Hong Kong Police Can Now Demand Phone Passwords Under New Security Rules
114 points
3 hours ago
| 15 comments
| gadgetreview.com
| HN
anonymousiam
1 minute ago
[-]
I wonder what would happen if HK tried to force somebody to unlock their business phone. It's typically a violation of corporate policy to allow a third party to access the encrypted, confidential information on corporate mobile devices.

The poor device user would be faced with a choice of losing their job and being held criminally liable for breaching their company's systems, or going to jail in Hong Kong.

reply
tyho
2 hours ago
[-]
Wow, what a free society! In the UK if you refuse to unlock your device you can be imprisoned indefinitely! In HK it's just one year!
reply
whatsupdog
45 minutes ago
[-]
In UK you can be imprisoned for liking a post on Facebook that is considered "hate speech".
reply
andylynch
2 hours ago
[-]
Why are you misrepresenting about UK law?

Yes, it can be a criminal offence. But the maximum tariff for this under RIPA 2000 is five years. If it’s not about nation security or CSAM, it’s two.

(Incidentally, the USA is a real outlier in this topic)

reply
cortic
7 minutes ago
[-]
Its five years with no limitations, so when you are due to be released; Whats your password? Another five years... Its such a poorly worded law you could literally spend your life in prison for forgetting your password. And Its mostly used against peaceful protesters.
reply
roenxi
2 hours ago
[-]
Are we damning the UK with faint praise now?

I'm not even sure how much practical difference there is between 5 and indefinite in practice, 5 years is a long time. I imagine it is pretty life-destroying. Especially for the crime of having something on your phone that you want to keep private.

> If it’s not about nation security or CSAM, it’s two.

I am sure we all get what you mean, but there is a comic interpretation in vaguely-Soviet style here where if someone hasn't done anything wrong they only get 2 years. I'm going to spend some time this weekend making sure my encryption is plausibly deniable where possible.

reply
idiotsecant
2 hours ago
[-]
You're unsure of the difference between 5 and infinity?
reply
deejaaymac
1 hour ago
[-]
5 years in prison can destroy your life easily, so yeah, what's the difference?
reply
watwut
34 minutes ago
[-]
Easily something like 45 years of difference. It is really not necessary to lie, no matter how much you hate UK or Europe.
reply
gib444
2 hours ago
[-]
Oh just 5 years, that's OK then.
reply
pcdevils
2 hours ago
[-]
The police must obtain appropriate permission from a judge to obtain a s.49 RIPA notice.

Before a judge grants the notice, they must be satisfied that:

The key to the protected information is in the possession of the person given notice. Disclosure is necessary in the interest of national security, in preventing or detecting crime or in the interests of the economic wellbeing of the UK. Disclosure is proportionate. If the protected information cannot be obtained by reasonable means.

reply
beambot
2 hours ago
[-]
So you're saying it's still at the discretion of a single magistrate?

I'm sure China could find some judges to rule in the name of national security if it would give everyone warm fuzzies.

Judicial checks and balances only function when they're independent of the executive and parliament

reply
danlitt
1 hour ago
[-]
Not addressing your main point, magistrates and judges are not the same thing. It would be much worse if it were at the discretion of a magistrate.
reply
jonex
2 hours ago
[-]
Feature request: Make it default behavior on phones that you can have multiple passwords, connected to different profiles. With no way to determine how many profiles a phone have.

I'm sure there's some people here working on mobile operating systems, might be worth considering?

reply
hananova
2 hours ago
[-]
"This profile doesn't have anything on it. Give us the password for the real profile."

Or even worse, you did give them the real password, but because your phone supports the feature and your profile is kind of barren, they don't believe you. Now you are in a very bad lose-lose situation.

reply
keiferski
2 hours ago
[-]
With LLMs, it should be easier than ever to fake generate text messages, notes, emails, etc.
reply
Verdex
48 minutes ago
[-]
I suppose that you could have the phone listening in real time and generating profiles that are hidden and embarrassing but not illegal.

So when they ask for the real profile it shows in the next unlock a profile that makes it very clear you have a deeply embarrassing ASMR addiction.

