On Monday morning, Hong Kong's government quietly published amendments to a bylaw under the National Security Law in the official gazette. No vote was taken. No legislative debate was held. The city's leader, John Lee, bypassed the Legislative Council entirely.
The amendment gives Hong Kong police the power to demand passwords to phones and computers from anyone suspected of breaching the National Security Law. Those who refuse can be jailed for up to one year and fined up to HK$100,000 — approximately US$12,700. Those who provide "false or misleading information" face up to three years in prison.
The same amendments give customs officials the power to seize any items they deem to "have seditious intention."
This is a significant expansion of the state's reach into private digital life. To understand why it matters — and why it's not a surprise — you need to understand what the National Security Law is, how Hong Kong got here, and what happens to cities that reach this point.
What the National Security Law Actually Covers
The National Security Law was enacted in June 2020 by Beijing, imposed directly on Hong Kong without going through the city's own legislature. It was a response to the 2019 pro-democracy protest movement, which saw millions of Hong Kong residents take to the streets and, in some cases, storm government buildings.
The NSL criminalizes four categories of offences:
- Secession — advocating Hong Kong independence from China
- Subversion — undermining the authority of the central government
- Terrorism — using violence or threats against people or property to coerce the government
- Collusion with foreign forces — working with foreign governments or entities to impose sanctions, interfere in Hong Kong affairs, or endanger national security
On paper, these categories sound like standard national security law — analogous to laws that exist in the US, UK, and elsewhere. In practice, each category is defined broadly enough to encompass activities that would be considered routine political speech or journalism in most democracies.
"Subversion" has been applied to organizing an unofficial primary election. "Collusion with foreign forces" has been charged against journalists who quoted foreign officials. "Seditious intention" — the standard now applied to customs seizures — has no fixed legal definition and is determined by enforcement officers in the field.
How Hong Kong Got Here: A Timeline
1997: Britain hands Hong Kong back to China under the "one country, two systems" framework, guaranteed by the 1984 Sino-British Joint Declaration. Under the arrangement, Hong Kong was to maintain its own legal system, civil liberties, and a high degree of autonomy until at least 2047.
2003: Hong Kong's government attempts to pass a domestic national security law (Article 23 of the Basic Law). Half a million people march in protest. The bill is shelved.
2014: The Umbrella Movement — tens of thousands occupy central Hong Kong for 79 days demanding genuine universal suffrage. Beijing rejects the demand. The protest disperses without concessions.
2019: The extradition bill crisis. A proposed law allowing criminal suspects to be extradited to mainland China triggers the largest protests in Hong Kong's history — an estimated two million people march at peak. The government eventually withdraws the bill, but the protest movement continues demanding broader political reform. Police and protesters clash repeatedly. The movement is suppressed.
June 2020: Beijing imposes the National Security Law directly. It takes effect without going through Hong Kong's legislature. Within days, protest slogans are declared potentially illegal. Activists begin leaving Hong Kong in significant numbers.
2021: Pro-democracy newspaper Apple Daily, with a daily circulation of approximately 500,000, is shut down after police freeze its assets under the NSL and arrest its executives. Founder Jimmy Lai is detained.
2023: Hong Kong introduces "Article 23" legislation — a domestic national security law filling gaps in the 2020 NSL — passing it in under two weeks through a legislature that had been restructured to exclude most pro-democracy voices.
February 2026: Jimmy Lai is convicted of foreign collusion and publishing seditious material. He is sentenced to 20 years in prison. He is 76 years old.
March 23, 2026: The phone password amendments are gazetted, bypassing the legislature entirely.
The Phone Password Question: Where Does It Stand Elsewhere?
The compelled disclosure of phone passwords is a live legal debate in most democracies. The HK amendment differs from those debates in a specific and important way.
In the United States, courts have split on whether compelling a password constitutes a Fifth Amendment violation (self-incrimination). The Supreme Court has not definitively resolved the question. Some circuits hold that providing a password is "testimonial" (protected); others distinguish between providing a password (testimonial, protected) and biometric unlocking (not testimonial, not protected). In any case, US compulsion applies to criminal investigations governed by constitutional protections, judicial oversight, and probable cause requirements.
In the United Kingdom, Section 49 of the Regulation of Investigatory Powers Act (RIPA) allows police to compel decryption keys or passwords, with refusal punishable by up to two years in prison (five years in national security cases). UK courts must issue a notice; it is not a police-level power.
