Vietnam: Withdraw Problematic Cyber Security Law

(New York) – Vietnam should revise its overly broad and vague draft cyber security law to bring it into compliance with international legal standards before it goes before the legislature, Human Rights Watch said today. Vietnam’s National Assembly is scheduled to vote on the draft of this highly criticized law on June 12, 2018.

The government and the ruling Communist Party of Vietnam have a long record of punishing political and social dissent under the rationale of protecting national security. The draft law, in turn, gives the authorities wide discretion to determine when expression must be censored as “illegal.” Vietnam’s national laws lack meaningful protections for privacy and the provisions in the cyber security law could make it easier for the government to identify and prosecute people for their peaceful online activities.

“The goal of Vietnam’s proposed cyber security law appears as much to protect the party’s monopoly on power as to protect network security,” said Brad Adams, Asia director at Human Rights Watch. “This bill, which squarely targets free expression and access to information, will provide yet one more weapon for the government against dissenting voices. It is no coincidence that it was drafted by the country’s Ministry of Public Security, notorious for human rights violations.”

Under the draft law, service providers must take down offending content within 24 hours of receiving a request from the Ministry of Information and Communications or Ministry of Public Security. Requirements that internet companies store data locally, “verify” user information, and disclose user data to authorities without the need for a court order also threaten the right to privacy and could facilitate further suppression of online dissent or activism.

Features of the draft cyber security law that raise human rights concerns include:

Provisions that subordinate freedom of expression, access to information, freedom of opinion, and other rights to political interests of the Vietnam Communist Party:

• Defining “network espionage” as the act of knowingly bypassing a firewall among other things to illegally acquire information (Article 2);
• Designating “the principle of protecting cyber security” to be “under the leadership of Vietnam’s Communist Party” (Article 4);
• Prohibiting “the use of cyberspace” to “prepare, post, and spread information” that “has the content of propaganda opposing the State of the Socialist Republic of Vietnam,” or “offends the nation, the national flag, the national emblem, the national anthem, great people, leaders, notable people, and national heroes” (Articles 8 and 15);
• Prohibiting the use of cyberspace “to organize, carry out, collude, urge, buy off, dupe, entice, train, or coach people to oppose the State of the Socialist Republic of Vietnam,” or “to distort history, deny revolutionary achievements, [or] undermine national solidarity” (Article 8);
• Prohibiting propaganda against the Socialist Republic of Vietnam, including “psychological warfare,” “defamatory propaganda against the people’s administration,” “false information intended to seriously harm human dignity or honor or cause damage” – but no requirement that the person putting forward the information has to know it is false, and “information that propagandizes, urges, campaigns, incites, threatens, causes division, [or] entices people to gather and cause disruption” (Articles 8 and 15); and
• Prohibiting “electronic information pages, web portal or specialized pages on social network of offices, organizations and individuals to provide, post or spread information” that the government deems as violations of “national sovereignty and security” (Article 26).

Provisions that force companies to deny service to, censor, or inform the government about people who publish forbidden content, including Article 26, requiring such actions by domestic and international providers of “cyberspace services or those who own information systems in Vietnam”:

• To “establish mechanisms to verify information when users register their digital accounts;”
• To “provide user information to the specialized task force for cyber security protection under the Ministry of Public Security upon receiving written requests”;
• To “erase information, prevent the sharing of information that has content” prohibited by the Vietnamese government “within 24 hours of receiving a request” from the Ministry of Information and Communications or Ministry of Public Security;
• To “store relevant traces (lưu vết liên quan) in order to provide them to the specialized task force for cyber security protection;” and
• To “not provide or stop providing services on telecommunication networks, Internet, and value-added services for organizations and individuals that publish on cyberspace” content prohibited by the Vietnamese government (Article 26).

Provisions that require data localization, including forcing companies:

•  To “store in Vietnam individual information from service users in Vietnam and important data related to national security;”
• To “establish headquarters or representative offices in Vietnam”; and
• To “fulfill requests of relevant authorities during their investigation and handling of legal violations of cyber security” (Article 26).

The draft law follows and expands on similar provisions in the government’s Decree 72 on the management, provision, and use of Internet services and online information, which contains provisions establishing content-filtering and censorship, and outlawing sweepingly defined “prohibited acts.”

The Vietnamese authorities have recently stepped up their crackdown against online dissidents and rights activists. In July 2017, the information and communications minister, Truong Minh Tuan, reported that “Google and Facebook had removed 3,367 clips with bad and poisonous content after being requested to do so by the Ministry of Information and Communications. Facebook removed more than 600 accounts that have violating content.”

The government has mobilized a massive army of paid “collaborators on social opinions” (Cong tac vien du luan xa hoi), often referred to as “public opinion shapers” (du luan vien), whose job is to promote official propaganda and to combat views deemed hostile to the ruling party and government. Separately, Colonel General Nguyen Trong Nghia reported in December 2017 that Force 47, a military task force founded in early 2016 to combat online opinions critical of the regime, has over 10,000 members “ready to combat erroneous views every hour, minute and second of the day.”

The draft law is being considered at a time when Vietnam has intensified its crackdown on human rights activism, Human Rights Watch said. In 2017, authorities arrested at least 41 rights advocates and bloggers for joining protests or other events or publishing articles critical of the government. During the first five months of 2018, Vietnamese Communist Party-controlled courts prosecuted at least 26 rights defenders. Several were sentenced to more than 10 years in prison. Victims of Vietnam’s renewed effort to silence critics include prominent activists Nguyen Van Dai, Nguyen Trung Ton, Truong Minh Duc, Pham Van Troi, Nguyen Bac Truyen, Hoang Duc Binh, Tran Hoang Phuc, Nguyen Ngoc Nhu Quynh (also known as Mother Mushroom), Tran Thi Nga, Bui Van Trung, Ho Van Hai, and many others.

“Vietnam’s National Assembly should prove that it’s not a puppet of the ruling Communist Party by standing with the public and opposing this cyber security law,” Adams said. “If adopted, this law will be a major step backward for a vibrant online community and efforts to make Vietnam a more modern and open country.”