National ID Cards Pose Inherent Privacy Dangers in Hong Kong

By Patrick McShane

Fourth of a series.

In June, China imposed a sweeping new “national security law” on Hong Kong — threatening the personal privacy of nearly 7.6 million citizens and sending shivers throughout the global business community, including over 1,500 U.S. companies.

In these weekly reports, Digital Privacy News examines the ramifications of Beijing’s decision. Today’s report details how mandatory national ID cards can be abused to spy on Hong Kong citizens.

Not many Americans even think about being legally required to carry a national ID card at all times — but they’d probably be surprised at how many other nations have this requirement.

All the standard authoritarian regimes long have mandated national ID cards: Russia, China, North Korea, Cuba, Saudi Arabia, Iran, Iraq, Kuwait. But, so do several more “liberal” societies — Spain, Portugal, Greece and Luxembourg.

Internationally, many conservative political leaders, and most law-enforcement agencies endorse compulsory national ID cards, saying they makes policing easier and more efficient.

But libertarians and liberals are horrified at the idea, claiming the risks of abuse of personal privacy and of political persecution are far too great.

A poster hangs in Hong Kong. Protests now are banned under China’s new “national security law.”

Ripe for Abuse

However, both those who oppose ID cards and those who endorse the idea mutually agree that, to be effective, they must be mandatory. The information also must be stored in a central location, thus easily located.

Liberals and libertarians counter that those two prerequisites are precisely what make the cards so ripe for government abuse.

In Hong Kong, IDs first became mandatory in a big way in the 1970s, when tens of thousands of residents from nearby Guangdong Province fled China every year seeking freedom and a better life across the border.

In fact, every summer, limbless bodies washed ashore in Hong Kong’s Mirs Bay, the victims of shark attacks, as they chose to swim to the British colony rather than trek through the well-patrolled rural frontier border area.

But if a mainland refugee reached the urban areas, they could vanish — absorbed instantly into the sprawling high-rise city life of more than seven million, making it on their own or with help from local relatives.

Thus, official Hong Kong ID cards became a requirement for all legal residents of the territory over the age of 18, locally born and expatriates alike.

The cards must be carried at all times; if lost, they must be reported to authorities immediately.

Every Facet of Life

Since then, Hongkongers must show ID cards for every aspect of life: to register a marriage or seek a divorce; to buy a car or an apartment; to book a hotel room, apply for a library card or a credit card or an Octopus public-transport card; to be admitted to a hospital or see a new doctor; to obtain a driver’s license, open a bank account, seek a bank loan or declare bankruptcy; to open a postal box or begin litigation; to leave Hong Kong at the airport, at a train station or at a ferry terminal; to re-enter the city at any point; or to register a birth, record a death and buy a burial plot.

For decades, Hong Kong’s ID cards have been issued and managed by the Department of Immigration. Then, in late 2018, the government said the old cards would be replaced by new “smart” cards.

The transformation process, for some 8.8 million cards, would take four years, with completion by 2023, at a cost of $7 million.

Hongkongers protest the firing of a top editor at the Ming Pao Chinese-language daily newspaper in 2016. Such demonstrations now are banned by Beijing’s “national security law,” imposed in June.

Made on the Mainland

Initially, the plastic Hong Kong ID cards were made in the U.K. The manufacturing later was moved to Hong Kong. Today, the cards are made on the mainland.

The government said it was replacing the older cards because they would soon wear out, also stressing that the new technology made the cards difficult to counterfeit.

For many Hongkongers, however, especially younger ones, fears are rising about the significant potential for misusing the technology, especially under the new security law.

In its news releases, the government itself confirmed last year that the cards would use built-in radio frequency identification (RFID), as well as have expanded storage capacity to support higher-resolution photos — this to support facial-recognition technology.

Additionally, the new cards will be able to provide fingerprint verification.

The Hong Kong Immigration Department’s FAQ page regarding the new cards make these points, but actually they raise more questions:

  • “The collection, storage, use and release of data (on the new cards) are governed by the Personal Data Ordinance, Registration of Persons Ordinance and Registration of Persons Regulations.”

But who reviews those regulations, for instance?

  • “Only authorized departments have access to the relevant database, and there is no sharing of databases among government departments.”

What are those “authorized departments”?

  • “Data for different applications (on the card) are segregated. The chip is designed with segregated compartments to separate immigration applications from other value-added nonimmigration functions.”

Yet, which government agency has access to the card’s nonimmigration functions?

  • “Only minimal data are stored in the chip. More sensitive data are kept in back-end computer systems.” 

But what is “minimal data”? Also, which government offices have access to the “back-end computer systems”?

A posted sign in Hong Kong.

Perhaps most worrisome for so many Hongkongers is that those government statements were made well before the national security law was enacted. And many here are convinced that the new rule will allow government agencies to disregard everything.

Asked if the new smart ID cards could be used to pry or spy on the private activities of Hongkongers, a senior executive for a major international logistics company told Digital Privacy News: “With the kind of RFID technology these cards have, the government could track any cardholder in Hong Kong — with the same ease that we can track a blueberry pie you’d send from your home in Boston to your grandmother’s home in Berkeley, Calif.

“And, if that same government office also demanded access to that same person’s Octopus card, they would be able to basically lay out that individual’s entire day — from what time he left the house, what train or bus or ferry they took, where they went, where they ate lunch, where they spent the afternoon.

“And even when he got home — or at least to the nearest bus stop or (Mass Transit Railway) station.

“So,” the executive cautioned, “if this person got picked up by the police, and was accused of being at an illegal protest rally — and he denied it, saying he stayed home all day — they could easily prove him to be a complete liar.

“No question whatsoever.

“The real question,” the individual said, “is whether the government will eventually allow the police access to everyone’s ID card?”

Patrick McShane is a longtime resident of Asia.

Source: