By Claire Chow

Hong Kong, 3 July 2024: Authorities are paving the way for Hong Kong’s first cybersecurity legislation, seeking to regulate the protection of computer systems in sectors which are essential to the smooth running of the city. Operators of such systems will be required to ensure their integrity and reliability, while a new Commissioner’s Office will oversee the regime and ensure implementation. Significant fines may be imposed on organisations which fail to comply.

The measures are contained in the Protection of Critical Infrastructure (Computer System) Bill, details of which were given to the Legislative Council’s Panel on Security this week. A month-long public consultation is imminent, with the bill expected to be brought before the full LegCo by the end of this year.

So-called critical infrastructures (CIs) are the facilities necessary for the maintenance of normal functioning of society, such as financial institutions, healthcare systems, telecoms services, power supplies and transport networks. The computer systems at the heart of these need safeguarding from breakdowns or cyberattacks.

There have been numerous incidents overseas in which major institutions or corporations have been seriously disrupted by hackers. In 2021, a fuel pipeline operator suffered a ransomware attack that hindered nearly half the fuel supply on the US east coast. Earlier this year, a data centre in Sweden was attacked by hackers, disrupting government operations.

Synnovis (NHS England’s pathology services provider) was also subject to a ransomware attack by Qilin (the Russian cyber-criminal group) only last month in which thousands of hospitals and appointments were disrupted. Publication of the stolen data included patient names, NHS numbers and blood test descriptions. The incident also forced the NHS to issue an urgent message to people with universal blood types to donate as the attack affected hospitals’ ability to match patients’ blood.

Here in Hong Kong, medical services were similarly affected by a recent ransomware attack on the computer system of Union Hospital, though the hospital has stated that no leakage of patient data was found.

The government is proposing two categories of CIs. First, those delivering essential services in eight sectors: energy, IT, banking and financial services, land transport, air transport, maritime, healthcare, and communications and broadcasting. Second, those maintaining important societal and economic activities such as major sports and performance venues, research and development parks, and the like.

The proposed regime will apply only to designated CI operators (CIOs) – in other words, large organisations and institutions – and then only to their critical computer systems. In line with similar legislation in other jurisdictions, the identities of CIOs will not be made public in order to shield them from becoming potential attack targets.

Essential services provided by the government, such as water supply and drainage relief, are not covered by the bill. These will remain regulated via an administrative approach under the internal Government Information Technology Security Policy and Guidelines.

Once designated by the Commissioner’s Office, CIOs will be required to: appoint a dedicated team with professional knowledge to manage cybersecurity; formulate and carry out a computer system security management plan and submit it for scrutiny; conduct a computer system security risk assessment once a year and undergo an independent audit every two years. Further, CIOs will be obligated to take part in a computer system security drill organised by the Commissioner’s Office every two years.

In the event of extremely serious security issues, CIOs must notify the Commissioner’s Office within two hours. Lower-level security incidents should be reported within 24 hours. It is proposed that fines for non-compliance with any aspect of the new regime should range from HK$500,000 up to HK$5 million, with additional daily fines in the event of continuing breaches. It is also worth noting that while some companies outsource IT operations or management to third-party contractors, CIOs will ultimately be liable.

In conclusion, the new cybersecurity legislation should be viewed as essential in protecting the core facilities that keep Hong Kong running smoothly. Clearly, cyberattacks can have serious and life-threatening consequences. We await with interest the final version of the bill, which will give potential CIOs a clearer picture of their obligations. In the meantime, organisations likely to be designated as such are strongly advised to review their existing cybersecurity arrangements and prepare for the new regime.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.