At the beginning of 2024, the internet penetration rate in Vietnam stood at 79.1 percent.1 The MIC reported that there were 100.7 million smartphone subscribers as of February 2024.2

Fixed-line broadband remains a relatively small segment of the internet service market, while mobile broadband has played a significant role in increasing access to faster internet connections. As of April 2024, the median mobile download speed stood at 50.88 megabits per second (Mbps), while the media mobile upload speed stood at 20.02 Mbps, according to Ookla’s Speedtest Global Index. The median fixed-line broadband download speed was 120.32 Mbps, and the corresponding upload speed was 111.60 Mbps.3

A report published in March 2024 cites MIC data showing that the fourth-generation (4G) mobile service network covered 99.8 percent of Vietnam’s territory.4 At the start of 2023, 40 out of 63 provinces and cities with provincial status in the country had fifth-generation (5G) coverage.5

Severe disruptions to submarine internet cables, which are pivotal for connecting to the international internet, were reported during the coverage period. The Asia Africa Europe 1 (AAE-1), an international undersea fiberoptic cable line, faced disruptions in late September 2023, and was fully restored about a month later, in November.6 The Asia-Pacific Gateway (APG) cable, which connects Vietnam with the rest of Asia, began experiencing malfunctions in December 2022 and was restored in late 2023.7 During the previous coverage period, all five of Vietnam’s international internet cables partly or wholly malfunctioned, resulting in a 75 percent loss of capacity.8

In January 2024, the MIC announced plans to invest in two to four more international telecommunications cables by 2025 to alleviate strain on existing international cables.9

Access to the internet has become more affordable for most segments of the population, including those in rural areas, but connectivity remains out of reach for those living in extreme poverty, which is found in many ethnic minority communities based in mountainous regions.

As of 2022, 61 percent of the population was considered rural,10 yet there are relatively low disparities in access to the internet based on geographic region due to the high overall internet penetration rates.11 According to a 2023 report from the United Nations Children’s Fund (UNICEF), Vietnam has achieved gender parity in internet use.12

The average price for 1 gigabyte (GB) of mobile data is 7,000 dong ($0.29),13 while the average monthly wage in 2023 was 4.96 million dong ($204), according to the General Statistics Office.14 The most inexpensive monthly mobile data plan cost around $2 in 2024,15 while a fixed-line package cost around $10 per month.16

There were no significant intentional disruptions to internet service or mobile networks during the coverage period. In the past, authorities have employed periodic throttling and sometimes restricted access to the internet for political or security reasons.

In July 2023, the MIC issued for public consultation a draft decree that would replace the existing Decree 72. The proposed new rules would compel internet service providers (ISPs) to block individual users from accessing the internet if they are found to have shared content that is deemed illegal by the state (see C4 and C6).17

In February 2020, Reuters reported that Facebook’s country-based servers were taken offline, significantly slowing Facebook, Instagram, and WhatsApp services for users in Vietnam (see B1). Access was restored in early April 2020, after the company allegedly agreed to remove significantly more “antistate” content (see B2).

The government retains the ability to restrict connectivity because of its technical control over infrastructure. While several companies have licenses to build infrastructure, the state-owned Vietnam Posts and Telecommunications Group (VNPT) and military-owned Viettel dominate the country's telecommunications sector. Those firms make up two of the three major providers servicing internet exchange points (IXPs), which allocate bandwidth to ISPs.18

Though any firm is allowed to operate as an ISP, informal barriers prevent new companies without political ties or economic clout from participating in the market. According to the MIC’s 2023 White Paper on Information Technology and Communication, the three largest fixed-line broadband providers were Viettel, which held 38.27 percent of the market, VNPT, which held 38.9 percent, and the private company FPT, which held 17.93 percent.19

In the mobile sector, Viettel commanded 56.39 percent of subscriptions in 2023, while VNPT and MobiFone ranked second and third with 20.91 percent and 17.91 percent, respectively. These three providers together controlled over 90 percent of the telecommunications market in almost all types of services. Smaller companies that lack the infrastructure to provide high-quality service and coverage, such as Vietnamobile and Gmobile, struggle to compete.20

Various government agencies regulate and oversee digital technology in an ad hoc, nontransparent manner, without public consultation. Guidelines for regulating the telecommunications sector are provided by the CPV, compromising the independence of regulatory bodies.

