Vietnam Consolidates Digital Control With New 2025 Cybersecurity Framework

Vietnam is intensifying its crackdown on digital expression by leveraging cybersecurity legislation to penalize the dissemination of "false information." This shift signals a broader effort by the state to consolidate its authority over the internet and emerging technologies.

Recent enforcement actions highlight the government's willingness to target individual users for minor infractions. The Ministry of Public Security recently fined an individual 7.5 million VND ($285) for spreading what authorities termed "false information" via viral photos shared during a heatwave in Hanoi. The Ministry has explicitly warned citizens to refrain from posting or disseminating misleading information that could affect public order, security, or the legitimate rights of organizations and individuals.

A New Legal Architecture

This crackdown coincides with a major legislative overhaul. Vietnam is currently drafting a Cybersecurity Law 2025, which is intended to consolidate and replace both the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. Unlike previous iterations, the 2025 framework places a heightened focus on data sovereignty and the regulation of emerging technologies, specifically artificial intelligence and deepfakes.

While the government frames these updates as necessary for national security, the move follows a regional pattern. Countries such as Myanmar and Bangladesh have similarly utilized cybersecurity justifications to suppress dissent and target government critics. Vietnam's 2019 laws already granted the state broad powers to monitor and censor the web, but the new legislation suggests a move toward a more integrated model of digital control.

The Deterrence Gap

Despite the increase in enforcement, some officials within the government believe current penalties are insufficient. Lieutenant Colonel Nguyen Dinh Do Thi of the Ministry of Public Security stated that administrative penalties for cybersecurity violations remain significantly low compared to international standards and lack sufficient deterrent power.

Currently, the maximum administrative fines for cybersecurity violations are capped at VND 200 million ($7,600) for organizations and VND 100 million ($3,800) for individuals. This debate over penalty ceilings comes as the state faces genuine security threats; Vietnam recorded over 600,000 cyberattacks targeting domestic information systems in 2024 alone.

Implications for Digital Rights

By blending AI regulation, data sovereignty, and national security into a single legal apparatus, the Vietnamese government can more effectively criminalize speech it deems harmful to public order. The transition to the 2025 framework likely creates a chilling effect on digital expression, as the boundary between a security threat and political dissent becomes increasingly blurred.

Observers are now watching how the 2025 law will be implemented in practice, particularly regarding the monitoring of AI-generated content. While the government emphasizes the need to combat cyberattacks and misinformation, the primary concern for activists and journalists remains the potential for increased arrests and the systematic erasure of online opposition.