Joint Circular No. 06/2008/TTLT-BTTTT-BCA on ensuring the safety of infrastructure and information security in postal, telecommunications, and information technology activities

JOINT CIRCULAR

On ensuring the safety of infrastructure and information security in

 postal, telecommunications, and information technology activities

__________________________

 

Pursuant to the Law on Information Technology 2006;

Pursuant to the National Security Law 2004;

Pursuant to the Ordinance on Postal Services and Telecommunications 2002;

Pursuant to Decree No. 160/2004/NĐ-CP dated September 3, 2004 detailing certain provisions of the Ordinance on Postal Services and Telecommunications regarding telecommunications;

Pursuant to Decree No. 157/2004/NĐ-CP dated August 18, 2004 detailing certain provisions of the Ordinance on Postal Services and Telecommunications regarding postal services;

Pursuant to Decree No. 128/2007/NĐ-CP dated August 2, 2007 on express delivery services;

Pursuant to Decree No. 187/2007/NĐ-CP dated December 25, 2007 on the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications;

Pursuant to Decree No. 136/2003/NĐ-CP dated November 14, 2003 on the functions, tasks, powers, and organizational structure of the Ministry of Public Security;

Pursuant to Decree No. 151/2005/NĐ-CP dated December 14, 2005 on the powers and responsibilities of agencies and specialized staff for national security protection;.

The Ministry of Information and Communications and the Ministry of Public Security hereby jointly issue guidelines on ensuring the safety of infrastructure and information security in postal, telecommunications, and information technology activities as follows:

I. GENERAL PROVISIONS

This Circular applies to units under the Ministry of Education and Training; departments of education and training, education and training divisions; preschool education institutions, general education institutions, regular education institutions, teacher training colleges, college of education, universities, universities, academies, other educational institutions, and related organizations and individuals (hereinafter referred to collectively as agencies and units).

a. These Circulars guide the measures to ensure the safety of infrastructure and information security in postal, express delivery, telecommunications, Internet, broadcasting, and information technology activities (hereinafter referred to as postal, telecommunications, and information technology activities);

b. These Circulars apply to organizations and individuals involved in establishing networks; providing and using services; producing, trading equipment; and constructing and installing postal, telecommunications, and information technology facilities in Vietnam.

2. Explanation of terms

a. Ensuring the safety of infrastructure means the integrity of the system of equipment, networks, and facilities for postal, telecommunications, and information technology; the integrity and confidentiality of letters, postal items, parcels, packages, goods, and information transmitted through postal, telecommunications, and information technology networks; the safety of parties involved in the establishment, provision, and use of postal, telecommunications, and information technology services;

b. Ensuring information security involves management, control, prevention, detection, blocking, and combating actions that use or exploit postal, telecommunications, and information technology infrastructure to infringe upon national security and public order and social safety, and citizens' interests.

3. General principles for ensuring the safety of infrastructure and information security

a. Parties participating in postal, telecommunications, and information technology activities have the responsibility to ensure the safety of infrastructure and information security, promptly detect and rectify incidents; bear legal responsibility for the content of letters, postal items, parcels, packages, goods, and information they store and transmit through postal, telecommunications, and information technology networks;

b. Ensuring the safety of infrastructure and information security in postal, telecommunications, and information technology activities shall not hinder the production and business operations of postal, telecommunications, and information technology enterprises and harm the legitimate rights and interests of parties involved in postal, telecommunications, and information technology activities;

c. Only authorized personnel from specialized agencies responsible for national security protection as stipulated in Article 9 of Decree No. 151/2005/NĐ-CP dated December 14, 2005 on the powers and responsibilities of agencies and specialized staff for national security protection shall have the authority to monitor information security in postal, telecommunications, and information technology activities;

d. Acts violating the safety of infrastructure and information security must be detected promptly and dealt with strictly in accordance with the law.

4. Prohibited acts

a. Providing, using, or exploiting infrastructure and postal, telecommunications, and information technology services to infringe upon national security, public order, and social safety, causing adverse effects on ethnic customs and traditions;

b. Illegally obstructing postal, telecommunications, and information technology activities;

c. Destroying, damaging, or destroying postal, telecommunications, and information technology facilities or using networks, equipment, hardware, and software tools to cause interference, disruption of postal, telecommunications, and information technology infrastructure operations;

d. Stealing and improperly using passwords, encryption keys, and personal information of organizations and individuals; illegally preventing access to information of organizations and individuals;

đ. Producing, purchasing, selling, storing, transporting, using counterfeit postal stamps; appropriating, opening, swapping, disclosing the contents of letters, postal items, parcels, packages, goods, and information transmitted through postal, telecommunications, and information technology networks;

e. Other illegal acts related to postal, telecommunications, and information technology activities.

