Refuse to Unlock Your Phone, Face Jail Time: Inside Hong Kong’s Strict New Cybersecurity Rules

Hong Kong, March 27, 2026 — Travelers planning to visit or transit through Hong Kong face a stringent new digital reality. This week, the Hong Kong government officially enacted sweeping amendments to its national security enforcement rules, granting police the power to compel individuals to surrender passwords for their personal electronic devices.

Gazetted and implemented with immediate effect on Monday, the updated legislation has triggered international concern, particularly regarding its impact on foreign tourists, business travelers, and transiting passengers.

The New Digital Mandate and Penalties

Under the newly revised Implementation Rules for Article 43 of the National Security Law (NSL), police officers investigating suspected national security offenses possess the legal authority to demand passwords, PIN codes, or any other decryption methods for smartphones, laptops, and encrypted devices.

Refusal to comply is no longer a matter of digital privacy—it is a criminal offense. Individuals who fail to provide the requested access face severe penalties, including a fine of up to HK$100,000 (approximately $12,770 USD) and up to one year in prison. Furthermore, attempting to deceive authorities by providing false or misleading passwords carries an even harsher penalty: a maximum sentence of three years in prison and a fine of HK$500,000.

Global Repercussions and Travel Warnings

Because the law applies to everyone within Hong Kong’s jurisdiction—including foreign nationals and passengers merely transiting through Hong Kong International Airport—international bodies have reacted swiftly.

Following the enactment, the U.S. State Department issued an updated security alert. “It is now a criminal offense to refuse to give the Hong Kong police the passwords or decryption assistance to access all personal electronic devices including cellphones and laptops,” the advisory warned, urging travelers to exercise extreme caution.

Hong Kong Government Dispels “Street Check” Fears

Addressing immediate concerns that the new rules could lead to arbitrary, widespread searches, Hong Kong’s Security Chief Chris Tang provided a firm clarification to the Legislative Council on Tuesday. Tang emphasized that officers will not be conducting random device checks on the street.

According to Tang, the amendment strictly targets national security cases. To demand a password, police are required to obtain a judicial search warrant, and the request must be approved by an officer holding the rank of at least assistant commissioner.

“The amendments only target national security cases requiring police officers to apply for a search warrant and clearly specifying which type of electronic devices they are asking the passwords for. We won’t do this casually,” Tang stated. He dismissed claims of arbitrary street checks as false narratives meant to “scare people,” comparing a suspect’s refusal to unlock a device to obstructing police from entering a residence with a valid search warrant.

A Broader Security Crackdown

The password mandate is just one component of a broader package of enforcement tools introduced under the revised Article 43 rules. Other significant changes include:

• Digital Takedowns: Police, with approval from the Secretary for Security, can now order internet service providers, platforms, and publishers to remove electronic messages or content deemed a threat to national security.

• Travel Restrictions: The amendments introduce stricter penalties for non-compliance with court orders to surrender travel documents, or for attempting unauthorized departures from Hong Kong while under investigation.

• Customs Authority: Customs officers have been granted the authority to seize items reasonably suspected of carrying seditious intent during routine border and cargo checks.

Hong Kong authorities maintain that these revisions are a necessary evolution, drawing from years of case-handling experience to ensure law enforcement can effectively investigate and prevent national security threats in an increasingly complex digital era.