Hong Kong government praised for world-leading data protection protocols despite weaknesses exposed by hacking of VTech

PUBLISHED : Tuesday, 08 December, 2015, 2:41pm
UPDATED : Tuesday, 08 December, 2015, 3:37pm

As Hong Kong reels from last month’s hacking of children’s toy maker VTech, global telecoms experts say the city is still one of the world’s leading lights in terms of the importance it places on protecting data privacy.

“Hong Kong is at or near the top of the list in addressing the cyber security privacy questions,” said Thomas Dailey, chief international legal and regulatory officer at Verizon.

He said the city has a solid legal framework for handling such issues, with detailed rules applying to different sectors. Moreover, it recently ushered in a new Innovation and Technology Bureau, which is expected to pitch in with such issues as cybersecurity.

“The government attaches great importance to data protection, in particular protection of personal data,” said a spokesperson from the office of Hong Kong’s chief information officer.

The city relies on its personal data ordinance, which is enforced by the privacy commissioner for personal data, to regulate privacy matters.

But not everyone believes the ordinance is sufficient. Other experts have called for it to be overhauled.

READ MORE: VTech hack in Hong Kong sees industry experts urge firms to lean more on big data to boost cybersecurity

“Hong Kong has always been reactive rather than proactive,” said Clareta Chia, Verizon’s general counsel for north Asia.

“This is a balance,” she said. “The government is taking adequate measures to protect individuals while not stifling business innovation.”

But while several international surveys rank Hong Kong very highly in terms of cybersecurity, especially from a government standpoint, many experts still believe the majority of local companies are woefully ill-prepared to fend off cyber attacks.

READ MORE: ‘This is a wake-up call for Hong Kong’: VTech data hack reveals cybersecurity not taken seriously by local businesses

The Economist’s Safe Cities Index 2015 ranks Hong Kong world No. 4 in terms of cybersecurity after Tokyo, Singapore and New York.

The index measures the amount of resources and level of technologies dedicated to cybersecurity, as well as the number of hacking incidents and scope and impact of computer viruses.

Meanwhile, the United Nations ranked Hong Kong eighth in the world in its latest Global Cybersecurity Index & Cyberwellness Profiles report.

Created by the UN’s International Telecommunication Union, the report assesses countries and regions in terms of the legal, technical, and organisational measures they have at their disposal to safeguard people’s and companies’ information online.

But local companies remain vulnerable, as the VTech case, the worst hacking incident in the city in the last five years, illustrated.

In the middle of November, VTech’s customer database was broken into, which exposed five million customer accounts, mostly belonging to parents, and the profiles of nearly 6.4 million children worldwide.

Dailey said most data breaches like this are not caused by “brutal force” attacks that require sophisticated technology or strong computational power. Rather, they are caused by much simpler tools: Phishing and fake calls.

“They are surprisingly low-tech,” he said.