The internet penetration rate was 71 percent by the end of 2021, according to data from the Ministry of Infomation and Communications (MIC).1 Mobile broadband has played a significant role in increasing access to faster internet service. As of May 2022, the median mobile download speed stood at 35.29 megabits per second (Mbps) while the upload speed stood at 16.89 Mbps according to Ookla’s Speedtest Global Index. The median fixed broadband download speed was 71.79 Mbps and upload speed was 67.20 Mbps.2 Market data aggregator Statista estimated smartphone penetration at 61.37 percent as of May 2021.3 Fixed broadband remains a relatively small market segment.

As of December 2021, 4G signal covered 99.8 percent of Vietnam’s territory, while 5G had been tested in 16 provinces, according to the MIC.4

Disruptions to international internet cables took place repeatedly during the coverage period when the country was in full or partial lockdowns due to COVID-19 outbreaks.5 In February 2022, three undersea cables—the Intra-Asia, Asia-America Gateway, and Asia-Pacific Gateway cables—were disrupted at the same time, seriously affecting internet users nationwide.6 The cables are pivotal for connectivity to the international internet.

Access to the internet has become more affordable for most segments of the population, including those in rural areas, but connectivity remains out of reach for those living in extreme poverty, which is found in many communities of minority ethnicities in mountainous areas. The most inexpensive monthly mobile data plan cost around $2 in 2022,7 while a fixed-line package cost around $7.8 The average monthly wage was 6.1 million dong ($266) as of June 2021, according to the General Statistics Office.9

There were no significant intentional disruptions to internet or mobile networks during the coverage period. Authorities have sometimes employed periodic throttling and restricted access to the internet for political or security reasons in the past.

Most recently, Reuters reported that Facebook’s country-based servers were taken offline in February 2020, significantly slowing Facebook, Instagram, and WhatsApp services for users in Vietnam (see B1).10 Access was restored in early April 2020, after the company allegedly agreed to remove significantly more “antistate” content (see B2).

The government retains the ability to restrict connectivity because of its technical control over infrastructure. While several companies have licenses to build infrastructure, the state-owned Vietnam Posts and Telecommunications Group (VNPT) and military-owned Viettel dominate the country's telecommunications sector. Those firms make up two of the three major providers servicing internet exchange points (IXPs), which allocate bandwidth to service providers.11

Though any firm is allowed to operate as an ISP, informal barriers prevent new companies without political ties or economic clout from participating in the market. According to the MIC’s White Paper on Information Technology and Communication Vietnam 2021, in 2020, the three largest broadband providers were Viettel (which controlled 39.5 percent of the market), VNPT (38.5 percent), and the private FPT (15.6 percent).12

In the mobile sector, Viettel commanded 52.5 percent of mobile subscriptions, while VNPT and MobiFone rank second and third with 23.8 percent and 18.5 percent, respectively. These three providers combined controlled over 90 percent of the telecommunications market in almost all types of services. Smaller companies that lack the infrastructure to provide quality service and coverage, such as Vietnamobile and Gmobile, struggle to compete.13

Various government agencies regulate and oversee digital technology in an ad hoc, nontransparent manner, without public consultation. Guidelines for regulating the telecommunications sector are provided by the CPV, compromising the independence of regulatory bodies.

The Vietnam Internet Network Information Center (VNNIC), an affiliate of the MIC, is responsible for managing, allocating, supervising, and promoting the use of internet domain names, IP addresses, and autonomous system numbers.14 Two ministries—the MIC15 and the Ministry of Public Security (MPS)16 —manage the provision and usage of internet services. In practice, censorship of online content could be ordered by any government body.

The Vietnamese authorities have established an effective content-filtering system. However, social media and communications apps remained available during the coverage period, despite being periodically blocked in previous years.