The Vietnam Internet Network Information Center (VNNIC), an affiliate of the MIC, is responsible for managing, allocating, supervising, and promoting the use of internet domain names, internet protocol (IP) addresses, and autonomous system numbers.21 Two ministries—the MIC and the Ministry of Public Security (MPS)—manage the provision and usage of internet services.22 In practice, however, censorship of online content can be ordered by any government body.

The authorities have established an effective content-filtering system. However, while social media and communications applications have been periodically blocked in previous years, they remained accessible during the coverage period.

Censorship frequently targets high-profile blogs or websites with many followers, as well as content considered threatening to the rule of the CPV, including discussion of social unrest or political dissent, advocacy for human rights and democracy, and criticism of the government’s reactions to border and maritime disputes with China. Content promoting organized religions that the state sees as a potential threat—including Buddhism, Roman Catholicism, and the Cao Đài group—is blocked to a lesser but still significant degree. Websites critical of the government, such as Việt Nam Thời báo, Báo Tiếng Dân, Văn Việt, The Vietnamese, and Bauxite Vietnam, are generally inaccessible. Access to international websites such as those of Reporters Without Borders (RSF), Amnesty International (AI), and the Vietnamese-language services of Radio Free Asia (RFA), Voice of America (VOA), and the British Broadcasting Corporation (BBC) has almost always been blocked.23

According to an MIC report, the ministry blocked over 10,000 fraudulent or law-violating domains as of March 2024, including 2,700 domains that were allegedly engaged in online fraud.24 The MIC also reported that authorities had blocked 3,369 similar websites from January to November 2023.25

Social media platforms and communication apps were not blocked during the coverage period. However, in April 2023, during the previous coverage period, the government discussed blocking TikTok over its failure to remove content that was allegedly in violation of Vietnamese laws (see B2).

In November 2020, the government reportedly threatened to shut down Facebook’s services in Vietnam should the company refuse to comply with an official request for more extensive content restrictions.26 A Washington Post investigative report published in October 2021 confirmed that Facebook had been threatened by the government and decided to comply with its demands (see B2).27

Content was removed at an alarming rate during the coverage period, and the government used the Cybersecurity Law, which took effect in 2019, to pressure social media companies to comply with content removal requests.28 The regular removal of content has led users to employ the common practice of sharing screenshots of online articles that they think are likely to be removed later, rather than sharing the articles’ URLs.

Authorities have imposed heavy fines on online publications for publishing “false information” and required outlets to delete content that officials deem to be “illegal.” Zing News was fined twice during the coverage period, in June and July 2023, for a total of 423 million dong ($17,400), for covering news items that were supposedly outside of its mandate as a digital magazine (see B6). The government did not disclose further details to the public about what specific reporting led to the fines.29

The online magazine Diễn đàn Doanh nghiệp was fined 71.25 million dong ($2,900) in March 2024 for “publishing and distributing false information” and “distorting and insulting organizations and individuals” in Phú Yên Province.30 The authorities also fined Bất Động Sản magazine 20 million dong ($820) for publishing purportedly misleading information about a land transfer in the city of Cần Thơ.31

In October 2023, the MIC announced the findings from its months-long probe into TikTok: the platform, it concluded, was not effectively censoring material that violates Vietnamese laws.32 The investigation, which began in May 2023, came after the MIC announced a potential ban on the platform for not removing “toxic” and “threatening” content at the request of Vietnamese authorities.33 Experts have raised concerns about the government’s conflation of genuinely harmful online content with content that simply critiques the state, especially in its takedown requests to social media platforms.34

In recent years, Meta—the parent company of Facebook and affiliated services—has increasingly restricted content at the government’s request.35 In June 2023, the Washington Post reported that Meta‘s guidelines for content moderation in Vietnam included a list of CPV officials who should not be insulted on its platforms. The internal list, according to employees who spoke with the paper, ”was shaped in large part by Vietnamese authorities,“ and until the time of the article it was kept private “even within the company.“36

Between July and December 2023, Facebook restricted access—based on government requests—to more than 2,520 pieces of content for alleged violations of local laws under Decree 72 on the Management, Provision, and Use of Internet Services and Internet Content Online.37 Google similarly complied with government requests during the coverage period. Between July and December 2023, Google received 417 removal requests from the government relating to 5,330 pieces of content; 93 percent of the requests were related to criticism of the government, and Google complied with the removal of 3,339 items.38

