Hong Kong Intelligence Report #180: "Data Zeroization"—How MNCs and the HKSARG Coordinated National Security Law Amendments
- Ryota Nakanishi (Grace)
- Jun 13
- 17 min read
Updated: Jun 13
Open-source intelligence (OSINT)
🔻 IMPORTANT
▪️My conclusion (English only): How MNCs and the HKSARG Coordinated National Security Law Amendments?
How MNCs and the HKSARG Coordinated National Security Law Amendments: In contrast to the officially coordinated rhetoric surrounding the latest national security law amendments of March 2026 and June 2026, these represent a conscious local politics against the state, despite the state's own involvement. The amendments are scheduled to be implemented subsequent to the establishment of "Data Zeroization" and the implementation of risk-abiding practices. This sequence of events is indicative of the political coordination that occurs within the framework of corporatism and crony capitalism between the localist HKSARG and Western businesses. Moreover, a clear distinction exists between local national security laws and Western common law practices, despite the official rhetoric to the contrary. Consequently, the proposed amendments are effectively nullified from the outset through clandestine negotiations among local vested interests. The political sincerity of the HKSARG in relation to China is a subject of debate.
Note 1: It has been confirmed that the retroactive amendment of the national security law has now been explicitly applied to unprosecuted criminal actions that occurred prior to 2020.
Note 2: The high level of the MNCs' pre-establishment of countermeasures was indicative of the existence of negotiations and became the basis for the subsequent national security law amendment. This amendment was made under the conscious coordination between the chambers of commerce and the HKSARG. Consequently, the proposed amendment can be characterized as a "coordinated" amendment. This phenomenon exemplifies the intricacies of Hong Kong's localist politics, particularly in its dynamic relationship with both Western and Chinese entities.
▪️Analytical Contents (English only):
The latest changes to Hong Kong's national security laws include two major expansions of executive and police powers enacted through subsidiary legislation: [1, 2]
1. Chief Executive Certification Power (June 2026) [3]
On June 9, 2026, the Hong Kong government gazetted the Safeguarding National Security (Procedural Matters) Regulation. [4]
• The Change: It introduces a classification mechanism that empowers the Chief Executive to issue a certificate designating any criminal case as involving national security. [5, 6]
• The Impact: This certificate is binding on the courts. It allows authorities to retroactively apply strict national security procedures—such as trial by designated national security judges and stricter bail conditions—to older criminal cases, even if the alleged offences occurred before the 2020 National Security Law was passed. [2, 5, 6]
2. Device Password Surrender Requirement (March 2026) [7, 8]
On March 23, 2026, the government enacted the 2026 Implementation Rules for Amending the Implementation Rules for Article 43 of the National Security Law. [9]
• The Change: It criminalises the refusal to provide passwords, encryption keys, or decryption assistance to police officers investigating national security cases. [8, 10]
• The Penalties: Failing to comply carries a penalty of up to one year in prison and a HK$100,000 fine. Providing false or misleading information carries up to three years in prison. [10]
• Scope: This applies broadly to suspects, device owners, or anyone believed to know the passwords, including travelers transiting through Hong Kong International Airport. Suspects cannot invoke the legal privilege against self-incrimination to refuse. [8, 10, 11]
These updates follow the broader domestic Safeguarding National Security Ordinance (commonly known as Article 23), which initially expanded crimes related to treason, insurrection, and foreign interference. [12, 13]
The latest updates to Hong Kong’s national security framework in June 2026 and March 2026 significantly alter how national security laws are enforced, focusing heavily on digital investigation powers and retrospective procedural changes. [1, 2, 3, 4]
While the Hong Kong SAR Government emphasizes that these changes merely resolve "operational gaps" and add structural clarity without inventing new offenses, legal experts and international bodies warn that they dramatically expand police powers and increase data risks for individuals and businesses. [5, 6, 7]
The updates impact investigations and legal procedures in several key ways:
1. Mandatory Phone and Device Decryption (March 2026) [8]
• The Change: Amendments to the Article 43 Implementation Rules make it a distinct criminal offense to refuse to provide passwords or decryption assistance to the police for electronic devices (phones, laptops) during a national security investigation. [1, 9]
• The Impact: Police can now compel suspects, or anyone believed to know the password, to hand it over. Refusal carries a penalty of up to one year in prison and a HK$100,000 fine. Providing false information carries up to three years in prison. Foreign consulates, including the U.S. Consulate General, have issued formal security alerts warning travelers that this rule applies to anyone entering or transiting Hong Kong International Airport. [1, 3, 9]
2. Retroactive Retrofitting of Older Criminal Cases (June 2026)
• The Change: The Safeguarding National Security (Procedural Matters) Regulation empowers the Chief Executive to certify "other offenses" as national security cases. [10, 11]
• The Impact: This classification is binding on the courts and applies retroactively. Even if a criminal act or prosecution took place before the 2020 National Security Law was enacted, it can now be retrofitted under national security procedures. This subjects defendants to longer detention periods, stricter bail conditions, designated judges, and the denial of standard early-release remissions for good behavior. [2, 10, 12]
3. Property Freezing and Travel Bans (March 2026)
• The Change: The rules surrounding asset management and travel restrictions have been tightened.
