- Updated: March 27, 2026
- 3 min read
Hong Kong Police Gain Power to Demand Phone Passwords Under New Security Rules
**Summary – Hong Kong Police Can Now Demand Passwords for Encrypted Devices**
**Key Facts**
– **New legal amendment** to Hong Kong’s National Security Law (effective 23 Mar 2026) allows police to compel anyone to provide “any password or other decryption method” for phones, laptops, tablets, or any encrypted device **without a warrant**.
– **Penalties for non‑compliance**:
– Refusal → up to **1 year imprisonment** + HK $100,000 fine (≈ US $12,700).
– Supplying false credentials → up to **3 years imprisonment**.
– The requirement applies not only to the device owner but also to anyone who knows the password or decryption key (spouse, business partner, IT administrator, etc.).
– The amendment expands the definition of “national security threats” to include **secession, subversion, terrorism, and foreign collusion**, giving police broad discretion to deem ordinary encrypted communications as threatening.
– The changes were **gazetted by Chief Executive John Lee** without Legislative Council debate or judicial oversight, and also grant customs powers to seize “seditious” material and freeze assets.
**Context**
– Hong Kong’s National Security Law was originally enacted in 2020 after the 2019 pro‑democracy protests; since then, **386 arrests and 176 convictions** have been recorded under its provisions.
– The new amendment follows a pattern of tightening control over digital privacy and dissent, mirroring similar moves in other authoritarian jurisdictions.
– Legal scholars (e.g., UK‑based law lecturer Urania Chiu) have criticized the powers as **“grossly disproportionate”** and lacking judicial authorization, raising concerns about privacy, fair trial rights, and the chilling effect on free expression.
– The government argues the measures are necessary to protect human rights and national security, but critics note the vague language gives police wide latitude to target ordinary users of encrypted messaging apps (Signal, Telegram) and VPNs.
**Nuances & Implications**
– **Technical impact**: Even strong device encryption (biometrics, multi‑factor authentication) becomes legally ineffective if authorities demand access; compliance is mandatory under threat of criminal sanction.
– **Scope of liability**: Anyone with knowledge of a password—family members, colleagues, IT staff—could be prosecuted, extending responsibility beyond the device owner.
– **Business & journalistic risk**: Companies handling sensitive data and journalists operating in or traveling through Hong Kong face heightened legal exposure; encrypted communications may be treated as evidence of “national security” offenses.
– **International ripple effect**: The amendment signals to other jurisdictions that digital privacy can be overridden by security legislation, potentially encouraging similar policies elsewhere.
– **Enforcement without oversight**: The lack of a warrant requirement removes a key judicial check, concentrating power in the police and executive branch.
– **Potential for abuse**: The vague “national security” criteria could be used to target political dissent, activism, or merely inconvenient information, as seen in prior NSL prosecutions.
**Bottom Line**
Hong Kong’s latest amendment to its National Security Law grants police warrant‑less authority to force the decryption of any device, imposing criminal penalties for refusal or false compliance. The rule expands liability to anyone who knows a password, undermines the practical security of encryption, and raises serious concerns about privacy, due process, and the chilling of legitimate speech and business activities.