Censorship frequently targets high-profile blogs or websites with many followers, as well as content considered threatening to the rule of the CPV, including discussion of social unrest or political dissent, advocacy for human rights and democracy, and criticism of the government’s reaction to border and maritime disputes with China. Content promoting organized religions that the state sees as a potential threat—including Buddhism, Roman Catholicism, and the Cao Đài group—is blocked to a lesser but still significant degree. Websites critical of the government, such as Luật Khoa, The Vietnamese, Việt Nam Thời báo, Báo Tiếng Dân, Diễn đàn Xã hội Dân sự, and Bauxite Vietnam, are generally inaccessible. Access to international websites such as those of Human Rights Watch (HRW) and the Vietnamese editions of Radio Free Asia (RFA) and the British Broadcasting Corporation (BBC) has been unstable and unpredictable.

According to an MPS report to the National Assembly, the ministry blocked 4,214 overseas-hosted websites that “published toxic and harmful information” from January to September 2021.17 The MIC stated in January 2022 that it blocked approximately 2,000 websites in 2021 in collaboration with other government agencies and networks.18

Social media and communications platforms were not blocked during the coverage period. In November 2020, the Vietnamese government reportedly threatened to shut down Facebook’s service in Vietnam should the company refuse to comply with the government’s request for a larger scale of content restrictions. 19 A Washington Post investigative report published in October 2021 confirmed that Facebook had been threatened by the government and decided to comply with its demands.20

Content was removed at an alarming rate during the coverage period, and the government used the Cybersecurity Law, which took effect in January 2019, to pressure social media companies to comply with content removal requests.21 The regular removal of content has led users to employ the common practice of sharing screenshots of online articles that they think are likely to be removed later, rather than sharing their URLs.

Authorities have imposed heavy fines on online publications for publishing “false information.” A major online newspaper, Dân Trí, was fined 50 million dong ($2,000) for incorrectly reporting a death of COVID-19.22 The authorities also fined another news site, Công Lý, 55 million dong ($2,400) for publishing purported misinformation on a land issue.23

Social media platforms, including Facebook and Google, restricted content at the government’s request. According to the MIC, in 2021, Facebook blocked and/or removed 3,377 posts, Google removed 13,141 videos from YouTube, and TikTok blocked and/or removed 1,180 videos.24 Google reported that 92 percent of the removal requests it received from the Vietnamese government from July 2021 to December 2021 related to government criticism, while Facebook disclosed that the majority of removal requests it received in the same period related to purported COVID-19 misinformation or insult and defamation.25

Activists, dissidents, and online commentators, including those living outside of Vietnam, have increasingly had their Facebook accounts suspended for violating the platform’s community standards.26 For instance, the Facebook account of Dương Quốc Chính—a prominent independent political commentator—was suspended several times during the coverage period, each suspension lasting approximately a month, and had several posts blocked in Vietnam per “legal requests.”27

The government also pressures individuals to remove their content. For instance, officials reported that individual Facebook users were summoned by police and forced to remove content concerning COVID-19 throughout 2021.28

Other entities with financial and political influence may exert control over online content or discourage free expression. For example, Facebook users experienced content restrictions or account blocking in February 2021, during the previous coverage period, relating to posts that criticized the major domestic car manufacturer Vinfast, which is a subsidiary of Vingroup, one of the country’s largest conglomerates.29 On the day of the May 2021 legislative elections, online state media outlets removed reporting on independent candidate Lương Thế Huy without explanation.30

Intermediary liability was formalized in 2013 with Decree 72 on the Management, Provision, Use of Internet Services and Internet Content Online, and was further developed with the 2018 Cybersecurity Law. It requires intermediaries—including those based overseas—to regulate third-party contributors in cooperation with the state, and to “eliminate or prevent information” that opposes the republic, threatens national security and the social order, or defies national traditions, among other broadly worded provisions. The decree holds cybercafé owners responsible if their customers are caught surfing “bad” websites. The regulation process was articulated in a circular issued in 2014, which requires website owners to eliminate “incorrect” content “within three hours” of its detection or receipt of a request from a competent authority in the form of an email, text message, or phone call.

The MIC, the MPS, the Central Propaganda Committee, and various other authorities regularly instruct online outlets to remove content they perceive as problematic through nontransparent, often verbal orders. These requests often have no legal footing, and are therefore not proportional to the alleged “harm” the government deems the content creates. Even if a content removal request is delivered through official channels, there is no appeals process.

