To get onto his Facebook account, the police used Tony Chung’s body.
When officers swarmed him at a Hong Kong shopping mall last month, they pulled him into a stairwell and pinned his head in front of his phone — an attempt to trigger the facial recognition system. Later, at his home, officers forced his finger onto a separate phone. Then they demanded passwords.
“They said, ‘Do you know with the national security law, we have all the rights to unlock your phones and get your passwords?’” Mr. Chung recalled.
Emboldened by that new law, Hong Kong security forces are turning to harsher tactics as they close a digital dragnet on activists, pro-democracy politicians and media leaders. Their approaches — which in the past month have included installing a camera outside the home of a prominent politician and breaking into the Facebook account of another — bear marked similarities to those long used by the fearsome domestic security forces in mainland China.
Not accustomed to such pressures, Hong Kong lawmakers and activists, and the American companies that own the most popular internet services there, have struggled to respond. Pro-democracy politicians have issued instructions to supporters on how to secure digital devices. Many have flocked to encrypted chat apps like Signal and changed their names on social media.
Dogged by the global reach of the law, even people from Hong Kong living far away from the city worry. One Facebook discussion group of Hong Kongers living in Australia closed off public access after a user claimed to have reported discussions to the Hong Kong authorities for potentially violating the law.
Major internet companies like Facebook and Twitter have temporarily cut off data sharing with the local police. Others have gone further, devising more permanent solutions. In July, Yahoo changed its terms of service so that users in Hong Kong are protected under American law, not local rules. It also cut access for employees in Hong Kong to user data to protect them from the law, according to two people familiar with the matter.
A Google spokeswoman said in a statement that the company had not produced data for the Hong Kong authorities since the national security law was enacted, and that the authorities could seek information for criminal investigations through U.S. diplomatic channels. That means the company is effectively treating data requests in the city the way it does those from mainland China.
Long known as a financial hub, Hong Kong is now emerging as a land of internet fault lines, a place where China’s harsh techno-authoritarian rule collides with the open internet in a society and economy governed by rules that protect digital rights.
“With China’s rising influence and power, it’s not safe for technology companies to put their servers in China or Hong Kong now,” said a prominent activist, Joshua Wong. “It’s important for them to help support Hong Kong’s citizens and society with digital security.”
The first coordinated sting under the new security law made Mr. Chung an example of an offense new to Hong Kong but common in mainland China: an internet crime. The police accused him of writing a post calling for Hong Kong independence on the Facebook page of a newly formed political party and demanded he delete it. He denied writing it.
Enforcing internet laws meant gathering digital evidence, and the police pushed hard to gain access to Mr. Chung’s accounts. Though less than fully prepared for the arrest, Mr. Chung said, he was able to foil officers at each turn. In the stairwell when the police forced his head in front of his phone, he closed his eyes and scrunched his face, rendering useless his iPhone’s facial recognition software. He had long since disabled the fingerprint unlock on his other phone. For passwords, he told the police that he had forgotten them.
Even so, a few hours after he was detained, his friends noticed that his Facebook account was active, appearing as if he were online and using it. Mr. Chung believes that the security forces broke in, though he said he wasn’t sure how. When he was released and tried to sign back in, Facebook had frozen his account over a suspicious login.
The Hong Kong police declined to comment on recent tactics and cases. A Facebook spokeswoman declined to comment. A spokeswoman for Verizon Media, which owns Yahoo, said it was “assessing potential impacts” of the law on its operations in Hong Kong.
There are also concerns that the Hong Kong police are adopting invasive surveillance techniques commonly used by China’s secret police force.
Agnes Chow, a prominent activist and politician, is no stranger to police attention. Weeks before she was arrested this month, she released a YouTube video punctuated with animations designed to teach Hong Kongers the basics of cybersecurity. She dispensed tips like how to enable two-factor authentication and how to maintain a “public toilet phone” where users can download apps they don’t trust — like, she pointed out, those from mainland China.
Yet she was surprised when strange men appeared near her house, apparently keeping watch in shifts and openly filming her with their smartphones. “I’m a bit scared,” she wrote in a Facebook post a day before her arrest that included a photo of the men.
A statement released after her arrest said an infrared surveillance camera had also appeared next to her doorstep in the weeks ahead of her arrest and was removed after she was pulled in by the police. In China, putting a camera outside the door of dissidents is a common trick of the secret police.
If the surveillance caught Ms. Chow off guard, her response also showed how Hong Kong activists are successfully adapting to aggressive police tactics. Shortly after she was arrested, her personal Facebook account was suspended. An assistant posted on her public page to explain that the account, with the help of Facebook, had been disabled to protect it.
The company allows people to appoint other legal administrators to an account. That person can then coordinate with Facebook to shut the account to protect the data in the event of an arrest.
Other police tactics have been more subtle, and more challenging to address.
Hours after the media mogul Jimmy Lai was arrested, an employee at his company, Next Digital, received a message from someone posing as a part of tech support. Using the names of his employees, the message asked for login details to Mr. Lai’s Twitter account in order to set up a new iPhone for Mr. Lai.
Schooled from years of cyberattacks, the recipient of the message flagged it as suspicious. Mark Simon, an executive at Next Digital, said the company believed it was an attempt by the Hong Kong police to get the login information for Mr. Lai’s account. The tactic has added to a new level of paranoia that has made day-to-day operations more difficult, according to Mr. Simon.
“The problem is this slows everything down, because now everyone is double checking: ‘Did you send this message? Did you send that?’ It never stops; it just never, ever stops,” he said.
Calling new police tactics “more aggressive,” Mr. Simon said it had become difficult for Mr. Lai to hold on to a phone because of the spate of arrests.
“I think they have four of his phones now,” he said. “They take his phone every damn time. Teenage rock stars throwing fits don’t go through as many phones as Jimmy does, thanks to the Hong Kong police.”
Mr. Simon added that people in Hong Kong were quickly adapting to the new information security environment. With the police now able to tap phones without a warrant, many citizens have switched entirely to encrypted chat apps. Many, he said, go further, setting the apps to auto-delete messages and even eschewing taking paper notes in meetings.
“I just don’t want to come off this is the end of the world; it’s not. This is just a nuisance that we have to live with every day,” Mr. Simon said.
“In China this is normal stuff. In Hong Kong they’re learning how to operate.”
Edmund Lee contributed reporting. Lin Qiqing contributed research.