II. ENSURING THE SAFETY OF INFRASTRUCTURE AND INFORMATION SECURITY

1. Ensuring the safety of infrastructure in postal, telecommunications, and information technology activities

The content of ensuring the safety of infrastructure in postal, telecommunications, and information technology activities includes:

a. Protecting postal, telecommunications, and information technology infrastructure to prevent attacks, intrusions, and destruction; preventing and combating fires, explosions, and other accidents caused by natural disasters, humans, and animals;

b. Implementing solutions and backup systems to ensure continuous and safe operation of postal, telecommunications, and information technology infrastructure;

c. Implementing measures to prevent the use or exploitation of networks, equipment, hardware, and software tools to obstruct, interfere with, disrupt, damage, or destroy postal, telecommunications, and information technology infrastructure operations; preventing and combating viruses, spam, spyware; preventing and combating acts of stealing and improperly using passwords, encryption keys, and personal information of organizations and individuals;

d. Ensure the safety of equipment and personnel operating postal, telecommunications, and information technology networks;

đ. Inspect, monitor, and handle violations related to the safety of infrastructure in postal, telecommunications, and information technology activities;

2. Ensure information security in postal, telecommunications, and information technology activities

The content of ensuring information security in postal, telecommunications, and information technology activities includes:

a. Implement operational measures and control information transmitted through postal, telecommunications, and information technology networks in accordance with the provisions of the law to detect, prevent, and promptly address violations; stop the provision and use of services and take measures against cases where the network and services of postal, telecommunications, and information technology are used for activities that infringe upon national security, public order, and social safety;

b. Implement solutions and measures to ensure the security of state secrets, personal information of organizations and individuals, contents of letters, parcels, packages, goods, and information transmitted through postal, telecommunications, and information technology networks;

c. Coordinate in granting permits and setting conditions for business operations to ensure information security for postal, telecommunications, and information technology activities;

d. Inspect, monitor, and handle violations related to information security in postal, telecommunications, and information technology activities.

III. RESPONSIBILITIES FOR ENSURING INFRASTRUCTURE SAFETY AND INFORMATION SECURITY

1. Responsibilities of the Ministry of Information and Communications

a. Direct and guide organizations, individuals, postal, telecommunications, and information technology enterprises to implement legal regulations on infrastructure safety: inspect, monitor, and handle violations concerning the safety of infrastructure in postal, telecommunications, and information technology activities;

b. Coordinate with the Ministry of Public Security to ensure information security, inspect, monitor, and handle organizations and individuals violating regulations on ensuring information security in postal, telecommunications, and information technology activities;

c. In emergency situations as prescribed by law, decide to mobilize part or all of the postal, telecommunications, and information technology infrastructure to serve security and defense tasks;

d. Lead the development, issuance, and implementation of technical standards and specifications for infrastructure safety in postal, telecommunications, and information technology;

đ. Compile a list of important projects related to national security and other critical infrastructure targets in postal, telecommunications, and information technology to be guarded by armed forces, along with documentation submitted to the competent authority for review and approval in accordance with the law;

e. Regarding licensing

- Lead the review and issuance of business licenses, trial network and service testing licenses for telecommunications, Internet, postal, and express delivery services, and notify the Ministry of Public Security in writing;

- Lead and coordinate with the Ministry of Public Security to review and issue licenses for foreign-invested express delivery enterprises, licenses for foreign organizations and individuals in Vietnam to establish private telecommunications networks, private Internet networks, and use radio frequency and broadcasting equipment;

- Lead and coordinate with the Ministry of Public Security and the Ministry of National Defense to review and issue licenses for laying submarine telecommunications cables within Vietnam's territorial waters as stipulated in Article 46 and Article 47 of Decree No. 160/2004/NĐ-CP dated September 3, 2004 detailing the implementation of certain provisions of the Postal and Telecommunications Ordinance on telecommunications;

- Lead and coordinate with the Ministry of Public Security and the Ministry of National Defense to review and issue licenses for vessels and ships conducting surveys, construction, maintenance, and repair of submarine telecommunications cables within Vietnam's territorial waters;

