The internet penetration rate was 68.70 percent by the end of 2019, according to ITU data.1 Mobile broadband has played a significant role in increasing access to faster internet service. As of July 2021, the average mobile download speed stood at 42.46 megabits per second (Mbps) while the upload speed stood at 19.25 Mbps according to Ookla’s Speedtest Global Index, placing Vietnam at 58th place in a global ranking of 141 countries and territories. The average fixed broadband download speed was 78.43 Mbps and upload speed was 68.38 Mbps, putting Vietnam in 59th place.2 One source estimated smartphone penetration at 61.37 percent as of May 2021.3 Fixed broadband remains a relatively small market segment.

In the first quarter of 2017, VinaPhone became the first provider to roll out a 4G network in Hanoi, Ho Chi Minh City, and 11 other provinces.4 By the end of 2019, it covered 100 percent of the population with its 4G signal.5 In April 2019, military-owned mobile service provider Viettel began the first pilot for a 5G network;6 by February 2021, it had over 17,000 registered 5G subscribers.7 Vinaphone and Mobiphone have also joined the 5G market.

Disruptions to the Asia Pacific Gateway (APG) in January and February 2021 affected most internet service providers (ISPs) and disrupted service.8 The cables are pivotal for connectivity to the international internet.

Access to the internet has become more affordable for most segments of the population, including those in rural areas, but connectivity remains out of reach for those living in extreme poverty, which is found in many communities of minority ethnicities in mountainous areas. The most inexpensive monthly mobile data plan cost around $2 in 2021,9 while a fixed-line package cost around $7.10 The average monthly wage was $280 as of July 2020.11

Score Change: The score improved from 3 to 4 because there were no temporary connectivity disruptions or restriction on Facebook’s country-based servers reported; both were imposed during the previous coverage period.

There were no significant disruptions to internet or mobile networks during the coverage period. Authorities have sometimes employed periodic throttling and restricted access to the internet for political or security reasons in the past.

Connectivity was previously restricted several times in the Đồng Tâm commune, a village on the outskirts of Hanoi. In 2017, 3G access and a phone signal were briefly unavailable during a violent land dispute. Similar restrictions were reported in January 2020, following violent clashes over the same dispute.12 Reuters reported that Facebook’s country-based servers were taken offline in February 2020, significantly slowing Facebook, Instagram, and WhatsApp services for users in Vietnam (see B1).13 Access was restored in early April 2020, after the company allegedly agreed to remove significantly more “antistate” content (see B2).

The government retains the ability to restrict connectivity because of its technical control over infrastructure. While several companies have licenses to build infrastructure, the state-owned Vietnam Posts and Telecommunications Group (VNPT) and military-owned Viettel dominate the country's telecommunications sector. Two out of three major providers servicing internet exchange points (IXPs), which allocate bandwidth to service providers, are state- or military-owned (VNPT and Viettel).14

Though any firm is allowed to operate as an ISP, informal barriers prevent new companies without political ties or economic clout from disrupting the market. As of September 2020, the three largest broadband providers are VNPT (which controls around 40 percent of the market), Viettel (around 38 percent), and the private FPT (around 14 percent).15

In the mobile sector, Viettel commands 50.5 percent of mobile subscriptions, while VinaPhone and MobiFone rank second and third with 24.6 percent and 21.1 percent, respectively. These three providers controlled a combined 96.2 percent of mobile subscriptions in 2019, a 1-percent increase over their 2018 share. Smaller companies that lack the infrastructure to provide quality service and coverage, like Vietnamobile and Gmobile, struggle to compete.16

Various government agencies regulate and oversee digital technology in an ad hoc, nontransparent manner, without public consultation. Guidelines for regulating the telecommunications sector are provided by the CPV, compromising the independence of regulatory bodies.

The Vietnam Internet Network Information Center (VNNIC), an affiliate of the Ministry of Information and Communications (MIC), is responsible for managing, allocating, supervising, and promoting the use of internet domain names, IP addresses, and autonomous system numbers.17 Two ministries—the MIC18 and the Ministry of Public Security (MPS)19 manage the provision and usage of internet services. In practice, censorship of online content could be ordered by any government body.

The Vietnamese authorities have established an effective content-filtering system. Social media and communications apps remained available during the coverage period, despite being periodically blocked in previous years.