The Cybersecurity Law requires social media companies to remove content upon request from the authorities within one day (see C2 and C6).31 Any content the government deems “toxic” or offensive is subject to removal under the law.32 In August 2022, after the coverage period, authorities issued Decree No. 53/2022/ND-CP, which details implementation of the Cybersecurity Law and takes effect in October 2022. Decree 53 details procedures for removing content that is illegal under the Cybersecurity Law—including content that infringes on national security, undermines traditions and customs, distorts facts, or involves insult or slander—and designates the MPS, the MIC, and the Ministry of Defense as authorities to serve takedown orders. Decree 53 also empowers MPS to suspend information systems and revoke domain names on national security and cybersecurity grounds.33

In July 2021, authorities issued Decree 70/2021/ND-CP, which requires foreign and domestic websites that host advertisements—including international social media platforms—to comply with Vietnamese online content regulations, including the prohibitions on illegal content under the Cybersecurity Law. Decree 70 requires websites to remove illegal content within 24 hours and provide the advertisers’ information to the government upon requests,34 with penalties including administrative fines.35 Separately, Reuters reported in April 2022 that the Vietnamese government was considering draft regulations to require social media companies to remove illegal content within 24 hours, as specified under the Cybersecurity Law, and block livestreams deemed illegal within three hours.36

In general, censorship is carried out by ISPs, rather than at the backbone or international gateway level. Specific URLs are generally identified for censorship and placed on blacklists. ISPs use different techniques to inform customers of their compliance with blocking orders. While some notify users when an inaccessible site has been deliberately blocked, others post an apparently benign error message.

Economic and social penalties, in addition to the risk of criminal prosecution, lead to a high degree of self-censorship online. The unpredictable and nontransparent ways in which topics become prohibited make it difficult for users to know what areas might be off-limits, and bloggers and forum administrators routinely disable commenting functions to prevent controversial discussions. A number of draconian laws and decrees have a chilling effect on the online speech of activists, journalists, and ordinary users (see B6 and C2). Vague clauses found in the country’s Cybersecurity Law, for example, have compelled online journalists to exercise even greater caution while posting or commenting online.

For example, Vietnam’s mainstream media did not report on a scandal about the MPS minister Tô Lâm dining at an expensive restaurant in November 2021.37 Neither did they publish critical content on two major controversies relating to the conglomerate Vingroup: the company “borrowed” COVID-19 vaccines from the government in July 202138 and announced in December 2021 that it would transfer its majority stake in automaker VinFast out of Vietnam.39

The arrests and convictions of prominent NGO leaders—including Mai Phan Lợi, Bạch Hùng Dương,40 Đặng Đình Bách,41 and Ngụy Thị Khanh42 —in 2021 and 2022 further spurred the closing of civic space in Vietnam, potentially driving self-censorship online.

The government exercises a high degree of control over content published online. All content produced by newspapers and online news outlets must pass through in-house censorship before publication. In weekly meetings, detailed instructions handed out by a CPV committee to editors dictate areas and themes to report on or suppress. Furthermore, amidst the COVID-19 pandemic, the government issued a number of directives to news outlets clarifying how they should report on the virus.43

The government also actively seeks to manipulate public opinion online. In 2018, the Communist Party established Task Force 35 to counter purported propaganda against the state, including online information.44 The task force recruits agents and contributors from progovernment political groups and among civilians and directs them to manipulate online discussions and coordinate information operations; those operations continued during the coverage period.45

In June 2021, the state introduced a national set of guidelines on social media behavior. The guidelines prohibit posts that affect state interest and violate national law, and ask users to promote “the beauty of Vietnam's scenery, people and culture, and spread good stories about good people.” The guidelines apply to Vietnamese users, social media companies, and state organizations, though it remains unclear how they will be implemented and enforced.46

According to a 2019 report from the Oxford Internet Institute (OII), Vietnam employs a network of approximately 10,000 people that manipulates information on Facebook and YouTube. At least one government agency is involved.47 Members of the network are encouraged to use their real accounts to disseminate propaganda and the government’s preferred messaging, troll political dissidents, attack the opposition, and suppress unwanted content, including through mass reporting content to social media platforms for removal. An investigative report by the Intercept published in December 2020 outlined how the network targets dissidents, activists, and critics. For instance, members of an invitation-only Facebook group of progovernment actors called “E47” identify targets to report en masse for violating the platform’s community standards.48

