{"data":{"documents":[{"document_id":"grapheneos-september-releases-2026","title":"Releases: GrapheneOS 2026091000, 2026091700 and 2026091900","short_title":"GrapheneOS September releases","issuing_body":"GrapheneOS","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-09-19","canonical_url":"https://grapheneos.org/releases#2026091900","retrieved_at":"2026-09-20T21:48:54.174Z","content_hash":"sha256:91e8f131994ffa0517c761d638abb92f5bcc09f2bcbd114767a403c151b6a2d8","archive_url":"https://cunicula.com/primary-sources/archive/grapheneos-september-releases-2026.txt","media_type":"text/plain","passages":[{"id":"september-patch-level","locator":{"type":"section","label":"2026091000: Changes since the 2026090700 release (included in September 19 release history)","page":1},"quote":"full 2026-09-01 security patch level"},{"id":"modem-firmware","locator":{"type":"section","label":"2026091700: Changes since the 2026091000 release","page":1},"quote":"Pixels: backport cellular modem firmware from Android 17 QPR1"}]},{"document_id":"flock-lpr-policy-2026","title":"License Plate Reader Policy","short_title":"Flock LPR policy","issuing_body":"Flock Safety","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-06-30","canonical_url":"https://www.flocksafety.com/legal/lpr-policy","retrieved_at":"2026-09-20T21:34:35Z","content_hash":"sha256:c92398d62608b2c249021bbf86484959b6f0191c26b215f6cc83d26a114d3182","archive_url":"https://cunicula.com/primary-sources/archive/flock-lpr-policy-2026.txt","media_type":"text/plain","passages":[{"id":"query-auditing","locator":{"type":"section","label":"Authorized Users and Access","page":1},"quote":"All queries of the LPR system are stored for auditing purposes, including: Username Date Time Purpose of query License plate and other elements used to query the system"},{"id":"retention-scope","locator":{"type":"section","label":"Data Retention and Privacy (page labelled June 30; wording retrieved September 21)","page":1},"quote":"LPR data is hard deleted on a rolling 7-day basis by default; this may be increased or decreased on a case-by-case basis if a different schedule is required by a customer’s law or policy. Privacy: This policy governs the LPR system provided by Flock Safety."}]},{"document_id":"trezor-brevo-2026","title":"Security incident at Brevo, our third-party email provider","short_title":"Trezor Brevo disclosure","issuing_body":"Trezor","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-09-09","canonical_url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider","retrieved_at":"2026-09-20T21:20:42.326Z","content_hash":"sha256:e174a3abc49460f24aea0ff048e281a6d6b9fe7949cf5b00b7b550ccdc369bb4","archive_url":"https://cunicula.com/primary-sources/archive/trezor-brevo-2026.txt","media_type":"text/plain","passages":[{"id":"exported-contacts","locator":{"type":"section","label":"Updated September 17, 2026","page":1},"quote":"Brevo has confirmed that 347,149 marketing email contacts were exported from our list through the API during this incident."},{"id":"wallet-scope","locator":{"type":"section","label":"Was Trezor itself hacked?","page":1},"quote":"No Trezor product, wallet, or account system was affected."},{"id":"phishing-app","locator":{"type":"paragraph","label":"Phishing email description","page":1},"quote":"The phishing email sent from our account contained a malicious link that prompted users to download an app that asked users to enter their wallet backup."}]},{"document_id":"trezor-shipmonk-2026","title":"Recent customer data exposed in shipping provider incident","short_title":"Trezor ShipMonk disclosure","issuing_body":"Trezor","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-08-12","canonical_url":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident","retrieved_at":"2026-09-20T21:20:42.565Z","content_hash":"sha256:53efa089aabc2bf3bea34d06df8eb646a961acc81560c98da1a8d38d621d568f","archive_url":"https://cunicula.com/primary-sources/archive/trezor-shipmonk-2026.txt","media_type":"text/plain","passages":[{"id":"incident-total","locator":{"type":"section","label":"How many customers are affected by this incident? (September 4 update; header August 12, body says original August 13)","page":1},"quote":"80,689 customers are affected."},{"id":"historical-orders","locator":{"type":"section","label":"Updated September 4, 2026","page":1},"quote":"This leaked data affects another approximately 67,000 US customers and includes full exposure (name, email, phone number, shipping address, order number)."},{"id":"deletion-assurances","locator":{"type":"section","label":"Updated September 4, 2026","page":1},"quote":"We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."