internet security hong-kong
Are security pentesting services and software legal in Hong Kong?
<p>I am planning to open a HK company that will specialize in selling software that is meant to test one's IT defense as well as tools for penetration testers/red teams and similar.</p>

<p>I've heard that some countries consider such software as IT weaponry (which I think is silly). Anyone is familiar with HK laws that define such software? Maybe there are none and it is treated as regular software.</p>

<p>There is no law in Hong Kong which specifically forbidden penetration testing software (as in forbidding firearms). However there are some related laws which you may want to be aware of:</p>

<p><a href="http://www.hklii.hk/cgi-bin/sinodisp/eng/hk/legis/ord/106/s27A.html" rel="nofollow noreferrer">Chapter 106 Section 27A</a>:</p>

<blockquote>
  <p>Any person who, by telecommunications, knowingly causes a computer to
  perform any function to obtain unauthorized access to any program or
  data held in a computer commits an offence (...)</p>
</blockquote>

<p>Which in laymen terms, is "hacking".</p>

<p>The key point here is "unauthorized". As long as you have obtained permission to perform penetration testing, you will be okay.</p>

<p>Then, there is this "catch all" clause in <a href="http://www.hklii.hk/cgi-bin/sinodisp/eng/hk/legis/ord/200/s59.html" rel="nofollow noreferrer">Chapter 200 Section 59</a>. They usually use this to prosecute somebody on computer-related crimes if they cannot locate a specific law:</p>

<blockquote>
  <p>(...) to cause a computer to function other than as it has been
  established to function by or on behalf of its owner (...)</p>
</blockquote>

<p>Penetration testing should always be conducted after the owner has agreed anyway. No license is required to conduct such activities.</p>