2. Responsibilities of the Ministry of Public Security

a. Direct and implement information security assurance work, crime prevention, and other law violations in the postal, telecommunications, and information technology sectors; inspect, monitor, and handle violations by organizations and individuals who violate regulations on ensuring information security in postal, telecommunications, and information technology activities;

b. Direct local police units to closely cooperate with agencies and organizations under the Ministry of Information and Communications to ensure infrastructure safety, inspect, monitor, and handle violations by organizations and individuals who violate regulations on ensuring infrastructure safety in postal, telecommunications, and information technology activities;

c. Organize research and investment in scientific and technological activities aimed at enhancing the application of information technology in national security assurance work and maintaining public order and social safety. Implement operational measures and invest in installing systems and equipment to serve monitoring and ensuring infrastructure safety and information security for the Ministry of Public Security;

d. Direct local police units to deploy People's Armed Police forces to guard and protect important projects related to national security and other critical infrastructure targets in postal, telecommunications, and information technology;

đ. Specialized agencies responsible for national security protection under local police units, when discovering information, documents, data, and items related to activities that infringe upon national security as stipulated in Article 3 of Decree No. 151/2005/NĐ-CP dated December 14, 2005 on the powers and responsibilities of specialized agencies and personnel for national security protection, must comply with the following provisions:

- Require organizations and individuals to provide relevant information, data, figures, documents, and items;

- Carry out measures to seize, copy information, data, figures, documents, and items, or parts or all of related equipment systems within their authority;

- Prevent access to equipment systems, networks, and service usage;

- Perform other duties and exercise other powers as prescribed by law;

e. Local police units responsible for specialized national security protection have the responsibility to provide operational guidance to protective forces of organizations managing and operating postal, telecommunications, and information technology infrastructure based on contracts between both parties;

g. Pay transmission channel rental fees for information security assurance work as prescribed.

h. Regarding licensing

- For granting licenses to foreign investment enterprises: within twenty days from the date of receiving the request from the Ministry of Information and Communications and the valid application file, the specialized agency responsible for security shall advise and assist the leadership of the Ministry of Public Security in reviewing the contents related to ensuring the safety of infrastructure and information security in the license application file and respond in writing to the Ministry of Information and Communications.

- For granting licenses to foreign organizations and individuals in Vietnam to establish private telecommunications networks, private Internet networks, and use radio frequency bands and radio transmitters: within ten days from the date of receiving the request from the Ministry of Information and Communications and the valid application file of foreign organizations and individuals, the specialized agency responsible for security shall advise and assist the leadership of the Ministry of Public Security in responding in writing to the Ministry of Information and Communications. In special cases, for foreign organizations and individuals in Vietnam enjoying diplomatic or consular privileges and immunities, within three working days from the date of receiving the request from the Ministry of Foreign Affairs and the valid application file for licensing, the specialized agency responsible for security shall advise and assist the leadership of the Ministry of Public Security in responding in writing to the Ministry of Foreign Affairs and the Ministry of Information and Communications.

- For granting licenses to install submarine telecommunication cables in Vietnam's territorial waters: within fifteen days from the date of receiving the request from the Ministry of Information and Communications and the valid application file of the organization applying for cable installation, the specialized agency responsible for security shall advise and assist the leadership of the Ministry of Public Security in responding in writing to the Ministry of Information and Communications.

- For granting licenses to vessels and boats operating survey, construction, installation, maintenance, repair of submarine cables in Vietnam's territorial waters: within five working days from the date of receiving the request from the Ministry of Information and Communications and the valid application file of the organization applying for vessel and boat operation permission, the specialized agency responsible for security shall advise and assist the leadership of the Ministry of Public Security in responding in writing to the Ministry of Information and Communications.

3. Responsibilities of postal, telecommunications, and information technology enterprises

a. Develop plans and implement measures to ensure the safety of infrastructure and information security commensurate with the scale of the network, services, and global technological trends;

b. Research and develop technologies to enhance the security of postal and telecommunications networks; develop contingency plans for networks and equipment to respond to emergencies and incidents to ensure information security and continuous, safe operation of postal, telecommunications, and information technology networks and services;

c. Establish and promulgate procedures and regulations to coordinate with police, military, and self-defense forces to ensure the safety of infrastructure and information security;

d. Provide necessary information, data on technology and system engineering and new projects approved in the field of postal, telecommunications, and information technology to relevant units under the Ministry of Public Security to serve the work of ensuring the safety of infrastructure and information security;