Censorship frequently targets high-profile blogs or websites with many followers, as well as content considered threatening to the rule of the CPV, including social unrest, political dissent, advocacy for human rights and democracy, and criticism of the government’s reaction to border and maritime disputes with China. Content promoting organized religions such as Buddhism, Roman Catholicism, and the Cao Đài group, which the state considers a potential threat, is blocked to a lesser but still significant degree. Websites critical of the government are generally inaccessible, such as Talawas, Dân Luận, Luật Khoa, The Vietnamese, Việt Nam Thời báo, Dân Làm Báo, Diễn đàn Xã hội Dân sự, and Bauxite Vietnam. Access to international websites such as those of Human Rights Watch (HRW), and the Vietnamese editions of Radio Free Asia (RFA) and the British Broadcasting Corporation (BBC) has been unstable and unpredictable.

According to the MPS’s website, the ministry’s Department of Cybersecurity and High-Tech Crime Prevention and Control monitored and blocked almost 3,400 overseas-hosted websites that “published toxic and harmful information” in 2020.20 The MIC also stated in October 2020 that it had blocked 100 websites hosting pirated websites, 200 online games websites operating without licenses, 300 gambling websites, and 300 pornography websites.21

Social media and communications platforms were not blocked during the coverage period. However, in November 2020, the Vietnamese government reportedly threatened to shut down Facebook’s service in Vietnam should the company refuse to comply with the government’s request for a larger scale of content restrictions. 22

In February 2020, Reuters reported that state-owned telecommunications companies took Facebook’s local servers offline, significantly slowing services across Facebook, Instagram, and WhatsApp for Vietnamese users (see A3).23 Access was restored in early April after the company allegedly agreed to remove significantly more “antistate” content (see B2). Previously, in 2016, access to Facebook and Instagram was interrupted during protests in Hanoi and Ho Chi Minh City against an environmental disaster caused by a steel plant owned by Formosa, a Taiwanese company.24

Content was removed at an alarming rate during the coverage period, and the government used the Cybersecurity Law, which took effect in January 2019, to pressure social media companies to comply with content removal requests.25 The regular removal of content has led users to employ the common practice of sharing screenshots of online articles that they think are likely to be removed later, rather than sharing their URLs.

Authorities have imposed heavy fines and suspended online publications due to critical comments on their platforms in recent years. In May 2020, before the coverage period, the government fined the newspaper Phụ nữ TPHCM (Ho Chi Minh City Women) 55 million dong ($2,400) and suspended its website for a month, alleging the outlet published “wrongful information” about the Sun Group, a real-estate development company, in a series of investigative articles about the company’s damaging impact on the environment.26

Social media platforms and technology companies remove content upon request from the government. In early April 2020, full access to Facebook’s local servers was restored only after the company agreed to remove significantly more “antistate” content (see A3 and B1).27 That same month, Facebook removed two posts linking to RFA’s Vietnamese-language news site, citing local law. In 2020, the MPS requested more than 10,000 posts be removed or deactivated from online platforms.28

Social media platforms, including Facebook and Google, restricted content at the government’s request at a higher rate than ever before during the coverage period. According to the MIC’s report to the National Assembly in October 2020, the volume of Facebook’s content removals in 2020 increased 500 percent compared to 2019, reaching 95 percent of the total government requests for removals. The removal rate was 90 percent in the case of Google and its services, which included almost 11,000 YouTube videos removed within the first nine months of 2020. Besides alleged false information relating to COVID-19, the report says the content removed or filtered also includes “defamation against the Party and State officials.”

The report emphasizes that Facebook had agreed to block political advertisements from pages for and accounts owned by organizations deemed reactionary and terrorist—frequently nonviolent opposition groups. Google also agreed to not sharing advertising revenue for “content that violates Vietnam’s law” upon the Ministry’s requests.29

In another statement, the MIC said that Facebook had removed 2,311 posts between January and November 2020. Google blocked and removed over 29,000 videos and 24 YouTube channels deemed to be publishing antiparty or antistate content including government criticism, over that same period, according to the MIC. 30

Activists and dissidents, including those living outside of Vietnam, have increasingly had their Facebook accounts suspended for violating the platform’s community standards. Blogger Bùi Văn Thuận, for instance, had his Facebook account suspended and then permanently banned after he criticized the government’s role in the Đồng Tâm dispute in a January 2020 Facebook post. His account was not reinstated until September 2020, following pressure from civil society and inquiries from the press.31

