Decree No. 73/2007/ND-CP On research, production, business operation, and use of cryptographic means for protecting information not within the scope of state secrets

DECREE

On research, production, business operation, and use of cryptographic codes

to protect information not within the scope of state secrets

______________________

Pursuant to the Law on Organization of the Government dated December 25, 2001;

Pursuant to the Official Seal Law dated April 15, 2001;

Considering the proposal of the Director of the Government Official Seal Board.

DECREE

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Decree stipulates on research, production, business operation, and use of cryptographic codes to protect information not within the scope of state secrets; management of civil cryptographic codes, inspection, supervision, handling of violations, and resolution of complaints and denunciations regarding civil cryptographic codes.

Article 2. Applicability

This Decree applies to organizations and individuals participating in activities related to research, production, business operation, and use of cryptographic codes to protect information not within the scope of state secrets. In cases where international treaties to which the Socialist Republic of Vietnam is a party have different provisions from those of this Decree, the provisions of such international treaties shall apply.

Article 3. Explanation of Terms

2. Self-generated and self-consumed electricity is electricity produced and consumed by an organization or individual to serve their own needs.

1. "Information not within the scope of state secrets" means information that does not fall under the content of "top secret," "secret," and "confidential" as defined in the State Secrets Protection Ordinance dated December 28, 2000.

2. "Cryptographic code" refers to specific rules and conventions used to change the form of information representation with the purpose of keeping the content of the information confidential.

3. "Civil cryptographic code" is a cryptographic code used to protect information not within the scope of state secrets.

4. "Civil cryptographic product" includes documents, technical equipment, and software programs used for cryptographic purposes to protect information not within the scope of state secrets.

5. "Business operation of civil cryptographic products" involves implementing one or more stages of the investment process, from production to consumption of civil cryptographic products or provision of civil cryptographic services on the market with the aim of generating profit.

6. "Civil cryptographic service" includes advisory, supply, installation, training, warranty, repair services for series of civil cryptographic products, and other related services to protect information not within the scope of state secrets.

Article 4. Technical standards and application of technical standards for civil cryptographic products

1. The list of civil cryptographic products required to comply with national technical standards during each period shall be established by the Government Official Seal Board in collaboration with the Ministry of Science and Technology, submitted to the competent authority for promulgation. This list will be reviewed annually to supplement civil cryptographic products that must comply with national technical standards according to current regulations.

2. The list of civil cryptographic products required to obtain conformity certification in accordance with national technical standards during each period shall be established by the Government Official Seal Board in collaboration with the Ministry of Science and Technology, submitted to the competent authority for promulgation based on the list of civil cryptographic products required to comply with national technical standards as stipulated in Clause 1 of this Article.

Article 5. State policy on research of civil cryptographic codes, production, business operation, and use of civil cryptographic products

1. Emphasize investment in building material and technical infrastructure, and training human resources to serve state management in the field of civil cryptography.

2. Encourage scientific research, application, and technological development to support activities in the field of civil cryptography.

3. Encourage and create conditions for organizations and individuals to use civil cryptographic products that meet the requirements of economic and social development.

4. Ensure the rights and legitimate interests of organizations and individuals participating in research on civil cryptographic codes; production, business operation, and use of civil cryptographic products in accordance with the law.

5. Encourage expansion of international cooperation in the field of civil cryptography.

Article 6. Prohibited acts in the activities of civil cryptography research, production, business operation, and use of civil cryptographic products

1. Propaganda that distorts and opposes the policies of the Communist Party of Vietnam, laws of the Socialist Republic of Vietnam, and undermines the unity of the national community.

2. Infringing upon the interests of the Socialist Republic of Vietnam, the rights and legitimate interests of organizations and individuals.

3. Violating intellectual property rights; collecting, appropriating, deceiving, forging, and illegally transferring civil cryptographic products.

4. Illegally intruding and discovering secrets of civil cryptography and legally encrypted information of organizations and individuals; disclosing information about civil cryptographic products, information about customers legally using civil cryptographic products causing damage to organizations and individuals; disclosing state secrets in any form.