An investigative report by BBC News Vietnam published in April 2021 confirmed a recent expansion of Force 47—a military unit of over 10,000 people who are tasked with fighting “wrong, distorting opinions online”49 —into the district military branches of numerous provinces. Following violence over a land dispute in the Đồng Tâm commune, a village on the outskirts of Hanoi, these progovernment commentators posted forced confessions of villagers, who were referred to as terrorists and were alleged to have created weapons to attack police, on social media platforms.50

Constraints on advertising place an economic strain on online outlets, and stringent government regulations severely limit users’ ability to publish content online. In a corrupt environment, informal connections to high-ranking government officials or powerful companies offer economic and political protection to online media outlets and service providers. Media outlets are careful not to be seen as associated with antigovernment funders or advertisers. Likewise, advertisers avoid online outlets critical of the CPV and the government.

Government pressure on international social media companies to restrict content impacts online advertising. Decree 70, which was issued in July 2021, requires websites to comply with laws on the removal of illegal content with regard to online advertising (see B2),51 limiting the functioning of outlets that rely on advertising for revenue.

An October 2020 MIC report to the National Assembly emphasized that Facebook had agreed to block political advertisements from pages for and accounts owned by organizations deemed reactionary and terrorist—frequently nonviolent opposition groups (see B1). Google also agreed to not sharing advertising revenue for “content that violates Vietnam’s law” upon the ministry’s requests.52 Similar pressure to remove “toxic” content, was seen in 2017, when the Vietnamese branches of several multinational companies withdrew advertising from popular social media platforms like Facebook and YouTube at the request of Vietnamese government ministries.53 Vietnamese companies also pulled advertising after government representatives said that ads appeared next to content violating local laws, including some uploaded by dissidents who criticized the government.54

A circular issued in 2014 tightened procedures for registering and licensing new social media sites. Among other requirements, the person responsible for a platform must have at least a university degree.

Online outlets and ordinary users can be subjected to fines and suspensions based on content they post (see B2). A 2020 decree introduced administrative fines of up to 100 million dong ($4,300) for anyone who stores or spreads information that is deemed to be false, distorting, and fictitious.55 These fines can be applied for offenses not serious enough to merit criminal prosecution.

In September 2020, the MIC fined four registered online newspapers between 3 and 45 million dong ($130 to $2,000) for articles on a range of topics, including a former Ho Chi Minh City official, a conference on Ho Chi Minh, the CPV’s propaganda, and construction investment projects. The MIC authorities claimed the outlets were spreading misinformation.56 In February 2019, Người Tiêu Dùng (The Consumer), an online publication, was forced to close for three months and pay a fine of 65 million dong ($2,800) for an article critical of high-ranking leaders of Ho Chi Minh City; authorities claimed the article spread misinformation.57

Internet content producers face a range of pressures that affect the quality and diversity of online information, including the in-house censorship process imposed upon newspapers and online news outlets (see B5). Further, disinformation from both progovernment and antigovernment actors has increasingly distorted the online space, limiting the diversity of content and the democratic potential of social media.

Although government-run outlets continue to dominate, new domestic online outlets and social media platforms are expanding the media landscape. Young, educated Vietnamese people are increasingly turning to blogs, social media platforms, and other online news sources for information, rather than state television and radio broadcasters.58 Tools for circumventing censorship are well known among younger, tech-savvy internet users in Vietnam, and many can be found with a simple Google search.59

While digital tools largely remain available, draconian prison sentences for online activism, invasive surveillance, and general hostility from the government make many users wary of online mobilization. Despite this, certain activists have continued to use digital tools in the course of their work and have amassed notable online followings.60 Furthermore, as the government imposed full or partial lockdowns across the country in the latter half of 2021 and early 2022 amid a surge of COVID-19 cases, individuals and civil society groups actively used Facebook to raise funds and mobilize humanitarian support for those who suffered from the pandemic and the government’s ill-advised policies.61

