An answer on Bluetooth LE scan as non root? indicates that with
hcitool lescan an "Operation not permitted" error is generated by a
writev system call (in
hci_le_set_scan_parameters -> hci_send_req -> hci_send_cmd -> writev
What's so special about a Bluetooth LE scan compared to a normal Bluetooth scan?
PS: It reminds me of Torvalds quote: requiring root password for mundane things is “moronic”. There must be a very good reason for this, I hope.