5. Trading in civil cryptographic products of unknown origin.

Chapter II

RESEARCH ON CIVIL CRYPTOGRAPHY, PRODUCTION, BUSINESS OPERATION AND USE OF CIVIL CRYPTOGRAPHIC PRODUCTS

PART 1

CIVIL CRYPTOGRAPHY RESEARCH

Article 7. Rights and obligations of organizations and individuals participating in civil cryptography research activities

Organizations and individuals engaged in civil cryptography research enjoy rights and fulfill obligations as prescribed in Articles 15, 16, 17, and 18 of the Law on Science and Technology and as prescribed in Articles 6 and 8 of this Decree.

Article 8. Application of product and commodity quality regulations to the results of civil cryptography research

1. For civil cryptographic products that are research results, it is encouraged for organizations and individuals conducting research to publish them in compliance with standards as prescribed by the Ministry of Science and Technology and obtain permission to transfer them to businesses producing and trading in civil cryptographic products or organizations and individuals legally using such products.

2. For civil cryptographic products that are research results and do not fall under the list of civil cryptographic products required to apply National Technical Regulations as stipulated in Article 4 of this Decree, it is encouraged for organizations and individuals conducting research to publish them in compliance with technical regulations as prescribed by the Ministry of Science and Technology and obtain permission to transfer them to businesses producing and trading in civil cryptographic products or organizations and individuals legally using such products.

3. For civil cryptographic products that are research results and fall under the list of civil cryptographic products required to apply National Technical Regulations as stipulated in Article 4 of this Decree, organizations and individuals conducting research must publish them in compliance with technical regulations as prescribed by the Ministry of Science and Technology and obtain permission to transfer them to businesses producing and trading in civil cryptographic products or organizations and individuals legally using such products.

4. For civil cryptographic products that are research results and require certification of conformity to National Standards when requested, they shall be subject to review, evaluation, and certification of conformity by the General Office for Security and Conscription.

5. For civil cryptographic products that are research results and fall under the list of civil cryptographic products required to obtain certification of compliance with National Technical Regulations as stipulated in Article 4 of this Decree, they must be reviewed, evaluated, and certified of compliance by the General Office for Security and Conscription before being transferred to businesses producing and trading in civil cryptographic products or organizations and individuals legally using such products.

PART 2

PRODUCTION AND BUSINESS OPERATION OF CIVIL CRYPTOGRAPHIC PRODUCTS

Article 9. Rights and Obligations of Organizations and Individuals Participating in the Production and Business of Civil Cryptographic Products

1. The following rights:

a) To choose civil cryptographic products for production and business;

b) To conclude investment contracts for the production, business, export, and import of civil cryptographic products with organizations and individuals both domestically and internationally in accordance with the provisions of the law;

c) To refuse to provide civil cryptographic products and services when discovering that organizations or individuals violate the law on the use of civil cryptographic products or breach commitments agreed upon regarding the use of products provided by the enterprise;

d) To enjoy other rights as prescribed by law.

2. The following obligations:

a) To manage files and documents related to technical solutions and production technology;

b) To apply security and safety measures;

c) To be responsible under the law for the quality of civil cryptographic products and services, and to protect legitimate users of such products provided by the enterprise;

d) To temporarily suspend or cease providing civil cryptographic products and services in emergency situations to ensure national security;

đ) To cooperate and facilitate authorities with the implementation of operational measures when requested;

e) Fulfill other obligations as prescribed by law.

Article 10. Conditions for Producing and Trading Civil Cryptographic Products

Civil cryptographic products and services are included in the list of goods and services subject to restricted business activities. Organizations and individuals producing and trading civil cryptographic products must meet the following requirements:

1. Establishing an enterprise and registering for production and business in accordance with the Law on Enterprises;

2. Possessing a Permit for the Production and Business of Civil Cryptographic Products issued by the Government Office of Official Communications in accordance with Clause 11 of this Decree;

3. Meeting state management regulations concerning product quality, goods, and services.

Article 11. Conditions for Issuing a Permit for the Production and Business of Civil Cryptographic Products

1. Subject conditions: It must be an enterprise established in accordance with the Law on Enterprises.

2. Personnel conditions:

a) The head of the enterprise producing and trading civil cryptographic products must have a clear background, knowledge of the law, and expertise in the field of information security and cybersecurity;

b) A team of technical staff, managers, executives, security personnel, and customer service staff with professional qualifications and who have signed Labor Contracts in accordance with the law.

