Chapter III
PREVENTION AND ACTIONS AGAINST CYBERSECURITY VIOLATIONS
Article 16. Prevention and handling of cyberinformation that is meant to oppose the government of Socialist Republic of Vietnam, cause riots, disturb the peace, humiliate or slander, or violate economic management laws
1. A piece of information in cyberspace will be considered propaganda against the government of Socialist Republic of Vietnam if it:
a) slanders or defames the people's government;
b) is used for psychological warfare; provokes war of aggression; causes discrimination against or hostility towards a race, religion or country;
c) offends the people or desecrate the national flag, national anthem, political leaders, honored people or national heroes.
2. A piece of information in cyberspace will be considered provoking riots or disturbing the peace if it:
a) persuades, encourages, deceives, threatens people or causes discrimination for the purpose of armed activities or use of violent force to oppose the people's government.
b) encourages, deceives, threatens or persuades people to participate in public gathering intended to cause disruption or oppose law enforcers or obstructs operation of an organization, thus threatens public order and security.
3. A piece of information in cyberspace will be considered humiliating or slandering if it:
a) seriously harms another person’s dignity or honor;
b) is fabricated to harm another person’s dignity or honor or violate lawful rights and interests of another organization or individual.
4. Information in cyberspace that is meant to commit violations against regulations of law on economic management includes:
a) Fabricated or false information about products, goods, money, bonds, treasury bills, checks and other financial instruments;
b) Fabricated or false information about finance, banking, e-commerce, electronic payment, foreign exchange, capital raising, multi-level marketing, securities.
5. Other fabricated or false information in cyberspace that is meant to cause public confusion or economic loss, obstructing regulatory bodies or law enforcers, violate lawful rights and interests of other organizations and individuals.
6. Administrators of information systems have the responsibility to implement administrative and technical measures for prevention, discovery, intervention and removal of the information mentioned in Clause 1 through 5 of this Article on their systems at the request of professional cybersecurity forces.
7. Professional cybersecurity forces and competent authorities shall apply the measures mentioned in Point h, i and l Clause 1 Article 5 of this Article to handle the cyberinformation mentioned in Clause 1 through 5 of this Article.
8. TSPs, ISPs, VAS providers and information system administrators shall cooperate with competent authorities in handling the information mentioned in Clause 1 through 5 of this Article.
9. Any organization or individual that devises, posts or spreads the information mentioned in Clause 1 through 5 of this Article shall remove it at the request of the professional cybersecurity force and bear legal responsibility.
Article 17. Prevention and response to cyber espionage; protection of state-secret information, business secrets, family secrets and privacy in cyberspace
1. The following acts are considered cyber espionage or deliberate violation of state-secret information, work secrets, business secrets, family secrets and privacy in cyberspace:
a) Illegal obtainment, trade, collection, deliberate revelation of information classified as state secret information, work secrets, business secrets, family secrets and privacy which harm the dignity, reputation or lawful rights and interests of another organization or individual;
b) Deliberate deletion, causing damage, loss or changes to information classified as state-secret information, work secrets, business secrets, family secrets and privacy that is transmitted or stored in cyberspace;
c) Deliberately changing, canceling or neutralizing a technical measure that is meant to protect state-secret information, work secrets, business secrets, family secrets or privacy;
d) Posting state-secret information, work secrets, business secrets, family secrets and privacy in cyberspace against the law;
dd) Illegally eavesdropping or recording conversations;
e) Other acts that are considered deliberate violation of state-secret information, work secrets, business secrets, family secrets or privacy in cyberspace:
2. Information system administrators have the responsibility to:
a) Carry out cybersecurity inspection to detect and remove malicious codes and hardware, fix weaknesses and vulnerabilities; discover and prevent infiltration or other risks to cybersecurity;
b) Implement administrative and technical measures to prevent, discover and stop cyber espionage, infringement upon e state-secret information, work secrets, business secrets, family secrets or infringement upon privacy in their systems and remove relevant information;
c) Comply with requests of cybersecurity forces regarding prevention and response to cyber espionage and protection of state-secret information, work secrets, business secrets, family secrets and privacy in their systems.
3. The agencies responsible for drafting and storing state-secret information and documents are also responsible for protection of such information and documents which are stored in computers, other devices or transmitted in cyberspace in accordance with regulations of law on protection of state secrets.