The government also pressures individuals to remove their content. Amnesty International reported that police summoned users to police stations between January and March 2020 and forced them to remove posts discussing COVID-19 (see C3).32

Other entities with financial and political influence may exert control over online content or discourage free expression. Many Facebook users experienced content restrictions or account blocking in February 2021 relating to posts that criticized the major domestic car manufacturer Vinfast, which is a subsidiary of Vingroup, one of the country’s largest conglomerates.33 Similar reprisals have been reported in previous years; for instance, negative news stories about Vingroup have reportedly been removed from state-owned media sites and Facebook.34

On the day of the May 2021 legislative elections, online state media outlets removed reporting on independent candidate Lương Thế Huy without explanation.35

Intermediary liability was formalized in 2013 with Decree 72 on the Management, Provision, Use of Internet Services and Internet Content Online. It requires intermediaries—including those based overseas—to regulate third-party contributors in cooperation with the state, and to “eliminate or prevent information” that opposes the republic, threatens national security and the social order, or defies national traditions, among other broadly worded provisions. The decree holds cybercafé owners responsible if their customers are caught surfing “bad” websites. The regulation process was articulated in Circular 09/2014/TT-BTTTT, issued in 2014, which requires website owners to eliminate “incorrect” content “within three hours” of its detection or receipt of a request from a competent authority in the form of an email, text message, or phone call.

The MIC, the Central Propaganda Committee, and various other authorities regularly instruct online outlets to remove content they perceive as problematic, through nontransparent, often verbal orders. These requests often have no legal footing, and are therefore not proportional to the alleged “harm” the government deems the content creates. Even if a content removal request is delivered through official channels, there is no appeals process, independent or not.

The Cybersecurity Law requires social media companies to remove content upon request from the authorities within one day (see C2 and C6).36 Any content the government deems “toxic” or offensive is subject to removal under the law.37 A draft decree to clarify the law’s implementation was still under consideration as of November 2020.

In general, censorship is carried out by ISPs, rather than at the backbone or international gateway level. Specific URLs are generally identified for censorship and placed on blacklists. ISPs use different techniques to inform customers of their compliance with blocking orders. While some notify users when an inaccessible site has been deliberately blocked, others post an apparently benign error message.

Economic and social penalties, in addition to the risk of criminal prosecution, lead to a high degree of self-censorship online. The unpredictable and nontransparent ways in which topics become prohibited make it difficult for users to know what areas might be off-limits, and bloggers and forum administrators routinely disable commenting functions to prevent controversial discussions. A number of draconian laws and decrees have a chilling effect on the online speech of activists, journalists, and ordinary users (see B6 and C2). Vague clauses found in the country’s Cybersecurity Law, for example, have compelled online journalists to exercise even greater caution while posting or commenting online.

The government exercises a high degree of control over content published online. All content produced by newspapers and online news outlets must pass through in-house censorship before publication. In weekly meetings, detailed instructions handed out by a CPV committee to editors dictate areas and themes to report on or suppress, as well as the allowed depth of coverage. Furthermore, amidst the COVID-19 pandemic, the government issued a number of directives to news outlets clarifying how they should report on the virus.38

The government also actively seeks to manipulate public opinion online. According to a report from the Oxford Internet Institute (OII), which was released in September 2019, Vietnam employs a network of approximately 10,000 people that manipulates information on Facebook and YouTube. At least one government agency is involved.39 Members of the network are encouraged to use their real accounts to disseminate propaganda and the government’s preferred messaging, troll political dissidents, attack the opposition, and suppress unwanted content, including through mass reporting content to social media platforms for removal. An investigative report by the Intercept published in December 2020 outlined how the network targets dissidents, activists, and critics. For instance, members of an invitation-only Facebook group of pro-government actors called “E47” identify targets to report en masse for violating the platform’s community standards.40