3. Other guarantee conditions:

a) Ensuring security and safety conditions, fire prevention, and protection of natural resources and the environment;

b) Having feasible technical and production and business plans consistent with technical standards and product quality standards.

Article 12. Documents for Applying for a Permit for the Production and Business of Civil Cryptographic Products

1. The application documents for a Permit for the Production and Business of Civil Cryptographic Products include:

a) An application form for a Permit for the Production and Business of Civil Cryptographic Products as prescribed;

b) A certified copy of the Enterprise Registration Certificate or Investment Certificate of the enterprise;

e) Technical plans and production and business plans for civil cryptographic products;

d) Curriculum vitae of the enterprise's head and technical members confirmed by the People's Committee of the commune, ward, or town where they reside.

2. The enterprise applying for a Permit for the Production and Business of Civil Cryptographic Products shall be responsible under the law for the contents declared in the application documents.

Article 13. Examination of Documents and Issuance of Civil Cryptographic Product Production and Business License

1. Within ten working days from the date of receipt of a valid application file from a business requesting issuance of a Civil Cryptographic Product Production and Business License, the Government General Office shall be responsible for examining the application file and issuing the Civil Cryptographic Product Production and Business License to the business.

2. In cases where the business does not meet all conditions stipulated in Article 11 of this Decree, the Government General Office shall notify the business in writing and clearly state the reasons for not issuing the Civil Cryptographic Product Production and Business License.

Article 14. Revocation of Civil Cryptographic Product Production and Business License

1. The Civil Cryptographic Product Production and Business License shall be revoked in the following cases:

a) The business is dissolved or declared bankrupt under the Enterprise Law;

b) The business has its Business Registration Certificate revoked;

c) The business no longer meets all conditions stipulated in Article 10 of this Decree;

d) The business does not commence operations within six months from the date of issuance of the Civil Cryptographic Product Production and Business License without a legitimate reason.

2. After three months from the date of revocation of the Civil Cryptographic Product Production and Business License, if the business meets all conditions stipulated in Article 10 of this Decree, it may reapply for the Civil Cryptographic Product Production and Business License. The procedures shall be the same as for a new application.

Article 15. Application Documents for Issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification

1. The application documents for issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification include:

a) An application form for issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification according to the prescribed model;

b) A copy of the identity card or passport for individuals; a certified copy of the Business Registration Certificate for businesses or establishment decision for organizations;

c) Technical documentation, product origin documentation, design documentation, algorithm documentation, operational solutions, technical descriptions;

d) Product samples.

2. Organizations and individuals applying for issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification shall bear legal responsibility for the contents declared in the application documents.

Article 16. Testing, Evaluation for Compliance with Technical Standards and Regulations and Issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification

1. Within thirty working days from the date of receipt of a valid application file from organizations or individuals requesting issuance of Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification, the Government General Office shall be responsible for testing, evaluation, and issuing the certification.

2. In cases where civil cryptographic products do not fully comply with the technical standards and regulations of the products as prescribed by current laws, the Government General Office shall not issue the Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification and shall provide written reasons.

3. In special cases requiring additional time for testing and evaluating the quality of civil cryptographic products, the period for testing, evaluation, issuance, or non-issuance of the Civil Cryptographic Product Conformity Certification and Civil Cryptographic Product Compliance Certification shall not exceed six months. The Government General Office shall be responsible for notifying organizations and individuals requesting certification in writing of the reasons.

Article 17. Responsibilities of enterprises producing and trading civil cryptographic products regarding the application of technical standards and regulations

1. Enterprises producing and trading civil cryptographic products must declare conformity to the applicable standards for their products with the competent state authorities.

2. Enterprises producing and trading civil cryptographic products must declare compliance to the applicable technical regulations for their products when such products fall under the list of civil cryptographic products required to apply technical regulations as stipulated in Article 4 of this Decree, with the competent state authorities.

3. Enterprises producing and trading civil cryptographic products that require certification of conformity shall organize production and trade of such civil cryptographic products and be subject to inspection, evaluation, and certification of conformity certificates by the Government Cryptographic Office for those products.

