At the height of Hong Kong's Occupy Central movement in the final months of 2014, many activists and demonstrators suspected that police were recording their mobile instant message communications.
Although Hong Kong requires police to obtain court approval before monitoring a person's phone communications, these messages may have been surveilled with no official oversight of any kind.
Under Hong Kong's 2006 Interception of Communications and Surveillance Ordinance (ICSO), police must prove to a judge that interception or surveillance are necessary to preventing or detecting serious crimes or protecting public security. And they must prove reasonable suspicion on the target. The Commissioner on Interception of Communication and Surveillance  is responsible for supervising wiretap and other forms of communications interception and monitoring, a position established to ensure that law enforcement authorities complied with the law. The Commissioner is required to release an annual report informing the public of its activities.
When the 2013 Commissioner's report on Interception and Surveillance  was released in early December 2014, surveillance chief Darryl Gordon Saw refused to comment on whether messages sent on WhatsApp and other Internet-based mobile applications could be intercepted under the policy. A senior police officer told the local press that online messaging applications are not covered by the ICSO. This has left many local advocates concerned that police surveillance of these private communication tools has not been overseen by any authority at all.
Since its enactment, the ICSO has been criticized by pro-democratic law makers who say the law gives enforcement units too much power. A former Surveillance Commissioner and high court judge Woo Kwok-hing openly criticized the ICSO of being full of loopholes and argued that the Commissioner does not have the teeth to oversee its implementation. It was against this background that the government finally decided to amend the law in 2013.
Several civic groups have spoken out to address the potential abuse of police power in the monitoring of internet based communications. Hong Kong's In-Media urged  the government and Legislative Council member to restrict the power and improve accountability on surveillance practice. It demanded that the ICSO be amended to:
- Cover all forms of interpersonal communication, including the Internet-based email and messaging services and to ensure that law enforcement units are fully compliant with legal procedures for their interception activities
- Provide a clearer definition of “violence” to ensure that law enforcement would not undertake surveillance operations targeting protest organizers, leaders of civic groups, or political dissidents on grounds of public security
- Add a provision to prevent the monitoring of protected journalistic materials
- Establish penalties for non-compliance
Note: Hong Kong In-Media, a media freedom organization, it funds the operation of inmediahk.net, the author of this post.
According to the Security Bureau, the ICSO only covers law enforcement requests for online communications content  — in other words, the actual text, images and other content sent in a message. Requests for user metadata — such as the time, date, and user identity — and other evidence from Internet service providers are not restricted  by the ICSO. Since 2010, law enforcement on average sent more than 4,000 user data requests to local ISPs, mostly without a court order.
Legislative Council member Charles Mok also addressed  the potential loopholes in the implementation of the ordinance:
Recently, law enforcement refused to provide the list of technology devices used to assist official interception and surveillance activities, claiming that such information is confidential. This prevents the public from monitoring the extent of the government surveillance activities. Moreover, apart from intercepting communication contents, user data, metadata such as communication records, and IP data are not defined as “communications content”. Yet such information can be used to analyze a target's social network, and to track his/her footprints and habits. Police can ask the Internet service providers (ISPs) for this data with no restriction from the ICSO.
Keyboard Frontline, a civic group on web freedom, urged that  the ICSO should also restrict law enforcement collection of metadata, inform the target post-facto, and increase the supervision powers of the Surveillance commissioner.
Nevertheless, the constructive opinions put forward by pro-democracy law makers and civic groups are interpreted as “anti-government” by pro-establishment politicians. In a public hearing at the Legislative Council attended by a number of civic groups including Hong Kong Human Rights Watch, Hong Kong Journalist Association, Civic Right Observer, Labour Party and Hong Kong In-Media on May 2, Ng Leung-sing, a lawmaker representing the finance sector rebuked  the critiques of civic groups:
They [the representatives of the civic groups] just want to obstruct the government's administration. Why should these groups care about the ordinance while the majority of groups that care about “social welfare” are not worried? The explanation is [answered by a Chinese saying]: “be an upright person and you will be fearless of the knocks late at night.” The reason why they care is because they are doing bad things and are worried that they will be punished for it.