Million Mask March in Hong Kong, 2014. Demotix/Gonzales Photo. All Rights Reserved.Hong Kong’s top security official has finally clarified the legal procedure governing law enforcement’s requests for user information from Internet service providers. Unsurprisingly, there is no legal procedure. We can’t help but ask: is our metadata non-sensitive enough to justify government agencies’ access without any judicial review or oversight?
During a Legislative Council meeting in late April, Lai Tung-kwok, the Secretary for Security, said that law enforcement agencies may request necessary user information (such as account names, IP addresses and log records) from service providers for locating witnesses, evidence or suspects when investigating crime cases. Warrants are only required for seizure of communications content and documents, and no warrants are required for requests for metadata. That means there is no judicial scrutiny of the 23,946 user information requests the Hong Kong Police Force and the Customs and Excise Department have issued over the past five years.
The lack of judicial oversight is particularly worrying given the fact that since last June, at least nine social activists have been arrested for radical comments on social media platforms, according to a database maintained by Hong Kong Transparency Report, an independent research project at the Journalism and Media Studies Centre, University of Hong Kong. The police obtained the activists’ IP addresses and managed to track their physical locations without any judicial scrutiny.