4. Enterprises producing and trading civil cryptographic products that fall under the list of civil cryptographic products required to obtain compliance certification as stipulated in Article 4 of this Decree must be inspected, evaluated, and certified of compliance by the Government Cryptographic Office before being put into circulation on the market.

Article 18. Exporting and Importing Civil Cryptographic Products

1. The list of civil cryptographic products subject to export and import restrictions falls within the category of restricted business goods and products.

2. Organizations and individuals engaged in exporting and importing civil cryptographic products must comply with the provisions set forth in Article 10 of this Decree and may only export and import civil cryptographic products listed in the export-import product list.

PART 3

USE OF CIVIL CRYPTOGRAPHIC PRODUCTS

Article 19. Rights and Obligations of Organizations and Individuals Using Civil Cryptographic Products

1. The following rights:

a) Freedom to choose civil cryptographic products and select enterprises providing civil cryptographic products and services;

b) Transfer, lease, gift, exchange civil cryptographic products;

c) Enjoy other civil rights as provided by law.

2. The following obligations:

a) Adhere to the commitments made with the provider of civil cryptographic products concerning: management and use of encryption keys, transfer, repair, maintenance of civil cryptographic products, and other related matters;

b) Cooperate and facilitate state agencies with authority to implement measures ensuring cryptographic security, information security, preventing crimes involving theft of information and cryptography, and using civil cryptographic products for illegal purposes;

c) Fulfill other obligations as prescribed by law.

Chapter III

STATE MANAGEMENT OF CIVIL CRYPTOGRAPHY

Article 20. Contents of State Management of Civil Cryptography

1. Establish mechanisms, policies, strategies, planning, and development plans for cryptographic science and technology serving civil purposes.

2. Develop and promulgate legal normative documents and guidelines for managing research, production, trade, and use of civil cryptographic products.

3. Manage the issuance and revocation of licenses for the production and trade of civil cryptographic products.

4. Inspect, evaluate, certify conformity, and issue certificates of conformity and compliance for civil cryptographic products to organizations and individuals authorized to produce and trade.

5. Manage safety and security in the use of civil cryptographic products.

6. Conduct inspections, investigate violations, and resolve complaints and denunciations in the field of civil cryptography.

7. International cooperation in the field of civil cryptography.

Article 21. Responsibilities of the Government Cryptographic Administration

1. Take the lead and coordinate with relevant ministries and sectors to develop legal normative documents on civil cryptography management, draft standards and technical regulations for civil cryptographic products, submit them to competent authorities for issuance and guide their implementation.

2. Take the lead and coordinate with relevant ministries and sectors to develop national cryptography policies and strategies for developing scientific and technological potential in civil cryptography.

3. Organize administrative machinery for registration, evaluation, certification of conformity, certification of compliance, production and business licensing for civil cryptographic products; issue certificates of conformity for civil cryptographic products and certificates of compliance for civil cryptographic products.

4. Take the lead and coordinate with relevant ministries and sectors to organize inspections, examinations, handling of violations, and resolution of complaints and denunciations in civil cryptography research activities, production, business operations, and product usage according to their authority.

5. International cooperation in civil cryptography.

Article 22. Responsibilities of Ministries, Sectors, People's Committees of Provinces and Central Cities

1. The Ministry of Public Security takes the lead and coordinates with the Government Cryptographic Administration to implement technical and operational measures to prevent and combat crimes, ensure national security and social safety in civil cryptography research activities, production, business operations, and product usage.

2. The Ministry of Science and Technology takes the lead and coordinates with the Government Cryptographic Administration to manage state activities related to scientific and technological research in civil cryptography; assess and announce National Standards for civil cryptographic products; assess National Technical Regulations for civil cryptographic products.

3. The Ministry of Trade takes the lead and coordinates with the Government Cryptographic Administration to present

4. The Ministry of Finance takes the lead and coordinates with the Government Cryptographic Administration to stipulate fee collection levels and management and utilization systems for fees and charges related to the assessment, evaluation, certification of conformity, certification of compliance for civil cryptographic products and issuance of licenses for production and business operations of civil cryptographic products, certificates of conformity for civil cryptographic products, and certificates of compliance for civil cryptographic products.

