Relevant reporting:

Hong Kong security law: Police handed power to do warrantless searches, freeze assets, intercept comms, control internet

https://hongkongfp.com/2020/07/06/breaking-hong-kong-securit...

Note that more details are just being released (and hence newer interpretation of the law, or at least part of it):

“On Monday night, the government gazetted the details of Article 43 of the controverisal legislation”.

Grim. Is infrastructure capable of enforcing internet restrictions to any useful degree already in place?

China will probably keep it mostly kosher on the surface level. But no doubt will be wide open in the background for surveillance. Assuming it wasn't already mostly accessible to them.

I'd be surprised if anything like the firewall happens. More likely to be quiet intimidation or disappearances of people posting stuff online.

Don't forget, however, that for the exact same excuse, the NSA approached american companies who complied with voluntary backdoors for years, until someone betrayed and exiled to Russia.

Not saying both are right, just that this is done from New Zealand to Finland, and it's not very easy to understand why we in Hong Kong are suddenly oppressed by that.

Because the possibility that you are disappeared for your online activities is likely much much higher in HK now than it has ever been in those other countries.

"Google, Facebook and Twitter Suspend Review of Hong Kong Requests for User Data"

https://www.wsj.com/articles/whatsapp-to-suspend-processing-...

it's behind a paywall

GCP and AWS both have regions in Hong Kong. If anyone was storing data for serving it to any place outside, I guess this might be a good time to shift it to some neighbouring region.

Additionally many western companies have their offices in Hong Kong. Does this mean any privileged access that these offices/employees had with data is also now susceptible.

The National Security Law is extraterritorial. Hosting outside of Hong Kong means nothing.

https://twitter.com/alvinllum/status/1280184488857710592

Hosting outside of Hong Kong is important. Hong Kong can't impound the servers if they're outside the territory, without the cooperation of the server owner/operator or the government where it resides.

Of course, if the owner/operator has employees or assets in Hong Kong, those could be held to elicit cooperation.

It matters a bit, but not that much. Failure to comply comes with a maximum fine of HK$100,000 (US$ 12,500), plus six months imprisonment for service providers. [0]

If HK police repeatedly fine a company, the company may have to stop serving HK or even China.

[0] https://news.rthk.hk/rthk/en/component/k2/1536151-20200706.h...

I think Canada suspended their extradition treaty to protect against this threat.

Companies still serving to HK might be screwed anyway.

I was saying that wrt companies who had infra in HK which was serving traffic outside HK. It might make sense to not keep that in HK anymore.

Apple operates its services inside the great firewall, where the CCP has complete access to its servers. The Hong Kong change is therefore relatively minor for Apple.

_for Chinese users _, is an important distinction.

My worry is that the definition of "Chinese users" will be expanded. Right now the assumption is that it's for Chinese citizens, but of course, anyone who registered an account while in China is also thrown in that pile. I have to wonder if this will someday include Chinese citizens who've been living abroad and created accounts while outside of China, people with former Chinese citizenship who've taken another country's citizenship, their children, and so on.

Wechat's surveillance is pushing the idea of what should be monitored by China. It's a real possibility that this will expand into foreign companies with operations in China.

> people with former Chinese citizenship who've taken another country's citizenship, their children, and so on.

How the CPP doesn't accept peopel giving up Chinese citizenship and how it affects children of affected people is a known problem.

That seems like a valid worry, however, it would be cause for such enormous outrage that I think it’s a route Beijing will never take. Tiktok is a good microcosm of this, it’s already stirring outrage and it’s not even monitoring more than any other surveillanceware (Facebook, Instagram, etc).

China trying to exert its pressures on Chinese citizens abroad has already been happening to not that much outrage in Australia[1] and the United States.[2]

[1] https://www.abc.net.au/news/2019-03-31/chinese-government-ac... [2]https://www.privateinternetaccess.com/blog/university-of-min...

I don't know if this distinction is that important. If someone from the US imessages or emails someone holding an Apple account in China, then their data will also be revealed.

That’s not true — my iCloud data is not transferred to China because I email a Chinese iCloud user. That message will be revealed, but that is very different from “their data will also be revealed.”

Chinese users are no less users than other users, and speaks volumes about the companies cooperating with the CCP.

So... punish the Chinese people for having an oppressive government by not providing them with the top of the line? It seems more unjust to me. There is no good choice here, only bad and worse — I think Apples presence in China is the lesser of two evils. Same with Google etc.

Since HK now = China, I'd imagine that the security laws will be similar; ie, all your data now belongs to us (CCP)

Some of the new HK laws are worse then the counterpart in China. (Through practically in long term it might not matter that much as law enforcement/interpretation are another matter altogether).

Actually the law force any company in the world to comply with it regardless of whether or not its in HK or not. So if you say something in the US critical of china then go to HK you'd still be in trouble

So I’m assuming everybody who was defending the GDPR nonsense about the law applying to every company worldwide is rethinking that now?

also if they stopped[1] sharing it indicates that they did so until now (including during the protests):

> And another one. Twitter just confirmed that it stopped all data and info requests from Hong Kong authorities as soon as Hong Kong’s national security law went into effect. That leaves Apple and Google...

What were they handing over last year when many protesters were relying on Facebook products for secure messaging?

[1] https://www.nytimes.com/2020/07/06/technology/tiktok-google-...

There are valid data sharing requests, like e.g. in a murder investigation or similar.

Sure, one problem is weather or not the investigation is just made up to get data for an less lawful investigation.

It could be true, because that's just the nature of an autocratic state. Former Soviet Russia and Nazi Germany also suspected their citizens conspiring against them. Which is why they need to tap phones and surveil internet.

Is this not by default true of any company operating in China that has sufficient size to be deemed a state-asset?

could that law conflict with GDPR under any circumstance? If they can ask for user data about someone in the EU, I guess yes.