Deloitte and KPMG ask staff to use burner phones for Hong Kong trips

Some companies were said to be concerned about hacks and the access of client data if work devices were brought to Hong Kong. Photo / 123RF

Some of the world’s biggest audit and consulting firms are asking staff to use burner phones when they visit Hong Kong, a sign of the increasing difficulties global companies are facing in a city long known as an international business hub.

Deloitte and KPMG have advised some US-based executives not to use their usual work phones in the territory, according to multiple people with knowledge of the policies. Several McKinsey consultants have also taken separate phones when travelling to the territory, the people said.

Some senior staff are reluctant to visit Hong Kong as a result of the inconvenience of leaving devices behind, according to an executive at one global consultancy. The policy applies even to people not involved with sensitive projects, the person said, adding: “People are not prepared to come here.”

Some companies in industries such as aerospace and semiconductors have for years asked employees to take separate phones and laptops to mainland China over security concerns. The application of the same approach in Hong Kong — a city that hosts the Asia-Pacific headquarters of many global companies — by a broader spectrum of businesses comes as Beijing has increased its control over the territory and people return after the end of lockdown restrictions.

In 2020, Beijing imposed a wide-ranging national security law on Hong Kong, an unprecedented step to exert greater control over the previously semi-autonomous territory. The US subsequently revoked the territory’s special trade status, saying Hong Kong was no longer sufficiently autonomous to warrant being treated differently from the mainland, which this year also strengthened its data and anti-espionage laws.

“With much talk [about] national security issues, the general feeling is that it is important to be cautious in Hong Kong as well,” said James Zimmerman, a partner at Perkins Coie in Beijing.

While the companies have not always given staff an explicit reason for using separate phones, some executives said their organisations were concerned about the risk of hacks and, in particular, the chance that data about their clients could be accessed.

“We have been recommending for several years that clients treat the risk of being in Hong Kong as the same as mainland China,” said a senior executive at a cyber security firm that counts large consultancies among its clients. “I think what you’re seeing is that message sinking in now.”

The person said there was “a range of risks, up to and including the risk of infiltration by a state-backed hacker”.

One UK-based consultant at a Big Four firm said consultancies had in general become increasingly risk averse, in part because of fear of legal liability for a leak of client data.

Deloitte, KPMG and McKinsey declined to comment.

Not all Big Four firms have such rules on devices. A PwC spokesperson said it did not have such a policy. EY declined to comment but an executive at the firm said they were unaware of any such policy at the company.

Still, the requirement by some companies that staff take separate devices sits uneasily with Hong Kong’s recent attempts to burnish its credentials as a global financial centre.

Its de facto central bank, the Hong Kong Monetary Authority, this month hosted a finance conference attended by 300 senior financiers from global companies, including Goldman Sachs’s David Solomon and Morgan Stanley’s James Gorman.

Hong Kong’s chief executive John Lee said in a speech at the event that “what distinguishes and sustains Hong Kong is our ‘one country, two systems’ framework”, a reference to the special administrative region’s ability to operate under different rules from the mainland.

While the consultancies’ policies have in some cases been in place for a year or more, they have had relatively little impact until recently because Hong Kong’s strict Covid-19 rules meant few executives were travelling to the territory, the people said.

Hong Kong scrapped hotel quarantine rules for visitors arriving in the city in September last year and lifted other pandemic-era restrictions in December.

- Additional reporting by Stephen Foley, Simon Foyand Chan Ho-him.

Written by: Kaye Wiggins, Leo Lewis and Joe Leahy

© Financial Times