5. Ministries, ministerial-level agencies, and government agencies within the scope of their functions, tasks, and powers shall be responsible for coordinating with the Government Cryptographic Administration to guide enterprises engaged in the production and business operations of civil cryptographic products in accordance with the law.

6. Provincial and municipal people's committees under the central government shall perform state management functions over the production and business operations of civil cryptographic products in their localities in accordance with the provisions of this Decree.

Chapter IV

INSPECTION, EXAMINATION, HANDLING OF VIOLATIONS AND RESOLUTION OF COMPLAINTS AND DENUNCIATIONS

Article 23. Inspection and auditing

1. The Government Cryptographic Administration shall take the lead and coordinate with relevant ministries, sectors, and localities to organize and direct inspections and examinations of civil cryptography research activities, production, business operations, and product usage.

2. Organizations and individuals engaged in civil cryptography research activities, production, business operations, and product usage shall be subject to inspections and examinations by state agencies with authority in accordance with the law on inspection.

Article 24. Handling violations of regulations on civil cryptography research, production, business, and use of civil cryptographic products

1. A fine of VND 5,000,000 to VND 10,000,000 shall be imposed for one of the following violations:

a) Renting out or lending the Production and Business License for civil cryptographic products,

b) Adding, erasing, or modifying contents within the Production and Business License for civil cryptographic products.

2. A fine of VND 15,000,000 to VND 20,000,000 shall be imposed for conducting business activities not in accordance with the contents recorded in the Production and Business License for civil cryptographic products.

3. A fine of VND 25,000,000 to VND 30,000,000 shall be imposed for any of the following violations:

a) Violating the provisions stipulated in Clause 4, Article 17 of this Decree;

b) Producing, trading in civil cryptographic products without a Production and Business License for civil cryptographic products issued by the Government Cryptographic Office.

Other violations related to civil cryptography research, production, business, and use of civil cryptographic products shall be handled according to the nature and severity of the violation as prescribed by law.

Article 25. Handling violations of regulations on fees and charges

For violations concerning fees and charges in the issuance of the Production and Business License for civil cryptographic products, the Certificate of Conformity for civil cryptographic products, and the Certificate of Compliance for civil cryptographic products, the provisions of Decree No. 106/2003/NĐ-CP dated September 23, 2003 of the Government on administrative penalties for violations in the field of fees and charges shall apply.

Article 26. Authority to impose administrative penalties

1. The Government Cryptographic Inspection Agency currently performing its duties has the authority to impose administrative penalties for administrative violations in civil cryptography research, production, business, and use of civil cryptographic products according to its state management functions and the penalty authority prescribed by law.

2. Chairpersons of People's Committees at all levels and other specialized inspections shall impose administrative penalties for administrative violations in civil cryptography research, production, business, and use of civil cryptographic products as prescribed in this Decree according to the provisions of law.

Article 27. Principles, time limits, deadlines, and procedures for imposing penalties

1. The principles for determining the authority to impose penalties, time limits for imposing penalties, deadlines, procedures, and sequences for handling administrative violations in civil cryptography research, production, business, and use of civil cryptographic products shall be implemented according to the provisions of the Administrative Violations Handling Ordinance.

2. Fines collected from administrative violations in civil cryptography research, production, business, and use of civil cryptographic products must be deposited into the State budget at the National Treasury. The management system for receipt forms for fines and payments of fines shall be carried out according to current laws.

Article 28. Complaints, accusations, and resolution of complaints and accusations

1. Organizations and individuals have the right to complain and accuse acts violating the law in civil cryptography research, production, business, and use of civil cryptographic products.

2. Organizations and individuals with authority shall be responsible for examining, resolving, and responding to complaints and accusations in accordance with the provisions of law on complaints and accusations.

Article 29. Compensation for Damage

Organizations and individuals causing damage to other organizations and individuals in the activities of researching civil cryptography, producing, trading, and using civil cryptographic products must provide compensation in accordance with the provisions of the law.

Chapter V

IMPLEMENTING PROVISIONS

Article 30. Effective Date

This Decree shall take effect fifteen days from the date of publication in the Official Gazette.

Article 31. Responsibility for Implementation

Ministers, Heads of ministerial-level agencies, Heads of agencies under the Government, Chairpersons of People's Committees of provinces and centrally governed cities are responsible for implementing this Decree.