}]},{"document_id":"brevo-postmortem-2026","title":"Attacker gained access to client accounts","short_title":"Brevo incident postmortem","issuing_body":"Brevo","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-09-10","canonical_url":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up","retrieved_at":"2026-09-20T21:20:42.799Z","content_hash":"sha256:47425f4490e004f7bbb073bc6302773f31c6271e59f2eacaabbcb0d67a1fd6f9","archive_url":"https://cunicula.com/primary-sources/archive/brevo-postmortem-2026.txt","media_type":"text/plain","passages":[{"id":"platform-accounts","locator":{"type":"section","label":"What happened","page":1},"quote":"On September 10th at 6:30 AM UTC we identified a security issue where an attacker exploited a flaw in the way Brevo handles SAML SSO to gain access to 138 Brevo accounts."},{"id":"authenticated-email","locator":{"type":"section","label":"If you have received some of these emails","page":1},"quote":"These messages were sent through legitimate infrastructure, so they passed the usual email authentication checks and looked genuine."}]},{"document_id":"mullvad-public-dns-closure-2026","title":"Shutting down our public encrypted DNS servers and sponsoring Quad9 instead","short_title":"Mullvad public DNS closure","issuing_body":"Mullvad VPN","hosting_body":null,"document_type":"transparency-report","source_relation":"provider","published_at":"2026-09-03","canonical_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead","retrieved_at":"2026-09-21T06:58:25+10:00","content_hash":"sha256:3a5d9c626cb8eedba19547f3afc90fa9bdb09e8f43c25f1825f517d8dc97a6aa","archive_url":"https://cunicula.com/primary-sources/archive/mullvad-public-dns-closure-2026.txt","media_type":"text/plain","passages":[{"id":"migration-deadline","locator":{"type":"section","label":"Migrating to Quad9","page":1},"quote":"If you have manually configured our DoH servers, switch before November 2nd 2026."},{"id":"internal-dns","locator":{"type":"paragraph","label":"Opening paragraph","page":1},"quote":"They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries."},{"id":"browser-migration","locator":{"type":"section","label":"Mullvad Browser","page":1},"quote":"Mullvad Browser users who have kept the default DoH settings or the included ad blocking one, will automatically be migrated to Quad9."},{"id":"custom-settings","locator":{"type":"section","label":"Mullvad Browser","page":1},"quote":"If you have customized the DoH, we will not change them."}]},{"document_id":"hksar-article-43-implementation-rules-2026","title":"Implementation Rules for Article 43 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region","short_title":"Instrument A303","issuing_body":"Chief Executive in conjunction with the Committee for Safeguarding National Security of the Hong Kong Special Administrative Region","hosting_body":"Legislative Council of the Hong Kong Special Administrative Region","document_type":"regulation","source_relation":"official","published_at":"2026-03-23","canonical_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf","retrieved_at":"2026-08-09T23:32:16+10:00","content_hash":"sha256:409c3acb01c81a53a4ffac029c7a63ffb40919bf8979416fea64864d680b104a","archive_url":"https://cunicula.com/primary-sources/archive/hksar-article-43-implementation-rules-2026.pdf","media_type":"application/pdf","passages":[{"id":"amendments-commencement","locator":{"type":"section","label":"Rule 1, Editorial Note","page":6},"quote":"For the commencement arrangements under the subsequent amendments to these Implementation Rules, please see L.N. 166 of 2023 (commencement date: 15 December 2023) and L.N. 27 of 2026 (commencement date: 23 March 2026)."},{"id":"customs-property-powers","locator":{"type":"section","label":"Rule 2(3)","page":6},"quote":"The Secretary for Justice, the Secretary for Security, a member of the Customs and Excise Service or a police officer may, in accordance with Schedule 3, exercise the power to freeze, restrain, confiscate and forfeit property relating to the commission of an offence endangering national security."},{"id":"magistrate-warrant-application","locator":{"type":"section","label":"Schedule 1, Part 1, section 2(1)","page":8},"quote":"A police officer may, for investigation of an offence endangering national security, apply to a magistrate by information on oath for a warrant under this section."