The OII report reaffirmed earlier evidence of teams that manipulate online content. At the end of 2017, General Nguyễn Trọng Nghĩa, at the CPV’s national conference on propaganda, introduced Force 47, a new military unit with over 10,000 staff, “well qualified and loyal to the revolution,” whose task is to fight “wrong, distorting opinions” online. Critics contend that Force 47’s main objective is to spread smear campaigns aimed at opponents of the government.41 An investigative report by BBC News Vietnam published in April 2021 confirmed a recent expansion of Force 47 into the district military branches of numerous provinces. In 2013, Hanoi's head of propaganda, Hồ Quang Lợi, revealed that the city has a 900-person team of "internet polemicists" or "public opinion shapers" who are tasked with spreading the party line.42 Following the violence in Đồng Tâm, these progovernment commentators posted forced confessions of villagers, who were brandished as terrorists and were alleged to have created weapons to attack police, on social media platforms (see A3 and B2).43

In June 2021, after the coverage period, the state introduced a national set of guidelines on social media behavior. The guidelines prohibit posts that affect state interest and violate national law, and ask users to promote “the beauty of Vietnam's scenery, people and culture, and spread good stories about good people.” The guidelines apply to Vietnamese users, social media companies, and state organizations, though it remains unclear how they will be implemented and enforced.44

Constraints on advertising place an economic strain on online outlets, and stringent government regulations severely limit users’ ability to publish content online. In a corrupt environment, informal connections to high-ranking government officials or powerful companies offer economic and political protection to online media outlets and service providers. Media outlets are careful not to be seen as associated with antigovernment funders or advertisers. Likewise, advertisers avoid online outlets critical of the CPV and the government.

The government’s 2017 move to pressure international social media platforms to remove “toxic” content impacted online advertising. The Vietnamese branches of several multinational companies withdrew advertising from popular social media platforms like Facebook and YouTube at the request of Vietnamese government ministries.45 Vietnamese companies also pulled advertising after government representatives said that ads appeared next to content violating local laws, including some uploaded by dissidents who criticized the government.46

Circular 09/2014/TT-BTTTT, issued in 2014, tightened procedures for registering and licensing new social media sites (see B3). Among other requirements, the person responsible for the platform must have at least a university degree.

Online outlets and ordinary users can be subjected to fines and suspended based on content they post (see B2). Decree 15/2020/NĐ-CP47 introduced administrative fines of up to 100 million Vietnamese dong ($4,300) for anyone who stores or spreads information that is deemed to be false, distorting, and fictitious. These fines can be applied for offenses not serious enough to merit criminal prosecution. The decree outlined additional fines for violations related to online commerce.

In September 2020, the MIC fined four registered online newspapers between 3 and 45 million dong ($130 to $2,000) for articles on a range of topics, including a former Ho Chi Minh City official, a conference on Ho Chi Minh, the CPV’s propaganda, and construction investment projects. The MIC authorities claimed the outlets were spreading misinformation.48 Before the coverage period, in February 2019, Người Tiêu Dùng (The Consumer), an online publication, was forced to close for three months and pay a fine of 65 million Vietnamese dong ($2,800) for an article critical of high-ranking leaders of Ho Chi Minh City, which authorities claimed was spreading misinformation.49

Internet content producers face a range of pressures that affect the quality and diversity of online information, including the in-house censorship process imposed upon newspapers and online news outlets (see B5). Further, disinformation from both progovernment and antigovernment actors has increasingly distorted the online space, limiting the diversity of content and the democratic potential of social media.

Although government-run outlets continue to dominate, new domestic online outlets and social media platforms are expanding the media landscape. Young, educated Vietnamese people are increasingly turning to blogs, social media platforms, and other online news sources for information, rather than state television and radio broadcasters.50 Tools for circumventing censorship are well known among younger, tech-savvy internet users in Vietnam, and many can be found with a simple Google search.51

Score Change: The score declined from 3 to 2 due to heightened restrictions on online political organizing as the government cracked down on independent candidates using social media to campaign ahead of the May 2021 legislative elections.

