Summary
Striking against peaceful expression, Vietnam’s National Assembly passed a cybersecurity law to increase regulation and control over online activity. While the Vietnamese government had previously issued decrees on the management of internet services and online content, the new cybersecurity law is the first to specify that foreign companies must store user data in Vietnam and be subject to domestic law.
Similar to other laws and decrees, the language used in the cybersecurity law is vague and open to interpretation. Much like the current Vietnamese penal code, the cybersecurity law provides the police with sweeping authority to arrest people under the guise of “national security.”
Due to take into effect on January 1, 2019, the cybersecurity law will be enforced by the Ministry of Public Security and Ministry of Information and Communications. The Ministry of Public Security released the draft decree for implementation of the law in early November, with two months allotted for public feedback.
Internet Landscape
With a population of almost 100 million, Vietnam recently surpassed 64 million internet users. Vietnamese rely heavily on mobile applications to communicate and connect with each other.
According to one survey, the two dominant messaging applications are Facebook Messenger and Zalo (a local platform) followed by Skype, Viber and Line. Not surprisingly, the most popular social media platform is Facebook with more than 55 million users as of 2018—placing Vietnam among the top 10 countries worldwide.
With limited space for free expression offline, Vietnamese have taken to the internet and more specifically, Facebook, to discuss, collaborate, and organize around socio-political issues considered sensitive by the authorities. Activists have organized on Facebook over the controversial plan to cut down 6,700 trees in Hanoi and against the environmental disaster off the central coast of Vietnam.
In the summer of 2018, Facebookers engaged in heated discussions over the cyber security law and the government’s plan to establish Special Economic Zones (SEZs) where foreign entities could acquire 99-year leases. The online protests culminated in large offline anti-government protests in over a dozen cities in June 2018.
In a country dominated by government controlled media, social media is often where important stories are covered first. Vietnamese authorities tend be to be tight-lipped on health issues of political figures but Facebook users were ahead of state media in announcing the death of President Tran Dai Quang in September 2018.
Vietnamese authorities have employed a variety of legal measures and tactics to stifle online expression over the years. From 2009 (when Facebook first took off in Vietnam) until 2016 (when the platform perhaps became “too big to fail”), authorities reacted to online activism by having internet service providers intermittently throttle Facebook—usually to prevent popular opposition to controversial policies from reaching critical mass. In response, savvy users responded by searching for virtual private networks (VPN) or other circumvention tools.
As Facebook became a fact of life, Vietnamese authorities resorted to weaponizing social media. Tactics have included:
- cyber bullying by state sponsored trolls
- deploying a cyber army
- proliferating misinformation and imitation Facebook pages and websites to counter independent news and media
- phishing attacks on Facebook in order to suspend or take over the accounts of well-known human rights activists and citizen journalists
- abusing the report button to to take down posts and accounts.
According to Viet Tan’s No Firewall Helpdesk, a security helpline to assist Vietnamese activists, the majority of cases received in 2018 were content removal or account suspensions on Facebook.
Most worrying, Vietnamese authorities have reacted to online activism by intensifying the crackdown on bloggers and activists with more arrests and significantly lengthier prison terms. Higher profile and lesser known activists brought to trial in 2018 were handed prison sentences ranging from 6 to 20 years.
The new cybersecurity law is the clearest indication that Hanoi plans to further tighten its grip on the online public sphere. Although the law had gone through multiple drafts and commenting by NGOs and industry groups, the final legislation represents a significant restriction against independent news and information online.
Timeline: Policing the Internet in Vietnam
Key Provisions of the Cybersecurity Law
The new law has the potential to seriously impact most internet users, civil society, and domestic and foreign businesses. Such an expansive and draconian law also has the potential to encourage widespread civil disobedience.
Prohibited online content
The law lists a range of activities and content that are prohibited online, including: “organizing against the Socialist Republic of Vietnam” and “distorting history or negating revolutionary achievements”. Furthermore, the law also defines online “propaganda against the state” to be online information critical of the people’s administration or information which would disturb public disorder. The law makes it illegal for people to call, campaign or share information about mass gatherings and public protests.
The language of “propaganda against the state” and “organizing activities against the state” is similar to the Penal Code—which has been used to sentence bloggers to lengthy prison terms. In 2017, citizen journalists Tran Thi Nga and Nguyen Van Hoa were charged with “conducting propaganda against the state” for their work online.
More recently, authorities extensively mined democracy activist Le Dinh Luong’s Facebook account, detailing what he posted, shared or even who he friended with to build a case against him. The indictment against Le Dinh Luong scrutinized Facebook postings and activity over several years to accuse him of sweeping national security crimes.
For the cybersecurity law, Vietnamese authorities have simply copied from previous political indictments and the penal code and applied the language to the online context.
