Decision No. 71/2004/QĐ-BCA(A11) Regarding the issuance of regulations on ensuring safety and security in the management, provision, and use of Internet services in Vietnam

Pursuant to …;

Regarding the issuance of regulations on ensuring safety and security in the operation of management, provision, and use of Internet services in Vietnam

management, provision, and use of Internet services in Vietnam

                                         

THE MINISTER OF PUBLIC SECURITY

Pursuant to Decree No. 136/2003/NĐ-CP dated November 14, 2003 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Public Security;

Pursuant to Decree No. 55/2001/ND-CP dated August 23, 2001 of the Government on management, provision, and use of Internet services;

At the proposal of the Director of the General Department of Security,

DECISION:

Article 1. This Decision promulgates the "Regulations on Ensuring Safety and Security in the Operation of Management, Provision, and Use of Internet Services in Vietnam."

Article 2. This Decision shall take effect fifteen days from the date of publication in the Official Gazette and shall supersede Decision No. 848/1997/QĐ-BNV (A11) dated October 23, 1997 of the Minister of Home Affairs (now the Ministry of Public Security) promulgating Regulations on Measures and Equipment for Inspection and Control to Ensure National Security in Internet Activities in Vietnam.

Article 3. Functional units of the Ministry of Public Security, organizations, units, enterprises providing Internet services, Internet agents, and users of Internet services in Vietnam are responsible for implementing this Decision.

REGULATIONS

ON ENSURING SAFETY AND SECURITY IN THE OPERATION OF MANAGEMENT, PROVISION, AND USE OF INTERNET SERVICES IN VIETNAM

(Issued together with Decision No. 71/2004/QĐ-BCA (A11) dated January 29, 2004 of the Minister of Public Security)

Chapter I:

GENERAL PROVISIONS

Article 1. These regulations apply to entities such as enterprises, units providing Internet services (Internet Exchange Point - IXP, Internet Service Provider - ISP, Internet Operating Service Provider - OSP, Internet Content Provider - ICP, Private Internet Service Provider - Private ISP); Internet agents (agents providing access services, Internet application services), and individuals using Internet services in Vietnam.

Article 2. Ensuring safety and security in Internet activities in Vietnam includes protecting the systems, equipment, information, and data in databases and networks of subjects participating in Internet operations to ensure stability; ensuring that information circulating on the Internet is uninterrupted, intact, fast, and timely; proactively preventing, detecting, and stopping actions exploiting Internet services to infringe upon national security and public order.

Article 3. Ensuring safety and security in Internet activities is the responsibility of state agencies, organizations, and individuals. The Ministry of Public Security is the state administrative agency responsible for ensuring security in Internet activities, having the authority to inspect, control, and supervise information on the Internet according to the provisions of the law.

Article 4. Every organization, enterprise, and individual participating in Internet activities in Vietnam must be responsible for the contents of information they store and transmit on the Internet; subject to management, inspection, supervision, and implementation of requirements to ensure safety and security in Internet activities as stipulated in these regulations and other relevant laws.

Article 5. Strictly prohibited are the following acts:

1. Exploiting the Internet to engage in activities that infringe upon national security, public order and safety, violate social customs and morals, the cultural identity of Vietnam, and the legitimate rights and interests of organizations and citizens, as well as committing criminal acts through any form or means.

2. Storing on computers connected to the Internet information, documents, and data classified as state secrets.

3. Using cryptographic methods contrary to the provisions of the law on official seals.

4. Accessing foreign Internet service providers by directly dialing international phone numbers; using or instructing others to use tools to access websites banned by competent state authorities; sending, spreading, disseminating computer viruses, software programs with features to steal information and destroy computer data onto the Internet; disrupting, hindering the provision and use of Internet services; establishing websites and organizing forums on the Internet with content guiding, enticing, and inciting others to commit such acts.

5. Exploiting positions and powers in state administration regarding information security to obstruct the lawful activities of Internet service participants; infringing upon the legitimate rights and interests of agencies, organizations, and citizens.

Chapter II:

SPECIFIC PROVISIONS

Article 6. Internet service providers shall be responsible for:

1. Having technical equipment commensurate with the scale of their operations to implement management, inspection, and supervision to ensure system safety, prevent information prohibited by law from being stored or transmitted on the Internet through systems under their management.

2. Establishing operational rules, exploitation, and usage guidelines for Internet services provided by the enterprise. Organizing propaganda, guidance, and inspection of implementation for enterprises using services (for ICPs, these are members providing content information on the Internet), Internet agents, Internet service users, and internal staff of the enterprise.