},{"id":"warrantless-rank-condition","locator":{"type":"section","label":"Schedule 1, Part 1, section 3(1)","page":10},"quote":"If a police officer not below the rank of Assistant Commissioner of Police is satisfied that"},{"id":"warrantless-practicability-condition","locator":{"type":"section","label":"Schedule 1, Part 1, section 3(1)(c)","page":10},"quote":"for any reason it would not be reasonably practicable to obtain a warrant, the police officer, or another police officer authorized by the police officer, may exercise one or more of the powers under section 2(3) of this Schedule for investigation of an offence endangering national security without a warrant."},{"id":"password-requirement","locator":{"type":"section","label":"Schedule 1, Part 1, section 4(2)(a)","page":11},"quote":"(a) require a specified person to provide the police officer with any password, or other decryption method, that is necessary;"},{"id":"assistance-requirement","locator":{"type":"section","label":"Schedule 1, Part 1, section 4(2)(b)","page":11},"quote":"(b) require a specified person to provide the police officer with any other reasonable and necessary information or assistance,"},{"id":"noncompliance-penalty","locator":{"type":"section","label":"Schedule 1, Part 1, section 5(1)","page":12},"quote":"If a person fails to comply with a requirement imposed under section 4(2) of this Schedule, the person commits an offence and is liable on conviction on indictment to a fine of $100,000 and to imprisonment for 1 year."},{"id":"reasonable-excuse-defence","locator":{"type":"section","label":"Schedule 1, Part 1, section 5(3)","page":12},"quote":"It is a defence for a person charged with an offence under subsection (1) to establish that the person had a reasonable excuse for failing to comply with the requirement."},{"id":"false-statement-penalty","locator":{"type":"section","label":"Schedule 1, Part 1, section 6","page":13},"quote":"(a) provides any information, or makes a statement, that the person knows to be false or misleading in a material particular; or (b) recklessly provides any information, or recklessly makes a statement, that is false or misleading in a material particular, the person commits an offence and is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years."}]}],"claims":[{"claim_id":"grapheneos-guide-september-patches","claim":"GrapheneOS release 2026091000 reports the full 2026-09-01 security patch level.","target":{"kind":"article","slug":"grapheneos-privacy-phone-guide"},"document_id":"grapheneos-september-releases-2026","passage_id":"september-patch-level","required_quote_terms":["2026-09-01","security patch level"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-grapheneos-guide-september-patches","source_url":"https://grapheneos.org/releases#page=1","passage":{"id":"september-patch-level","locator":{"type":"section","label":"2026091000: Changes since the 2026090700 release (included in September 19 release history)","page":1},"quote":"full 2026-09-01 security patch level"}},{"claim_id":"grapheneos-guide-modem-backport","claim":"GrapheneOS release 2026091700 reports a Pixel cellular modem firmware backport from Android 17 QPR1.","target":{"kind":"article","slug":"grapheneos-privacy-phone-guide"},"document_id":"grapheneos-september-releases-2026","passage_id":"modem-firmware","required_quote_terms":["cellular modem firmware","Android 17 QPR1"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-grapheneos-guide-modem-backport","source_url":"https://grapheneos.org/releases#page=1","passage":{"id":"modem-firmware","locator":{"type":"section","label":"2026091700: Changes since the 2026091000 release","page":1},"quote":"Pixels: backport cellular modem firmware from Android 17 QPR1"}},{"claim_id":"flock-lpr-query-auditing","claim":"Flock's LPR policy says queries are stored for auditing with user, date, time, purpose and search elements; this is not verification of OS Investigate logging.","target":{"kind":"article","slug":"license-plate-readers-traffic-enforcement"},"document_id":"flock-lpr-policy-2026","passage_id":"query-auditing","required_quote_terms":["LPR system","auditing purposes","Purpose of query"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-flock-lpr-query-auditing","source_url":"https://www.flocksafety.com/legal/lpr-policy#page=1","passage":{"id":"query-auditing","locator":{"type":"section","label":"Authorized Users and Access","page":1},"quote":"All queries of the LPR system are stored for auditing purposes, including: Username Date Time Purpose of query License plate and other elements used to query the system"}},{"claim_id":"flock-lpr-retention-scope","claim":"Flock states a seven-day default deletion period with customer law or policy exceptions; the policy expressly governs its LPR system, not every investigative record.","target":{"kind":"article","slug":"license-plate-readers-traffic-enforcement"},"document_id":"flock-lpr-policy-2026","passage_id":"retention-scope","required_quote_terms":["7-day","law or policy","governs the LPR system"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-flock-lpr-retention-scope","source_url":"https://www.flocksafety.com/legal/lpr-policy#page=1","passage":{"id":"retention-scope","locator":{"type":"section","label":"Data Retention and Privacy (page labelled June 30; wording retrieved September 21)","page":1},"quote":"LPR data is hard deleted on a rolling 7-day basis by default; this may be increased or decreased on a case-by-case basis if a different schedule is required by a customer’s law or policy. Privacy: This policy governs the LPR system provided by Flock Safety."