It could cross reference your local laws to ensure to not spill the beans on something locally illegal.

reply
limagnolia
1 hour ago
[-]
You do use your "fake" profile regularly, just for "sanitized" activities. Check in on official sanctioned news sources, do your "legit" banking and financial stuff, etc.
reply
idiotsecant
2 hours ago
[-]
So put stuff on it, duh
reply
hananova
2 hours ago
[-]
"This isn't what we expected to find. Give us the real password."
reply
eqvinox
1 hour ago
[-]
So your approach instead is...?
reply
hydrogen7800
2 hours ago
[-]
reply
dachris
2 hours ago
[-]
Veracrypt e.g. has had this for a long time.

https://en.wikipedia.org/wiki/Plausible_deniability

reply
yakkomajuri
1 hour ago
[-]
As others have pointed out this would likely not save you in this case, but there are some phones which do support this, and I know people in Brazil that use these features in order to be able to comply when getting mugged without giving away access to your bank etc.
reply
joekrill
1 hour ago
[-]
Android has a "Private Space" feature. As far as I can tell it's only a single extra profile you can create, but I think you can keep it "hidden" (at least in as much as you can't tell if it's been created without unlocking it).

https://source.android.com/docs/security/features/private-sp...

reply
hypeatei
2 hours ago
[-]
Software isn't going to save you in this scenario. If you're worried about local laws violating your privacy then buy a burner and only put data on there that's necessary for your travels.
reply
mikhael
1 hour ago
[-]
> Provide fake credentials? Three years behind bars.
reply
jobs_throwaway
1 hour ago
[-]
They would be real credentials, just to a separate profile. Are they going to make multiple profiles illegal?
reply
josefritzishere
56 minutes ago
[-]
Genius.
reply
kevincloudsec
2 hours ago
[-]
I think everyone's glossing over that this extends to anyone who knows the password. Your sysadmin, your business partner, your spouse. Hong Kong just turned your company's entire key management chain into a legal liability.
reply
kleiba
2 hours ago
[-]
It would be nice if phones had a feature where you can define more than one pin, but only one is for your actual phone contents - the other ones leave you to a completely harmless but otherwise indistinguishable looking smartphone interface that contains no or only completely bogus data.
reply
pavel_lishin
2 hours ago
[-]
It would be nice if I didn't get beaten with a hose in a vain attempt to prove that I unlocked the "real" one.
reply
iamnothere
2 hours ago
[-]
If your country has this problem, you’re way past worrying about phones, and you need to be acquiring arms and training.
reply
whatsupdog
44 minutes ago
[-]
It's illegal to have any decently good arms in Canada.
reply
pstuart
1 hour ago
[-]
I maintain that the series "24" back in the day did us all a great disservice by promoting the value of torture to "save the world".

I'm hard pressed to find any reason for any citizen to be compelled to share their secrets with the police because the police had "suspicions".

The 4th and 5th are paramount for a free society.

reply
kleiba
1 hour ago
[-]
> with a hose

You mean wrench? https://xkcd.com/538/

reply
Stefan-H
1 hour ago
[-]
If you've read Applied Cryptography, you'd know it is definitely a hose.
reply
gmerc
2 hours ago
[-]
Almost every chinese android variant has that. On Oppo it’s called clone system
reply
ulfw
2 hours ago
[-]
My Oppo Find N6 allows multiple user accounts
reply
mmsc
2 hours ago
[-]
Ah, finally catching up to ... The UK, Australia, Ireland, France, the Netherlands, and probably a lot more.
reply
vrganj
2 hours ago
[-]
The horrible bastion of despotism that is China-run Hong Kong has now caught up to the rule of law utopias of enlightened thought in the US and UK.
reply
gruez
2 hours ago
[-]
>in the US and UK

???

Of all the issues with the US justice system, being compelled to disclose passwords isn't one of them. It is an issue for UK, though.

reply
some_random
2 hours ago
[-]
Funny how it's a horrible misrepresentation slurring the honor of the United Kingdom to exaggerate the penalty of not unlocking your phone for His Majesty's Law Enforcement, but US border cops being allowed to ask foreigners for the same thing upon pain of not being allowed to enter the country (something that no one seems to care about other nations doing?) is totally the same thing.
reply
quentindanjou
2 hours ago
[-]
> Of all the issues with the US justice system, being compelled to disclose passwords isn't one of them.

This is not totally true. It is also a US issue: CBP has been asking for passwords (or to unlock the device) for phones and computers for more than a year now. Last year, multiple people got turned around because they disagreed with US policies and political views that differ from those of the US's current president.

reply
NoImmatureAdHom
1 hour ago
[-]
You don't have the protections of U.S. law at the border.

CBP is also asking, not compelling. You don't have to give them your password. If you don't, and you're a foreigner, you may be turned away. If you're a citizen, and I remember correctly, they can seize your device for up to two days if they want.

But they're not going to put you in prison for refusing like the U.K. and Hong Kong will.

reply
Scaled
8 minutes ago
[-]
If you're a US citizen, I believe they can seize your device indefinitely, and detain you for up to two days. They are required to let you eventually back into the country though.