Streaming services are also targeted by the authorities. In July 2023, Netflix removed a Chinese series, Flight to You, after Vietnamese authorities took issue with depictions of a map of the South China Sea, where the two countries have an ongoing territorial dispute.39 Similarly, in April 2023, an episode of the Netflix documentary MH370: The Plane That Disappeared was removed from the platform’s service in Vietnam at the request of the Department of Radio, Television, and Electronic Information.40

Activists, dissidents, and online commentators, including those living outside of Vietnam, have had their Facebook accounts suspended for violating the platform’s community standards.41 For instance, political commentators Phan Châu Thành and Dương Quốc Chính reported that their accounts were repeatedly suspended for days at a time during the 2023–24 coverage period.42

The government, as well as other entities with financial and political influence, also pressure people and organizations to remove their own content. In January 2024, for instance, state-owned online media outlets removed articles about the collapse of a Vinpearl cable-car station in Nha Trang shortly after they were published.43 Many observers speculated that the censorship orders came from Vingroup,44 the largest conglomerate in the country, of which Vinpearl is a subsidiary. Over the next month, police repeatedly summoned Trần Mai Sơn, Ngô Thị Oanh Phương, and Phuong Ngo—Facebook users with large followings—over their posts related to the building collapse (see C3).

Intermediary liability was formalized in 2013 with Decree 72, and was further developed with the 2018 Cybersecurity Law and Decree 53/2022/ND-CP (see B3).45 It requires intermediaries—including those based overseas—to regulate third-party contributors in cooperation with the state, and to “eliminate or prevent information” that opposes the republic, threatens national security and the social order, or defies national traditions, among other broadly worded provisions. The laws hold cybercafé owners responsible if their customers are caught visiting prohibited websites.

The MIC, the MPS, the CPV’s Central Propaganda Department, and various other authorities regularly instruct online outlets to remove content that they perceive as problematic through nontransparent, often verbal orders (see B2). Many of these requests have no grounding in law. Even if a content removal request is delivered through official channels, there is no appeals process.

The Cybersecurity Law requires social media companies to remove content upon request from the authorities within one day (see C2 and C6).46 Any content that the government deems “toxic” or offensive is subject to removal under the law.47 Decree 53/2022/ND-CP, which took effect in October 2022, details procedures for removing content that is illegal under the Cybersecurity Law, including content that infringes on national security, undermines traditions and customs, distorts facts, or involves insult or slander. The decree designates the MPS, the MIC, and the Ministry of Defense as authorities that may issue takedown orders and empowers the MPS to suspend information systems and revoke domain names on national security and cybersecurity grounds.48

In July 2021, authorities issued Decree 70/2021/ND-CP, which requires foreign and domestic websites that host advertisements—including international social media platforms—to comply with Vietnamese online content regulations, including the prohibitions on illegal content under the Cybersecurity Law. Decree 70 requires websites to remove illegal content within 24 hours and provide the advertisers’ information to the government upon request,49 with penalties including administrative fines for violations.50

The government uses legal threats, investigations, and other forms of pressure to compel compliance with its restrictions on the internet. In general, censorship is carried out by ISPs, rather than at the backbone or international gateway level. Specific URLs are generally identified for censorship and placed on blacklists. ISPs use different techniques to inform customers of their compliance with blocking orders. While some notify users when an inaccessible site has been deliberately blocked, others post an apparently benign error message.

In October 2023, after a months-long government investigation into TikTok, the MIC urged the MPS to require TikTok Singapore to store Vietnamese users' data in Vietnam in keeping with data localization laws (see B1, B2, and C6).

In February 2023, the MIC threatened to block cross-border television service providers, such as Netflix, if they did not open an office in the country.51 However, as of the end of the coverage period, Netflix remained available in the country despite having not yet opened an office in Vietnam.

Possible economic and social repercussions, in addition to the risk of criminal prosecution, lead to a high degree of self-censorship online.52 The unpredictable and nontransparent ways in which topics become prohibited make it difficult for users to know what areas might be off-limits, and bloggers and forum administrators routinely disable commenting functions to prevent controversial discussions.

A number of draconian laws and decrees also have a chilling effect on the online speech of activists, journalists, and ordinary users (see B6 and C2). For example, when VCP general secretary Nguyễn Phú Trọng was hospitalized in January 2024, mainstream media outlets in Vietnam did not report on his weeks-long absence from the public eye.53 Instead, international media companies, like Bloomberg, broke the news of his hospitalization.54 Trọng ultimately died of his unspecified ailments in July 2024, after the coverage period.

