Protesters staged a sit-in outside government headquarters on September 27 at Admiralty, demanding CY Leung, chief executive of Hong Kong, to meet them to have a dialogue. Photo by P H Yang. Copyright Demotix

At the height of Hong Kong's Occupy Central movement in the final months of 2014, many activists and demonstrators suspected that police were recording their mobile instant message communications.

Although Hong Kong requires police to obtain court approval before monitoring a person's phone communications, these messages may have been surveilled with no official oversight of any kind.

Under Hong Kong's 2006 Interception of Communications and Surveillance Ordinance (ICSO), police must prove to a judge that interception or surveillance are necessary to preventing or detecting serious crimes or protecting public security. And they must prove reasonable suspicion on the target. The Commissioner on Interception of Communication and Surveillance is responsible for supervising wiretap and other forms of communications interception and monitoring, a position established to ensure that law enforcement authorities complied with the law. The Commissioner is required to release an annual report informing the public of its activities.

When the 2013 Commissioner's report on Interception and Surveillance was released in early December 2014, surveillance chief Darryl Gordon Saw refused to comment on whether messages sent on WhatsApp and other Internet-based mobile applications could be intercepted under the policy. A senior police officer told the local press that online messaging applications are not covered by the ICSO. This has left many local advocates concerned that police surveillance of these private communication tools has not been overseen by any authority at all.

Since its enactment, the ICSO has been criticized by pro-democratic law makers who say the law gives enforcement units too much power. A former Surveillance Commissioner and high court judge Woo Kwok-hing openly criticized the ICSO of being full of loopholes and argued that the Commissioner does not have the teeth to oversee its implementation. It was against this background that the government finally decided to amend the law in 2013.

Several civic groups have spoken out to address the potential abuse of police power in the monitoring of internet based communications. Hong Kong's In-Media urged the government and Legislative Council member to restrict the power and improve accountability on surveillance practice. It demanded that the ICSO be amended to:

• Cover all forms of interpersonal communication, including the Internet-based email and messaging services and to ensure that law enforcement units are fully compliant with legal procedures for their interception activities
• Provide a clearer definition of “violence” to ensure that law enforcement would not undertake surveillance operations targeting protest organizers, leaders of civic groups, or political dissidents on grounds of public security
• Add a provision to prevent the monitoring of protected journalistic materials
• Establish penalties for non-compliance

Note: Hong Kong In-Media, a media freedom organization, it funds the operation of inmediahk.net, the author of this post.

According to the Security Bureau, the ICSO only covers law enforcement requests for online communications content — in other words, the actual text, images and other content sent in a message. Requests for user metadata — such as the time, date, and user identity — and other evidence from Internet service providers are not restricted by the ICSO. Since 2010, law enforcement on average sent more than 4,000 user data requests to local ISPs, mostly without a court order.

Legislative Council member Charles Mok also addressed the potential loopholes in the implementation of the ordinance:

執法機構以機密為由，拒絕向立法會提供截取通訊器材的清單，外間無法得知亦無從監察香港政府監控網絡通訊至何等程度。除了通訊內容外，用戶資料或元資料(Metadata)如通話紀錄、IP位置等不屬通訊內容的資料，能夠幫助分析被監控人士的人際網絡、行踨和生活習慣。這些資料也可能被警方在不受條例規管之下，向互聯網服務供應商大量索取。

Recently, law enforcement refused to provide the list of technology devices used to assist official interception and surveillance activities, claiming that such information is confidential. This prevents the public from monitoring the extent of the government surveillance activities. Moreover, apart from intercepting communication contents, user data, metadata such as communication records, and IP data are not defined as “communications content”. Yet such information can be used to analyze a target's social network, and to track his/her footprints and habits. Police can ask the Internet service providers (ISPs) for this data with no restriction from the ICSO.

Keyboard Frontline, a civic group on web freedom, urged that the ICSO should also restrict law enforcement collection of metadata, inform the target post-facto, and increase the supervision powers of the Surveillance commissioner.

Nevertheless, the constructive opinions put forward by pro-democracy law makers and civic groups are interpreted as “anti-government” by pro-establishment politicians. In a public hearing at the Legislative Council attended by a number of civic groups including Hong Kong Human Rights Watch, Hong Kong Journalist Association, Civic Right Observer, Labour Party and Hong Kong In-Media on May 2, Ng Leung-sing, a lawmaker representing the finance sector rebuked the critiques of civic groups:

它們都是反對政府施政，質疑為何條例會觸動這些團體，社會上其餘大量「為社會謀福祉」的團體則不用擔心，是「平生不作虧心事，夜半敲門也不驚」，關注人士是因為做不好的事怕踩中地雷。

They [the representatives of the civic groups] just want to obstruct the government's administration. Why should these groups care about the ordinance while the majority of groups that care about “social welfare” are not worried? The explanation is [answered by a Chinese saying]: “be an upright person and you will be fearless of the knocks late at night.” The reason why they care is because they are doing bad things and are worried that they will be punished for it.