(If you're not a citizen, all bets are off)

reply
watwut
28 minutes ago
[-]
You dont have protectiond of US law on the border, inside the border and barely if you are a citizen far away from border. Realistically.

And also actually per law. And yes, being forced to give out passwords and make profiles public as a rputine thing is much worst then being forced to give out password when there is actual warrant.

reply
mothballed
1 hour ago
[-]
CBP has absolutely put me in jail (not prison) for refusing to answer questions (including the strip search and being put in chains and handcuffs). As well as threatening to revoke my passport (though they could not). On another occasion they threatened to deport me even though I'm a US citizen. On yet another, they faked a drug dog hit then dragged me to multiple hospitals, racking up bills in my name while claiming I was packing drugs up my ass. I am still being chased by debt collectors for the last one.

I've contacted multiple lawyers and the answer got was they've tried cases like these before and they always lose so they don't take them anymore. Though this was pre-Trump, now it's suddenly in vogue to take up longshot border or immigration cases.

reply
NoImmatureAdHom
1 hour ago
[-]
That sucks. You were wronged, and I hope you get justice.

In the U.K. or Hong Kong, "justice" would entail prison.

reply
wat10000
1 hour ago
[-]
I don't approve of CBP's approach here, but being denied entry to the country isn't punishment, even if it might feel like it at the time. And that only applies to non-citizens, where entry is fairly reasonably at the government's discretion. Citizens must be admitted regardless.

Rules at the border tend to be pretty restrictive almost everywhere. You can literally get in trouble for having a sandwich in your bag. I'd wager Hong Kong border control was also empowered to request phone passwords and turn away refusers long before this change.

reply
fn-mote
15 minutes ago
[-]
Do you ever travel outside your own country? Do you think you should retain some basic privacy rights while you do that?

It’s not even good for business. Business laptops and phones have trade secrets to conduct regular company activities.

Normalizing the surveillance dystopia we live in ON HN is beyond my understanding.

reply
throwaway290
2 hours ago
[-]
> Last year, multiple people got turned around because they disagreed with US policies and political views

so they were not in US technically?

reply
traceroute66
2 hours ago
[-]
> Of all the issues with the US justice system, being compelled to disclose passwords isn't one of them

Under the present administration I wouldn't be surprised if for example ICE tried the $5 wrench method.

reply
0x3f
2 hours ago
[-]
Depends, you can get NSL'd to disclose passwords. Good luck running that one up to the supreme court. And biometrics aren't as well-protected. Though, yes, in the UK it's a much more routine affair.
reply
ulfw
2 hours ago
[-]
You have never crossed the border into the Great US of A then
reply
ericd
2 hours ago
[-]
It's possible to cross the border many times and not have this happen.
reply
john_strinlai
2 hours ago
[-]
okay, but it is also possible to have it happen.
reply
FpUser
2 hours ago
[-]
The above probably meant a point that current democracies are increasingly sliding into the same hole as authoritarian governments. Amount on encroachment of governments and big corporations on personal freedoms and democracy in "democratic" countries is quickly becoming intolerable under a guise of safety and "save the children" mantras
reply
vrganj
2 hours ago
[-]
I take it you haven't crossed the border recently?
reply
throwaway290
2 hours ago
[-]
in china was never a problem for police to detain you for any reason (or no reason) but HK has a different legal system
reply
everdrive
2 hours ago
[-]
No one likes when I say this but it's really past time to stop doing anything interesting on your phone. Delete all your apps, set it as minimally as possible. Leave it home when you go for walks, and power it off when you go driving or to the store, or whatever.
reply
pavel_lishin
2 hours ago
[-]
For many people, their phone is their primary, if not only, computing and communications device.
reply
everdrive
2 hours ago
[-]
Right, which is why they need to start changing their behavior.
reply
em-bee
1 hour ago
[-]
how? whatsapp, wechat, telegram, even signal, all require a phone to be used.

if i didn't need any of those apps then sure, but unfortunately there is no way around these apps if i want to keep in touch with certain people that are important to me.

reply
iamnothere
1 hour ago
[-]
If you “must” use those then keep a phone off in a drawer and turn it on once a day to keep in touch.

If those people won’t allow you to be offline from time to time and aren’t willing to switch communication methods as an alternative, maybe it’s not a symmetrical relationship.