The government exercises a high degree of control over content published online. All content produced by newspapers and online news outlets must pass through in-house censorship before publication. The government also actively seeks to manipulate public opinion online.

Force 47, a military unit of over 10,000 people that is tasked with fighting “wrong, distorting opinions online,” was established in 2017 and has since expanded into the district military branches of numerous provinces.55 Various reports during the coverage period indicated that the force was still active.56 In 2018, the CPV established Task Force 35 to counter purported propaganda against the state, including online information.57 Unlike Force 47, which is a military unit, Task Force 35 recruits agents and contributors from among government employees, progovernment political groups, and civilians across all economic sectors. They are then directed to manipulate online discussions and coordinate information operations; the group’s operations continued during the coverage period.58

In June 2021, the state introduced a national set of guidelines on social media behavior, prohibiting posts that affect state interests and violate national law, and encouraging users to promote a positive image of Vietnam. The guidelines have rarely been publicly cited in any executive actions,59 though in April 2024, when user Nam Em was fined for causing “public anxiety” during a Facebook live-stream, authorities requested that she obey the national guidelines.60

Restrictions on advertising place an economic strain on online outlets, and stringent government regulations severely limit users’ ability to publish content online. In the country’s corrupt environment, informal connections to high-ranking government officials or powerful companies offer economic and political protection to online media outlets and service providers. Media outlets are careful not to be seen as associated with antigovernment funders or advertisers. Similarly, advertisers avoid online outlets that are critical of the CPV and the government.

The MIC maintains a blacklist of over 400 websites, including individuals’ social media accounts, that have purportedly violated Vietnamese laws by posting antigovernment or “toxic” content; 98 sites were added to the list in December 2023.61 Advertisers who place ads on the sites may be fined. The MIC also maintains a whitelist of websites on which advertisements are encouraged; as of February 2024, the list contained more than 3,000 websites.62

Controls on advertising extend to social media platforms. 63 An October 2020 MIC report indicated that Facebook had agreed to block political advertisements from pages for and accounts owned by organizations that are deemed reactionary and terrorist—labels that are frequently applied to nonviolent opposition groups (see B1). Google also agreed to not share advertising revenue for “content that violates Vietnam’s law” at the ministry’s request.64 Several domestic companies, like WPP and Omnicom Media Group Vietnam, were fined by the MIC during the coverage period for displaying ads next to “toxic” content on major platforms.65

Online outlets and ordinary users can be subjected to fines and suspensions based on content they post (see B2). A 2020 decree introduced administrative fines of up to 100 million dong ($4,100) for anyone who stores or spreads information that is deemed to be false, distorting, and fictitious.66 These fines can be applied for offenses not serious enough to merit criminal prosecution. In June and July 2023, the popular online magazine Zing News was fined, and in tandem with the second fine it had its press license suspended for three months, having been accused of reporting outside of its approved mandate (see B2).67 Zing News has since changed its name to Znews and resumed publishing, but it is no longer allowed to report on daily news.68

A circular issued in 2014 tightened procedures for registering and licensing new social media sites. Among other requirements, the person responsible for a platform must have at least a university degree.

Internet content producers face a range of pressures that affect the quality and diversity of online information, including the in-house censorship process imposed on newspapers and online news outlets (see B5). Disinformation from both progovernment and antigovernment actors has increasingly distorted the online space, limiting the diversity of content and the democratic potential of social media.

Government-run outlets continue to dominate the online media landscape. Newer so-called “general information websites” and “social networks,” like Kênh 14 and Vietcetera, are owned by private entities but have been granted permission by the MIC to republish content from state media.

Young, educated Vietnamese people are increasingly turning to blogs, social media platforms, and other online news sources for information, rather than state television and radio broadcasters.69 Tools for circumventing censorship are well known among younger, tech-savvy internet users in Vietnam.

While digital tools largely remain available, the increasing persecution of dissidents, activists, nongovernmental organization (NGO) leaders, and ordinary internet users—as well as invasive state surveillance and general hostility from the government—has curtailed online organizing in Vietnam.