The increasing persecution of dissidents, activists, nongovernmental organization (NGO) leaders, and regular internet users has curtailed online organizing in Vietnam. The most prominent openly organized political effort during the coverage period was a March 2022 open letter from Vietnamese activists and dissidents to the Ukrainian Embassy in Vietnam expressing solidarity against the Russian invasion of Ukraine.62

During the previous coverage period, a crackdown on candidates using social media to campaign ahead of the May 2021 legislative elections presented heightened restrictions to online political organizing. At least three people were arrested and criminally charged after declaring their intent to run for office in Facebook posts and YouTube videos, with the arrests drawing widespread condemnation.63 Several state media outlets warned candidates that they should not campaign on social media.64 Lương Thế Huy, a prominent independent candidate, was targeted by an online smear campaign after he successfully registered to run for office. High school students in Huy’s voting district were allegedly forced to falsely accuse him of tax evasion and foreign ties in Facebook posts, with participation tied to higher grades.65

Digital mobilization in Vietnam tends to be local, rather than national, in scale, and often revolves around environmental issues, as well as concerns about the expansion of China’s influence. Social media platforms including Facebook and Twitter were used to organize anti-China demonstrations in 2011,66 2014,67 and 2018,68 and environmental demonstrations in 201569 and 2016.70 Social media platforms have also helped activists document police abuses.71

During the coverage period, as increased government persecution and the COVID-19 pandemic made physical social gatherings more rare, online networking became more widely practiced than before. As the government has increasingly pressured Facebook to remove content, internet users have turned to other platforms, like Telegram, to disseminate information and connect with one another.72

The Constitution affirms the right to freedom of expression, but the CPV has strict control over the media in practice, using both formal measures such as laws and regulations and informal measures such as verbal directives. The judiciary is not independent, and trials related to free expression are often brief and apparently predetermined. Police routinely flout due process, arresting bloggers and online activists without a warrant or retaining them in custody beyond the maximum period allowed by law.

A series of regulations have extended controls on traditional media content to the online sphere.73 The laws and regulations are designed to impose censorship, control the media environment, and punish those who are deemed to spread content “opposing the Socialist Republic of Vietnam,” inciting violence, revealing state secrets, and providing false information, among other broad provisions that restrict freedom of expression online.

Legislation, including internet-related decrees, the Penal Code, the Publishing Law, the Cybersecurity Law, and the 2018 Law on Protection of State Secrets, can be used to fine and imprison journalists and netizens.

The Cybersecurity Law prohibits a wide range of activities conducted online, including organizing opposition to the CPV; distorting Vietnam’s revolutionary history and achievements; spreading false information; and harming socioeconomic activities.74 In addition, websites and individual social media pages are prohibited from posting content that is critical of the state or that causes public disorder (see B3).

In January 2018, amendments to the 2015 Penal Code took effect. Under the amended law, Articles 109, 117, and 331 are commonly used to prosecute and imprison bloggers and online activists for subversion, antistate propaganda, and abusing democratic freedoms.75 The amendments also contain vaguely worded provisions that criminalize those preparing to commit crimes with penalties of one to five years in prison. The new law also holds lawyers criminally responsible for failure to report clients to the authorities for a number of crimes, including illegal online activities, effectively making attorneys agents of the state.76

In April 2020, Decree 15/2020/ND-CP replaced a decree from 2013 that regulates administrative fines in the post and telecommunications industry, as well as for communication technologies and e-commerce. 77 The decree notably covers speech on social media, instituting fines for vaguely defined offenses including creating and disseminating false and misleading information, insulting reputations, damaging moral or social values, and revealing state secrets. In January 2022, authorities amended Decree 15 to increase administrative fines, including for online speech. For instance, the amendments increased fines on media outlets for publishing purported false information and for using domain names not included in their operating licenses.78 Fines for individuals range from 10 million to 20 million dong ($432 to $865) (see C3).