• The Impact: Property freezing notices no longer have a strict two-year cap and will automatically remain valid until all legal proceedings are concluded. Additionally, it is now explicitly a criminal offense to violate restriction orders on travel documents or attempt to leave Hong Kong while under investigation. [13, 14, 15]
4. Commercial and Data Compliance Friction
• The Change: The evidentiary shifts place a heavier burden of proof on individuals and commercial organizations.
• The Impact: International firms, such as foreign banks operating in Hong Kong, face severe data privacy compliance conflicts. They must navigate the risk of local authorities demanding immediate, warrantless access to electronic devices against their home countries' strict data protection mandates. [5, 13, 16]
[12] https://www.scmp.com
[15] https://www.scmp.com
The differences between Hong Kong’s national security laws and those of Western nations (such as the US, UK, and Australia) are a subject of intense global debate. [1, 2]
While the Hong Kong SAR Government emphasizes that its laws are modeled after common law precedents and feature lower maximum penalties for certain crimes (e.g., life imprisonment for espionage vs. the death penalty in the US), international legal experts highlight fundamental structural differences regarding judicial independence, executive power, and definitions of crime. [3, 4, 5]
The structural and procedural differences break down into several distinct categories:
1. Executive Discretion vs. Judicial Oversight
• Hong Kong: The Chief Executive holds unilateral authority to issue legally binding certificates designating an act or organization as involving national security. These decisions are shielded from traditional judicial review. Under the 2026 procedural updates, this executive designation can even be applied retroactively to older criminal cases.[5, 6, 7, 8, 9]
• Western Nations: In the US and UK, the executive branch must prove its case to an independent judiciary at every level. Government decisions regarding national security are frequently challenged, blocked, or altered by federal and high courts based on constitutional rights. [5, 10]
2. Procedural Rights and Pre-Trial Detention
• Hong Kong: The legal framework effectively reverses the presumption of bail. Suspects are routinely denied bail unless they can prove they will not continue to endanger national security—a threshold that has led to years of pre-trial detention. Furthermore, the 2026 digital updates allow police to criminally penalize individuals who refuse to decrypt electronic devices before a trial even begins. [10, 11, 12, 13, 14]
• Western Nations: While laws like the UK National Security Act or the US Patriot Act expand investigative powers, they remain tightly bound by constitutional protections. For example, the US Fifth Amendment protects individuals from being compelled to provide self-incriminating evidence, such as passwords, without specific, highly restricted warrants that are subject to strict judicial scrutiny. [5, 10]
3. Vaguely Defined Crimes vs. Specific Intent
• Hong Kong: Offenses such as "subversion" and "collusion with foreign forces" are interpreted broadly. Prohibitions extend to peaceful political advocacy, civil society organizing, or lobbying foreign governments. [1, 6, 15, 16, 17]
• Western Nations: Western statutes generally tie security offenses to narrow, specific actions involving explicit criminal intent or violence. For instance, treason or sedition in the US explicitly requires the use of force, levying war, or providing physical "aid and comfort" to an official military enemy. Peaceful political dissent or international academic collaboration is strictly protected. [10, 18, 19]
4. Overriding Local and Human Rights Laws
• Hong Kong: The 2020 National Security Law explicitly states that it trumps any local Hong Kong ordinances—including the Bill of Rights—in the event of a conflict. [15]
• Western Nations: National security legislation must still comply with overarching constitutional frameworks, such as the US Bill of Rights or the European Convention on Human Rights (which continues to bind the UK). Citizens can actively appeal to independent or international tribunals to strike down overreaching security laws. [5, 20]