In previous years, digital mobilization often revolved around environmental issues or concerns about the expansion of China’s influence. However, such efforts have not been observed since 2018 due to the increasingly constrained political space for organizing or mobilizing civic action online.70 Vietnam’s LGBT+ community nevertheless continues to leverage the internet to organize online and offline Pride Month activities, as it did in September 2023.71

Certain activists have continued to use digital tools in the course of their work and have amassed notable online followings.72 As the government has increasingly pressured Facebook to remove content, internet users have turned to other platforms, like Telegram, to disseminate information and connect with one another.73

The constitution affirms the right to freedom of expression, but the CPV has strict control over the media in practice, using both formal measures such as laws and regulations and informal measures such as verbal directives. The judiciary is not independent, and trials related to free expression are often brief and apparently predetermined. Police routinely flout due process safeguards, arresting bloggers and online activists without a warrant or retaining them in custody beyond the maximum period allowed by law.

A series of laws and regulations have extended controls on traditional media content to the online sphere (see B3 and C2).74 The laws and regulations are designed to impose censorship, control the media environment, and punish those who are deemed to spread content “opposing the Socialist Republic of Vietnam,” inciting violence, revealing state secrets, and providing false information, among other broad provisions that restrict freedom of expression online.

Legislation—including internet-related decrees, the penal code, the Press Law, the Publishing Law, the Cybersecurity Law, and the 2018 Law on Protection of State Secrets—can be used to fine and imprison journalists and internet users.

The Cybersecurity Law prohibits a wide range of activities conducted online, including organizing opposition to the CPV, distorting Vietnam’s revolutionary history and achievements, spreading false information, and harming socioeconomic activities.75 In addition, websites and individual social media pages are prohibited from posting content that is critical of the state or that causes public disorder (see B3).

Articles 109, 117, and 331 of the penal code are commonly used to prosecute and imprison bloggers and online activists for the crimes of subversion, antistate propaganda, and abusing democratic freedoms. The articles also contain vaguely worded provisions that impose penalties of one to five years in prison for any actions taken in preparation for committing the main offenses in question.76 In addition, Article 19 of the penal code holds lawyers criminally responsible for failure to report clients to the authorities for a number of crimes, including illegal online activities, effectively making attorneys agents of the state.77

In January 2022, authorities amended Decree 15/2020/ND-CP,78 which covers speech on social media, in order to increase administrative fines for vaguely defined offenses including creating and disseminating false and misleading information, insulting reputations, damaging moral or social values, and revealing state secrets.79 For instance, the amended fines for individuals range from 10 million to 20 million dong ($410 to $820).

Authorities continued to pursue a substantial crackdown against online speech during the coverage period. Prosecutions for online activities were common, and some bloggers and human rights defenders received lengthy prison sentences. As of March 2024, 175 activists were being held in detention for exercising their fundamental rights, including freedom of expression.80

Several journalists, activists, and dissidents were given severe prison sentences during the coverage period, including under Article 117 of the penal code. In March 2024, Nguyễn Văn Lâm, administrator of the Facebook page “The Diary of Patriots,” was sentenced to eight years in prison for “making, storing, disseminating, propagandizing antistate information and materials” under Article 117.81

In July 2023, YouTube content producer and activist Phan Sơn Tùng was sentenced to six years in prison on antistate propaganda charges after he announced on the video-sharing platform that he was planning to establish a political party.82 In September 2023, dissident Nguyễn Minh Sơn was similarly sentenced to six years in prison for spreading antistate propaganda after posting a video clip on Facebook that allegedly insulted the CPV’s leadership.83 In December 2023, activist Lê Minh Thể was sentenced to 30 months in prison for social media posts that authorities found to “discredit the policies of the party and the state.”84

In February 2024, well-known activist and YouTuber Nguyễn Chí Tuyến was arrested and charged with “disseminating information, materials, items and publications against the Socialist Republic of Vietnam."85 In March 2024, avid Facebook user Hoàng Việt Khánh was arrested under Article 117 for posts that allegedly “smear[ed] the Communist Party of Vietnam and the Socialist Republic of Vietnam, and insult[ed] Ho Chi Minh,” the party’s founder.86

Ordinary users are also prosecuted for their online activities. In September 2023, businesswoman Nguyễn Phương Hằng was sentenced to three years in prison under Article 331 of the penal code for making ”unsubstantiated allegations” about several public figures on video live-streams.87

On three occasions in January and February 2024, the police summoned Trần Mai Sơn and Ngô Thị Oanh Phương, two popular Facebook users known for their critical posts on Vingroup’s business dealings and alleged human rights violations (see B2).88 Trần Mai Sơn reportedly fled Vietnam to seek asylum abroad in April 2024.

