Hong Kong Security Report — July 28, 2026

Security analysis based on open-source intelligence and web research. Period: July 21 — July 28, 2026.

Executive Summary

Hong Kong's security landscape from July 21 to July 28, 2026, was marked by significant developments in cybersecurity, internal security enforcement, and evolving diplomatic relations with the United States. The US allowed a national emergency declaration concerning Hong Kong to expire, leading to the removal of some sanctions, though others remain in place, signaling a nuanced shift in US-China relations. Internally, Hong Kong authorities intensified counter-terrorism preparedness with drills and continued to apply the National Security Law (NSL), including new rules allowing retroactive application and warrantless access to electronic devices. Cybersecurity threats, particularly AI-enabled attacks, remained a critical concern, prompting regulatory warnings and highlighting Hong Kong's vulnerability as a financial hub. These events underscore a complex security environment influenced by both domestic governance priorities and broader geopolitical competition.

Key Security Developments

• Diplomatic Shift in US Sanctions Policy
  On July 23, 2026, US Secretary of State Marco Rubio confirmed that the US President Donald Trump had allowed a national emergency declaration on Hong Kong, initially issued in July 2020, to expire last week. This decision led to the removal of nine persons designated under Executive Order 13936 from the SDN List, and 39 individuals were moved from the SDN List to the Non-SDN Menu-Based Sanctions List. While China welcomed this as an "important step" towards restoring normal economic and trade exchanges, Rubio clarified that sanctions on 39 Hong Kong and mainland Chinese officials, including former Chief Executive Carrie Lam and current Chief Executive John Lee, would remain in place. This indicates a partial easing of pressure but not a full restoration of Hong Kong's prior special trade and economic status.

• Heightened Cybersecurity Threats and Regulatory Response
  The Hong Kong Securities and Futures Commission (SFC) issued a circular on July 27, 2026, urging licensed firms to bolster cybersecurity measures against escalating AI-enabled cyberattacks. This comes amidst a reported 27% year-on-year increase in cybersecurity incidents in Hong Kong, reaching over 15,000 in 2025. The SFC circular, building on an earlier one issued on June 2, 2026, highlights that AI models can now autonomously plan complex attacks, identify zero-day vulnerabilities, and orchestrate large-scale disruptions, fundamentally reshaping the threat landscape.

• Cross-border Cyber Espionage with Hong Kong Links
  From July 9 to 13, 2026, threat intelligence platform Hunt.io identified three open directories hosted in Hong Kong that contained exploit code, Web shells, and custom scripts used in an espionage attack targeting the Thai Ministry of Finance. The attack was largely driven by an autonomous AI agent named Hermes, operating in an unrestricted "YOLO" mode, demonstrating a new level of automation in cyber-espionage operations. This incident underscores Hong Kong's potential as a hosting location for malicious cyber infrastructure.

• Police Counter-Terrorism Drill at Central Library
  On July 24, 2026, Hong Kong police conducted a counter-terrorism exercise, codenamed GREATWILL, at the Hong Kong Central Library, involving over 150 participants. The drill simulated a terrorist attack during a seminar, with officers rapidly intervening and evacuating people. This exercise, held nine days after national security police raided two independent bookstores and arrested five people, drew online criticism regarding the choice of venue and its timing, linking it to broader national security crackdowns.

• Continued Enforcement and Expansion of National Security Law Powers
  New subsidiary legislation, gazetted on June 9, 2026, came into effect, enabling certain criminal cases to be retroactively brought under national security procedures, even if the alleged offenses occurred before the 2020 National Security Law was enacted. This allows the Chief Executive to classify any criminal act as "involving national security," subjecting cases to stricter bail conditions, trials by designated judges, and denial of standard sentence remission. Furthermore, rules enacted on March 23, 2026, made it a criminal offense to refuse police warrantless access to personal electronic devices, including for transit passengers, raising significant concerns for data protection and compliance for international businesses.

