Hong Kong law compels travelers to surrender device passwords at the border

Hong Kong authorities revised enforcement rules under the National Security Law on March 23, 2026, granting police the power to demand passwords and decryption assistance for phones, laptops, and other personal electronics. The rules apply broadly, including to travelers merely transiting through the airport, and refusal to comply is now itself a criminal offense.

A U.S. Consulate General security alert flagged the change on March 26, noting that police can also seize and indefinitely retain devices they assert are linked to national security offenses. The framework effectively eliminates the practical value of device-level encryption at the border for anyone within Hong Kong jurisdiction, since the legal compulsion bypasses the cryptography entirely.

For anyone carrying sensitive data through Hong Kong — journalists, researchers, business travelers, or dissidents — the operational implication is that any data physically present on a device can be reached on demand. Mitigations shift from encryption-at-rest to data minimization: travel with clean devices, keep sensitive material remote behind authentication that cannot be coerced on the spot, and assume seized hardware will not return.