The Cybersecurity Law restricts anonymity online by requiring users to register for accounts on various social media platforms with their real names, and by obliging technology companies to verify the identities of their users.89

In July 2023, the MIC published a new draft decree that would replace the existing Decree 72 and enforce the Cybersecurity Law. If enacted after the public consultation period, it would require social media platforms to verify users’ identity, allow only verified accounts to post, and potentially block unverified accounts (see A3 and C6).90 A letter signed by 20 human rights organizations in August 2023 criticized the draft, calling its identity verification rule “a direct and substantial threat” to social media users’ right to privacy, free expression, and information.91

In May 2023, the MIC shut down almost a million unverified phone numbers—numbers for which the associated users’ registered personal information did not match Vietnam’s national residence database.92 In March 2024, the MIC shared that in 2023, telecommunications companies had “processed” 17 million unverified mobile subscribers, though it did not clarify what processing entailed.93

There are no restrictions on encryption or the use of encryption tools, though some laws require that authorities be given decryption keys on request (see C6).

Limited information is available about the surveillance technology used by Vietnamese authorities, though reports during the coverage period indicated that the government has expanded its capacity to conduct surveillance. The country’s legal framework, including the Cybersecurity Law, enables authorities to infringe on the privacy rights of citizens with relative ease.

In July 2021, Israeli humans rights lawyer Eitay Mack reported that the Israeli firm Cellebrite had sold phone-hacking technology to the MPS. The technology is said to have the capacity to extract data from locked mobile phones.94 In December 2020, Canadian research group Citizen Lab published a report that identified Vietnam as a likely client of Circles, an affiliate of the Israeli spyware company NSO Group. Circles provides two separate systems to access a phone’s geolocation, calls, and texts without hacking the device itself; one system connects to the infrastructure of local telecommunications companies, and the other connects to telecommunications companies globally.95

In 2013, Citizen Lab identified FinFisher software—which has the power to monitor communications and extract information, including contacts, text messages, and emails, from other computers without permission—on servers in Vietnam.96

Recent efforts to expand government data collection have raised privacy concerns, particularly in light of the lack of a personal data protection framework in Vietnamese law (see C6). As of November 2023, the MPS had issued 83 million chip-based identity cards to citizens;97 they are reportedly used to make financial transactions and access public and private services, including banking services and vehicle and social welfare registration.98 Despite major concerns about personal data protection, the data from the cards are stored in a centralized government database and are accessible to government officials.99 In June 2024, after the end of the coverage period, the government issued Circular 16/2024/TT-BCA, which stated that as of July 2024, citizens would be required to use a newly designed chip-based identification card with the ability to collect and store citizens’ biometric data.100

In June 2021, the MPS established the Research and Application Center for Residents Data (RAR) to provide services using a National Database of Residents, which includes personal data and biometric data.101

Between 2014 and 2017, the cybersecurity company FireEye tracked at least 10 separate cyberattacks from a group dubbed Ocean Lotus, or APT32, that sought to access the data of overseas-based Vietnamese journalists and private- and public-sector organizations in Vietnam.102 The group was believed to be aligned with the Vietnamese government.

Service providers and technology companies are required by law to aid the government in monitoring the communications of their users in a number of circumstances. The Cybersecurity Law dramatically increased requirements for companies to facilitate government surveillance by introducing data retention and localization provisions.

In February 2024, the MPS formally submitted a proposal to the cabinet to initiate the drafting process for a new data protection law.103

Decree 53, which took effect in October 2022, requires all domestic companies and some foreign companies—including social media platforms, telecommunications services, payment providers, and gaming platforms—to store the personal data of Vietnamese users within the country for at least 24 months and provide that data to the government on request.104 Personal data under Decree 53 are broadly defined, and the regulations also cover data associated with users’ accounts, like IP addresses, usernames, and registered phone numbers.105

In April 2023, authorities issued Decree 13/2023/ND-CP concerning personal data protection, which took effect that July.106 Most of the decree’s provisions are in line with international standards for data privacy. However, the decree established broad exceptions for government use of personal data, including for law enforcement purposes, raising concerns that it would not curtail privacy abuses in practice.107

Decree 72, which requires service providers to supply authorities with users’ personal information based on requests “related to terrorism, crimes, and violations of law,” lacks procedures and adequate oversight to discourage abuse. Under the decree, “authorities” encompasses ministers, heads of ministerial agencies and government agencies, provincial people’s committees, and “relevant organizations and individuals.” The decree mandates that companies maintain at least one domestic server “serving the inspection, storage, and provision of information at the request of competent authorities,” and requires them to store certain data for a specified period. In addition, owners of international domain names who run news sites and social media platforms must inform the MIC about their operations.

