Critics of Hong Kong’s national security enforcement often make selective emphasis: A single feature is isolated and then presented as proof of an “unbounded crackdown”. A case at hand: Amendments introduced on Monday to refine national security enforcement measures, including making it a punishable offense for a person to refuse to provide passwords for electronic devices during a national security investigation, have triggered “concerns” about potential infringement on rights and what not. Such views are persuasive only if the audience never returns to the structure of the amended Implementation Rules under Article 43 of the Hong Kong SAR National Security Law (NSL), never asks how thresholds are defined, and never examines the rights protection procedures that exist. Any serious assessment should begin with legal architecture, because in Hong Kong, the legitimacy of enforcement powers depends on how clearly they are expressed, how they are constrained, and how they are subject to review.
Article 43 of the NSL is an enabling provision, not an improvisational license. It links national security investigations to measures already familiar to Hong Kong’s criminal procedure in serious crime contexts, while permitting additional specified measures and authorizing Implementation Rules to set out the operational detail. The 2026 amendments should therefore be read as a refinement within an existing legal mechanism that has operated since 2020, which is now updated in response to practical experience and recurring procedural disputes. Legal systems that remain effective do not pretend that digital evidence, cross-border facilitation, and organized evasion techniques will remain static. They write rules that make enforcement workable while preserving definable constraints.
The most cited change concerns access to electronic equipment, particularly passwords and decryption methods. The key point is that the amendments do not create a general power directed at the public. The obligation is confined to specified persons whose connection to the device is concrete and objectively describable. That design addresses a specific evidential problem in modern investigations: Lawful search powers can become ineffective where encryption prevents access to data that is otherwise within the scope of a lawful search. If the law refuses to deal with that reality, it hands a technological immunity to any suspect who can store evidence behind encryption.
A second point, often omitted, is that the amendments do not treat compelled decryption as an evidentiary shortcut. They include limits on admissibility in criminal proceedings in which the person claims, before compliance, that the required disclosure may incriminate them. The logic is familiar in serious crime procedure: Permit lawful access to evidence so that investigations do not fail in the digital era, while restricting the prosecutorial use of the compelled act and compelled disclosure against the person, subject to defined exceptions for integrity-related offenses such as noncompliance and false statements. This balance is not an ornamental promise. It is written into the rules as a legal consequence that courts must apply.
The 2026 amendments push the system toward codified discipline in the areas most contested in modern investigations: Digital access, privilege protection, and enforceable processes
The question of judicial control also requires greater precision than headlines allow. Hong Kong’s criminal procedure does not operate on a single model in which every investigative step must be pre-authorized by a judge. It operates through a combination of authorization requirements for certain intrusive measures, defined statutory thresholds such as reasonable suspicion, and post-event judicial scrutiny of legality and admissibility. The amendments to Schedule 1 make the warrant threshold and the scope of powers clearer, including the requirement of information on oath and reasonable grounds for suspecting specified evidence is in a certain place. They also specify supplementary provisions for electronic equipment, setting out what actions may be taken to access, reproduce, copy, and transfer evidential material. Greater specificity is a restraint, because it reduces the space for ad hoc discretion and increases the precision with which a court can later assess whether an officer acted within lawful bounds.
The amendments also deserve to be judged by how they handle the most sensitive category of material in investigations, namely, information potentially protected by legal professional privilege. The revised framework sets out a structured, court-facing process that includes sealing procedures, timetables, list-based identification of disputed items, affidavit evidence, written submissions, and a court determination, generally without an oral hearing unless a hearing is necessary. This design aims to protect rights, reassuring the audience that legal privileges are safeguarded within a clear, disciplined process rather than left vulnerable to delays or vagueness.
The customs-related amendments have also been portrayed by some critics as “arbitrary” confiscation of items deemed to have seditious intent. In fact, the rules create a staged process suited to the border and cargo context. A seizure depends on reasonable suspicion and is confined to specified locations, such as points of entry and cargo storage areas. Interested persons can make written representations within a defined period. Where the authority remains of the view that forfeiture is justified, it must proceed to a magistrate for determination, with the civil standard of proof applied and appeal-related mechanisms addressed. This transparent process aims to reassure the audience that enforcement is lawful, fair, and subject to judicial oversight, easing fears of “arbitrary” action.
A broader counterargument is that safeguards on paper do not prevent “chilling effects” in practice, particularly in high-profile cases. This concern should not be dismissed, yet it must be analyzed in the correct category. The Implementation Rules govern investigative procedures. They do not redefine the elements of offense. Their task is to specify what enforcement agencies may do when investigating defined offenses, and to set out the conditions and processes that govern those measures. In this respect, the amendments strengthen legal certainty by clarifying who may be required to assist, what must be done to assert privilege, how disputes are brought before the court, and how contested matters are resolved. Legal certainty is not an answer to every anxiety, but it is the proper legal answer to the claim that enforcement is unstructured and unreviewable.
The claim that Hong Kong has adopted an unprecedented model does not survive comparative scrutiny. Many common-law jurisdictions have grappled with encryption and have created legal mechanisms to compel assistance under defined conditions, while debating the evidentiary consequences. The existence of debate elsewhere does not undermine Hong Kong’s approach. It confirms that the issue is universal: Encryption can defeat lawful investigation unless the law provides a workable response. Hong Kong’s amendments respond by writing clearer rules, defining procedural steps, and preserving judicial functions in cases requiring adjudication.
Safeguarding national security is not a slogan; and it can be achieved only through clear legal powers, clear constraints, and clear procedures that can be tested in court. The 2026 amendments push the system toward codified discipline in the areas most contested in modern investigations: Digital access, privilege protection, and enforceable processes.
The author is a solicitor, a Guangdong-Hong Kong-Macao Greater Bay Area lawyer, and a China-appointed attesting officer.
The views do not necessarily reflect those of China Daily.
