Executive summary
Libya's risk is governed by armed group competition rather than insurgency. Violence is episodic, geographically concentrated and usually short, but it arrives with little warning and closes airports, roads and districts within hours.
The country operates as two administrations with overlapping institutions. Compliance, banking, permitting and even security clearance therefore depend on which authority a counterpart recognises.
The dominant duty-of-care exposure is being caught between armed formations in Tripoli or on the coastal road, followed by detention risk for staff without correctly issued documentation.
Sources · [8] Institute for Security Studies (ISS Africa) · [1] ACLED
Full report
Political and security structure
Western Libya is governed through a coalition of armed formations with institutional titles; the distinction between state security body and militia is administrative rather than operational. Eastern Libya operates a more consolidated command structure with correspondingly different access and permitting arrangements.
Practical consequence: an organisation must know which authority governs each site, corridor and bank relationship it depends upon, and must maintain parallel relationships rather than assume national coverage.
Sources · [6] NASA FIRMS / Copernicus · [9] INGO ADVISORY analyst desk
Movement and premises
Tripoli movement should be planned around clash-prone districts and institutional flashpoints, with alternate routes to the airport and a defined shelter-in-place standard for offices and residences, water, fuel, food and communications for a minimum of seventy-two hours.
The coastal road, the Tunisian border crossings and the southern routes each carry distinct risks: checkpoint proliferation in the west, smuggling-related violence in the south, and administrative closure at borders with limited notice.
Sources · [3] UN OCHA / ReliefWeb · [6] NASA FIRMS / Copernicus
Compliance and counterparty risk
Sanctions exposure, ownership opacity and the political affiliation of local partners make counterparty due diligence a security control, not a legal formality. Screening should cover beneficial ownership, armed group affiliation and prior contract performance.
Payment routing, cash movement and fuel procurement are the three areas where operational necessity most often collides with compliance policy; decide the organisation's position in writing before the field asks for an exception.
Sources · [8] Institute for Security Studies (ISS Africa) · [1] ACLED
Indicators and warnings
Escalation: mobilisation of formations from Misrata or Zawiya towards Tripoli; contested appointment at the central bank or National Oil Corporation; arrest attempt against a senior commander; closure of Mitiga airport; renewed force movement across the Sirte line.
De-escalation: agreed electoral framework with security arrangements attached; sustained reunification of financial institutions; verified withdrawal of foreign forces; durable local ceasefires in Tripoli's contested districts.
Key findings
- Tripoli's security balance rests on a small number of armed formations whose alignments shift; clashes typically follow leadership changes, arrest attempts or control disputes over revenue-bearing institutions.
- Hydrocarbon facilities and the National Oil Corporation remain the principal instrument of political use; blockade threats are a bargaining tool, not merely an operational event.
- Migration routes and associated detention infrastructure create significant safeguarding, reputational and third-party liability exposure for organisations operating in the sector.
- Explosive remnants of war and legacy minefields remain a genuine hazard in previously contested areas around Tripoli's southern approaches and in the south.
- Documentation and visa irregularity is the most common cause of staff detention, and the easiest control to fix.
Analyst assessment
We assess with high confidence that the current fragmented equilibrium will persist through 2027, with periodic localised clashes and no national unification process reaching completion.
We assess with moderate confidence that Tripoli will experience at least one multi-day clash episode per year of sufficient intensity to close Mitiga airport and suspend movement.
The most likely serious incident affecting international staff is entrapment during a clash or a detention arising from documentation, not deliberate targeting.
Related reports
Footnotes & sources
- [1] ACLED — Armed Conflict Location & Event Data — Africa event recordsL1 Conflict · reliability A
- [2] UCDP — Uppsala Conflict Data Program — organised violence datasetL1 Conflict · reliability A
- [3] UN OCHA / ReliefWeb — Situation reports, access snapshots and humanitarian updatesL2 Early warning · reliability A
- [4] GDACS — Global Disaster Alert and Coordination System alertsL2 Early warning · reliability B
- [5] FEWS NET — Food security outlooks and alertsL2 Early warning · reliability A
- [6] NASA FIRMS / Copernicus — Active fire detections and open satellite imagery for corroborationL3 GEOINT · reliability B
- [7] GDELT Project — Global media event and tone monitoringL5 Strategic · reliability C
- [8] Institute for Security Studies (ISS Africa) — Regional political and security analysisL5 Strategic · reliability B
- [9] INGO ADVISORY analyst desk — Practitioner interviews, field reporting and imagery verificationL6 Verification · reliability B
- [10] OpenSanctions — Sanctions, PEP and enforcement screening dataL5 Strategic · reliability A
Free operational toolkit
Act on this assessment
Six free operational tools for NGO and charity teams — no sign-up, nothing leaves your browser.
- Travel risk authorisationRisk-tiered approval form with control verification before movement is signed off.
- Vehicle & convoy check13-point pre-departure inspection with go / no-go clearance logic.
- Safeguarding / PSEA referralAnonymised referral log for PSEA and misconduct concerns.
- Cyber hygiene assessmentScored self-assessment producing a prioritised remediation workplan.
- Staff accountability roll callReal-time headcount and status tracking during an incident.
- Endurance calculatorContingency stock planning for water, food, fuel and cash.