While digital tools largely remain available, draconian prison sentences for online activism, invasive surveillance, and general hostility from the government make many users wary of online mobilization. Despite this, certain activists have continued to use digital tools in the course of their work. Some activists have tens of thousands of followers on their social media pages, even in the face of intensifying government pressure (see B2 and C3).52 For example, Phạm Thị Đoan Trang, a leading activist, had approximately 70,000 followers on her Facebook profile as of October 2020, when she was arrested by the authorities for her activism (see C3).53

A crackdown on candidates using social media to campaign ahead of the May 2021 legislative elections presented heightened restrictions to political online organizing. At least three people were arrested and criminally charged after declaring their intent to run for office in Facebook posts and YouTube videos, drawing widespread condemnation.54 Several state media outlets warned candidates that they should not campaign on social media.55 Lương Thế Huy, a prominent independent candidate, was targeted by an online smear campaign after he successfully registered to run for office. High school students in Huy’s voting district were allegedly forced to falsely accuse him of tax evasion and foreign ties in Facebook posts, with participation tied to higher grades.56

Digital mobilization in Vietnam tends to be local, rather than national, in scale, and often revolves around environmental issues, as well as concerns about the expansion of China’s influence. Social media platforms including Facebook and Twitter were used to organize anti-China demonstrations in 2011,57 2014,58 and 201859 and environmental demonstrations in 201560 and 2016.61 Social media platforms have also helped activists document police abuses.62

During the coverage period, as increased government persecution and the COVID-19 pandemic made physical social gatherings more rare, online networking became more widely practiced than before. As the government has increasingly pressured Facebook to remove content, internet users have turned to other platforms, like Telegram, to disseminate information and connect with each other.63

The Constitution affirms the right to freedom of expression, but the CPV has strict control over the media in practice. The judiciary is not independent, and trials related to free expression are often brief and apparently predetermined. Police routinely flout due process, arresting bloggers and online activists without a warrant or retaining them in custody beyond the maximum period allowed by law. Vietnam’s Cybersecurity Law also imposes sweeping restrictions on freedom of expression online (see B3, C2, and C6).64

Since 2008, a series of regulations have extended controls on traditional media content to the online sphere. Decree 97, passed in 2008, ordered blogs to refrain from political or social commentary and barred them from disseminating press articles, literary works, or other publications prohibited by the Press Law. Passed in 2011, Decree 2 gave authorities the power to penalize journalists and bloggers for a number of infractions, including publishing under a pseudonym.65 Decree 72 replaced Decree 97 in 2013, expanding regulation from blogs to all social media networks. Article 5 of Decree 72 prohibits online activity found to be “opposing the Socialist Republic of Vietnam,” inciting violence, revealing state secrets, and providing false information, among other broad provisions that restrict freedom of expression online.

Legislation, including internet-related decrees, the Penal Code, the Publishing Law, the Cybersecurity Law, and the 2018 Law on Protection of State Secrets, can be used to fine and imprison journalists and netizens.

The Cybersecurity Law prohibits a wide range of activities conducted online, including organizing opposition to the CPV; distorting Vietnam’s revolutionary history and achievements; spreading false information; and harming socioeconomic activities.66 In addition, websites and individual social media pages are prohibited from posting content critical of the state or that causes public disorder (see B3).

In January 2018, amendments to the 2015 Penal Code took effect. Under the amended law, Articles 109, 117, and 331 are commonly used to prosecute and imprison bloggers and online activists for subversion, antistate propaganda, and abusing democratic freedoms.67 The amendments also contain vaguely worded provisions that criminalize those preparing to commit crimes with penalties of one to five years in prison, meaning that a person can be sentenced to five years in prison for preparing to criticize the state online. The new law also holds lawyers criminally responsible for failure to report clients to the authorities for a number of crimes, including illegal online activities, effectively making attorneys agents of the state.68

In April 2020, Decree 15/2020/NĐ-CP, first drafted in February, replaced Decree 13/2013 in regulating administrative fines in the post and telecommunications industry, as well as for communication technologies and e-commerce. The decree notably covers speech on social media, instituting fines for vaguely defined offenses including creating and disseminating false and misleading information, insulting reputations, damaging moral or social values, and revealing state secrets. Fines range from 10 million to 20 million dong ($432 to $865) (see C3).69

Vietnam continues to experience a substantial crackdown against online speech. Prosecutions for online activities were common during the coverage period, and some bloggers and human rights defenders received lengthy prison sentences. As of June 2021, 235 activists were held in detention for exercising their fundamental rights, including freedom of expression.70