In Hong Kong under the new amendment, the power sits with police directly — no judicial warrant is specified in the published amendment — and it applies to anyone suspected of an NSL offence, a category broad enough to include journalists, academics, civil society workers, and ordinary residents who have posted political content online.
The phrase "suspected of breaching" is key. Under the NSL, suspicion does not require evidence that would meet Western probable cause standards. It can be triggered by speech, association, or possession of materials deemed seditious.
The Bypass: Why the Legislature Wasn't Involved
The amendments were made to a bylaw — a subordinate piece of legislation — which in Hong Kong's system can be amended by executive gazette without a full legislative vote. John Lee, Hong Kong's chief executive, used this mechanism to implement the changes immediately.
This matters for two reasons. First, it demonstrates that the government no longer perceives any need for the legitimizing optics of legislative debate, even in a legislature restructured to guarantee pro-government majorities. Second, it sets a precedent for further expansions of NSL-adjacent powers via bylaw amendment — a mechanism that can be used repeatedly and quickly.
Hong Kong's Legislative Council was restructured in 2021 under Beijing-mandated electoral reform that reduced the number of directly elected seats and required all candidates to be vetted as "patriots." No candidate who supported the 2019 protest movement can currently serve. The body that would have debated this amendment no longer contains meaningful political opposition.
The Practical Effect: Who Gets Asked for Passwords
Since the NSL's introduction in 2020, the categories of people arrested under it have included:
- Pro-democracy legislators and district councillors
- Journalists and editors (most prominently at Apple Daily and Stand News, both now shuttered)
- Academics who published research on Hong Kong politics
- Social media users who shared protest-related content
- Students who possessed protest materials
- A man who drove a motorcycle with a protest slogan on the vehicle
Under the new amendment, any of these categories of suspect — and anyone newly identified under the expanding NSL definitions — can now be compelled to unlock their phone on demand. The contents of messaging apps, browsing history, contact lists, and photos become accessible to investigators without the need to obtain decryption assistance from Apple or Google through separate legal channels.
For the approximately 7.4 million people living in Hong Kong — including a large expatriate community of business people, diplomats, journalists, and NGO workers — the practical risk is not evenly distributed. The amendments are unlikely to affect most ordinary residents. They are highly likely to affect anyone whose work or associations touch on politics, media, civil society, or international organizations.
Hong Kong's Freedom Trajectory: The Data
Freedom House, which tracks political and civil liberties globally, rated Hong Kong as "Free" for most of its modern history before 2020. Since the NSL's introduction:
- Freedom House downgraded Hong Kong from "Partly Free" to progressively lower ratings through 2023–2025
- The Reporters Without Borders Press Freedom Index dropped Hong Kong from 80th in the world (2002) to 140th by 2023
- The number of accredited foreign correspondents in Hong Kong declined significantly post-2021, with multiple foreign media organizations relocating regional headquarters to Singapore or Seoul
- Amnesty International closed its Hong Kong offices in 2021, citing the NSL
Hong Kong's status as a global financial hub — which depends partly on perceptions of legal predictability and rule of law — has remained more resilient than its civil liberties trajectory might suggest. The Hang Seng Index and Hong Kong's position as a capital markets gateway for mainland Chinese companies have continued to function. But the legal environment for individuals, journalists, and civil society has moved in a single direction since 2020: toward greater state control and fewer protections for private conduct and speech.
What This Is — and What It Isn't
This is not a surprise. The NSL's trajectory since 2020 has been consistent, incremental, and in one direction. Each amendment, each prosecution, each institutional closure has followed from the logic of the previous one. The phone password amendment is not a sudden rupture — it is the next step in a sequence that was set in motion when Beijing decided in 2020 that the 2019 protests represented a systemic threat that the existing legal framework was insufficient to address.
What it is: the formalization of a power that police in many authoritarian states exercise informally and arbitrarily. By codifying it in a bylaw amendment, Hong Kong's government has made it legally enforceable, systematically applicable, and appealable — on the government's terms — through Hong Kong courts that now operate under NSL constraints including the ability to hold some trials in secret.
For those doing business with Hong Kong, traveling through it, or living in it: the legal risk profile of possessing a smartphone that contains politically sensitive content — in the broadest possible definition of "sensitive" — has materially changed as of Monday, March 23, 2026.
The amendment was gazetted Monday morning. It is in effect now.