Key takeaways
- Hong Kong's updated national security rules make refusing to give police device passwords a criminal offense carrying up to one year in prison
- The U.S. Consulate General issued a security alert warning the law applies to all visitors, residents, and airport transit passengers
- Authorities gain expanded powers to seize personal devices as evidence in cases they link to national security offenses
Surveillance Powers Expand
On March 23, 2026, the Hong Kong government amended the implementing rules of its National Security Law, making it a criminal offense to refuse to provide police with passwords or decryption assistance for personal electronic devices. The changes, gazetted without fanfare, represent the first substantial expansion of the 2020 law's surveillance powers.
The scope is sweeping. Cellphones, laptops, and all personal electronic devices are covered. Refusal to hand over a password carries up to one year in prison and a HK$100,000 fine. Providing false information to obstruct access carries up to three years and HK$500,000. Compliance is mandatory even when disclosure would result in self-incrimination or breach existing confidentiality obligations.
Who Is Affected
The rules apply to Hong Kong residents, visitors, and critically, anyone simply transiting through Hong Kong International Airport. The U.S. Consulate General in Hong Kong issued a security alert on March 26 warning American citizens of the legal change, advising those arrested or detained to contact consular services immediately.
Police officers with magistrate warrants, or those ranked assistant commissioner or above, can compel disclosure. A government spokesman claimed the amendments 'set out stringent requirements' with 'the judiciary playing the gatekeeping role,' but the law's breadth tells a different story. Organizations suspected of being foreign political groups can also be compelled to surrender information and submit members for questioning.
The Hong Kong government insists these measures 'would not affect the public's daily lives or the normal operation of institutions.' Similar provisions exist in the United Kingdom, where penalties reach up to five years, and in Singapore, where they range from six months to ten years.
Why It Matters
Hong Kong just put into law what authoritarian regimes have always wanted: the legal right to compel you to unlock your own devices for the state. The promise of 'judicial gatekeeping' is cold comfort when the same government has already used the National Security Law to arrest journalists, raid newsrooms, and freeze the assets of political opposition. For anyone holding Bitcoin in Hong Kong, the calculus just changed. A hardware wallet in your bag is now a potential exhibit. A passphrase on your device is now something you can be jailed for withholding. The lesson is not complicated: self-custody means nothing if the state can legally force the key out of your hands. If you must transit through Hong Kong, your seed phrase belongs in your brain, not on any device.