Vietnam continues to experience a substantial crackdown against online speech. Prosecutions for online activities were common during the coverage period, and some bloggers and human rights defenders received lengthy prison sentences. As of March 2022, 204 activists were held in detention for exercising their fundamental rights, including freedom of expression.79

Several journalists and activists were handed severe prison sentences during the coverage period. Prominent journalist Phạm Thị Đoan Trang80 and activists Trịnh Bá Phương81 and Nguyễn Thị Tâm82 were convicted of “antistate propaganda,” partly in relation to their online speech and publications, in December 2021. They were sentenced to 9 years, 10 years, and 6 years of imprisonment, respectively, under either Article 88 of the Penal Code 1999 or the Article 117 of the Penal Code 2015. The trial of Báo Sạch (Clean Newspaper) in October 2021 found all five of its members (Trương Châu Hữu Danh, Nguyễn Phước Trung Bảo, Nguyễn Thanh Nhã, Lê Thế Thắng, and Đoàn Kiên Giang) guilty of “abusing democratic freedom rights” under Article 331 of the Penal Code, based on posts shared on their Facebook pages and Youtube channels. They were sentenced to between two and four and a half years of imprisonment, variously.83

Everyday users also received years-long sentences for their online activities. In January 2022, Youtuber Lê Chí Thành was sentenced to two years of imprisonment for “obstructing officials carrying out government duties” under Article 330 of the Penal Code. Lê, a former police officer, is known for his Youtube channel that monitored traffic police and exposed police corruption. In April 2022, prosecutors filed additional charges of “abusing democratic freedom rights” against Lê.84 According to The 88 Project, the number of online commentators arrested in 2021 was 15, an increase from 12 in 2020.85

During the pandemic, the number of citizens being fined for their online activities has continued to surge. Several internet users were summoned to police stations and fined for their COVID-related online content, including that which was allegedly misleading or false or offensive (see B2).86 For example, one Facebook user in Ho Chi Minh City was fined 7.5 million dong ($350) for posting a meme that mocked the government’s delay in releasing money from a pandemic relief fund.87

The Cybersecurity Law restricts anonymity online by requiring users to register for accounts on various social media platforms with their real names, and requiring technology companies to verify the identities of their users.88 There are no restrictions on encryption or the use of encryption tools, although some laws require that authorities be given decryption keys on request (see C6).

Limited information is available about the surveillance technology used by Vietnamese authorities, though reports during the coverage period indicate that the government has expanded its capacity to conduct surveillance. The country’s legal framework, including the Cybersecurity Law, enables authorities to infringe on the privacy rights of citizens with relative ease.

Since the start of the COVID-19 pandemic, the government has released at least 20 COVID-related mobile and web apps that may violate users’ privacy.89 In April 2020, the government launched a Bluetooth COVID-19 tracing application called Bluezone. An analysis of the application raised concerns that Bluezone shared user data with the government without disclosing that fact to users. The source code was not made available for external auditing.90 In late May 2021, the Ministry of Health issued an instruction to local governments that recommended sanctioning people who did not install Bluezone and other COVID apps before entering certain public places and facilities; local authorities were tasked with determining the specific sanction.91 92 As of May 2021, Bluezone had reached 31.88 million downloads.93

Furthermore, during the outbreak happening accross the country in the latter half of 2021, some government bodies sough to force citizens to install mobile apps and scan QR codes in order to declare health conditions, pass through checkpoints, and enter certain places.94 Concerns about privacy for these apps’ users have never been addressed thoroughly by the authorities.95

In July 2021, Israeli humans rights lawyer Eitay Mack reported that the Israeli firm Cellebrite had sold phone-hacking technology to the MPS. The technology is said to have the capacity to extract data from locked mobile phones.96

Recent efforts to expand government data collection have raised privacy concerns, particularly in light of the lack of a personal data protection framework (see C6). In 2021, the MPS issued chip-based identity cards to citizens for which data will be stored in a centralized government database and accessible to officials, despite major concerns over personal data protection.97 The new ID card is reportedly used to access public services, make financial transactions, access services such as banking98 and cash machines,99 vehicle registration, and social welfare registration.100 As of early 2022, 52 million ID cards had been issued and the ministry planned to complete the program within the first quarter of 2022.101 The chip-based ID cards are expected replace existing identification cards progressively.102 In June 2021, the MPS established the Research and Application Center for Residents Data (RAR) to provide services using a National Database of Residents, which includes personal data and biometric data.103