Or use something like Beeper (works on Linux): https://www.beeper.com/

reply
zie
50 minutes ago
[-]
If you need to use these, set the history retention to like no time. That would help a lot. They could still get the contents from the person you are communicating with, but it would require more work on their part. Humans are generally fairly lazy. If you can get the people you communicate iwth to also turn off message retention, that would help. Then they could tell you talked with Tootie, but not what you talked about, at least from the device(s) themselves.
reply
nhecker
2 hours ago
[-]
I'm starting to believe this is [a] way forward. Or maybe an approach which is on a spectrum between <everything I have is on a phone behind a fingerprint and a four digit pin> and <I don't own a smartphone>.

Unfortunately, it's pretty common to only have a smartphone as your sole compute device, and increasingly onerous not to own one at all.

reply
everdrive
1 hour ago
[-]
>Or maybe an approach which is on a spectrum between >increasingly onerous not to own one at all.

Yes, and I think this unfortunately demands a grey area. I'm starting to treat my smartphone more like a work device, and there are a few things I do on it:

- My work's authenticator app is there.

- Unfortunately Signal is tied to smartphone usage.

- Practically speaking, people will expect to be able to send you text messages.

- It's still useful for taking pictures.

- My banking app is on there.

Outside of rare occasions, that's really all I use my phone for. I don't carry it around the house. If I go somewhere with my wife, I don't even bring my phone most of the time. I'm "required" to have it, but in principle it's not even mine. It shouldn't be trusted or enjoyed.

reply
embedding-shape
2 hours ago
[-]
"Featured" on HN just a week ago, seems GrapheneOS' "Duress pin" would be very helpful in these cases: https://grapheneos.org/features#duress (https://news.ycombinator.com/item?id=47445931).

Now we just have to wait N years for Android and iOS to get approval from the government to build something similar, that they can market yet somehow screw up enough to not actually help.

reply
dev_l1x_be
2 hours ago
[-]
Ohh no, so they caught up with US border patrol?
reply
chirau
50 minutes ago
[-]
What happens if you just say "I don't know it, only answer calls on it."
reply
firefax
1 hour ago
[-]
These kinds of laws worry me since I have forgotten several old passwords. Being disorganized shouldn't be a criminal offense.
reply
3yr-i-frew-up
1 hour ago
[-]
>The US is evil

>China makes you give phone passwords, China makes Apple give user data

>The US wiretaps 1 person

"OMG THIS IS AN OUTRAGE!"

We forget because a Republikan is in charge how good we have it in the west. We forget how bad it is elsewhere.

reply
maplant
1 hour ago
[-]
The cops from the John Woo HK action flicks I've seen would love this
reply
xvector
2 hours ago
[-]
This shit is why I don't visit China.
reply
EGreg
2 hours ago
[-]
This shit is why I build platforms like Safecloud: https://community.safebots.ai/t/safecloud-governance-due-pro...
reply
dmitrygr
2 hours ago
[-]
Wait till you hear about most of europe...
reply
kubb
2 hours ago
[-]
Roleplaying a parallel reallity where "Europe" is an oppressive totalitarian regime will never not be funny.
reply
dmitrygr
2 hours ago
[-]
> Roleplaying a parallel reallity where "Europe" is an oppressive totalitarian regime will never not be funny.

Roleplaying inability to read will never not be funny

UK: https://www.pinsentmasons.com/out-law/news/law-requiring-dis...

France: https://www.fairtrials.org/articles/news/french-court-rules-...

Ireland: https://www.bbc.co.uk/news/world-europe-57468750

reply
kubb
2 hours ago
[-]
UK: Police can search phones to counteract human traffickers.

China: Police can search phones of dissidents, and jail them for life for criticising the Party.

You: Europe is worse than China (or will be really soon I promise).

Disingenuous.

reply
danlitt
1 hour ago
[-]
Nobody claimed Europe was worse than China, only that if you wouldn't visit China for this reason then you shouldn't visit Europe (or the US) for the same reason.

Speaking of being disingenuous, when you say "Police can search phones to counteract human traffickers", did you think critically about that at all before writing it? Given one of the stated justifications is "preventing terrorism", and the UK has been illegally arresting Palestine Action supporters as terrorists for over a year, this seems a little naive at least.

reply
kubb
1 hour ago
[-]
> Nobody claimed Europe was worse than China, only that if you wouldn't visit China for this reason then you shouldn't visit Europe (or the US) for the same reason.

That would be nonsensical. If you have anti-Xi propaganda on your phone (which could be the reasons you mention), you have nothing to fear in Europe or in the US and a lot to fear in China.

The US is actually worse than both China and Europe because it's 18th century amendments protect human traffickers. Although they do what they can to not have to adhere to those, especially in border control.