}},{"claim_id":"trezor-brevo-exported-contacts","claim":"Trezor's September 17 update reports 347,149 marketing email contacts exported through Brevo's API.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-brevo-2026","passage_id":"exported-contacts","required_quote_terms":["347,149","exported","API"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-brevo-exported-contacts","source_url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider#page=1","passage":{"id":"exported-contacts","locator":{"type":"section","label":"Updated September 17, 2026","page":1},"quote":"Brevo has confirmed that 347,149 marketing email contacts were exported from our list through the API during this incident."}},{"claim_id":"trezor-brevo-wallet-scope","claim":"Trezor says its product, wallet and account systems were not affected by the Brevo incident.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-brevo-2026","passage_id":"wallet-scope","required_quote_terms":["No Trezor product","wallet","account system"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-brevo-wallet-scope","source_url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider#page=1","passage":{"id":"wallet-scope","locator":{"type":"section","label":"Was Trezor itself hacked?","page":1},"quote":"No Trezor product, wallet, or account system was affected."}},{"claim_id":"trezor-brevo-phishing-app","claim":"Trezor describes a phishing email linking to an app that asked for a wallet backup, not a verified hardware repair.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-brevo-2026","passage_id":"phishing-app","required_quote_terms":["phishing email","wallet backup"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-brevo-phishing-app","source_url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider#page=1","passage":{"id":"phishing-app","locator":{"type":"paragraph","label":"Phishing email description","page":1},"quote":"The phishing email sent from our account contained a malicious link that prompted users to download an app that asked users to enter their wallet backup."}},{"claim_id":"trezor-shipmonk-total","claim":"Trezor's updated ShipMonk disclosure states that 80,689 customers are affected by that incident.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-shipmonk-2026","passage_id":"incident-total","required_quote_terms":["80,689","customers"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-shipmonk-total","source_url":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident#page=1","passage":{"id":"incident-total","locator":{"type":"section","label":"How many customers are affected by this incident? (September 4 update; header August 12, body says original August 13)","page":1},"quote":"80,689 customers are affected."}},{"claim_id":"trezor-shipmonk-historical-orders","claim":"Trezor's September 4 update adds approximately 67,000 US customers with full name, email, phone, shipping-address and order-number exposure.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-shipmonk-2026","passage_id":"historical-orders","required_quote_terms":["67,000","shipping address","order number"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-shipmonk-historical-orders","source_url":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident#page=1","passage":{"id":"historical-orders","locator":{"type":"section","label":"Updated September 4, 2026","page":1},"quote":"This leaked data affects another approximately 67,000 US customers and includes full exposure (name, email, phone number, shipping address, order number)."}},{"claim_id":"trezor-shipmonk-retained-data","claim":"Trezor says ShipMonk retained data despite confirmation of deletion; this is the customer's account, not an independent audit.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"trezor-shipmonk-2026","passage_id":"deletion-assurances","required_quote_terms":["confirmation","not deleted"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-shipmonk-retained-data","source_url":"https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident#page=1","passage":{"id":"deletion-assurances","locator":{"type":"section","label":"Updated September 4, 2026","page":1},"quote":"We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."