3. Cooperating with functional units of the Ministry of Public Security and state agencies with authority to detect, prevent, and handle acts exploiting the Internet to engage in activities that infringe upon national security and social order and safety.

4. Immediately cease providing Internet services to subjects who exploit the Internet to engage in activities against the Socialist Republic of Vietnam, thereby harming national security.

5. Arranging premises, network access points, and necessary technical conditions for functional units under the Ministry of Public Security to carry out tasks related to protecting national security in Internet activities.

Internet Service Providers (ISPs), Internet Service Operators (OSPs), Internet Information Service Providers (ICPs), and dedicated Internet Service Providers (dedicated ISPs) shall be responsible for:

Article 7. 1. Having firewall systems commensurate with the scale of each enterprise's operations to ensure detection and prevention of information prohibited by law as stipulated in Decree No. 55/2001/ND-CP, as well as protection of the safety of the enterprise's and unit's system equipment, information, and data.

2. Information put into and transmitted on the Internet must be retained on the enterprise's or unit's server for 15 days, the retention period starting from when the information reaches/reaches the server.

3. Organizing training for Internet agent staff to thoroughly understand state regulations on information security in Internet activities, appropriate technical solutions for agents to effectively guide customers to use services for healthy purposes, and promptly detect and prevent customers engaging in violations of Decree No. 55.

4. Internet Service Providers (ISPs and dedicated ISPs) must cooperate to prevent acts exploiting their system equipment, networks, and services to cause disruption, destruction, and obstruction of Internet service provision and use.

Internet agents shall be responsible for:

Article 8. 1. Adhering to legal provisions regarding Internet information security assurance. Establishing and publicly posting usage rules at exploitation points.

2. Information related to service users must be retained on the agent's server for 30 days, the retention period starting from when the information reaches/reaches the server.

3. Maintaining a registration book for service usage that comprehensively details customer information including: name, address, ID card number or passport number, time of service use. Must have measures to prevent access to web pages with harmful content on the Internet and install software programs to manage customer information in real-time.

4. Arranging technically qualified staff familiar with state regulations on the Internet at exploitation points to guide customers to use services for healthy purposes, and promptly detect and prevent customers engaging in violations of Internet-related laws.

5. Providing complete data on technical configuration, connection diagrams, and information traffic within the managed agency area truthfully, in detail, and fully to competent state management agencies when requested.

6. Cooperating with public security agencies and other state agencies with authority to implement requirements for ensuring information security and safety.

Internet users shall be responsible for:

Article 9. 1. Being legally accountable for content posted and transmitted on the Internet.

2. When receiving information that harms national security, social order, and safety, violates customs and Vietnamese cultural identity, they must not print, copy, disseminate, and report immediately to the nearest public security agency for handling.

3. Protecting passwords, encryption keys, personal information content, and safeguarding their own Internet system equipment.

Organizations, individuals participating in Internet activities shall be responsible for implementing the following information and reporting systems:

Article 10. 1. After obtaining permission to provide Internet services, enterprises and units must report to the General Department of Security - Ministry of Public Security the network connection diagram, plans, measures, and equipment to ensure safety and security in Internet activities, a list of key personnel of the enterprise or unit, and brief biographies of network administrators, system managers, and network operation staff, no later than 15 days before the inter-ministerial inspection team conducts an actual inspection according to Circular No. 04/2001/TT-TCBĐ dated November 20, 2001 of the General Post Office (now the Ministry of Posts and Telecommunications).

1. Enterprises and units, after being granted permission to provide Internet services, must report to the General Bureau of Security - Ministry of Public Security the network connection diagram, plans, measures, and equipment ensuring safety and security during Internet operations, a list of key staff members of the enterprise or unit, and brief resumes of network administrators, system administrators, and network operation personnel not later than 15 days before the inter-ministerial inspection team conducts on-site inspections according to the guidelines set forth in Circular No. 04/2001/TT-TCBD dated November 20, 2001, issued by the General Post Office Administration (now the Ministry of Posts and Telecommunications).

2. Every six months, enterprises providing Internet services shall be responsible for reporting to the Security General Department - Ministry of Public Security the results of their work on ensuring safety and security in the provision and use of Internet services, changes and additions to the structure of their network, lists of Internet agents, and subscribers using their services; compile a list of information providers and types of electronic news on the Internet according to a unified model and closely monitor and manage them.

