Hong Kong Expands Police Access to Devices

Hong Kong has widened device-access powers under national security rules

Hong Kong brought new amendments into force on March 23, 2026 under the implementation rules for Article 43 of the National Security Law. The Hong Kong government said the changes were meant to improve the city’s ability to prevent, suppress and investigate acts endangering national security, while also stating that lawful rights and interests of individuals and organisations would be adequately protected.

The most controversial part of the amendments concerns electronic devices. Local and international reporting says the new rules allow police to require certain persons to provide passwords, decryption methods and other necessary assistance to access phones, laptops and other devices when handling national security cases. Refusal to comply has been turned into a criminal offence.

What changed on passwords and decryption demands

Public discussion has often described the rule as if every traveller can automatically be forced to unlock devices at the border. The legal trigger, however, is tied to national security cases and to people considered connected to the device or the relevant data. ABC News reported that the rule may extend not only to the person under investigation, but also to the owner or possessor of the device, any person authorised to access it, and anyone who knows the password or decryption method.

That is why the issue is not limited to Hong Kong residents. Although the official Hong Kong press release does not separately list tourists and transit passengers, the U.S. Consulate General in Hong Kong and Macau warned that the legal change applies to everyone in Hong Kong, including arrivals and people merely transiting Hong Kong International Airport. In practical terms, that means foreign visitors and transit passengers are not carved out from the reach of the new rule if they become subject to a national security-related request.

What penalties now apply for refusal and false information

The amendments set out separate penalties for separate types of conduct. Refusing to provide a password, decryption method or required assistance is punishable by up to one year in prison and a fine of up to HK$100,000. That penalty level appears consistently across local reporting and international summaries of the new rules.

The penalty for false or misleading information is more severe. Hong Kong’s official e-Legislation database states that a person who knowingly or recklessly provides information or a statement that is false or misleading in a material particular is liable to a fine of HK$500,000 and imprisonment for three years. That is an important clarification because some retellings of the story mentioned the prison term without clearly stating the higher fine ceiling.

Customs officers also gained seizure powers over “seditious” items

The amendments do not stop at device access. Reporting in The Standard and other outlets says customs officers now have authority to seize items they reasonably suspect to carry seditious intent. Some summaries frame this as the power to seize objects considered to have a “seditious intention” or “seditious” character. In other words, the changes extend beyond digital access and also broaden physical seizure powers in national security-related enforcement.

The Hong Kong government, however, insists that the measures are limited to national security enforcement and should not affect the general public’s daily life or the normal operation of institutions and organisations. In the official release, authorities also argue that the amendments contain legal thresholds and mechanisms in which the judiciary retains a gatekeeping role for various measures.

Why the amendments triggered an international response

The reaction outside Hong Kong was swift because phones and laptops routinely contain business, personal, journalistic, medical and legal data. Critics argue that broad national security definitions combined with stronger device-access powers create larger risks for privacy, confidential communications and international business operations. ABC News and other outlets quoted legal and rights voices describing the changes as potentially open to abuse.

Hong Kong authorities have responded with the opposite case. In the official government statement, they say the amendments are consistent with the Basic Law, human-rights provisions and the National Security Law itself, and that the offences have been drafted by reference to provisions already found in Hong Kong law.

How accurate are comparisons with Britain and Singapore

Comparisons with Britain and Singapore are possible, but only partially. In the United Kingdom, there is indeed a separate criminal offence for failing to comply with a lawful decryption notice under the Regulation of Investigatory Powers Act 2000. The official legislation.gov.uk record for Section 53 shows a maximum sentence of up to two years in ordinary cases and up to five years in national security cases. But that is a distinct legal regime, not a direct copy of Hong Kong’s new mechanism.

Singapore is only partly comparable as well. Singapore law gives customs and law-enforcement authorities broad search and seizure powers, and 2025 amendments expanded customs powers including the seizure of computers, associated devices and mobile communication devices when they may bear on an offence. But from the official materials I found, it does not follow that Singapore has introduced an identical new rule specifically for tourists and transit passengers under a national security framework in the same way Hong Kong has. It is therefore more accurate to describe the comparison as one of partially analogous coercive powers rather than a like-for-like legal match.

What this means for tourists, transit passengers and business travellers

The practical significance of the amendments is that devices now sit more clearly at the center of border, policing and national security risk. Phones, laptops and tablets carried by travellers may contain business files, personal records or sensitive professional material. Even if the government says the new powers are limited to national security cases, international warnings already treat the issue as relevant to anyone arriving in or transiting through Hong Kong.

For business, the implications include a stronger case for clean-device policies, separation of personal and corporate data, minimisation of locally stored material and closer scrutiny of travel routes. For tourists, it means refusal to disclose a password can now have criminal consequences rather than merely administrative ones. For transit passengers, it means that a short airport stopover does not necessarily place them outside the practical reach of the new rules.

As International Investment experts report, the new Hong Kong amendments matter not only as another tightening of the city’s national security framework. They also show how control over personal digital devices is becoming part of the broader architecture of border management, policing and customs enforcement. For international business and travellers, the main conclusion is that data protection can no longer be separated from route planning: in 2026, a laptop or smartphone at the border is not just a personal object, but a potential subject of legal compulsion.

FAQ

Do all tourists now have to hand over device passwords automatically in Hong Kong?
No. The available descriptions do not show an automatic universal obligation for every traveller. The mechanism is tied to national security cases, but the U.S. Consulate warns that the rule applies to tourists and transit passengers too if they fall within such a request.

What is the penalty for refusing to disclose a password in Hong Kong?
Up to one year in prison and a fine of up to HK$100,000.

What is the penalty for giving false or misleading information?
Up to three years in prison and a fine of up to HK$500,000, according to Hong Kong’s official legislation database.

What else changed apart from password demands?
The amendments also broadened powers to remove messages considered to endanger national security and gave customs officers authority to seize items regarded as having seditious intent.

Can the Hong Kong rule be directly equated with Britain or Singapore?
Only partly. Britain has a separate offence for failing to comply with a decryption notice, and Singapore has broad device-search and seizure powers, but the legal frameworks are not identical.