Passwords and the New Hong Kong Security Rule: A Power Meant for “Protection” That Raises a Silence Test

In Hong Kong, passwords have moved from a personal security measure to a legal obligation in national security investigations: police can now demand access to phones or computers from people suspected of breaching the National Security Law, and refusal can carry up to a year in jail and a fine of up to HK$100, 000.

What exactly changed—and who can be compelled to hand over Passwords?

The Hong Kong government has introduced new amendments to a bylaw under the National Security Law (NSL), gazetted on a Monday, expanding enforcement tools tied to investigations that authorities frame as national security matters. Under the updated rule set, police can require people to provide “any password or other decryption method” needed to access electronic equipment believed to contain evidence, provided police have warrants to access the equipment.

The obligation is not limited to a single category of suspect. The amendment applies both to individuals under investigation for endangering national security and to others who may have access to the device or knowledge needed to unlock it. That includes anyone who owns, controls, or is authorized to access the equipment in question, and it also covers anyone who knows the password or decryption method.

The legal exposure is specific: refusing to comply can lead to a penalty of up to a year in prison or a fine of up to HK$100, 000. The amendments also create a separate risk for those who provide “false or misleading information, ” which can carry a potential sentence of up to three years in jail.

How does the rule sit inside the National Security Law’s wider reach?

The NSL was introduced in Hong Kong in 2020, following massive pro-democracy protests the year before. Authorities say the laws, which target acts like terrorism and secession, are necessary for stability. Critics argue the same framework is used to quash dissent. The law is described as covering a sweeping range of offences, including secession, subversion, terrorism, and collusion with external forces—offences that are presented as broadly and vaguely defined.

Within that landscape, the new power to compel passwords is positioned as an investigative tool tied to evidence gathering from electronic devices. The rule also states that the obligation to disclose applies even where there is a “duty of confidentiality or any other restriction on the disclosure of information, ” including situations involving journalists, doctors, and lawyers. That framing places the device-access requirement above confidentiality constraints in the specified national security context.

The amendments do not stand alone. The same package of changes also gives customs officials the power to seize items that they deem to “have seditious intention. ” The Hong Kong authorities said the amendments were designed to ensure that “activities endangering national security can be effectively prevented, suppressed and punished, and at the same time the lawful rights and interests of individuals and organisations are adequately protected. ”

What is the contradiction the public should scrutinize now?

Verified fact: The city’s leader, John Lee, announced changes to the bylaw while bypassing the city’s legislative council. The government’s position is that the amendments are meant to prevent and punish national security threats while also protecting lawful rights and interests.

Informed analysis (clearly labeled): The tension lies in the gap between a stated goal of protecting lawful rights and a mechanism that can compel disclosure of passwords even where confidentiality duties ordinarily restrict disclosure. In practice, compelling access to personal devices can be experienced as more than a narrow evidence request, because phones and computers often function as repositories of broad private life. The public-interest question is how “adequately protected” rights are operationalized when the law elevates compelled disclosure above confidentiality restrictions in sensitive professions.

Verified fact: The NSL also allows for some trials to be heard behind closed doors. The city has seen the arrests of hundreds of protesters, activists, and former opposition lawmakers since the law’s introduction.

Informed analysis (clearly labeled): When a law has both sweeping offences and procedural features that can narrow public visibility, expansion of investigative powers—like compelled device access—becomes harder for the public to evaluate in real time. That does not establish misuse on its own; it does heighten the need for clear guardrails, measurable reporting, and transparent oversight mechanisms.

Verified fact: Recent cases referenced in the same context include that, in February, the father of a pro-democracy activist in exile was jailed for trying to cash out her insurance policy under a homegrown law expanding on the NSL, and that in February, media tycoon Jimmy Lai received a 20-year sentence after conviction of foreign collusion and publishing seditious material under the NSL.

Informed analysis (clearly labeled): High-profile prosecutions and penalties can shape public expectations about the risks of being drawn into national security processes—especially where the new amendment extends obligations beyond the primary target of an investigation to anyone who can unlock a device. That expansion creates a wider circle of potential legal exposure tied to passwords and decryption methods.

What accountability questions should be asked next?

The amendments establish new criminal penalties and broaden who can be compelled to assist device access. For a public reckoning grounded in the government’s own stated promise of protecting lawful rights, transparency becomes the key test: how frequently warrants are sought for device access, how often compelled disclosure is used, and how authorities evaluate claims tied to confidentiality duties. The amendments also invite scrutiny of how customs’ power to seize items deemed to “have seditious intention” is applied in practice.

Hong Kong authorities have defended the overall framework as necessary for stability, and the government spokesperson’s statement frames the changes as both preventive and rights-protective. At the same time, critics and human rights organizations, along with Western governments, argue the NSL has been used to roll back democratic freedoms and crush political dissent. The central question now is whether the expanded authority to compel passwords will be constrained narrowly to evidence needs under warrant, or whether it becomes a routine lever that deepens fear and silence in ordinary digital life.