Several journalists and activists were handed severe prison sentences during the coverage period. Three prominent journalists of the Independent Journalists Association of Vietnam, Phạm Chí Dũng, Nguyễn Tường Thụy, and Lê Hữu Minh Tuấn, were sentenced to 15, 11, and 11 years of imprisonment respectively in January 2021. The three journalists were sentenced for “making and disseminating propaganda against the state” under Article 117 of the Penal Code.71 They were the core writers of online newspaper Việt Nam Thời báo (Vietnam Time), one of the most active independent news outlets in Vietnam since 2014. Also in January 2021, a provincial court sentenced environmental activist Đinh Thị Thu Thủy to seven years of imprisonment for posting content on Facebook deemed offensive to party leaders under Article 117.72

Everyday users also received years-long sentences for their online activities. In June 2020, a pseudonymous Facebook user known as “Dr. Haircut” was sentenced to six years in prison for violating Article 117, after livestreaming information criticizing the government.73 In July 2020, Facebook user Nguyễn Quốc Đức Vượng was convicted to eight years in prison for posting videos and other content; authorities accused him of defaming political leaders.74 Nguyễn Quốc Đức Vượng had often shared information in support of democracy in Vietnam along with news of prodemocracy protests in Hong Kong. Three other Facebook users—Huỳnh Anh Khoa, Nguyễn Đăng Thương and Trần Trọng Khải—were sentenced to 15, 18, and 12 months in prison, respectively, in December 2020 for “abusing democratic freedoms” under Article 331 of the Penal Code. Their convictions were based on their alleged administration of a Facebook page that discusses economics and politics.75

In addition to providing the basis for extreme prison sentences, Article 117 and 331 of the Penal Code were deployed frequently to arrest netizens during the coverage period. Prominent journalist Phạm Thị Đoan Trang, who was arrested in October 2020 and charged under Articles 88 and 117 of the Penal Code, is a co-founder of two online magazines blocked in Vietnam, Luật Khoa and The Vietnamese. 76 Three reporters to the Facebook news page Báo Sạch—Nguyễn Phước Trung Bảo, Nguyễn Thanh Nhã, and Đoàn Kiên Giang—were arrested in April 2021 under Article 331.77 The page’s founder, Trương Châu Hữu Danh, was previously arrested in December 2020, after reporting on authorities’ questionable methods of control over the motorway concession system. Journalist Phan Bùi Bảo Thi, who worked for state-owned newspaper Giáo dục và Thời Đại, was arrested in early February 2021 and charged under Article 331 for defaming local government’s officials on Facebook.78 Another man accused of assisting his online activities was charged with the same crime.79

Since April 2020, the number of citizens being fined for their online activities has surged. In the wake of the COVID-19 pandemic, several internet users were summoned to police stations and fined for their online content (see B2).80 Some content that led to fines allegedly included misleading or false information. Separately, at least one Facebook user was fined 12.5 million Vietnamese dong ($540) for posting content that criticized and mocked the government’s response to the pandemic.81 Several other social media users were reportedly fined for posting allegedly false or misleading information about the May 2021 elections.82

The Cybersecurity Law restricts anonymity online by requiring users to register for accounts on various social media platforms with their real names, and for technology companies to verify the identities of their users.83 There are no restrictions on encryption or the use of encryption tools, although some laws require that authorities be given decryption keys on request (see C6).

Limited information is available about the surveillance technology used by Vietnamese authorities, but the legal framework, including the Cybersecurity Law, enables authorities to infringe on the privacy rights of citizens with relative ease.

In April 2020, the government launched a Bluetooth COVID-19 tracing application called Bluezone. An analysis of the application raised concerns that Bluezone shared user data with the government, which was not disclosed to users. The source code was not made available for external auditing.84 In June 2021, the government announced it would officially sanction people who did not install Bluezone before entering certain public places; local authorities were tasked with determining the specific sanction.85 As of May 2021, Bluezone had reached 31.88 million downloads.86

In October 2018, authorities announced that the government had established a new national unit to monitor daily social media and other web content. Authorities assert that the center is equipped with software that can analyze, evaluate, and categorize millions of posts.87 Additional monitoring efforts were announced in January 2021, when the government launched a fact-checking agency called Trung tâm Xử lý Tin giả Việt Nam (Vietnam Anti-Fake News Center) to detect allegedly false information spread online.88

