← Articles

Hong Kong Can Jail You for Refusing to Unlock a Device

Encryption at rest protects a phone until the state can force a person to unlock it. That is the line Hong Kong moved in March. Reuters and the BBC both reported that amended national security rules now let police require a suspect to provide a password or decryption method for an electronic device. Refusal is now its own offence. False or misleading information carries a steeper penalty. The technical shield still exists. The legal shield is thinner.

The question is not whether Hong Kong invented compelled access. Other jurisdictions have pushed in the same direction. The reason this matters is the setting. The U.S. State Department's Hong Kong travel guidance says the 2020 National Security Law and the 2024 Safeguarding National Security Ordinance create broad legal risk for foreign nationals and warns that criticism of PRC or Hong Kong authorities, protest activity, or political social posts can bring detention, criminal charges, expulsion, or travel restrictions.

That changes the OPSECOperational security is the practice of minimizing information leaks across behavior, devices, accounts, payments, and routines that can expose identity or intent.Glossary → question. In many places, the safest answer is strong device encryption. In Hong Kong, that answer is incomplete. If the law can turn refusal into a separate crime, the real defense shifts earlier: what device you carry, what accounts live on it, what data remains cached, and whether your main identity is attached to the hardware in your hand.

What the March 2026 change actually did

Reuters reported on March 23, 2026 that Hong Kong amended the implementation rules of its national security law. The report says police can require a person under investigation for a national security offence to provide a password or decryption method for an electronic device and to give any reasonable and necessary information or assistance. Reuters also reports the penalties: up to one year in jail and a HK$100,000 fine for refusal, or up to three years and HK$500,000 for false or misleading information.

The BBC's March 23 report matches those penalty figures and notes a second change that broadens search and retention risk: customs officials also gained power to seize items they deem to have seditious intention. That does not only raise the risk of device access. It raises the risk of a broader search and retention chain once a person is already inside a national security investigation.

Bruce Schneier's April 7 summary focused on the operational consequence for travelers. He quoted a March 26 U.S. consular alert saying Hong Kong authorities had changed the rules on March 23 and could require passwords or other assistance to access personal electronic devices. Schneier highlighted the transit angle too. If you treat airport transit as a legal gray zone where your normal travel kit is safe, that assumption is weaker now.

The government says there are safeguards. The details matter.

Four days after the rule change, the Hong Kong government published a long March 27 press release rejecting foreign criticism. That statement matters because it adds an official process claim missing from some early reports. The government says that under normal circumstances police must have reasonable grounds to suspect a device contains evidence of a national security offence, must apply for a warrant, and must obtain authorisation from a magistrate before requiring a specified person to provide a password or decryption method.

That is a real nuance. A careful article should not skip it. The problem is not that Hong Kong banned encryption outright or announced random street checks for every phone. The problem is that a power to compel disclosure now exists inside a system built for national security investigations, with harsh penalties for refusal and a legal vocabulary broad enough to make foreign nationals think twice about what they carry.

Reuters quoted Urania Chiu, a UK-based law lecturer researching Hong Kong, saying the powers interfere with privacy and fair-trial rights and do not need judicial authorisation. The government response says the opposite. It says the amendment rules are limited, necessary, and backed by judicial approval. Those two claims can coexist on paper. They do not cancel the operational reality. Once a device search enters a national security case, the user is no longer relying on cryptography alone. The user is relying on process, discretion, and a national security court process that foreign governments and rights critics already treat as high risk.

Why this matters for travelers, not just residents

This is where the Hong Kong story becomes a practical travel story. The State Department page does not treat the national security framework as a local-only rule set. It says the 2020 National Security Law and the 2024 Safeguarding National Security Ordinance create broad legal exposure for foreign nationals. The page also warns that political activity and criticism posted online can create risk. If your phone contains messages, archives, cloud-session cookies, draft notes, or private chats that touch those subjects, the device becomes a map of your life.

The 2024 legal layer matters here too. The Hong Kong Security Bureau FAQ says the Safeguarding National Security Ordinance passed on March 19, 2024 and took effect on March 23, 2024. The Legislative Council brief shows how broad that local framework already was before the 2026 amendment. It covers treason, insurrection, sedition, state secrets, sabotage, external interference, enforcement, and procedure. The March 2026 password rule did not create the national security architecture. It gave that architecture a more direct path into a person's device.

The transit angle matters because many people treat transit devices casually. They carry their daily phone through one airport because they never leave the secure zone. They log in once to answer email. They keep two-factor tokens, password managers, chat backups, and synced cloud drives on the same hardware. That setup is already risky in hostile-border environments. It is worse when the local security framework can punish refusal to unlock the device if a search reaches you.

Travelers should also avoid a false sense of safety from clean messaging apps. The weak point is not only message content. It is the chain around the messages: device unlock, app session tokens, cloud backups, local photo caches, browser tabs, downloaded PDFs, and identity overlap between work, activism, and personal life. A phone that looks ordinary can still expose a full social graph once it is open.

Encryption is still useful. The strategy around it has to change.

One common mistake starts here. People hear about compelled access and conclude encryption no longer matters. The rule change does not support that conclusion. Encryption still protects against theft, device loss, malware, and many routine border searches that never escalate into a demand backed by law. What changes is the planning model. You stop treating the phone as your vault and start treating it as a temporary access terminal.

That means carrying less, not just encrypting more. A burner setup with tightly scoped accounts is safer than a hardened flagship phone packed with your real identity. We cover the identity side in Creating a Burner Identity. We cover the device side in GrapheneOS: The Privacy Phone Guide. If sensitive files must exist at all, keep them encrypted off-device and under your own control, not permanently cached on a travel handset. PGP Basics is still relevant here because strong file-level encryption limits what sits in plaintext when the device is not unlocked.

The practical rule is simple. Do not bring your archive to a jurisdiction that can turn refusal into a charge. Bring the minimum account set needed for the trip. Strip browser sessions. Remove autofill. Move long-term notes and documents off the device. Disable cloud sync that would quietly repopulate the phone after you clean it. If a second factor lives on the same handset as every protected account, fix that before travel.

Compartmentalisation matters more than slogans here. One phone for normal life, one phone for sensitive work, and one account for travel can feel excessive until the moment a single unlocked device becomes a key to email, storage, contacts, and payment history at once. The March 2026 Hong Kong rule change is a reminder that device security is not just a hardware problem. It is an identity-graph problem.

The real shift is legal compulsion, not technical defeat

Hong Kong did not crack AES. It changed the leverage point. The new rules make the person holding the device part of the access system. That matters because modern privacy habits often overfocus on the lock screen and underfocus on the life behind it. The stronger your compartment boundaries, the less a compelled unlock can expose. The more your phone mirrors your entire digital life, the more a single search can unravel.

That is why this story matters outside Hong Kong too. Once one jurisdiction shows how to convert device access into a disclosure offence inside a national security framework, others can copy the pattern. The language may differ. The mechanism stays the same. First the state defines a broad class of investigations. Then it treats device access as evidence collection. Then refusal becomes obstruction.

If you travel through high-risk jurisdictions, plan as if the device may open. Your defense is not a better lock alone. Your defense is a phone that contains less, reveals less, and belongs to a smaller slice of your life.