}},{"claim_id":"trezor-brevo-platform-count","claim":"Brevo's postmortem reports 138 platform accounts accessed, distinct from Trezor's exported newsletter-contact count.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"brevo-postmortem-2026","passage_id":"platform-accounts","required_quote_terms":["138 Brevo accounts","SAML SSO"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-brevo-platform-count","source_url":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up#page=1","passage":{"id":"platform-accounts","locator":{"type":"section","label":"What happened","page":1},"quote":"On September 10th at 6:30 AM UTC we identified a security issue where an attacker exploited a flaw in the way Brevo handles SAML SSO to gain access to 138 Brevo accounts."}},{"claim_id":"trezor-brevo-authenticated-phishing","claim":"Brevo says the phishing messages passed ordinary email authentication because they used legitimate sending infrastructure.","target":{"kind":"service","slug":"trezor","field":"incidents"},"document_id":"brevo-postmortem-2026","passage_id":"authenticated-email","required_quote_terms":["legitimate infrastructure","email authentication"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-trezor-brevo-authenticated-phishing","source_url":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up#page=1","passage":{"id":"authenticated-email","locator":{"type":"section","label":"If you have received some of these emails","page":1},"quote":"These messages were sent through legitimate infrastructure, so they passed the usual email authentication checks and looked genuine."}},{"claim_id":"mullvad-public-dns-migration-deadline","claim":"Mullvad asks manually configured public DoH users to switch before November 2, 2026.","target":{"kind":"service","slug":"mullvad-dns","field":"privacyWarning"},"document_id":"mullvad-public-dns-closure-2026","passage_id":"migration-deadline","required_quote_terms":["manually configured","November 2nd 2026"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-mullvad-public-dns-migration-deadline","source_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead#page=1","passage":{"id":"migration-deadline","locator":{"type":"section","label":"Migrating to Quad9","page":1},"quote":"If you have manually configured our DoH servers, switch before November 2nd 2026."}},{"claim_id":"mullvad-guide-internal-dns-separate","claim":"Mullvad distinguishes its VPN internal DNS from the public encrypted DNS service being retired.","target":{"kind":"article","slug":"private-dns-setup-guide"},"document_id":"mullvad-public-dns-closure-2026","passage_id":"internal-dns","required_quote_terms":["internal DNS","Mullvad VPN"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-mullvad-guide-internal-dns-separate","source_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead#page=1","passage":{"id":"internal-dns","locator":{"type":"paragraph","label":"Opening paragraph","page":1},"quote":"They are unnecessary when using Mullvad VPN — traffic is already encrypted and Mullvad VPN's internal DNS handles all queries."}},{"claim_id":"mullvad-guide-browser-migration","claim":"Mullvad Browser default and included ad-blocking DoH settings will automatically migrate to Quad9.","target":{"kind":"article","slug":"private-dns-setup-guide"},"document_id":"mullvad-public-dns-closure-2026","passage_id":"browser-migration","required_quote_terms":["default DoH","automatically","Quad9"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-mullvad-guide-browser-migration","source_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead#page=1","passage":{"id":"browser-migration","locator":{"type":"section","label":"Mullvad Browser","page":1},"quote":"Mullvad Browser users who have kept the default DoH settings or the included ad blocking one, will automatically be migrated to Quad9."}},{"claim_id":"mullvad-guide-custom-dns-not-migrated","claim":"Mullvad says customized browser DoH settings will not be changed automatically.","target":{"kind":"article","slug":"private-dns-setup-guide"},"document_id":"mullvad-public-dns-closure-2026","passage_id":"custom-settings","required_quote_terms":["customized","will not change"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-mullvad-guide-custom-dns-not-migrated","source_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead#page=1","passage":{"id":"custom-settings","locator":{"type":"section","label":"Mullvad Browser","page":1},"quote":"If you have customized the DoH, we will not change them."