Hong Kong police can now force unlock encrypted devices without warrants under new National Security Law amendments. Effective March 23, 2026, authorities may demand passwords or decryption methods for smartphones, laptops, and encrypted storage—no judicial approval required. Refusal risks 1 year imprisonment and a HK$100,000 fine (roughly $12,700 USD), while false credentials carry 3-year sentences.

The law targets device owners, IT administrators, and anyone with access details, including spouses or business partners. It applies to biometric locks, PINs, and enterprise encryption keys, making digital privacy contingent on state approval. Travelers using Signal or VPNs face heightened risks, as authorities can seize devices deemed threatening to "national security"—a vague standard covering secession, subversion, and foreign collusion.

Chief Executive John Lee implemented changes without Legislative Council oversight, bypassing judicial authorization requirements. Critics, including UK-based law lecturer Urania Chiu, call the measures "grossly disproportionate," arguing they violate privacy rights and fair trial guarantees. Since the 2020 National Security Law’s enactment, authorities have arrested 386 people with 176 convictions, setting precedents for broad security threat interpretations.

Hong Kong’s government claims the rules balance human rights protections with security needs, but privacy advocates warn of authoritarian overreach. For journalists, business travelers, and residents, everyday encryption tools now carry legal liability—turning Hong Kong into a digital minefield where device security becomes a liability, not a safeguard.