đ. Invest in and install systems and equipment to serve the work of ensuring information security at the enterprise level according to Decision No. 70/2007/QĐ-TTg dated May 21, 2007 of the Government Chairman regarding the investment in information security systems for telecommunications networks in Vietnam;

e. Allocate space, network access points, connection ports, and other necessary technical conditions for the task of ensuring information security as required by the Ministry of Public Security and the Ministry of Information and Communications. Ensure favorable conditions for national security protection agencies to carry out operational measures in accordance with the law to protect national security, public order, and social safety;

g. Provide complete and timely information, documents, data, and materials to the specialized agency responsible for national security protection when requested in writing by authorized persons as stipulated in Article 4 of Decree No. 151/2005/NĐ-CP dated December 14, 2005 on the powers and responsibilities of agencies and specialized personnel for national security protection;

h. Closely cooperate with business units under the Ministry of Public Security and the Ministry of Information and Communications:

- Collect, analyze, evaluate, and forecast information related to network incidents, weaknesses, and vulnerabilities in infrastructure safety and information security; propose measures to address and strengthen the ability to prevent and combat external attacks.

- Promptly handle technical incidents affecting the ability to control infrastructure safety and information security of equipment managed and operated by enterprises.

- Implement measures to protect the safety of postal, telecommunications, and information technology infrastructure; promptly detect, prevent, and immediately stop the provision and use of services in cases where networks and services of postal, telecommunications, and information technology are used to engage in activities that infringe upon national security, public order, and social safety;

i. Ensure the confidentiality of personal information related to users of postal, telecommunications, and information technology services in accordance with the law.

k. Organize training and develop human resources for infrastructure safety and information security in line with the scale of the network and the scope of business operations of the enterprise. Build a security force; equip security means; conduct patrols, guard duties; conduct surprise and regular inspections of the security work of postal, telecommunications, and information technology networks;

l. Promote the purpose, role, and significance of ensuring infrastructure safety and information security; guide organizations and individuals using postal, telecommunications, and information technology networks and services to comply with regulations on ensuring infrastructure safety and information security.

IV. INSPECTION, AUDIT, AND HANDLING OF VIOLATIONS

1. Units under the Ministry of Information and Communications and the Ministry of Public Security shall regularly or at random inspect and audit the safety of infrastructure and information security in postal, telecommunications, and information technology activities. Postal, telecommunications, and information technology enterprises and related organizations and individuals must provide all favorable conditions for competent state agencies when conducting inspections and audits.

2. Organizations and individuals who violate regulations on the safety of infrastructure and information security in postal, telecommunications, and information technology activities shall be subject to administrative penalties or criminal prosecution, depending on the nature and degree of violation, as provided by law.

V. IMPLEMENTATION

1. The Ministry of Information and Communications and the Ministry of Public Security, within their respective functions, tasks, and authorities, shall guide organizations and individuals in implementing measures to ensure the safety of infrastructure and information security in postal, telecommunications, and information technology activities.

2. People's Committees of provinces and centrally governed cities shall direct provincial Departments of Information and Communications, public security departments of provinces and centrally governed cities, and postal, telecommunications, and information technology enterprises operating within their jurisdiction to strictly comply with the provisions of this circular.

3. Every six months, provincial Departments of Information and Communications and public security departments of provinces and centrally governed cities shall compile the situation regarding network safety and information security in the postal, telecommunications, and information technology sector and report it to the Chairpersons of the People's Committees of provinces and centrally governed cities, along with proposals for implementation strategies.

4. Annually, postal, telecommunications, and information technology enterprises shall conduct mid-term reviews, make recommendations, propose initiatives, commend achievements, and report on work related to ensuring the safety of infrastructure and information security to relevant management agencies, and report to the Ministry of Information and Communications and the Ministry of Public Security.

5. This Circular shall take effect fifteen days from the date of publication in the Official Gazette and shall replace Joint Circular No. 01/2001/TTLT-TCBĐ-BCA dated June 7, 2001, issued by the General Post Office Administration and the Ministry of Public Security guiding the assurance of network safety and information security in postal and telecommunications activities. In the course of implementation, if difficulties or obstacles arise, organizations and individuals shall reflect them to the Ministry of Information and Communications and the Ministry of Public Security for timely guidance.

During the implementation process, if difficulties or obstacles arise, organizations and individuals shall reflect them to the Ministry of Information and Communications and the Ministry of Public Security for timely guidance./.