5. Extraterritorial Jurisdiction
• Hong Kong: Under Article 38, Hong Kong's security laws claim universal extraterritoriality. They apply to any individual, of any nationality, committing an act anywhere in the world, even if that act is entirely legal in the country where it occurs. [2, 21, 22]
• Western Nations: While nations like Australia and the US do enforce extraterritorial jurisdiction, international law principles generally restrict this to their own citizens abroad, or to non-citizens who target specific infrastructure or commit internationally recognized atrocities (such as war crimes or terrorism). [21, 22, 23]
[10] https://www.onc.hk
[16] https://www.hrw.org
[19] https://www.cnn.com
[22] https://www.scmp.com
The latest 2026 updates in Hong Kong widen the gap with Western security laws by consolidating absolute executive power over judicial outcomes and bypassing traditional constitutional protections against forced digital self-incrimination.
While the Hong Kong SAR Government and groups like the Law Society of Hong Kong contend that these updates merely align the city with other common law jurisdictions, international legal analysts highlight sharp contrasts in how these specific mechanisms function.
The newest 2026 changes differ from the laws of nations like the US, UK, and Australia in several critical ways:
1. Retroactive Classification via Executive Decree
• Hong Kong (June 2026 Change): The Procedural Matters Regulation allows the Chief Executive to issue a binding certificate classifying any ongoing or past criminal case as a national security matter. This triggers immediate retroactive procedural changes, such as revoking bail eligibility and blocking early release for good behavior.
• Western Nations: The US Constitution strictly prohibits ex post facto laws (retroactive criminal adjustments). In the UK and Australia, if a law changes, it generally cannot be used to retroactively alter the trial rules, detention conditions, or sentencing frameworks of previously committed acts or older cases.
2. Criminalized Refusal to Decrypt Devices
• Hong Kong (March 2026 Change): It is now a standalone criminal offense carrying up to a year in prison to refuse to provide passwords or decryption assistance to police during an authorized national security investigation.
• United States: The Fifth Amendment protects individuals against self-incrimination. US courts have repeatedly ruled that forcing a suspect to surrender a passcode is a violation of their constitutional rights unless the government meets an incredibly high evidentiary threshold ("foregone conclusion doctrine"), and even then, refusing does not carry an automatic, separate criminal sentence.
• United Kingdom & Australia: While the UK's Regulation of Investigatory Powers Act (RIPA) and Australia's Telecommunications Act allow police to request encryption assistance, they require an intense multi-tiered review process involving independent judicial tribunals. In Hong Kong, the executive branch handles the operational rules directly through administrative implementation.
3. Absolute Judicial Deference vs. Judicial Review
• Hong Kong: When the Chief Executive issues a certificate designating a case or piece of evidence as a national security matter, the courts have zero power to challenge it. The decision is legally binding and entirely shielded from judicial review.
• Western Nations: In the US, UK, and Australia, while governments can claim "state secrets privilege" or "public interest immunity," the judiciary retains the final say. A judge will review the government's claim in a private chamber (in-camera review) and can overrule the executive if they find the national security claim is being used as a pretext to hide misconduct or suppress a fair trial.
4. Application to Global Transit and Non-Citizens
• Hong Kong: The latest digital decryption rules apply directly to individuals simply transiting through Hong Kong International Airport, regardless of their nationality or where the alleged data was created.