4. The Ministry of Public Security, except for the cases mentioned in Clause 5 and Clause 6 of this Article, has the responsibility to:
a) Carry out inspection of cybersecurity of national security information systems to detect and remove malicious codes and hardware, fix weaknesses and vulnerabilities; discover and prevent network infiltration;
b) Carry out inspection of cybersecurity of communication equipment, products and services, digital and electronic devices before they are used in any national security information systems;
c) Carry out supervision of cybersecurity of national security information systems to detect and stop illegal collection of state-secret information;
d) Discover and take actions against acts of posting, storing or exchanging information and documents classified as state secrets in cyberspace;
dd) Participate in research and manufacturing of products serving storage and transmission of state-secret information and documents, and cryptographic products;
e) Inspect the protection of state secrets in cyberspace by state authorities and administrators of national security information systems;
g) Provide training in protection of state secrets in cyberspace, prevention and response to cyberattack, and cybersecurity protection for the cybersecurity forces as prescribed in Clause 2 Article 30 of this Law.
5. The Ministry of National Defense has the responsibility mentioned in Point a through e Clause 4 of this Article regarding military information systems.
6. VGCA is responsible for organizing implementation of regulations of law on cryptography in order to protect state-secret information stored and transmitted in cyberspace.
Article 18. Prevention and response to use of cyberspace, information technology or electronic devices for violations of regulations of law on national security and public order
1. Use of cyberspace, information technology or electronic devices for violations of regulations of law on national security and public order includes:
a) Posting or spreading the information mentioned in Clause 1 through 5 of Article 16 in cyberspace and the acts mentioned in Clause 1 Article 17 of this Law;
b) Appropriation of property; online gambling or organization thereof; theft of service involving voice over Internet protocol (VoIP); intellectual property and copyright infringement in cyberspace;
c) Making fake websites of other organizations and individuals; forging, stealing, illegally using, trading, collecting or exchanging others’ credit information or bank accounts; illegally issuing, providing or using payment facilities;
d) Advertising or trading in banned goods/services;
dd) Instructing others to commit violations of law;
e) Other uses of cyberspace, information technology or electronic devices for violations of regulations of law on national security and public order.
2. Professional cybersecurity forces have the responsibility to prevent and respond to use of cyberspace, information technology or electronic devices for violations of regulations of law on national security and public order.
Article 19. Prevention and response to cyberattacks
1. Acts of cyberattacks and relevant acts include:
a) Spread of software programs that are harmful to a telecommunications network, the Internet, computer network, communication system, information processing and control systems, databases or electronic devices;
b) Obstructing, causing disruption, paralysis or interruption of data transmission of a telecommunications network, the Internet, computer network, communication system, information processing system or electronic device control system;
c) Infiltrating, causing damage or illegally obtaining data stored or transmitted through a telecommunications network, the Internet, computer network, communication system, information processing and control systems, databases or electronic devices;
d) Infiltrating, creating or exploiting weaknesses or vulnerabilities of a system to illegally obtain information for profiteering;
d) Producing, trading, exchanging, giving tools, equipment, software programs that are meant to attack a telecommunications network, the Internet, computer network, a communication system, information processing and control systems, database or electronic devices;
e) Other acts affecting normal operation of a telecommunications network, the Internet, computer network, communication system, information processing and control systems, database or electronic devices;
2. Administrators of information systems have the responsibility to implement technical measures for preventing the acts mentioned in Point a, b, c, d, e Clause 1 of this Article from affecting their systems.
3. In case of a cyberattack that violates or threatens to violate national security, national interests, sovereignty or disrupt public order, the professional cybersecurity force shall take charge and cooperate with the system administrator, relevant organizations and individuals in tracing the origin of the attack, collecting evidence; request TSPs, ISPs and VAS providers to filter information serving the attack and provide relevant information and documents.
4. Responsibility for prevention and response to cyberattack:
a) The Ministry of Public Security shall take charge and cooperate with relevant ministries in prevention, detection and response to the acts mentioned in Clause 1 of this Article if they violate or threaten to violate national security, national interest, sovereignty or seriously disrupt public order nationwide, except of the cases mentioned in Point b and Point c of this Clause;
b) The Ministry of National Defense shall take charge and cooperate with relevant ministries in prevention, detection and response to the acts mentioned in Clause 1 of this Article if they are committed against military information systems;
c) VGCA shall take charge and cooperate with relevant ministries in prevention, detection and response to the acts mentioned in Clause 1 of this Article if they are committed against cryptography systems under its management.
