Libyan authorities say they have dismantled an organized sabotage cell accused of carrying out drone attacks against oil and electricity infrastructure in western Libya, providing the first major public breakthrough in the investigation into a series of attacks that have exposed vulnerabilities around the country’s critical energy facilities, according to Anadolu Agency’s latest report.

The Government of National Unity announced on September 6 that an intelligence and security operation led by the Ministry of Defense resulted in the arrest of five suspects, including Libyan and foreign nationals. Their identities and the nationalities of the foreign suspects have not been disclosed.

The operation comes after a series of attacks during August involving explosive-laden drones targeting facilities in Tripoli and Zawiya. According to authorities, investigators now believe the incidents were not isolated attacks but part of a coordinated sabotage campaign involving multiple actors, targets and methods.

The arrests therefore matter beyond the immediate investigation. If Libyan security agencies can establish the wider network behind the cell, the operation could reveal how the attackers obtained drones, selected targets, gathered intelligence and coordinated attacks against strategically important infrastructure.

A widening target set

The attacks have increasingly demonstrated that Libya’s energy infrastructure is becoming a security target in its own right.

During the first half of August, the Zawiya oil complex was struck by explosive drones, damaging oil infrastructure. Other attacks targeted power-generation and water facilities in the city, while separate incidents involved an oil storage facility and a power station in Tripoli.

The significance lies in the combination of targets.

Oil facilities, electricity plants, fuel storage sites and water infrastructure form interconnected components of Libya’s critical national infrastructure. Disrupting one can create consequences for the others, particularly in western Libya where Tripoli depends heavily on a limited number of strategic energy and fuel facilities.

The latest investigation suggests that the threat may have been broader still. Libyan authorities say they disrupted additional plots, including plans to attack a power station south of Tripoli. They also claim the suspected network had identified other vital facilities as well as political, security and military figures.

That would represent a significant escalation from attacks designed simply to damage industrial assets.

It would indicate an effort to combine infrastructure disruption with pressure against state institutions and security structures.

The counter-drone challenge

The military significance of the attacks goes beyond the damage caused by individual drones.

Small unmanned aircraft give relatively low-cost actors the ability to threaten infrastructure that is expensive and difficult to defend. A large refinery, fuel depot or power station can occupy a wide area, contain highly flammable materials and have multiple potential approaches.

Defending such facilities therefore requires more than physical security.

Libyan authorities need early warning, surveillance, intelligence collection, electronic countermeasures and, where necessary, kinetic counter-drone capabilities. But those capabilities are only one part of the problem.

The more difficult task is identifying the people behind the aircraft.

A drone attack requires a support chain. Someone must obtain or build the platform, modify it if necessary, acquire explosives, identify a target, determine an appropriate launch location and coordinate the operation.

That means the arrest of five suspects could become considerably more important if investigators can turn those arrests into intelligence about the wider network.

The key question is whether the cell was operating independently or whether it was connected to a larger armed, criminal or externally supported structure. At present, there is not enough publicly available evidence to establish that chain of command.

That distinction is important because attribution in Libya carries immediate political and military consequences. Accusing a particular armed group or external actor without sufficient evidence could trigger retaliation or further destabilize an already fragmented security environment.

From infrastructure attacks to strategic pressure

The choice of targets also deserves attention. An attack on a military position is immediately understood as a security incident. An attack on a fuel depot or power station can initially appear to be an industrial-security problem.

In reality, the consequences can be much wider.

Damage to fuel storage can affect transportation and commercial activity. Damage to electricity infrastructure can increase pressure on an already strained power network. An attack on an oil facility can disrupt production, refining or distribution and undermine confidence in the security environment surrounding Libya’s energy sector.

This makes critical infrastructure an attractive target for actors seeking to create pressure without directly engaging large security formations.

The Africanews report on the arrests similarly places the arrests within the wider investigation into the drone strikes against the refinery and associated infrastructure.

For Libya, the problem is compounded by the fragmentation of security institutions and the presence of multiple armed actors operating across western Libya.

A sophisticated counter-drone campaign cannot depend solely on guards protecting individual facilities. It requires intelligence-sharing between security agencies, coordinated investigations and the ability to track suspicious activity before a drone reaches its target.

That is where the latest operation could prove significant.

If authorities can move from arrests to identifying the network’s logistics, financing and command structure, Libya could gain a clearer understanding of the threat.

What comes next

The immediate priority will be determining whether the arrests have actually disrupted the operational capability behind the attacks.

The government says additional plots were prevented, including a planned attack against a power station south of Tripoli. It also says investigations will continue against other individuals involved in planning, financing and supporting the campaign.

That means the security operation is not finished.

Critical energy facilities across western Libya will likely remain vulnerable until authorities establish stronger surveillance and counter-drone coverage. The sites that have already been targeted should also be treated as potential repeat targets rather than assuming that the arrests have eliminated the threat.

The Middle East Online report on the dismantling of the cell highlights the same broader concern: the investigation points toward attacks against oil and power infrastructure rather than a single isolated incident.

The most important development, therefore, may not be the arrest of five suspects itself.

It is the possibility that Libyan authorities have finally obtained enough intelligence to begin mapping the organization behind the attacks.

If that intelligence leads to the identification of additional operatives, financiers, facilitators and launch networks, the arrests could mark a turning point in Libya’s response to the emerging drone threat.

If the investigation stops with the five suspects, however, the underlying vulnerability will remain.

For Libya’s security establishment, the challenge is now clear: protect the country’s energy infrastructure not only from individual drones, but from the networks capable of putting those drones in the air.