Even If You’re Just Transiting Hong Kong, Refusing To Unlock Your Devices Is Now A Crime

Key Takeaways

• Refusing device access now criminal in Hong Kong.
• Applies to arrivals and transiting passengers, including US citizens.
• Police may seize and retain personal electronics.
• US State Department issued travel warning for Hong Kong.
• Compliance risks rise for international business travelers.

Summary

Hong Kong has amended its National Security Law, making it a criminal offense to refuse police access to passwords or decryption assistance for any personal electronic device. The rule applies to all individuals, including U.S. citizens, whether arriving or merely transiting through Hong Kong International Airport. The Hong Kong government also gains broader authority to seize and retain devices. In response, the U.S. Department of State issued a travel warning urging caution for travelers, especially those on Cathay Pacific flights.

Pulse Analysis

The latest amendment to Hong Kong’s National Security Law expands police powers to compel password disclosure and to confiscate personal electronics. Previously, authorities could request device access, but refusal carried no criminal penalty. Now, any traveler—whether landing or simply passing through the airport—faces potential prosecution for non‑compliance. This shift reflects Beijing’s broader strategy to tighten control over digital information flows and to deter dissent, extending the law’s reach beyond residents to the global community that passes through the city’s transport hubs.

For business travelers, the new rule introduces a tangible risk that can affect itinerary planning, corporate expense policies, and data‑security protocols. The U.S. State Department’s warning underscores the diplomatic friction such measures generate, especially given parallel debates over device searches at U.S. borders. Penalties for non‑cooperation could include fines or imprisonment, prompting companies to reassess travel routes, provide legal briefings, and consider device‑free travel kits. Airlines like Cathay Pacific may also need to advise passengers on compliance, potentially influencing ticket sales to Hong Kong.

The broader implication is a heightened emphasis on encryption and data‑handling strategies for multinational firms. Organizations must ensure that sensitive corporate information is not stored on devices that could be seized, and they may need to adopt remote‑wipe capabilities or zero‑knowledge cloud solutions. The development also signals a trend where jurisdictions leverage national security statutes to enforce digital access, prompting legal teams to monitor similar moves worldwide. Travelers and corporations alike should stay informed, weigh alternative hubs, and prepare contingency plans to mitigate the operational and legal fallout of such aggressive surveillance policies.