3. Timely detect and report to public security agencies any activities violating information safety and security, attacks and destruction of system equipment, hindrances to the provision of Internet services, and other violations of the law; closely cooperate with public security agencies during the process of verifying and clarifying the content of violation cases, and provide necessary information and documents related to the case upon request.

Article 11. The Ministry of Public Security assigns the Security General Department to serve as the permanent agency assisting the leadership of the Ministry of Public Security in directing and organizing work to ensure safety and security in Internet activities, and shall be responsible for:

1. Organizing and implementing technical measures to inspect, control, and supervise information on the Internet in accordance with the provisions of the law.

2. Guiding organizations, individuals participating in Internet activities to implement preventive work against the use of Internet services to harm national security and social order and safety.

3. Guiding provincial and centrally-administered city public security agencies in organizing and implementing work to ensure safety and security in Internet activities in their respective localities.

Article 12. The Security General Department shall direct relevant business units and local public security agencies:

1. Every six months, organize inspections of the implementation of measures to ensure information safety and security in Internet activities by service providers in accordance with the contents stipulated in this Regulation.

2. Coordinate with the specialized Postal Telecommunications and Information Technology Inspectorate and the specialized Culture and Information Inspectorate to conduct inspections, checks, and handle violations in Internet activities in accordance with the provisions of the law.

Article 13. Organizations, individuals violating regulations on information safety and security in the management, provision, and use of Internet services shall be subject to administrative penalties depending on the nature and degree of violation as prescribed in Articles 41 and 45 of Decree No. 55. Specifically as follows:

1. A fine of VND 200,000 to VND 1,000,000 for one of the following violations:

a) Using another person's password, encryption key, or personal information to illegally access and use Internet services.

b) Using software tools to illegally access and use Internet services.

2. A fine of VND 1,000,000 to VND 5,000,000 for one of the following violations:

a) Violating state regulations on the encryption and decryption of information on the Internet when using Internet services.

b) Violating state regulations on information safety and security on the Internet when using Internet services.

3. A fine of from VND 10,000,000 to VND 20,000,000 shall be imposed for any of the following violations:

a) Violating state regulations on the encryption and decryption of information on the Internet when providing Internet services.

b) Violating state regulations on information safety and security on the Internet when providing Internet services.

c) Using the Internet with the purpose of threatening, harassing, or insulting others' dignity and reputation without reaching the level of criminal prosecution.

d) Posting or exploiting the Internet to disseminate pornographic information or other content contrary to legal provisions on Internet content without reaching the level of criminal prosecution.

đ) Stealing passwords, encryption keys, or personal information of organizations or individuals and disseminating it to others for use.

e) Violating regulations on the operation, exploitation, and use of computers causing disruptions, blocking, or altering, destroying data on the Internet without reaching the level of criminal prosecution.

4. A fine of VND 20,000,000 to VND 50,000,000 for creating and intentionally spreading computer viruses on the Internet without reaching the level of criminal prosecution.

5. In addition to administrative penalties, depending on the nature and degree of violation, organizations and individuals may also be subject to supplementary penalties or remedial measures as follows:

a) Temporarily suspending or stopping the provision and use of Internet services for violations at points 1, points 2, points 3, and point 4 of Clause 3 of Article 13 of this Regulation.

b) Compelling restoration to the original condition before being changed due to administrative violations for violations at point e of Clause 3 and Clause 4 of Article 13 of this Regulation.

6. Acts of exploiting the Internet to oppose the Socialist Republic of Vietnam and disrupt public order, and other serious violations indicating criminal offenses will be prosecuted criminally in accordance with the provisions of the law.

Chapter III:

IMPLEMENTING PROVISIONS

Article 14. Based on this Regulation, organizations and enterprises providing Internet services in Vietnam shall establish internal Internet management regulations, manage users, manage content, and technical measures for checking, monitoring, and ensuring information safety and security in Internet activities.

Article 15.

1. The Security General Department - Ministry of Public Security shall direct relevant business units to coordinate with competent agencies of the Ministry of Posts and Telecommunications, the Ministry of Culture and Information, and related ministries, sectors, and localities to examine technical solutions to ensure safety and security in Internet activities of organizations, units, and enterprises providing Internet services from the time of licensing and periodically check the organization and implementation of this Regulation.

2. Agencies, organizations, and individuals encountering difficulties during the implementation of this Regulation should reflect these issues to the Ministry of Public Security (through the Security General Department) for timely guidance and resolution.