Emboldened by Hong Kong's new security law, police are targeting the social media accounts of media executives, pro-democracy politicians, and activists
Under a new national security law, the police are targeting the social media accounts of executives, politicians and activists. Tweets: @paulmozur , @paulmozur , @paulmozur , @paulmozur , @paulmozur , and @paulmozur See also Mediagazer Tweets: @paulmozur : Finally there's Jimmy Lai. After he was arrested a message came into Next Digital using the right names of employees asking for Twitter logins to set up a new phone for him. They believe it was a phishing attempt by police to get into his account. @paulmozur : “The problem is this slows everything down, because now everyone is double checking: ‘Did you send this message? Did you send that?’ It never stops; it just never, ever stops,” said Mark Simon after Mr. Lai's arrest. @paulmozur : With the Nat Sec law biting, we're seeing more extreme tactics. Police pinned Tony Chung's head in front of his phone to trigger the facial rec. Then they held his finger to the phone's fingerprint scanner. Even tho neither worked, they seemed to break into his FB account later. @paulmozur : We all think of HK as a global financial hub, but it's also becoming something else: a land of internet fault lines, where China's harsh techno-authoritarian rule collides with the open internet in a society and economy governed by rules that protect digital rights. @paulmozur : Agnes Chow's neighbors said a surveillance camera was set up by her doorstep. She shows how people are adjusting. She appointed a 2nd admin to her FB account, who worked with FB to shut it down after she was arrested. Here's her video tutorial to cybersec: https://www.youtube.com/... @paulmozur : A mainland China style digital dragnet is descending on Hong Kong. In the past month HK police have broken into the Facebook account of one politician, hung a camera outside another's house, and tried to phish the login details to Jimmy Lai's Twitter. https://www.nytimes.com/... See also Mediagazer
Context & Ripple Effects
The arc here runs in one direction: after the security law passed on June 30, users began altering digital footprints and deleting posts, analysts warned police would no longer need court orders to compel ISPs, and Facebook, Telegram, Google, and Twitter suspended Hong Kong data requests. With the legal channel to platform data closed, police are now going after the accounts themselves.
The new reporting shows what that looks like in practice: a suspected phishing message to Next Digital asking for Jimmy Lai's Twitter logins after his arrest, reported break-ins of Tony Chung's and a politician's Facebook accounts, and Agnes Chow responding by adding a second admin and working with Facebook to shut her account down. The battleground has moved from courtrooms to login screens.
First-order effects
- Named targets must harden their own account security in real time: Agnes Chow appointed a second Facebook admin and had the account shut down, while Next Digital staff now double-check every credential request after the suspected phishing attempt on Jimmy Lai's Twitter.
- Because US platforms have suspended data requests, police bypass them entirely — suspected phishing of Next Digital employees and reported Facebook break-ins show account compromise replacing formal data access.
Second-order effects
- Account recovery and identity verification become the contested surface: platforms' refusal to hand over data shifts pressure onto employees, devices, and biometrics — Tony Chung's reported facial-recognition and fingerprint attempts both failed before his Facebook was breached.
- The post-law self-censorship wave accelerates: if accounts can be broken into, deleting posts no longer protects users, pushing more activists toward account shutdowns and platform exits.
Third-order effects
- If platforms stay out, Hong Kong's surveillance regime migrates toward endpoint compromise and social engineering — the same pattern the 2018 mainland WhatsApp prosecution showed — making account hygiene, not platform policy, the last line of defense for dissidents.
The trend: As US platforms refuse Hong Kong police data requests, law enforcement is shifting from legal process to direct account compromise, moving surveillance to the endpoints.