Vietnam’s cybersecurity law, scheduled to take effect on Jan 1, increases regulation and control over online activity and strikes against the exercise of peaceful expression, “a significant restriction against independent news and information online,” according to Viet Tan, a pro-democracy network operating both inside and outside the country.

The new law is the first to specify that foreign companies must store user data in Vietnam and be subject to domestic law, according to the NGO’s analysis, which describes the new law as “vague and open to interpretation” and could well result in diminished multinational business activity.

The law was approved by the National Assembly in June against the strong objections of multinationals operating in the country as well as the local business community and western governments including the US, which said the measure would stifle economic development and contribute to the already-strict posture against political dissent. Google, Facebook and other major IT firms had hoped vainly that they could soften objectionable provisions.

With 64 million users among the country’s 100 million people – 55 million of them on Facebook, placing the country among the top 10 across the globe -- the Internet has become a tidal wave of information, as it has across much of Southeast Asia. The dominant messaging applications are Facebook Messenger and Zalo, a local platform, followed by Skype, Viber and Line.

The Ministry of Public Security released the draft decree for implementation in early November, with two months allotted for public feedback. There has been heated discussion on Facebook and other social media platforms. Online protests culminated in large offline anti-government protests in over a dozen cities in June, according to Viet Tan.

In a country dominated by government-controlled media, social media is often where important stories are covered first, including the death in September of President Tran Dai Quang. Authorities nonetheless have sought to use legal measures and tactics to stifle online expression, reacting to online activism by using internet service providers to intermittently throttle Facebook, “usually to prevent popular opposition to controversial policies from reaching critical mass.

In response, however, according to the report, savvy users responded by searching for virtual private networks (VPN) or other circumvention tools. The state responded by cyber bullying by state sponsored trolls, deploying a cyber army, using imitation Facebook pages and websites to counter independent news and media, conducting phishing attacks on Facebook and abusing the “report” button to take down posts and accounts.

“Most worrying, Vietnamese authorities have reacted to online activism by intensifying the crackdown on bloggers and activists with more arrests and significantly lengthier prison terms. Higher profile and lesser known activists brought to trial in 2018 were handed prison sentences ranging from 6 to 20 years.”

The law “is the clearest indication that Hanoi plans to further tighten its grip on the online public sphere. Although the law had gone through multiple drafts and commenting by NGOs and industry groups, such an expansive and draconian law also has the potential to encourage widespread civil disobedience,” the Vet Tan report says. It “lists a range of activities and content that are prohibited online, including: “organizing against the Socialist Republic of Vietnam” and “distorting history or negating revolutionary achievements”. Furthermore, the law also defines online “propaganda against the state” to be online information critical.

The law makes it illegal for people to call, campaign or share information about mass gatherings and public protests. The language of “propaganda against the state” and “organizing activities against the state” is similar to the Penal Code—which has been used to sentence bloggers to lengthy prison terms.

For instance, in 2017, citizen journalists Tran Thi Nga and Nguyen Van Hoa were charged with “conducting propaganda against the state” for their work online. More recently, authorities extensively mined democracy activist Le Dinh Luong’s Facebook account, detailing what he posted, shared or even who he friended with to build a case against him. The indictment against Le Dinh Luong scrutinized Facebook postings and activity over several years to accuse him of sweeping national security crimes. For the cybersecurity law, Vietnamese authorities have simply copied from previous political indictments and the penal code and applied the language to the online context. Activists sentenced or arrested in 2018 with mention of Facebook activity in their indictment.

Removal of online content

Gaining access to and deleting accounts that publish information critical of the state is considered a form of cybersecurity protection. The law stipulates that system administrators (including companies and individuals running websites and social media networks) will be responsible to take “administrative and technical measures to prevent, detect, fight against or remove any information” considered to be “prejudicial to national security.”

The law further states that companies must delete information containing content considered “propaganda against the state” and prevent that content from being shared. The law also mentions that a “specialized force in charge of cybersecurity protection” will also take measures to handle online information.

Vietnamese authorities have previously requested Facebook and Google to remove certain political content from their social media platforms. The new law goes one step further by requiring foreign tech companies to actively remove any content critical of the state. Providing user data to authorities The law requires local and foreign companies to provide user data and information to the specialized force in charge of cybersecurity protection within the Ministry of Public Security, when “required in writing for the purpose of investigating and handling any violations of legislation on security.”

Given that the cybersecurity law is in line with the broad language seen in the Penal Code, Viet Tan said, this provision could force companies to hand over user data to authorities upon vague requests.

“This is of particular concern for the privacy and anonymity of activists who are using platforms to securely discuss and collaborate around socio-political issues which may be deemed sensitive by authorities.

Limiting internet access

A provision within the cybersecurity law requires telecommunications and internet companies to suspend service to organizations or individuals who publish information critical of the state. This could enable authorities to cut access to the internet entirely as a means to silence critics, independent media organizations, and human rights defenders.

Storing local user data in Vietnam

The cybersecurity law also states that local and foreign companies must store local user data and personal information in Vietnam, in essence, establishing local data servers in Vietnam. This is perhaps the most onerous—and impractical—provision of the new law.

“If every country enacted a ‘cybersecurity’ law similar to Vietnam’s, Facebook would have to locate its servers in nearly 200 countries and wrestle with how to organize its user data across all these countries,” the report continues. “Furthermore, foreign tech companies are required to establish local offices in Vietnam. While established companies such as Facebook may decide they want a local office, what about smaller, up-and-coming companies? This provision could subject current and future foreign tech companies to Vietnamese law if their platforms happen to be popular with Vietnamese netizens.

The law means the government “is applying its crackdown to online platforms. Within the last year, authorities have arrested numerous activists, announced a cyber army and exploited Facebook’s community standards to take down activist posts and their accounts on Facebook.”

The law “legitimizes these tactics in the government’s pursuit of ‘cyber protection measures.’

No major foreign internet company currently operates data centers in Vietnam. “By requiring data localization and local offices, the Hanoi government is demonstrating that its disregard for human rights can also be bad for business. As the Asia Internet Coalition stated, the law would undoubtedly hinder “the nation’s 4th Industrial Revolution ambitions to achieve GDP and job growth.”

Soon after the new cybersecurity law was passed in Vietnam, U.S. lawmakers sent letters to Facebook and Google urging them not to comply. Twenty American senators and members of Congress said: “If the Vietnamese government is coercing your companies to aid and abet censorship, this is an issue of concern that needs to be raised diplomatically and at the highest levels.”

“It is doubtful that the Vietnamese government ultimately would or could block popular platforms such as Facebook or YouTube if the foreign tech companies simply ignored the new cyber law. Authorities have previously tried to block Facebook but faced a serious public backlash.

With so many Vietnamese celebrities, businesses, and even governmental departments relying on Facebook as a means of communication, the report continues, it would be near impossible for Hanoi to block the platform.

Viet Tan recommends that the international community work with Vietnamese civil society to push back against the upcoming cybersecurity regulations. Specifically:

1. Foreign internet companies should continue to put the interests of their Vietnam customers first and be mindful of their corporate social responsibility. Tech firms can continue to serve Vietnamese netizens by not storing local data servers in-country and ensuring that their platforms remain free from government censorship.

2. Advocates should pressure the Vietnamese government from implementing the new cyber security law and support the efforts of Vietnamese citizens to freely share information and associate online.

3. Advocates should continue to press the Vietnamese government to release political prisoners, including activists targeted for their online goings-on.