With hacks and cameras, Beijing’s electronic dragnet closes on Hong Kong
By Paul Mozur
To get onto his Facebook account, police used Tony Chung’s body.
When officers swarmed him at a Hong Kong shopping mall last month, they pulled him into a stairwell and pinned his head in front of his phone — an attempt to trigger the facial recognition system. Later, at his home, officers forced his finger onto a separate phone. Then they demanded passwords.
“They said, ‘Do you know with the national security law, we have all the rights to unlock your phones and get your passwords?’” Chung recalled.
Emboldened by that new law, Hong Kong security forces are turning to harsher tactics as they close a digital dragnet on activists, pro-democracy politicians and media leaders. Their approaches — which in the past month have included installing a camera outside the home of a prominent politician and breaking into the Facebook account of another — bear marked similarities to those long used by the fearsome domestic security forces in mainland China.
Not accustomed to such pressures, Hong Kong lawmakers and activists, and the U.S. companies that own the most popular internet services there, have struggled to respond. Pro-democracy politicians have issued instructions to supporters on how to secure digital devices. Many have flocked to encrypted chat apps like Signal and changed their names on social media.
Dogged by the global reach of the law, even people from Hong Kong living far away from the city worry. One Facebook discussion group of Hong Kongers living in Australia closed off public access after a user claimed to have reported discussions to Hong Kong authorities for potentially violating the law.
Major internet companies like Facebook and Twitter have temporarily cut off data sharing with local police. Others have gone further, devising more permanent solutions. In July, Yahoo changed its terms of service so that users in Hong Kong are protected under U.S. law, not local rules. It also cut access for employees in Hong Kong to user data to protect them from the law, according to two people familiar with the matter.
A Google spokeswoman said in a statement that the company had not produced data for Hong Kong authorities since the national security law was enacted, and that authorities could seek information for criminal investigations through U.S. diplomatic channels. That means the company is effectively treating data requests in the city the way it does those from mainland China.
Long known as a financial hub, Hong Kong is now emerging as a land of internet fault lines, a place where China’s harsh techno-authoritarian rule collides with the open internet in a society and economy governed by rules that protect digital rights.
“With China’s rising influence and power, it’s not safe for technology companies to put their servers in China or Hong Kong now,” said a prominent activist, Joshua Wong. “It’s important for them to help support Hong Kong’s citizens and society with digital security.”
The first coordinated sting under the new security law made Chung an example of an offense new to Hong Kong but common in mainland China: an internet crime. Police accused him of writing a post calling for Hong Kong independence on the Facebook page of a newly formed political party and demanded he delete it. He denied writing it.
Enforcing internet laws meant gathering digital evidence, and police pushed hard to gain access to Chung’s accounts. Though less than fully prepared for the arrest, Chung said, he was able to foil officers at each turn. In the stairwell when police forced his head in front of his phone, he closed his eyes and scrunched his face, rendering useless his iPhone’s facial recognition software. He had long since disabled the fingerprint unlock on his other phone. For passwords, he told police that he had forgotten them.
Even so, a few hours after he was detained, his friends noticed that his Facebook account was active, appearing as if he were online and using it. Chung believes that the security forces broke in, although he said he was not sure how. When he was released and tried to sign back in, Facebook had frozen his account over a suspicious login.
Hong Kong police declined to comment on recent tactics and cases. A Facebook spokeswoman declined to comment. A spokeswoman for Verizon Media, which owns Yahoo, said it was “assessing potential impacts” of the law on its operations in Hong Kong.
Other police tactics have been more subtle and more challenging to address.
Hours after media mogul Jimmy Lai was arrested, an employee at his company, Next Digital, received a message from someone posing as a part of tech support. Using the names of his employees, the message asked for login details to Lai’s Twitter account in order to set up a new iPhone for Lai.
Schooled from years of cyberattacks, the recipient of the message flagged it as suspicious. Mark Simon, an executive at Next Digital, said the company believed it was an attempt by Hong Kong police to get the login information for Lai’s account. The tactic has added to a new level of paranoia that has made day-to-day operations more difficult, according to Simon.
“The problem is this slows everything down, because now everyone is double checking: ‘Did you send this message? Did you send that?’ It never stops; it just never, ever stops,” he said.