• Western Nations: Border device searches exist in Western nations (such as US border phone searches), but they are heavily litigated. For example, US federal appeals courts have increasingly ruled that border agents must have "reasonable suspicion" of an existing crime to search a device, and they cannot compel a foreign national to disclose passwords to online accounts stored in the cloud outside US territory.
Here is a direct comparison table detailing how Hong Kong's 2026 updates stack up against the UK National Security Act and the US Patriot and CLOUD Acts:
Legal Dimension | Hong Kong 2026 Security Updates | UK National Security Act (2023) | US Patriot Act & CLOUD Act |
Mandatory Phone / Device Decryption | Criminal Offense: Refusal to provide a passcode to police carries up to 1 year in prison. No independent judge is required to issue the specific decryption demand under Article 43 rules. | Judicial Order Required: Police can request a court order for decryption under RIPA, but it requires independent judicial approval and proof of necessity. | Constitutional Protection: The 5th Amendment generally protects suspects from being forced to reveal passcodes. Warrants require strict judicial review. |
Retroactive Case Adjustments | Allowed: The Chief Executive can retroactively certify older or ongoing criminal cases as national security matters, altering bail and early-release rules. | Prohibited: Changes to criminal procedures and sentencing frameworks generally cannot be applied retroactively to past acts. | Strictly Forbidden: The US Constitution explicitly bans ex post facto(retroactive) criminal laws or procedural penalties. |
Executive Powers vs. Courts | Absolute Deference: Executive certificates designating national security matters are legally binding on courts and immune to judicial review. | Judicial Review: Executive decisions can be challenged in the High Court. Judges retain the power to strike down overreaching state actions. | System of Checks: Federal judges can strike down executive actions, invalidate National Security Letters, or throw out illegally obtained evidence. |
Impact on Transiting Foreign Citizens | High Risk: Digital decryption rules apply to anyone inside Hong Kong territory, including passengers merely transiting Hong Kong International Airport. | Limited Focus: Investigative powers target individuals suspected of active foreign interference or espionage tied directly to the UK. | Border Limits: Border agents can search physical devices, but compelling access to cloud data stored outside the US is strictly limited and litigated. |
Asset Freezing Restrictions | Indefinite: Property freezing notices no longer have a strict two-year cap and remain valid automatically until all legal cases conclude. | Time-Limited / Reviewed: Asset freezing requires a court order and is subject to strict, time-bound judicial renewals and appeals. | Judicial Oversight: Asset seizures under national security laws require federal court warrants and are subject to civil forfeiture challenges. |
To navigate Hong Kong’s updated national security framework, multinational corporations (MNCs) are shifting from basic legal compliance to aggressive technical and structural risk mitigation.
The strategy focuses on a concept known as "Data Zeroization"—ensuring that employees and local offices physically possess no data that could be compromised during a snap investigation or transit.
MNCs are protecting their data through several specific operational guidelines:
1. The "Burner" Device Mandate
• The Policy: Executives and employees traveling to or transiting through Hong Kong are issued clean, temporary laptops and smartphones.
• The Execution: These devices contain no local data, corporate networks, or cached passwords. Upon leaving Hong Kong, the devices are completely wiped and factory reset. Personal or standard corporate devices are strictly banned from entering the territory.
2. Network Segmentation and "Geofencing"
• The Policy: Restricting Hong Kong offices from accessing global corporate data centers.
• The Execution: Companies are cutting direct network connections between Hong Kong branches and overseas headquarters. Hong Kong operations are siloed into localized, independent networks. If a local device is seized or ordered to be decrypted, it cannot be used as a gateway to access data stored in the US, Europe, or other regions. [1]
3. Ephemeral Communication and Cloud-Only Access
• The Policy: Banning the local storage of documents, emails, and chat histories on physical hard drives in Hong Kong.
• The Execution: Employees must use cloud-based virtual desktop infrastructures (VDI) where data is processed entirely in RAM and hosted on servers outside Hong Kong (e.g., Singapore or Tokyo). Once the session is closed, no data remains on the physical computer. Inter-office messaging is restricted to platforms with automated, short-term disappearing messages.