According to FireEye, a California-based cybersecurity company, Vietnam has developed considerable cyberespionage capabilities in recent years. Since 2014, the company tracked at least 10 separate attacks from a group called Ocean Lotus, or APT32, with targets including overseas-based Vietnamese journalists and private- and public-sector organizations in Vietnam. While there is no direct link between APT32 and the Vietnamese government, FireEye contended that the accessed personnel details and data from the targeted organizations were of “very little use to any party other than the Vietnamese government.”104 APT32 appeared to be used in attacks reported during the coverage period, such as three separate attacks against an anonymous blogger between July and November 2020 (see C8).105

In December 2020, Canadian research group CitizenLab published a report that identified Vietnam as a likely client of Circles, an NSO Group–affiliated surveillance firm. Circles provides two separate systems to access a phone’s geolocation, calls, and texts without hacking the device itself; one system connects to the infrastructure of local telecommunications companies and the other to telecommunications companies globally.106 In 2013, Citizen Lab identified FinFisher software—which has the power to monitor communications and extract information, including contacts, text messages, and emails, from other computers without permission—on servers in Vietnam.107

Service providers and technology companies are required by law to aid the government in monitoring the communications of their users in a number of circumstances. The Cybersecurity Law dramatically increased requirements for companies to aid the government in surveillance by introducing data retention and localization provisions.

Decree 53, which was released in August 2022, after the coverage period, requires all domestic companies and some foreign companies—including social media platforms, telecommunications services, payment providers, and gaming platforms—to store personal data on Vietnamese users within the country and provide that data to the government on request. Personal data under Decree 53 is broadly defined, and the law also covers data associated with users’ accounts, like IP addresses and usernames. 108 Separately, a resolution adopted by the Cabinet in March 2022 approves the substantive content of the draft decree on personal data protection, which would empower authorities to access user data without obtaining consent from or informing users, as long as officials justify the access under vaguely defined pretexts relating to national security, public security, and public order. The regulation was not enacted by the end of the coverage period, and the Cabinet has instructed the MPS to formulate the draft Law on Protection of Personal Data in 2024.109

Decree 72 requires providers such as social networks to “provide personal information of the users related to terrorism, crimes, and violations of law” to “competent authorities” on request, but lacks procedures and adequate oversight to discourage abuse. It also mandates that companies maintain at least one domestic server “serving the inspection, storage, and provision of information at the request of competent authorities,” and requires them to store certain data for a specified period. The decree gives users the ambiguous right to “have their personal information kept confidential in accordance with law.” Ministers, heads of ministerial agencies and government agencies, provincial people’s committees, and “relevant organizations and individuals” can use the decree, leaving anonymous and private communications subject to intrusion by almost any authority in Vietnam.

A draft amendment to Decree 72 released in April 2020 raises further concerns as it requires foreign services with more than one million users in Vietnam to inform the MIC about users’ identities and contact details.110 In July 2021, a draft decree was announced that would require social media platforms to provide the state with the contact information of users operating accounts with more than 10,000 followers or subscribers.111 Decree 72/2013/NĐ-CP also requires domain name registrars to collect and store identifying information on all owners of domain names. Owners of international domain names who run news sites and social networks must inform the MIC about their operations. Owners are responsible for the accuracy of the information provided, facing fines should they provide inaccurate information.112

The Law on Information Security, which introduced new cybersecurity measures, came into effect in 2016.113 Among its more troubling provisions, the law requires technology companies to share user data without their consent at the request of competent state agencies (Article 17.1.c), mandates that authorities be given decryption keys on request, and introduces licensing requirements for tools that offer encryption as a primary function, threatening anonymity.114

Certain websites are also required to retain and localize data. Under a 2014 circular, Vietnamese companies that operate general websites and social networks, including blogging platforms, are required to locate a server system in Vietnam and to store posted information for 90 days, and certain metadata for up to two years.115

Cybercafé owners are required to install software to track and store information about their clients’ online activities, and citizens must also provide ISPs with government-issued documents when purchasing a home internet connection.116 A regulation requiring prepaid mobile phone subscribers to provide their ID details to the operator is enforced consistently.117

Bloggers and online activists are subject to frequent physical attacks, job loss, severed internet access, travel restrictions, and other rights violations.

