Chương 1 Luật An toàn thông tin mạng 2015: Những quy định chung

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

This Law prescribes cyberinformation security activities, and rights and responsibilities of agencies, organizations and individuals in ensuring cyberinformation security; civil cryptography; standards and technical regulations on cyberinformation security; trading in the field of cyberinformation security; development of human resources for cyberinformation security; and state management of cyberinformation security.

Article 2. Subjects of application

This Law applies to Vietnamese agencies, organizations and individuals and foreign organizations and individuals directly involved in or related to cyberinformation security activities in Vietnam.

Article 3. Interpretation of terms

In this Law, the terms below are construed as follows:

1. Cyberinformation security means the protection of information and information systems in cyberspace from being illegally accessed, utilized, disclosed, interrupted, altered or sabotaged in order to ensure the integrity, confidentiality and usability of information.

2. Cyberspace means an environment where information is provided, transmitted, collected, processed, stored and exchanged over telecommunications networks and computer networks.

3. Information system means a combination of hardware, software and databases established to serve the creation, provision, transmission, collection, processing, storage and exchange of information in cyberspace.

4. National important information system means an information system which, when being sabotaged, will cause extremely serious harms to national defense and security.

5. Managing body of an information system means an agency, organization or individual competent to directly manage an information system.

6. Infringement upon cyberinformation security means an act of illegally accessing, utilizing, disclosing, interrupting, altering or sabotaging information or information systems.

7. Cyberinformation security incident means an incident that harms information or an information system, affecting the integrity, confidentiality or usability of information.

8. Cyberinformation security risk means a subjective factor or an objective factor that is likely to affect the status of cyberinformation security.

9. Cyberinformation security risk assessment means the detection, analysis and estimation of levels of harm and threats to information or information systems.

10. Cyberinformation security risk management means the introduction of measures to minimize cyberinformation security risks.

11. Malicious software (malware) means software that is likely to cause abnormal operation to part or the whole of an information system or that illegally copies, alters or deletes information stored in such information system.

12. Malware filtering system means a combination of hardware and software connected to a network to detect, prevent, filter, and collect statistics of, malware.

13. Electronic address means an address used to send and receive information in cyberspace, including email address, telephone number, internet address and other similar forms.

14. Information-related conflict means two or more domestic and foreign organizations using communication technological or technical measures to harm information or information systems in cyberspace.

15. Personal information means information associated with the identification of a specific person.

16. Owner of personal information means a person identified based on such information.

17. Processing of personal information means the performance of one or some operations of collecting, editing, utilizing, storing, providing, sharing or spreading personal information in cyberspace for commercial purpose.

18. Civil cryptography means cryptographic techniques and products used to keep secret or authenticate information not classified as state secret.

19. Cyberinformation security product means hardware or software functioning to protect information and information systems.

20. Cyberinformation security service means the service of protecting information and information systems.

Article 4. Principles of ensuring cyberinformation security

1. All agencies, organizations and individuals shall ensure cyberinformation security. Cyberinformation security activities must comply with law and ensure national defense and security and state secrets, firmly maintain political stability and social order and safety, and promote socio-economic development.

2. Organizations and individuals may not infringe upon cyberinformation security of others.

3. The response to cyberinformation security incidents must guarantee lawful rights and interests of organizations and individuals and may not infringe upon privacy, personal and family secrets of individuals and private information of organizations.

4. Cyberinformation security activities shall be conducted in a regular, continuous, prompt and effective manner.

Article 5. State policies on cyberinformation security

1. To step up training and development of human resources for cyberinformation security and construction of cyberinformation security technical infrastructure to meet the requirements of political stability, socio-economic development, and assurance of national defense and security and social order and safety.

2. To encourage the research, development and application of technical, technological, export support and market expansion measures for domestically produced cyberinformation security products and services; to facilitate the import of modem products and technologies that cannot be domestically produced or provided yet.

3. To ensure a fair competitive environment for the provision of cyberinformation security products and services; to encourage and create conditions for organizations and individuals to participate in investment, research, development and provision of cyberinformation security products and services.

4. The State shall allocate funds for ensuring cyberinformation security for state agencies and national important information systems.

Article 6. International cooperation on cyberinformation security

1. International cooperation on cyberinformation security must adhere to the following principles:

a/ Respect for national independence, sovereignty and territorial integrity, non-intervention into one another’s internal affairs, equality, and mutual benefit;

b/ Compliance with Vietnamese law and treaties to which the Socialist Republic of Vietnam is a contracting party.

2. Contents of international cooperation on cyberinformation security include:

a/ International cooperation in training in, and research and application of cyberinformation security sciences, techniques and technologies;

b/ International cooperation in prevention and control of violations of the law on cyberinformation security; investigation of and response to cyberinformation security incidents, and preclusion of the taking advantage of cyberspace for terrorist purposes;

c/ Other activities of international cooperation on cyberinformation security.

Article 7. Prohibited acts

1. Blocking the transmission of information in cyberspace, or illegally intervening, accessing, harming, deleting, altering, copying or falsifying information in cyberspace.

2. Illegally affecting or obstructing the normal operation of information systems or the users’ accessibility to information systems.

3. Illegally attacking, or nullifying cyberinformation security protection measures of, information systems; attacking, seizing the right to control, or sabotaging, information systems.

4. Spreading spams or malware or establishing fake and deceitful information systems.

5. Illegally collecting, utilizing, spreading or trading in personal information of others; abusing weaknesses of information systems to collect or exploit personal information.

6. Hacking cryptographic secrets and lawfully enciphered information of agencies, organizations or individuals; disclosing information on civil cryptographic products or information on clients that lawfully use civil cryptographic products; using or trading in civil cryptographic products of unclear origin.

Article 8. Handling of violations of the law on cyberinformation security

Violators of this Law shall, depending on the nature and severity of their violations, be disciplined, administratively sanctioned or examined for penal liability and, if causing damage, pay compensation in accordance with law.