4. "Split-Key" and Zero-Knowledge Encryption
• The Policy: Structuring encryption keys so that local employees physically cannot comply with decryption demands because they do not hold the keys. [2]
• The Execution: MNCs implement zero-knowledge architecture where encryption keys are managed and held exclusively by corporate security teams located overseas. If Hong Kong authorities demand a passcode under the 2026 rules, the local employee can legally and truthfully state that they do not possess the master key or the technical means to decrypt the global system. [3, 4]
5. Legal Counter-Mapping and Conflict of Laws Protocols
• The Policy: Giving local teams clear protocols when local national security demands conflict with home-country data laws (like the EU's GDPR). [5]
• The Execution: Legal departments provide local managers with "silent alert" protocols to immediately notify overseas general counsel the moment a data request is made. Corporate guidelines increasingly instruct entities to route sensitive data processing entirely out of Hong Kong legal entities to reduce the exposure of local directors to personal criminal liability.
[4] https://x.com
The legal debate over Hong Kong’s March and June 2026 updates centers on a fundamental clash of legal philosophies. International legal bodies—including United Nations special rapporteurs, international bar associations, and human rights watchdogs—argue that these changes violate core principles of international law. [1, 2]
Conversely, the Hong Kong SAR Government and mainland legal scholars maintain that the updates are perfectly valid exercises of sovereign authority that align with common law orthodoxy. [3]
The core legal arguments from international law bodies focus on five distinct pillars:
1. Violation of the Right Against Self-Incrimination [4]
• International Argument: International bodies cite Article 14(3)(g) of the International Covenant on Civil and Political Rights (ICCPR)—which legally binds Hong Kong under its Basic Law. They argue that criminalizing the refusal to hand over phone and laptop passcodes (L.N. 27 of 2026) forces individuals to actively assist in their own prosecution under duress, destroying the foundational right to remain silent. [5, 6]
• HK Government Counterargument: The Security Bureau states that the rule features clear stipulations regarding intent, mental elements, and defenses. They argue it is a necessary, proportionate measure modeled after regular common law obstruction and investigation statutes to prevent the destruction of digital evidence. [7, 8, 9]
2. Breaching the Prohibition on Retroactive Law [10]
• International Argument: The Safeguarding National Security (Procedural Matters) Regulation enacted in June 2026 allows older, pre-2020 cases to be reclassified and subjected to harsher security procedures. International jurists argue this violates the absolute international legal norm of non-retroactivity (Article 15 of the ICCPR), which dictates that criminal procedures and penalties cannot be altered to a defendant’s detriment after an act has occurred. [11, 12]
• HK Government Counterargument: Government legal advisers argue that the reclassification mechanism does not invent "new criminal offenses" retroactively. Instead, it merely clarifies the existing "procedural roadmap" and "legislative intent" for handling acts that already endangered national security, adding structural certainty for the courts. [8, 11, 13]
3. Eradication of "Equality of Arms" and Judicial Independence
• International Argument: By giving the Chief Executive the unilateral, binding power to issue certificates classifying any criminal act as a national security case, the executive branch effectively dictates the rules of the trial. International bar associations argue this violates the "equality of arms" principle (a fair trial where defense and prosecution are equal) because the judiciary is stripped of its constitutional power to independently review or overturn the executive's classification. [3, 13, 14, 15]
• HK Government Counterargument: Scholars writing for state media state that the executive certificate mechanism falls in line with common law traditions. They assert that executive branches worldwide hold the ultimate authority to determine what constitutes a threat to state sovereignty, and courts must defer to the executive on matters of national defense. [3, 16, 17]
4. Failure of the "Legal Certainty" Principle [18]
• International Argument: International legal watchdogs argue the June 2026 update relies on a dangerously vague umbrella definition: "other offenses endangering national security under the law of the HKSAR." Under international law, statutes must be precise so a citizen can reasonably foresee if an action is illegal. Leaving "other offenses" open-ended gives the executive arbitrary power to weaponize ordinary criminal law. [11, 13, 19]