Reports of physical abuse and torture in detention are common. In October 2021, police reportedly tortured Youtuber Lê Chí Thành—who was sentenced to two years imprisonment for videos relating to police corruption, among other details (see C3)—including by hanging him upside down for seven days.118 Journalist Phạm Thị Đoan Trang was held in pretrial detention for more than a year (see C3), during which she was not permitted family and lawyer visits and was denied medical attention despite serious illness.119

Nguyễn Thúy Hạnh—a human rights activist who frequently fundraised online for families of political prisoners and shared her views on Facebook—was arrested and charged with antistate propaganda in April 2021, and was subsequently also denied family and lawyer visitation for more than a year. She was forcibly transfered to a mental health facility in December 2021120 and again in April 2022, possibly due to lack of treatment for depression while in detention.121 Her case has been indefinitely suspended since April 2022.

Online journalists have also reported abduction in the past. In January 2019, Trương Duy Nhất, a journalist and commentator who was jailed from 2013 to 2015 on charges of “conducting propaganda against the state,” disappeared in Thailand after he submitted an asylum claim at the UN High Commissioner for Refugees (UNHCR) office there. He was reportedly abducted in Thailand and taken into custody in Vietnam, though authorities have denied the reports. That June, authorities raided his home and opened a criminal investigation for “misuse of power” during the time he worked for the newspaper Đại Đoàn Kết.122 He has since been sentenced to prison, and there has been no clarification over the circumstances leading to his return to Vietnam.

Threats against the families of journalists have led them to cease their coverage in the past. In March 2020, Berlin-based blogger Người Buôn Gió announced he would stop writing due to government harassment of his relatives in Vietnam, particularly his mother.123

Prominent bloggers and online activists experienced de facto house arrest several times in the coverage period. Plainclothes police guarded their homes for days without warrants, to block them from leaving, particularly during times of major events such as the CPV’s Congress and political trials,124 and during a solidarity event at the Ukrainian Embassy in Hanoi in March 2022.125 Others reported being summoned by police without warrants, or with warrants that provided no reasons or legal grounds, as another form of harassment in retaliation for online activities.126 For instance, activist Nguyễn Quang A was detained for several hours on his way to the residence of US Ambassador Daniel Kritenbrink in September 2020, during the previous coverage period. The police questioned him about his Facebook posts on several topics, including the Đồng Tâm conflict.127

Although no cyberattacks against human rights defenders and media sites were publicly disclosed during the coverage period, past reports suggest that the government and its affiliates are likely to have continued to employ the tactic.

In February 2021, Amnesty International reported evidence of cyberattacks by Ocean Lotus against a Germany-based Vietnamese human rights defender and a Philippines-based Vietnamese NGO. They were targeted with phishing emails containing malicious spyware between 2018 and November 2020. An investigative report published by Facebook in December 2020 outlined other Ocean Lotus tactics, including the creation of fictitious accounts, the promotion of Google Play Store applications that collect user data through lenient default permissions, and the coordination of watering-hole attacks using frequently visited websites.128

Research published in September 2018 reported several distributed denial-of-service (DDoS) attacks against the website of democracy organization Việt Tân and independent news outlet Tiếng Dân between April and June 2018.129 In February 2019, the Facebook page of the Liberal Publishing House was attacked, which led to the page’s closure. In November 2019, amid enhanced intimidation and harassment, the publishing house’s website was targeted with multiple technical attacks.130 The websites of two other critical outlets, Luật Khoa and The Vietnamese, were attacked amid large-scale protests against the Cybersecurity Law in June 2018.131

For several years, activists have been subject to account takeovers, including spear-phishing emails disguised as legitimate content, which carry malware that can breach the recipient’s digital security to access private account information.