Database

A 2017 draft version of the Law on Cybersecurity would require that foreign suppliers of telecom services and internet services to obtain operation licenses in order to provide their services in Vietnam. The concept of "telecom services" and "Internet services" are not defined. If "telecom services" and "Internet services" covered by the draft Law were too broad, the Law could be inconsistent with relevant WTO commitments, as the cross border supply of certain telecom services have been liberalised under Vietnam services schedule for WTO accession. Other requirements for these opertarors are to locate a "representative agency" in Vietnam and locate the server that manages Vietnamese users' data in the territory of Vietnam.

At this stage, since the full text of the law is not yet available, it is unclear whether this provision remains in the final version of the law due to come into force in January 2019.

While any Vietnamese firm can operate as an Internet Service Provider (ISP), only state-owned companies are allowed to operate as Online Service Providers or Internet Exchange Providers.

State regulation determines how Internet connectivity in Vietnam is organized and managed, and it is reported to facilitate Internet content filtering by limiting external access points that must be controlled.

Only Internet Exchange Points (IXPs) can connect to the Internet, while Online Service Providers (OSPs) and Internet Content Providers (ICPs) may connect to Internet Service Providers (ISPs) and IXPs.

Internet filtering happens at the Domain Name System (DNS) level, which means that instead of blocking a site, ISPs simply configure domain names to resolve to an invalid address or remove blocked websites from their DNS servers.

A draft version from 2017 of the Law on Cybersecurity would entitle the Ministry of Public Security to propose to the Government of Vietnam to cease the provision of cyber information at certain locations to respond to or remedy cybersecurity incidents for protecting national security, social safety, and order. This provision, if arbitrarily applied, could disrupt the flow of information.

At this stage, since the full text of the law is not yet available, it is unclear whether this provision remains in the final version of the law due to come into force in January 2019.

Art. 25 of Decree 72 sets the obligation of Internet Services Providers (ISPs) to coordinate with the State the removing or blocking of information that contains prohibited acts, which include: State opposition, undermining national security and social order, conducting propaganda; propagating obscenity, pornography and harming national traditions and customs; providing information offending organizations or individuals; and advertising banned good and services, banned newspapers, works and publications.

Various press reports have highlighted the controversial nature of Decree 72 and its wide scope regarding the capacity to block websites.