Activists sentenced or arrested in 2018 with mention of Facebook activity in their indictment
| TRIAL DATE | VIETNAMESE ACTIVIST | SENTENCE LENGTH |
| January 31, 2018 | Tran Hoang Phuc | 6 years prison |
| April 4, 2018 | Nguyen Van Dai | 15 years prison |
| September 17, 2018 | Do Cong Duong | 9 years prison |
| September 22, 2018 | Nguyen Hong Nguyen | 2 years prison |
| September 22, 2018 | Doan Khanh Vinh Quang | 2 years 3 months prison |
| September 24, 2018 | Bui Manh Dong | 2 years 6 months prison |
| Detained without trial | Le Minh The | — |
| Detained without trial | Nguyen Duy Son | — |
| Detained without trial | Nguyen Van Truong | — |
Removal of online content
Gaining access to and deleting accounts that publish information critical of the state is considered a form of cybersecurity protection. The law stipulates that system administrators (including companies and individuals running websites and social media networks) will be responsible to take “administrative and technical measures to prevent, detect, fight against or remove any information” considered to be “prejudicial to national security.” The law further states that companies must delete information containing content considered “propaganda against the state” and prevent that content from being shared. The law also mentions that a “specialized force in charge of cybersecurity protection” will also take measures to handle online information.
Vietnamese authorities have previously requested Facebook and Google to remove certain political content from their social media platforms. The new law goes one step further by requiring foreign tech companies to actively remove any content critical of the state.
Providing user data to authorities
The law requires local and foreign companies to provide user data and information to the specialized force in charge of cybersecurity protection within the Ministry of Public Security, when “required in writing for the purpose of investigating and handling any violations of legislation on security.”
Given that the cybersecurity law is in line with the broad language seen in the Penal Code, this provision could force companies to hand over user data to authorities upon vague requests. This is of particular concern for the privacy and anonymity of activists who are using platforms to securely discuss and collaborate around socio-political issues which may be deemed sensitive by authorities.
Limiting internet access
A provision within the cybersecurity law requires telecommunications and internet companies to suspend service to organizations or individuals who publish information critical of the state. This could enable authorities to cut access to the internet entirely as a means to silence critics, independent media organizations, and human rights defenders.
Storing local user data in Vietnam
The cybersecurity law also states that local and foreign companies must store local user data and personal information in Vietnam, in essence, establishing local data servers in Vietnam. This is perhaps the most onerous—and impractical—provision of the new law. If every country enacted a “cybersecurity” law similar to Vietnam’s, Facebook would have to locate its servers in nearly 200 countries and wrestle with how to organize its user data across all these countries.
Furthermore, foreign tech companies are required to establish local offices in Vietnam. While established companies such as Facebook may decide they want a local office, what about smaller, up and coming companies? This provision could subject current and future foreign tech companies to Vietnamese law if their platforms happen to be popular with Vietnamese netizens.
Implications
The cybersecurity law means that the Vietnamese government is applying its crackdown to online platforms. Within the last year, authorities have arrested numerous activists, announced a cyber army, and exploited Facebook’s community standards to take down activist posts and their accounts on Facebook. The cybersecurity law legitimizes these tactics in the government’s pursuit of “cyber protection measures.”
No major foreign internet company currently operates data centers in Vietnam. By requiring data localization and local offices, the Hanoi government is demonstrating that its disregard for human rights can also be bad for business. As the Asia Internet Coalition stated, the cybersecurity law would undoubtedly hinder “the nation’s 4th Industrial Revolution ambitions to achieve GDP and job growth.”
Soon after the new cybersecurity law was passed in Vietnam, U.S. lawmakers sent letters to Facebook and Google urging them not to comply. Twenty American senators and members of Congress said: “If the Vietnamese government is coercing your companies to aid and abet censorship, this is an issue of concern that needs to be raised diplomatically and at the highest levels.”
It is doubtful that the Vietnamese government ultimately would or could block popular platforms such as Facebook or YouTube if the foreign tech companies simply ignored the new cyber law. Authorities have previously tried to block Facebook but faced a serious public backlash. With so many Vietnamese celebrities, businesses, and even governmental departments relying on Facebook as a means of communication, it would be near impossible for Hanoi to block the platform.
Recommendations
The international community can work with Vietnamese civil society to push back against the upcoming cybersecurity regulations. Specifically:
- Foreign internet companies should continue to put the interests of their Vietnam customers first and be mindful of their corporate social responsibility. Tech firms can continue to serve Vietnamese netizens by not storing local data servers in-country and ensuring that their platforms remain free from government censorship.
- Advocates should pressure the Vietnamese government from implementing the new cyber security law and support the efforts of Vietnamese citizens to freely share information and associate online.
- Advocates should continue to press the Vietnamese government to release political prisoners, including activists targeted for their online speech and peaceful activities.
About Viet Tan
The mission of Viet Tan is to overcome dictatorship, build the foundation for a sustainable democracy, and demand justice and human rights for the Vietnamese people through a nonviolent struggle based on civic participation.
Through its Internet Freedom Program, Viet Tan aims to:
- Challenge legal statutes restricting freedom of expression
- Equip netizens with knowledge and tools for circumvention and digital security through our No Firewall Helpdesk
- Support citizen journalists and advocate for imprisoned digital activists.
Contact | if [at] viettan [dot] org | PGP: 4CF9 E44B 4C6A 65EE 1139 1100 31EC E7B2 0ADA A551
