Vietnam’s Proposed Law on Information Network Security Threatens to Imperil Its ICT Economy

Over the past decade, the information and communications technology (ICT) sector has made significant contributions to Vietnam’s economic growth. However, a proposed new Law on Information Network Security (LONIS)—which would apply onerous licensing and permitting requirements upon millions of ICT products containing cryptographic capabilities—threatens to short-circuit the robust levels of both ICT imports and exports that have underpinned the rapid growth of Vietnam’s ICT sector. Not only that, but LONIS potentially breaches commitments made by Vietnam in its World Trade Organization (WTO) accession report concerning imports of ICT products containing encryption as well as elements of the Trans-Pacific Partnership (TPP) trade agreement protecting trade in encrypted products.

ICT production and consumption have been key pillars in Vietnam’s stellar economic performance, with Vietnamese GDP growing, on average, more than 6 percent annually over the past 15 years. For example, the average annual growth rate of Vietnam’s ICT sector reached 55 percent from 2008 to 2013, while from 2004 to 2014, the percentage of ICT goods exports as a share of Vietnam’s total goods exports increased nine-fold, from 2.7 percent to 27 percent, making ICT goods the country’s largest export sector in the process. Revenues generated by Vietnam’s ICT sector reached $39.5 billion in 2013 and are expected to exceed $55 billion in 2016. Going forward, according to the report Vietnam: Embracing ICT for Economic Catch-up, the annual value-added by Vietnam’s ICT industry is expected to remain at least two to three times greater than the country’s GDP growth rate, such that by 2020 the contribution of Vietnam’s ICT industry will account for 8 to 10 percent of the country’s GDP.

Unfortunately, the Law on Information Network Security—alongside accompanying implementing legislation drafted by Vietnams’ Ministry of Information & Communications (MIC) and Ministry of Defense (MOD)—places Vietnam’s emerging ICT sector at risk. The proposed regulations would impose impracticable, near-blanket import-export and business licensing requirements upon a wide variety of commercial ICT products containing cryptographic capability—such as smartphones and integrated circuits (ICs)—even when encryption or cryptography is not the main intent of the ICT product. The regulations are broadly and vaguely defined, with most provisions making no distinction between products in which cybersecurity is a core vs. secondary function (such as the difference between a two-factor authentication key fob and a computer monitor). In total, LONIS could impact as much as $25.3 billion worth of ICT imports entering Vietnam annually.

LONIS potentially sets a worrisome precedent, for its proposed regulations on ICT products containing cybersecurity components are far more expansive and burdensome than those promulgated by any other government. That’s concerning, especially when the vast majority of governments do not even regulate commercial ICT products that use encryption as a secondary function, recognizing that such products are ubiquitous and do not pose a threat to security, meaning that regulating them adds virtually no value. Furthermore, even Vietnam’s MOD has recognized the difference between ICT products “specifically designed for information security” and ICT products in which “the information security function using encryption is not the core function.” Yet, strangely, while the MOD implementing decree accordingly exempts the latter set of ICT products from its business licensing requirements, it would not also exclude them from its import-export permitting requirements. The MIC implementing decree, with its broad list of ICT products and overlapping jurisdiction with MOD, has no exemption at all.

As Vietnamese ministries continue to hash out the details, they should focus on the greater reality that LONIS’ onerous licensing and permitting requirements would inflict significant damage upon Vietnam’s robust information economy while creating an immense administrative burden on the Vietnamese government without appreciably improving security. Indeed, the regulations would degrade the overall competitiveness of Vietnams’ ICT industry, including its potential for exports, economic, and employment growth, while also harming other industries that either supply or build upon Vietnam’s ICT industries.

A great strength of Asia’s regional economy has been the development of ICT supply chains—empowered by thoughtful policies such as the Information Technology Agreement (ITA), which removes tariffs to trade on hundreds of ICT components and products—that enable the seamless movement of ICT parts across borders at low cost. In Vietnam’s case, its largest ICT goods export—$24.4 billion of mobile phones annually—is underpinned by its largest ICT goods import—$10.3 billion worth of integrated circuits (e.g., semiconductors)—which power the mobile phone itself. Yet this symbiotic relationship—imports of key ICT inputs powering Vietnam’s most important ICT exports—threatens to be significantly disrupted by the onerous licensing and permitting requirements envisioned by LONIS. In short, the competiveness of Vietnam’s ICT industry depends on rapid and low-cost access to key imported components (such as integrated circuits and storage devices), the effective trading of ICT products within Vietnam, and the efficient export of ICT products, all of which are threatened by LONIS.

Moreover, as the aforementioned Embracing ICT for Economic Catch-up report notes, foreign direct investment (FDI) has been a significant contributor to the growth of Vietnam’s ICT industry. Foreign enterprises including Intel, LG, Microsoft, and Samsung have each made massive investments, such as Intel’s $1 billion investment in a semiconductor and testing facility near Ho Chi Minh and Samsung’s $3 billion smartphone assembly center in Bac Ninh province. All told, inbound FDI into Vietnam has averaged approximately $17 billion annually over the past five years, and topped $22 billion in 2015. FDI has played a pivotal role in powering Vietnam’s rapidly growing ICT economy, but over-regulation of the ICT sector, such as through the excessive licensing and permitting requirements contemplated by LONIS, threatens to add significant costs to trade in ICT products (both within Vietnam and across its borders) and this could significantly detract from Vietnam’s attractiveness as a location for FDI in the ICT industry.

Finally, without the existence of a blanket exemption from product-related requirements in LONIS for mass-marketed ICT products which are not “specially designed” for information security and that use encryption for non-core functions, certain provisions in LONIS (and the ministries’ decrees implementing them) are likely to conflict with Vietnam’s WTO and TPP commitments. Specifically, in paragraph 218 of its WTO accession report, Vietnam confirmed that its restrictions on imports of “specialized encryption machines and encryption software subject to State secret” would “not apply to general, commercially traded goods equipped with encryption technology, which were destined for mass consumption, such as all products covered by the WTO Information Technology Agreement.” In addition, Article 2.10.1 of the TPP’s Market Access chapter states: “Unless otherwise provided in this Agreement, no Party shall adopt or maintain any prohibition or restriction on the importation of any good of another Party or on the exportation or sale for export of any good destined for the territory of another Party…” and it’s clear that this prohibition on import restrictions expressly applies to the “importation of commercial cryptographic goods.” In other words, LONIS does not comport with the commitments TPP members have agreed to undertake in the agreement.

Fortunately, Vietnam can readily fix this problem: (i) by expanding the Ministry of Defense’s exemption from LONIS’ business license requirement to also cover the import-export permitting requirements; and (ii) by MIC adopting the same exemption in its decree. ICTs have played a powerful role in driving Vietnam’s economic and high-wage employment growth over the past decade and a half. But that growth will only persist if Vietnam refrains from introducing policies such as LONIS—and others, such as Decree 72, which has contemplated local data storage requirements—that add unnecessary and unproductive barriers and costs to ICT trade and investment.