According to FireEye, a California-based cybersecurity company, Vietnam has developed considerable cyberespionage capabilities in recent years. Since 2014, the company tracked at least 10 separate attacks from Ocean Lotus, or APT32, with targets including overseas-based Vietnamese journalists and private- and public-sector organizations in Germany, China, the United States, the Philippines, the United Kingdom (UK), and Vietnam itself. While there is no direct link between APT32 and the Vietnamese government, FireEye contended that the accessed personnel details and data from the targeted organizations were of “very little use to any party other than the Vietnamese government.”89 APT32 appeared to be used in attacks reported during the coverage period, such as those against an anonymous blogger three separate times between July and November 2020 (see C8).90

In December 2020, Canadian research group CitizenLab published a report that identified Vietnam as a likely client of Circles, an NSO Group-affiliated surveillance firm. Circles provides two separate systems to access a phone’s geolocation, calls, and texts without hacking the device itself; one system connects to the infrastructure of local telecommunications companies and the other to telecommunications companies globally.91

In 2013, Citizen Lab identified FinFisher software on servers in 25 countries, including Vietnam. Promoted by British distributor Gamma International as a suite for lawful intrusion and surveillance, FinFisher has the power to monitor communications and extract information from other computers without permission, including contacts, text messages, and emails. Citizen Lab noted that the presence of such a server does not indicate who is running it, though it is marketed to governments. Separately, in 2015, leaked documents showed that Italian company Hacking Team sold surveillance tools to Vietnam.92

Service providers and technology companies are required by law to aid the government in monitoring the communications of their users in a number of circumstances. The Cybersecurity Law dramatically increased requirements for companies to aid the government in surveillance by introducing data retention and localization provisions.

A draft decree released in early February 2021 guiding the Cybersecurity Law’s implementation would require online platforms—including large entities such as Facebook and Google and smaller platforms like payment services and game companies—to store data on Vietnamese users within the country and provide that data to the government on request.93 Companies would also be required to store data as long as they provide services in Vietnam. The data covered by the regulations include names, birth dates, nationality, identity cards, credit card numbers, biometrics files, and health records. Additionally, the draft decree would empower authorities to access user data without obtaining consent from or informing users, as long as officials justify the access under vaguely defined pretexts relating to national security, public security, and public order. The draft decree outlines two types of personal data, basic and sensitive, and affords users specific rights over their data. The draft decree was expected to go into effect on December 1, 2021.

Decree 72 requires providers such as social networks to “provide personal information of the users related to terrorism, crimes, and violations of law” to “competent authorities” on request, but lacks procedures and adequate oversight to discourage abuse. It also mandates that companies maintain at least one domestic server “serving the inspection, storage, and provision of information at the request of competent authorities,” and requires them to store certain data for a specified period (see B3). The decree gives users the ambiguous right to “have their personal information kept confidential in accordance with law.” Ministers, heads of ministerial agencies and government agencies, the provincial people’s committees, and “relevant organizations and individuals” can use the decree, leaving anonymous and private communications subject to intrusion by almost any authority in Vietnam. In mid-2016, “correspondence from the Saigon Post and Telecommunications Service Corporation” was the basis of Nguyễn Đình Ngọc’s indictment for disseminating antigovernment propaganda.94

A draft amendment to Decree 72 released in April 2020 raises further concerns as it requires foreign services with more than 1 million users in Vietnam to inform the MIC about users’ identities and contact details.95 After the coverage period, in July 2021, a draft decree was announced that would require social media platforms to provide the state with the contact information of users operating accounts with more than 10,000 followers or subscribers.96

Decree 72/2013/NĐ-CP also requires domain names registrars to collect and store identifying information on all owners of domain names. Owners of international domain names who run news sites and social networks must inform the MIC about their operations. Owners are responsible for the accuracy of the information provided, facing fines should they provide inaccurate information.97

Another draft decree on personal data protection was released for public consultation in early February 2021 that aims to create a new data protection authority called the Committee on Personal Data Protection. The new agency, which would be housed under the MPS, would have unilateral authority over personal data processing licenses for online services that collect or store user data, including social media companies, banking platforms, and healthcare platforms.98

The Law on Information Security, which introduced new cybersecurity measures, came into effect in 2016.99 Among its more troubling provisions, the law requires technology companies to share user data without their consent at the request of competent state agencies (Article 17.1.c), mandates that authorities be given decryption keys on request, and introduces licensing requirements for tools that offer encryption as a primary function, threatening anonymity.100

Certain websites are also required to retain and localize data. Under Circular 09/2014/TT-BTTTT, Vietnamese companies that operate general websites and social networks, including blogging platforms, are required to locate a server system in Vietnam and to store posted information for 90 days, and certain metadata for up to two years.101

Cybercafé owners are required to install software to track and store information about their clients’ online activities, and citizens must also provide ISPs with government-issued documents when purchasing a home internet connection.102 The regulation requiring prepaid mobile phone subscribers to provide their ID details to the operator is enforced consistently.103

Bloggers and online activists are subject to frequent physical attacks, job loss, severed internet access, travel restrictions, and other rights violations.