Decree 72 also requires domain-name registrars to collect and store identifying information on all owners of domain names.108 In July 2023, the MIC published for public consultation a draft decree to replace Decree 72, which would obligate platforms to identify users by default, among other requirements (see A3 and C4). The Global Network Initiative raised concerns with the draft decree, including its “extremely expansive and unclear scope,” “provisions on mandatory user identification,” and “proactive monitoring obligations.”109

In February 2024, the MIC released a draft decree to guide the implementation of the new Law on Telecommunication; if enacted, the decree would require ISPs to collect, verify, and store users’ names and mobile phone numbers, while data centers and cloud services would be required to store clients’ names, phone numbers, and email addresses.110

The Law on Information Security came into effect in 2016.111 Among other provisions, the law requires technology companies to share users’ data without their consent at the request of competent state agencies (Article 17.1.c), mandates that authorities be given decryption keys on request, and introduced licensing requirements for tools that offer encryption as a primary function, threatening anonymity.112

Under a 2014 circular, Vietnamese companies that operate general websites and social networks, including blogging platforms, are required to locate a server system in Vietnam, store posted information for 90 days, and retain certain metadata for up to two years.113

Cybercafé owners are required to install software to track and store information about their clients’ online activities, and citizens must also provide ISPs with government-issued documents when purchasing a home internet connection.114 A regulation requiring prepaid mobile phone subscribers to submit their identification details to the service provider is enforced consistently.115

Bloggers and online activists are subject to frequent physical attacks, job loss, severed internet access, travel restrictions, and other rights violations. As a result, numerous Vietnamese activists have been forced to go into hiding or flee the country.

During the previous coverage period, in April 2023, YouTuber Thái Văn Đường was allegedly abducted by Vietnamese security forces in Thailand and brought back to Vietnam, where he faced charges of “illegally entering” the country via Laos (see C3).116 He had lived in Thailand as a refugee since 2019 and ran a popular channel on Vietnamese politics.

Reports of physical abuse and torture in detention are common. 117 In January 2024, detention center guards reportedly inflicted severe beatings on Nguyễn Như Phương, who was sentenced in 2022 to five years in prison on allegedly fabricated drug charges after being investigated for Facebook posts that contained “propaganda against the state.”118

Threats against the families of journalists have led them to cease their work in the past.119 During the coverage period, some family members of jailed activists reported constant harassment from authorities.120 Trịnh Thị Nhung, wife of jailed online activist Bùi Văn Thuận, claimed that she had been repeatedly summoned to a police station ahead of and after visits to her husband in prison, as well as for allegedly running a proxy Facebook account on behalf of her husband, which she has denied.121

Prominent bloggers and online activists experienced de facto house arrest several times during previous coverage periods.122 Others reported being summoned by police without warrants, or with warrants that provided no reasons or legal grounds, as another form of harassment in retaliation for their online activities.123

Although no cyberattacks linked to the Vietnamese government and targeting human rights defenders and media sites were publicly disclosed during the coverage period, past reports suggest that the government and its affiliates are likely to have continued to employ the tactic.

An October 2023 Amnesty International report found that a series of attempted spyware attacks, including through phishing, against politicians and reporters in the United States, Taiwan, and the European Union had involved the use of Predator spyware and may have been associated with or carried out on behalf of government actors in Vietnam (see C5).124

Cybersecurity researchers reported in May 2023 that the hacker group Dark Pink had launched a cyberattack against a Vietnam-based nonprofit in December 2022.125 The group reportedly also targeted a religious organization in Vietnam in June 2022,126 and is known to target governments, militaries, and civil society organizations in the Asia-Pacific region. In March 2023, Check Point Research revealed that the China-based group SharpPanda had been running a cyberespionage campaign targeting the governments of Vietnam, Thailand, and Indonesia.”127

For several years, activists have been subject to account takeovers, including via spear-phishing emails that are disguised as legitimate content but carry malware capable of breaching the recipient’s digital security to access private account information.128