“Final risk posture: ELEVATED. The map pillar confirms that Hong Kong has broadened its national-security framework, empowering police to compel password disclosure without a warrant; the mechanics pillar specifies the penalty for non-compliance (≈1 year imprisonment and ≈US$12 k fine). Because both pillars recount the same legal change from complementary angles—scope of power vs. punishment—there is no substantive divergence to reconcile. Instead, they mutually reinforce a single narrative: residents, visitors and firms now face greater exposure to compelled data access and criminal liability. This elevates legal, operational and reputational risks, especially for entities handling sensitive information.”