Article 20. Prevention and response to cyberterrorism
1. Competent authorities shall implement the measures against cyberterrorism provided for in this Law, Article 29 of the Law on Cyberinformation security and regulations of law against cyberterrorism.
2. Information system administrators shall regularly review and inspect their systems to eliminate the risks of cyberterrorism
3. Any sign of cyberterrorism must be promptly reported to cybersecurity forces. The authority that receives the information about cyberterrorism shall promptly notify a professional cybersecurity force.
4. The Ministry of Public Security shall take charge and cooperate with relevant ministries in prevention and response to cyberterrorism, neutralize the sources of cyberterrorism, take actions against cyberterrorism and minimize damage to information systems, except for the cases mentioned in Clause 5 and Clause 6 of this Article.
5. The Ministry of National Defense shall take charge and cooperate with relevant ministries in prevention and response to cyberterrorism against military information system.
6. VGCA shall take charge and cooperate with relevant ministries in prevention and response to cyberterrorism against cryptography systems under its management.
Article 21. Prevention and response to cybersecurity emergencies
1. Cybersecurity emergencies include:
a) Provoking information in cyberspace that might lead to riots, disruption of public order or terrorism;
b) Attack on a national security information system;
c) Large-scale and intense attacks on multiple information systems;
d) Cyberattack meant to destroy a national security work or target;
dd) Cyber attack that seriously violates national security, national interest, sovereignty, social order or the lawful rights and interests of an organization or individual.
2. Responsibility for prevention and response to cybersecurity emergencies:
a) Professional cybersecurity forces shall cooperate with administrators of national security information systems in implementing specific measures for prevention, detection and response to cybersecurity emergencies;
b) Telecommunication enterprises, Internet enterprises, IT enterprises, TSPs, ISPs, VAS providers, relevant organizations and individuals shall cooperate with professional cybersecurity forces of the Ministry of Public Security in prevention, detection and response to cybersecurity emergencies.
3. Actions to be taken in response to a cybersecurity emergency:
a) Promptly implement the cybersecurity emergency prevention and response plan; avoid, eliminate or minimize damage caused by the cybersecurity emergency;
b) Inform relevant organizations and individuals;
c) Collect relevant information; continuously monitor the cybersecurity emergency;
d) Analyze information; estimate damage and impacts caused by the cybersecurity emergency;
dd) Stop providing cyberinformation within a certain area or disconnect from the international internet gateway;
e) Provide forces and equipment for prevention and elimination of the cybersecurity emergency:
g) Other measures specified in the Law on National security.
4. Responsibility to respond to cybersecurity emergencies:
a) The organization or individual that detects a cybersecurity emergency must promptly inform a professional cybersecurity force and implement the measures mentioned in Point a and Point b Clause 3 of this Article;
b) The Prime Minister shall make decisions or authorize the Minister of Public Security to make decisions regarding cybersecurity emergencies that occur nationwide or locally or to a specific target.
The Prime Minister shall make decisions or authorize the Minister of National Defense to make decisions regarding cybersecurity emergencies that occur to cryptography of VGCA;
c) Professional cybersecurity forces shall take charge and cooperate with relevant organizations and individuals in implementing the measures mentioned in Clause 3 of this Article to respond to cybersecurity emergencies;
d) Relevant organizations and individuals shall cooperate with professional cybersecurity forces in implementing measures for prevention and response to cybersecurity emergencies.
Article 22. Cybersecurity protection activities
1. Cybersecurity protection activities are organized by professional cybersecurity forces to protect national security and public order.
2. Cybersecurity protection activities include:
a) Monitoring status of national security;
b) Prevent and respond to attacks; protect national security information systems;
c) Paralyze or limit activities using cyberspace to violate national security or public order;
d) Launch cyberattacks to protect national security and public order.
3. The Ministry of Public Security shall take charge and cooperate with relevant ministries in cybersecurity protection activities.
Tìm kiếm
Luật An ninh mạng 2018 (Bản Pdf)
Luật An ninh mạng 2018 (Bản Word)