CYBER SECURITY AND TECHNOLOGY CRIME BUREAU
Hong Kong's specialist Police bureau for cyber security and technology crime.
The Cyber Security and Technology Crime Bureau (CSTCB) is a specialist bureau within the Crime Wing of the Hong Kong Police Force. It was formed on 1 January 2015 when the former Technology Crime Division of the Commercial Crime Bureau was upgraded into a standalone bureau.
CSTCB is responsible for cyber-security matters, technology-crime investigations, computer-forensic examinations and crime prevention. It also gathers cyber-threat intelligence, supports the security of critical-infrastructure networks and maintains liaison with local and overseas law-enforcement agencies.
STRUCTURE AND PRINCIPAL FUNCTIONS
Scope of CSTCB's investigations
Technology-crime investigations
CSTCB investigates serious or complex offences involving computer systems, online services, compromised accounts, malicious software and other digital infrastructure. Its work includes gathering real-time cyber intelligence and identifying active threats, offenders and linked criminal networks.
Cyber security and intelligence
The Bureau collects and analyses cyber-threat intelligence, maintains liaison with local and overseas partners, and supports the protection of Hong Kong's critical infrastructure. Its Cyber Security Centre operates around the clock to monitor threats and provide alerts and operational support.
Digital forensics
CSTCB conducts computer-forensic examinations and supports the lawful preservation, extraction, analysis and presentation of digital evidence. Its Digital Forensics Complex at Arsenal House is a central hub for examination, data analysis, evidence review and exhibit management.
Prevention and cooperation
The Bureau works with other Police formations, government bodies, infrastructure operators, businesses and overseas law-enforcement agencies. It also promotes public awareness of technology crime, online deception and practical cyber-security risks.
RELEVANT CYBER LEGISLATION
The Legal Framework of Cyber and Technology Crime in Hong Kong
Hong Kong does not rely on one general cybercrime statute. The applicable charge depends on the method of access, the purpose of the conduct, the effect on data or systems, any deception and the resulting loss or gain.
Access to a computer with criminal or dishonest intent
Section 161 of the Crimes Ordinance (Cap. 200) applies where a person obtains access to a computer with the prescribed criminal or dishonest purpose. The maximum penalty on conviction on indictment is five years' imprisonment.
Criminal damage involving computer data
Sections 59 and 60 of the Crimes Ordinance extend criminal-damage principles to the misuse of a computer and the alteration or erasure of programs or data. Depending on the evidence, these provisions may apply to ransomware, destructive malware, website defacement or attacks that impair computer systems. The ordinary maximum is ten years' imprisonment; the aggravated offence involving an intention or recklessness as to endangering life carries life imprisonment.
Unauthorised access by telecommunications
Section 27A of the Telecommunications Ordinance (Cap. 106) concerns knowingly causing a computer to perform a function to obtain unauthorised access to a program or data by telecommunications. It may arise where authentication is bypassed or stolen credentials are used to enter an external account or system. The statutory penalty is a fine of HK$20,000; other conduct may support separate and more serious charges.
Fraud and obtaining property by deception
The Theft Ordinance (Cap. 210) may apply to phishing, business-email compromise, false investment platforms, unauthorised transfers and other technology-enabled deception. Section 16A fraud carries a maximum of 14 years' imprisonment. Section 17 obtaining property by deception carries a maximum of ten years' imprisonment. The precise charge depends on the representation made, the property or economic prejudice involved and the defendant's state of mind.
SECRETARY FOR JUSTICE v CHENG KA YEE & OTHERS [2019] HKCFA 9
The limits of section 161 after the Court of Final Appeal's decision.
In SECRETARY FOR JUSTICE v CHENG KA YEE & OTHERS [2019] HKCFA 9, the Court of Final Appeal held that section 161 does not cover a person's use of their own computer merely because it was used for a criminal or dishonest purpose. The offence requires the accused to obtain access to a computer; it is not made out simply by operating one's own phone or computer. The decision should not, however, be reduced to a rule requiring sophisticated "hacking": whether access has been obtained, and to whose computer or data, remains a fact-sensitive question.
Before the ruling, section 161 had been used as a broad, catch-all provision—sometimes described as a legal "Swiss army knife"—in cases involving conduct such as upskirt photography, online publication, email deception and disclosure of private data where a computer or smartphone was used. After Cheng Ka Yee, use of the accused's own device alone cannot prove the offence.
The resulting gaps were addressed through more targeted legislation. The Crimes (Amendment) Ordinance 2021 introduced specific offences concerning voyeurism and unlawful recording or observation of intimate parts. Separate 2021 amendments to the Personal Data (Privacy) Ordinance created offences and enforcement powers concerning unlawful disclosure of personal data without consent.
HOW MCS CAN ASSIST
Advice where digital evidence is central to an investigation.
MCS can advise before and during a CSTCB interview, attend searches, examine the legal basis on which devices or accounts have been accessed and seized, preserve legally privileged material and help the client respond to requests for passwords, records or explanations. We can work with independent forensic specialists and experienced counsel to assess attribution, continuity, admissibility and the prosecution's interpretation of technical evidence, and represent the client in any resulting criminal proceedings.
Our partner, Eric Seto, possesses a robust technical background and deep domain expertise in digital systems, allowing him to deliver highly specialized, tech-savvy legal advice to numerous clients facing cyber and technology crime investigations in Hong Kong.
REFERENCES