Hong Kong’s laws need to evolve as protests enter the digital realm

(SCMP) – As the anti-extradition movement has shown, protests play out in the digital arena too, raising questions about whether the law should treat them the same as in the physical world. How we protect our virtual rights will be most instructive.

The extradition bill protests in Hong Kong have provided no shortage of remarkable visuals that will remain etched in our collective memory. Less visibly, but no less importantly, the conflict that has roiled the city is also playing out in the digital realm.

Protesters made judicious use of encrypted messaging apps to communicate not only with one another, but also with the media. They also used local peer-to-peer communication technology such as Apple’s Airdrop to anonymously send messages and plans to those in their immediate vicinity, entirely avoiding reliance on any communication infrastructure that could possibly be monitored.

Knowledge of how to use technology to avoid detection also extended to when not to use it — protesters stopped using Octopus cards and turned to single-use MTR tickets instead, to leave no digital trail. A minority also chose to use digital tools in a much more aggressive fashion. It was reported that 600 police officers had been “doxxed”, meaning their personal information was spread online. The police issued take-down requests to the websites to scrub the internet of the leaked personal details.

Those in favour of the bill (or opposed to the protests) also made use of the digital realm to advance their cause. A large distributed denial of service (DDoS) attack on Telegram, the encrypted messaging app used by protesters, was launched on June 12 at the same time the protests began.

Though no one took responsibility for the attack, Telegram’s chief executive officer said the size of the attack was consistent with the resources of a state actor and came primarily from IP addresses located in mainland China.

China’s ability to effectively control the digital distribution of information on the mainland also allowed it to spin a particular narrative about the protests for domestic consumption, portraying them as the violent result of foreign Anti Extradictionagitation.

These events remind us that political protests now play out not only in the physical world, but in the digital realm, too. This raises questions about whether protests using digital tools should be regulated in the same way as more traditional forms.

For instance, our constitutional rights to expression and privacy under the Basic Law mean the police must obtain a warrant before they can access the content of our communications.

But encrypted messaging apps mean that, even with a warrant, police cannot obtain that content; this is often described as the threat of “going dark”. Many governments claim the solution is to legislatively require messing services to create “back doors” in their encryption protocols that would ensure police access.

Opponents argue that artificially weakened encryption threatens not only our personal privacy and right to communicate, but the entire infrastructure of reliable and safe digital commerce. How would this debate play out in Hong Kong? We have not begun to grapple meaningfully with the question, but we must, because the use of encryption is only going to increase.

We also need to consider whether to treat protests the same whether they occur online or offline. For instance, the extradition bill protesters painted slogans on the walls of the police headquarters. Some would argue this should be understood as property damage under the law, and thus outside the bounds of the freedom of expression guarantee.

Setting aside for the moment whether this is constitutionally accurate, imagine a hypothetical hack of the police website so that it displayed the same messages sprayed on the physical walls. Should the hacker receive the same punishment as the real-world graffiti artist?

Under Part VII of the Crimes Ordinance, the misuse of a computer can be classed as damage to property. But hacking can also be prosecuted under section 161 of the ordinance, as the courts have interpreted this in a very broad way so that it functions as a virtual catch-all provision for any attempt to commit an offence using a computer.

Under the law as it is, an attempted hack is likely to draw a more severe punishment than an attempt to tag a wall with a political slogan. We must consider whether such differential treatment of online and offline activities is justified.

The right to protest and assemble is as important in the virtual world as it is in Victoria Park. These rights are at the heart of not only our Basic Law but our society. How we choose to approach those who exercise these rights primarily digitally will speak volumes about how serious our commitment to those rights truly is.