• HK Government Counterargument: The Department of Justice maintains that the updates provide more certainty, not less, by codifying exactly how domestic laws interact with the Beijing-imposed National Security Law. They claim it creates a seamless, holistic legal fabric that protects law-abiding organizations. [3, 11, 13, 20]
5. Overreach of Territorial Sovereignty [21]
• International Argument: Foreign legal entities challenge the application of these digital search and seizure updates to international travelers merely transiting through Hong Kong International Airport. They argue that enforcing domestic security laws against foreign nationals for data created outside Hong Kong territory violates standard international laws regarding state jurisdiction and territorial boundaries. [1, 6]
• HK Government Counterargument: The government asserts that under the principle of territorial sovereignty, Hong Kong has absolute legal jurisdiction over any individual physically located within its borders—including its transit zones—to prevent external forces from utilizing the city as a transit hub for national security breaches. [22, 23, 24]
[6] https://x.com
[12] https://www.scmp.com
Hong Kong courts have integrated the newly introduced 2026 rules by applying strict legal deference to the executive branch, adhering to a philosophy of "purposive interpretation" to blend Beijing’s security mandates into the city’s existing common law architecture. [1, 2]
Because the March and June 2026 updates are so recent, the judiciary's handling of the first wave of enforcement reflects absolute compliance with the administrative mechanisms built into the legislation, consistently rejecting constitutional pushback from defense lawyers. [3, 4]
Local courts are executing and responding to these updates across several key fronts:
1. Rejection of Retroactivity Challenges [5]
• The Judicial Stance: Following the gazetting of the Safeguarding National Security (Procedural Matters) Regulation, defense lawyers attempted to argue that retroactively moving pre-2020 or ongoing ordinary criminal trials under the national security umbrella violates the Basic Law protection against retroactive penalties. [4, 6, 7, 8]
• The Court Response: Judges have dismissed these arguments out of hand. The courts have accepted the government's stance that the regulation does not create "new crimes" or change the elements of an offense. Instead, magistrates view it as a strict "procedural adjustment." Consequently, once the Chief Executive issues a certificate, judges have immediately revoked standard bail, cancelled early-release remissions, and reassigned cases to designated national security judges. [4, 8, 9, 10, 11]
2. Complete Judicial Deference to Executive Certificates [12]
• The Judicial Stance: Under the new framework, the Chief Executive can issue a binding certificate declaring any act or trial a national security matter, stripping the judiciary of its independent vetting role for that specific determination. [13, 14]
• The Court Response: Hong Kong courts have formally ruled that they lack the constitutional jurisdiction to look behind or review these executive certificates. Aligning with broader common law principles of state secrecy, judges have stated that the executive branch is inherently in a better position than a court to assess threats to the state. Once a certificate is submitted to the bench, the court's role becomes purely administrative—it enforces the restrictions without examining the underlying government evidence. [13]
3. Rapid Enforcement of the "Gatekeeper" Role in Digital Searches
• The Judicial Stance: The government heavily promoted the idea that the March 2026 Article 43 updates featured a "judicial gatekeeping role" regarding device decryption. [15, 16, 17]
• The Court Response: In practice, this "gatekeeping" has translated into courts rapidly issuing broad electronic search warrants based on police assertions of "reasonable suspicion". Magistrates have routinely authorized police demands for device passwords and encryption keys. The courts have treated the failure to provide a passcode not as a triable constitutional debate over self-incrimination, but as an open-and-shut evidentiary roadblock, clearing the path for immediate separate criminal charges under the new rules. [17, 18, 19, 20, 21]
4. Enforcement of Indefinite Asset Freezing
• The Judicial Stance: Previously, defense attorneys could challenge prolonged asset freezes by citing the traditional two-year statutory cap on property restraint notices.
• The Court Response: Judges have swiftly adapted to the March 2026 changes, which removed the two-year ceiling. Courts are now systematically upholding long-term, indefinite property freezing orders issued by the Secretary for Security. The bench has consistently ruled that freezing orders will remain valid by default until all legal actions and potential appeals are exhausted, shutting down defense applications to unfreeze funds for operational or corporate maintenance. [22]
[3] https://x.com
Comments