> What about Palestine Action...

I'll limit myself to the LARP about "oppressive Europe invigilating your phone".

reply
Markoff
23 minutes ago
[-]
Nobody cares about your phone in China, if you are tourist, you are less likely have your phone searched than when visiting US. Nobody is going to ask you for your social media profiles when visiting China, unlike when visiting US. So who is here the free country?

I've spent this summer 3 weeks in China, used 2 VPNs, both of them worked fine (1 cost less than dollar, the other 4-5 dollars), so did my wife, mother and her husband, guess how many times someone cared about checking our phone.

The biggest issue was when we travelled into Beijing province where there are mo strict border checks and police found out we didn't register our accommodation (at wife's family), the scary horrible policemen then locked us for weeks and deport us from country... No, seriously, that would more likely happen in US than in China, in China they just told us to register after the weekend at local police station and let us continue into province to check Great wall, policemen in police station could not care less and be more laid back about it.

Maybe visit some other countries to have actual experiences instead spreading everywhere your feelings about other countries based on some propaganda.

reply
kubb
6 minutes ago
[-]
> if you are tourist

It's not the tourists, it's the local dissidents that have something to fear. Or maybe try going there as a tourist, and putting up anti-party posters.

reply
dmitrygr
28 minutes ago
[-]
Indeed anti-Xi posts are unsafe in China, and safe in UK. Equally, anti-UK posts are safe in China and not so in the UK... (eg https://www.congress.gov/119/meeting/house/118565/documents/...). The naïveté in the claim that these are significantly different reminded me of an old joke from the USSR:

American: In America, we have freedom of speech.

USSRian: What's that?

American: I can stand in front of the White House and yell "Reagan is a moron!" and nothing will happen to me.

USSRian: Well, we have that in USSR too.

American: Really?

USSRian: Yes, of course! I go stand in the center of the Red Square and yell "Reagan is a moron" and nothing will happen to me.

reply
netsharc
2 hours ago
[-]
How about the US? What I'm going to write smells of "whataboutism", but it's tragic how more and more of the world is becoming police states. Going to the USA, they want your social media accounts. Regardless of that, the border thugs can probably demand you unlock your devices or they'll detain you for weeks on end, without any repercussions, because that sort of lawlessness is government policy now.
reply
dmitrygr
2 hours ago
[-]
In the US, not disclosing a password is explicitly protected (5th amndmnt), SCOTUS has been clear. not so for biometrics, but so for PIN/passwd
reply
eqvinox
1 hour ago
[-]
> In the US, not disclosing a password is explicitly protected (5th amndmnt),

That's great but of exactly zero help if you're trying to travel to the US and CBP (or ICE) are staring you down. Even if they don't gulag you, they can always just reject entry for any non-citizen (and these days even some citizens it seems.)

reply
dmitrygr
30 minutes ago
[-]
Any country can reject non-citizen entry, for any reason or no reason at all. In fact, part of a definition of a country is ability to practice control over its territory and who is and is not there. This necessarily includes border controls, which any country can decide to make as onerous as they please. No non-citizen of a country has any right to be present in it, except as permitted by its government, so any country if free to make it as hard as they wish to enter for non-citizens. This may not be a good idea, but control over a territory is literally part of the definition.
reply
garciansmith
2 hours ago
[-]
They have? What was the relevant case? It was my understanding that some lower courts have ruled one way, others the opposite. There are also many nuances in particular cases (e.g., the police wanting a broad search of a device for something that may or may not be there versus them knowing for a fact a device has certain information they want).
reply
danlitt
1 hour ago
[-]
The 5th amendment only protects citizens, and we are only talking about visiting (as far as I can tell).
reply
netsharc
2 hours ago
[-]
Ah yes, the US government still respects the 5th amendment... like they respect the other amendments as well as the constitution.

The constitution doesn't say shooting citizens is illegal, right?

reply
plagiarist
1 hour ago
[-]
Federal agents couldn't possibly have been aware that executing people on the streets is a violation of those people's rights, so they are covered by QI.
reply
comboy
2 hours ago
[-]
Haha, here's some random AI generated content:

    At least 225 judges have ruled in more than 700 cases that the administration's mandatory immigration detention policy likely violates the right to due process[1] The Fifth Amendment's Due Process Clause generally requires those having federal funds cut off to receive notice and an opportunity for a hearing, which was not provided in many of DOGE's spending freezes[2]
(there's more but what's the point)

1. https://www.justsecurity.org/107087/tracker-litigation-legal...

2. https://www.cbpp.org/research/federal-budget/many-trump-admi...

reply