• PLA Navy Fleet Visit and Public Engagement
  A Chinese People's Liberation Army (PLA) Navy fleet, comprising the guided-missile destroyer Nanning and guided-missile frigate Hengyang, concluded a five-day visit to Hong Kong on July 6, 2026, which included open-house events for Hong Kong and Macao residents and students. The fleet arrived on July 2, 2026, at the PLA Hong Kong Garrison's naval base on Stonecutters Island, offering visitors insights into China's national defense and military development. This public engagement is part of a broader tradition of PLA garrison open days, which also included Ngong Shuen Chau, Shek Kong, and San Wai barracks in late June, attracting thousands of visitors.

• Hong Kong Police Operational Priorities
  The Commissioner's Operational Priorities for 2026, released on July 15, 2026, emphasize strengthening intelligence gathering and counter-terrorism capabilities under the HKSAR's 'Three-tier Prevention Framework'. This includes enhancing public awareness of domestic terrorism and self-radicalization, and conducting regular multi-agency exercises to improve contingency plans. The priorities also highlight collecting and analyzing national security intelligence, investigating acts endangering national security, and enhancing cooperation with other national security bodies.

• Economic Volatility Amidst Geopolitical Tensions
  On July 24, 2026, the Hang Seng Index fell by 1.3% (324 points) to 24,877, primarily due to mounting geopolitical tensions in the Middle East, specifically intensified Houthi attacks in the Red Sea and US President Donald Trump's threats against Iran. This global instability, coupled with US-China competition, continues to impact Hong Kong's financial markets and its role as a global financial hub.

Geopolitical Impact and Regional Dynamics

The period from July 21-28, 2026, saw Hong Kong navigating a complex geopolitical landscape, primarily shaped by its relationship with mainland China and the evolving stance of major Western powers, particularly the United States. The US decision to let the national emergency declaration on Hong Kong expire, while maintaining sanctions on specific officials, sends a mixed signal. China welcomed this as a positive step, suggesting it could improve bilateral economic and trade relations. However, the continued sanctions underscore that fundamental disagreements over Hong Kong's autonomy and human rights persist, preventing a full return to its pre-2020 special status. This nuanced approach by the US reflects a desire to engage with China on trade while still expressing concerns over Hong Kong's governance.

The broader strategic landscape sees Hong Kong increasingly integrated into China's national security framework, as evidenced by the continued and expanded application of the National Security Law. This integration, while providing stability from Beijing's perspective, raises concerns among international observers about the erosion of Hong Kong's judicial independence and civil liberties. The geopolitical competition between the US and China is also impacting Hong Kong's technological and economic sectors, particularly concerning access to advanced AI tools. Reports of generative AI tools like Anthropic's Claude being removed from internal systems for Hong Kong-based teams at major international banks highlight how AI is now treated as a strategic asset, potentially weakening Hong Kong's position as a global financial hub if it faces technological isolation.

Regionally, Hong Kong's security developments contribute to a broader narrative of China's growing influence and its assertion of sovereignty. The PLA Navy's public engagement activities, such as the fleet visit and garrison open days, serve as a soft power projection, aiming to foster national pride and a sense of security among Hong Kong residents. This public outreach reinforces the PLA's presence and its role in safeguarding national interests within the Special Administrative Region. The city's efforts to strengthen cybersecurity and counter-terrorism capabilities, including international cooperation in exercises, are crucial for maintaining its image as a stable international city amidst these complex dynamics.

Military and Defense Analysis

Hong Kong's military and defense posture is primarily defined by the presence of the Chinese People's Liberation Army (PLA) Garrison, which is responsible for the city's defense. The recent activities of the PLA in Hong Kong underscore a strategy focused on public engagement and demonstrating military capabilities, rather than overt operational shifts during this period. The five-day visit of the guided-missile destroyer Nanning and guided-missile frigate Hengyang from July 2 to July 6, 2026, at the Stonecutters Island naval base, along with open-house events, served to enhance public understanding and foster patriotic sentiment among Hong Kong and Macao residents. These events, which included tours, equipment displays, and cultural exchanges, are consistent with the PLA's long-standing tradition of opening its barracks to the public to strengthen community ties and national pride.

While there were no reports of new defense acquisitions or significant strategic shifts by the PLA Garrison during the reporting period, the emphasis on public interaction suggests a continued focus on integrating the garrison into the local community while subtly projecting China's military modernization. The guided-missile destroyer Nanning, commissioned in 2021, and the frigate Hengyang, commissioned in 2008, represent modern naval assets, showcasing China's growing naval capabilities.

