and responsibility fell instead on individual staff at the institution that was hit. As long as every new problem continues to be met — as happened with the creation of the National Authority for Cybersecurity and Digital Sovereignty — by adding a new body instead of resolving existing mandates, the same question will recur after the next attack: who, exactly, answers for it? Genuine reform begins when the state stops treating digitisation as a field of institutional competition and starts treating it as a single sovereign system under strict governance that serves the citizen first, with one clear chain of accountability when things go wrong. The transition from scattered digitisation to a digital state requires a single path and a single goal: serving the citizen with efficiency, security, and clarity.

The author would like to thank Abdulrauf Alhassi, engineer and ISOC Libya SIG 2024 Alumna, for proposing the initial concept and providing helpful discussions during the early stages of development.