Hong Kong seeks to fine operators of critical infrastructure HK$5 million for security lapses

Operators of essential infrastructure could face a HK$5 million (US$640,450) fine for failing to keep the security of their critical computer systems up to date under legislation proposed by Hong Kong authorities.

The Protection of Critical Infrastructure (Computer System) Bill covers critical infrastructures in eight sectors deemed crucial to the normal functioning of society – including energy, information technology, banking, communications, maritime, healthcare services, and land and air transport.

Operators of the infrastructure in these areas must formulate and carry out a computer system security management plan and submit it to a commissioner’s office to be created under the Security Bureau.

In the event of very serious security issues, the operators must notify the commissioner within two hours after they are made aware of the incident. In less serious cases, a report should be made within 24 hours, according to the bureau’s proposals.

Organisations that fail to do so or have not conducted a risk assessment as required could be fined up to HK$5 million, according to a document to be presented for discussion at next Tuesday’s Legislative Council security panel meeting.

But essential services provided by the government, such as water supply and drainage relief, are not covered by the proposed legislation and will be regulated in accordance with “the existing administrative approach without incorporating them into the proposed legislation”.

A month-long public consultation will be launched next month and the bureau hoped to put forward a bill by the end of this year.