}},{"claim_id":"mullvad-age-guide-dns-migration","claim":"Manually configured Mullvad public DoH users need to switch before November 2, 2026.","target":{"kind":"article","slug":"age-verification-privacy"},"document_id":"mullvad-public-dns-closure-2026","passage_id":"migration-deadline","required_quote_terms":["manually configured","November 2nd 2026"],"evidence_tier":"self-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-mullvad-age-guide-dns-migration","source_url":"https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead#page=1","passage":{"id":"migration-deadline","locator":{"type":"section","label":"Migrating to Quad9","page":1},"quote":"If you have manually configured our DoH servers, switch before November 2nd 2026."}},{"claim_id":"hk-article-43-amendments-effective-2026","claim":"The 2026 amendments to Instrument A303 commenced on 23 March 2026.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"amendments-commencement","required_quote_terms":["23 March 2026"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-amendments-effective-2026","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=6","passage":{"id":"amendments-commencement","locator":{"type":"section","label":"Rule 1, Editorial Note","page":6},"quote":"For the commencement arrangements under the subsequent amendments to these Implementation Rules, please see L.N. 166 of 2023 (commencement date: 15 December 2023) and L.N. 27 of 2026 (commencement date: 23 March 2026)."}},{"claim_id":"hk-article-43-password-demand","claim":"A police officer exercising the electronic-equipment search power may require a specified person to provide a necessary password or decryption method.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"password-requirement","required_quote_terms":["password","decryption method"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-password-demand","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=11","passage":{"id":"password-requirement","locator":{"type":"section","label":"Schedule 1, Part 1, section 4(2)(a)","page":11},"quote":"(a) require a specified person to provide the police officer with any password, or other decryption method, that is necessary;"}},{"claim_id":"hk-article-43-assistance-demand","claim":"The same power may require other reasonable and necessary information or assistance.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"assistance-requirement","required_quote_terms":["information or assistance"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-assistance-demand","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=11","passage":{"id":"assistance-requirement","locator":{"type":"section","label":"Schedule 1, Part 1, section 4(2)(b)","page":11},"quote":"(b) require a specified person to provide the police officer with any other reasonable and necessary information or assistance,"}},{"claim_id":"hk-article-43-refusal-penalty","claim":"Failure to comply can result in a HK$100,000 fine and one year of imprisonment on conviction on indictment.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"noncompliance-penalty","required_quote_terms":["$100,000","imprisonment for 1 year"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-refusal-penalty","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=12","passage":{"id":"noncompliance-penalty","locator":{"type":"section","label":"Schedule 1, Part 1, section 5(1)","page":12},"quote":"If a person fails to comply with a requirement imposed under section 4(2) of this Schedule, the person commits an offence and is liable on conviction on indictment to a fine of $100,000 and to imprisonment for 1 year."}},{"claim_id":"hk-article-43-reasonable-excuse-defence","claim":"A person charged with the noncompliance offence may establish a defence by showing a reasonable excuse for failing to comply.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"reasonable-excuse-defence","required_quote_terms":["reasonable excuse"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-reasonable-excuse-defence","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=12","passage":{"id":"reasonable-excuse-defence","locator":{"type":"section","label":"Schedule 1, Part 1, section 5(3)","page":12},"quote":"It is a defence for a person charged with an offence under subsection (1) to establish that the person had a reasonable excuse for failing to comply with the requirement."}},{"claim_id":"hk-article-43-false-information-penalty","claim":"Knowingly or recklessly providing materially false or misleading information can result in a HK$500,000 fine and three years of imprisonment on conviction on indictment.