Reports of physical abuse and torture in detention are common. In July 2020, blogger and democracy activist Lê Anh Hùng was beaten with a metal folding chair, tied to his bed, and forcibly medicated while being held in a psychiatric hospital without his consent. Hùng was forcibly hospitalized while awaiting trial after a July 2018 arrest; he was detained for criticizing Vietnam’s one-party communist state in online posts.104 In January 2020, during the previous coverage period, blogger Trần Thị Nga was forced into exile with her family in the United States after being released from prison, having served three years of a nine-year sentence.105 Nga alleges that she was tortured while in custody and was forced to confess to criminal behaviour.

Online journalists have also reported abduction in the past. In January 2019, Trương Duy Nhất, a journalist and commentator who was jailed from 2013 to 2015 on charges of “conducting propaganda against the state,” disappeared in Thailand, after he submitted an asylum claim at the UN High Commissioner for Refugees (UNHCR) office there. He was reportedly abducted in Thailand and taken into custody in Vietnam, which authorities have denied. That June, authorities raided his home and opened a criminal investigation for “misuse of power” during the time he worked for the newspaper Đại Đoàn Kết.106 He has since been sentenced to prison, and there has been no clarification over the circumstances leading to his return to Vietnam.

Threats against the families of journalists have led them to cease their coverage in the past. In March 2020, Berlin-based blogger Người Buôn Gió announced he would stop writing due to government harassment of his relatives in Vietnam, particularly his 86-year-old mother.107

Prominent bloggers and online activists experienced being put under de factor house arrest several times in the coverage period. Plain clothes police guarded their residences for days, without warrants, to block them from leaving, particularly during times of major events such as the CPV’s Congress and political trials.108 Others reported being summoned by police without warrants, or warrants that provided no reasons or legal ground, as another form of harassment in retaliation for online activities.109 For instance, activist Nguyễn Quang A was detained for several hours on his way to the residence of US Ambassador Daniel Kritenbrink in September 2020. The police questioned him about his Facebook posts on several topics, including the Đồng Tâm case.110

Activists in Vietnam and abroad have been the target of systematic cyberattacks.

In February 2021, Amnesty International reported evidence of cyberattacks by Ocean Lotus against a Germany-based Vietnamese human rights defender and a Philippines-based Vietnamese NGO. They were targeted with phishing emails containing malicious spyware between 2018 and November 2020. An investigative report published by Facebook in December 2020 outlined other Ocean Lotus tactics, including the creation of fictitious accounts, the promotion of Google Play Store applications that collect user data through lenient default permissions, and the coordination of watering hole attacks using frequently visited websites.111

Research published in September 2018 reported several distributed denial-of-service (DDoS) attacks against the website of Việt Tân and independent news outlet Tiếng Dân between April and June 2018.112 In February 2019, the Facebook page of the Liberal Publishing House was attacked, which led to the page’s closure. In November 2019, amid enhanced intimidation and harassment, the publishing house’s website was targeted with multiple technical attacks (see C7).113

The websites of two other critical outlets, Luật Khoa and The Vietnamese, were attacked amid large-scale protests against the cybersecurity law in June 2018.114 Previous research from 2017 revealed that hackers conducting coordinated cyberespionage campaigns targeted two Vietnamese media organizations in 2015 and 2016 and the Vietnamese diaspora in Australia in 2017, as well as corporations with interests in Vietnam.115

For several years, activists have been subject to account takeovers, including spear-phishing emails disguised as legitimate content, which carry malware that can breach the recipient’s digital security to access private account information. Starting in 2013, attacks using malware to spy on journalists, activists, and dissidents became more personal. The California-based Electronic Frontier Foundation and Associated Press journalists reported receiving infected emails inviting them to human rights conferences or offering academic papers on the topic, indicating that the senders are familiar with the activities and interests of the recipients.