Internally, Hong Kong's security forces, particularly the Police Force, are actively enhancing their counter-terrorism and national security capabilities. The large-scale inter-departmental counter-terrorism exercise "SECUREWALL" conducted at Hong Kong International Airport and Tung Chung on June 16-17, 2026, involving over 1,400 personnel, demonstrated a robust preparedness for major incidents and international conferences. This was followed by a more targeted counter-terrorism drill at the Central Library on July 24, 2026. These exercises, alongside the Commissioner's Operational Priorities for 2026, highlight a continuous effort to strengthen intelligence gathering, improve rapid response, and enhance inter-agency coordination against both physical and cyber threats. The focus on "domestic terrorism and self-radicalisation" in the Commissioner's priorities indicates an internal security emphasis, aligning with the broader national security framework.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Hong Kong is likely to continue its stringent focus on national security and cybersecurity. The recent expiration of the US national emergency declaration, while a diplomatic gesture, does not signal a complete reversal of US policy, meaning Hong Kong will likely remain a point of contention in US-China relations. Domestically, the Hong Kong Police Force will maintain a high state of vigilance, particularly with upcoming major international conferences later in 2026, for which extensive counter-terrorism preparations have already been undertaken. Cybersecurity will remain a top priority, with financial institutions and critical infrastructure facing increasing pressure to enhance defenses against sophisticated, AI-enabled cyberattacks, as highlighted by the SFC's circular.

Critical flashpoints and risk areas: Critical flashpoints include further enforcement actions under the National Security Law and the Safeguarding National Security Ordinance (Article 23), especially given the new rules allowing retroactive application and warrantless access to electronic devices. Any high-profile arrests or prosecutions under these laws could reignite international criticism and diplomatic tensions. The ongoing geopolitical competition between the US and China, particularly concerning technology and trade, poses a significant risk to Hong Kong's economic stability and its role as an international financial hub. The city's access to advanced AI technologies could be restricted, impacting its competitiveness. Furthermore, the threat of sophisticated cyberattacks, potentially with state-sponsored links, remains elevated, as demonstrated by the recent incident involving the Thai Ministry of Finance with Hong Kong-hosted elements.

Indicators to monitor: Key indicators to monitor include any further adjustments in US sanctions policy or trade relations with Hong Kong, which could significantly impact the city's economic outlook. The frequency and nature of enforcement actions under the National Security Law, including arrests and judicial proceedings, will be crucial for assessing the trajectory of civil liberties and autonomy. Developments in cybersecurity regulations and the actual incidence of major cyberattacks, particularly those targeting financial institutions or critical infrastructure, will indicate the effectiveness of defense measures. Public and international reactions to PLA activities and internal security drills will also provide insights into the perception of Hong Kong's security environment.

Strategic recommendations: Hong Kong should prioritize strengthening its cybersecurity resilience through robust investment in technology, talent development, and international collaboration on threat intelligence, while carefully navigating geopolitical restrictions on technology access. Diplomatic efforts should focus on clarifying its unique economic and legal status to international partners, despite the overarching national security framework. Internally, transparent communication regarding national security enforcement and counter-terrorism measures could help manage public perception and international scrutiny. Economically, diversifying its financial services and fostering innovation in areas less susceptible to geopolitical tech restrictions could enhance long-term stability.

Sources

• scmp.com
• steptoe.com
• freemalaysiatoday.com
• apnews.com
• chinadaily.com.cn
• indopremier.com
• theonlinecitizen.com
• osac.gov
• scmp.com
• ipdefenseforum.com
• asiapacific.ca
• amnesty.org
• mayerbrown.com
• securityboulevard.com
• scmp.com
• darkreading.com
• people.cn
• chinamil.com.cn
• globaltimes.cn
• chinadaily.com.cn
• news.cn
• dotdotnews.com
• globaltimes.cn
• rthk.hk
• mod.gov.cn
• chinadailyhk.com
• police.gov.hk
• equityworld-futures.com
• scmp.com
• police.gov.hk
• news.gov.hk
• info.gov.hk