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"false-statement-penalty","required_quote_terms":["$500,000","imprisonment for 3 years"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-false-information-penalty","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=13","passage":{"id":"false-statement-penalty","locator":{"type":"section","label":"Schedule 1, Part 1, section 6","page":13},"quote":"(a) provides any information, or makes a statement, that the person knows to be false or misleading in a material particular; or (b) recklessly provides any information, or recklessly makes a statement, that is false or misleading in a material particular, the person commits an offence and is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years."}},{"claim_id":"hk-article-43-magistrate-warrant","claim":"The ordinary warrant route requires a police officer to apply to a magistrate by information on oath.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"magistrate-warrant-application","required_quote_terms":["apply to a magistrate","information on oath"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-magistrate-warrant","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=8","passage":{"id":"magistrate-warrant-application","locator":{"type":"section","label":"Schedule 1, Part 1, section 2(1)","page":8},"quote":"A police officer may, for investigation of an offence endangering national security, apply to a magistrate by information on oath for a warrant under this section."}},{"claim_id":"hk-article-43-warrantless-exception","claim":"The section 3(1) warrantless route requires satisfaction by a police officer not below the rank of Assistant Commissioner.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"warrantless-rank-condition","required_quote_terms":["Assistant Commissioner of Police"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-warrantless-exception","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=10","passage":{"id":"warrantless-rank-condition","locator":{"type":"section","label":"Schedule 1, Part 1, section 3(1)","page":10},"quote":"If a police officer not below the rank of Assistant Commissioner of Police is satisfied that"}},{"claim_id":"hk-article-43-warrantless-practicability","claim":"The section 3(1) warrantless route also requires that obtaining a warrant would not be reasonably practicable.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"warrantless-practicability-condition","required_quote_terms":["not be reasonably practicable to obtain a warrant"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-warrantless-practicability","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=10","passage":{"id":"warrantless-practicability-condition","locator":{"type":"section","label":"Schedule 1, Part 1, section 3(1)(c)","page":10},"quote":"for any reason it would not be reasonably practicable to obtain a warrant, the police officer, or another police officer authorized by the police officer, may exercise one or more of the powers under section 2(3) of this Schedule for investigation of an offence endangering national security without a warrant."}},{"claim_id":"hk-article-43-customs-property-powers","claim":"Rule 2(3) adds Customs and Excise Service members to the officials who may exercise Schedule 3 property freezing, restraint, confiscation, and forfeiture powers.","target":{"kind":"article","slug":"hong-kong-device-password-law"},"document_id":"hksar-article-43-implementation-rules-2026","passage_id":"customs-property-powers","required_quote_terms":["Customs and Excise Service","freeze, restrain, confiscate and forfeit"],"evidence_tier":"third-party-reported","reader_url":"https://cunicula.com/en/primary-sources#claim-hk-article-43-customs-property-powers","source_url":"https://www.legco.gov.hk/yr2026/english/panels/ajls/papers/Instrument_A303-e.pdf#page=6","passage":{"id":"customs-property-powers","locator":{"type":"section","label":"Rule 2(3)","page":6},"quote":"The Secretary for Justice, the Secretary for Security, a member of the Customs and Excise Service or a police officer may, in accordance with Schedule 3, exercise the power to freeze, restrain, confiscate and forfeit property relating to the commission of an offence endangering national security."}}]},"meta":{"total":7,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","claim_total":27,"page_url":"https://cunicula.com/en/primary-sources","feed_url":"https://cunicula.com/feed.xml","scope":"Original documents and exact passages attached to published Cunicula claims. Evidence tiers describe the relationship between a document and the claim; the presence of a primary document does not by itself indicate an audit or direct test."}}