VIETNAM NATIONAL UNIVERSITY, HANOI VIETNAM JAPAN UNIVERSITY VU PHUONG LINH CYBERSECURITY LEGAL FRAMEWORKS IN VIETNAM AND JAPAN: A COMPARATIVE ANALYSIS MASTER’S THESIS MASTER OF PUBLIC POLICY Hanoi, 2019 i LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com VIETNAM NATIONAL UNIVERSITY, HANOI VIETNAM JAPAN UNIVERSITY VU PHUONG LINH CYBERSECURITY LEGAL FRAMEWORKS IN VIETNAM AND JAPAN: A COMPARATIVE ANALYSIS MAJOR: PUBLIC POLICY CODE: PILOT RESEARCH SUPERVISORS: Associate Prof. KOBAYASHI TAKAAKI Dr. BUI HAI THIEM Hanoi, 2019 ii LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com CONTENTS LIST OF FIGURE. Why choose this topic?.
Purpose of the research:. Limitation of the research: .10 CHAPTER 2: COMPARISION BETWEEN VIETNAMESE AND JAPANESE CYBERSECURITY LEGAL FRAMEWORKS. Japanese cybersecurity legal frameworks. Characteristics of Japanese cybersecurity legal framework.
Vietnamese cybersecurity legal framework. Characteristics of Vietnamese cybersecurity legal framework. Similarities between Japanese and Vietnamese legal frameworks: .25 CHAPTER 3: EXPLANATION WHY THERE ARE DIFFERENCES BETWEEN TWO LEGAL FRAMEWORKS. Background of Japan: .27 i LUAN VAN CHAT LUONG download : add luanvanchat@agmail.
Situation in Japan:. History of modern law of Japan. The theory of “Rule of Law”. Background of Vietnam:.
Situation about cybersecurity in Vietnam:. History of modern law in Vietnam:. Theory of Socialist state ruled of law .37 CHAPTER 4: THE EFFECTS FROM LEGAL FRAMEWORKS. The effects from Japanese cybersecurity legal framework.
The effects from Vietnamese cybersecurity legal framework .45 CHAPTER 5: RECOMMENDATIONS AND CONCLUSION .53 ii LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com LIST OF FIGURE Figure 3.1: The percentage of total population and number of aging people over 70 years old in Japan (1990 – 2018).1: The organization of agencies in charge of cybersecurity before and after the Basic Act on Cybersecurity……………….2: Current framework of cybersecurity policy in Japan………….3: Proactive measures taken to guard against cyberattacks……….4: Top risky online behaviors in Vietnam.5: Weakness of enterprises in Vietnam about information security.1: Promoting cybersecurity through anime in Japan………………….50 iii LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com ACKNOWLEDGEMENTS From the bottom of my heart, I would like to thank my supervisors, Prof. Kobayashi and Dr. Thiem, for their wonderful supports. Despite the fact that both of them are very busy, they always try to spend their time to help and give me valuable ideas.
Kobayashi has helped me with the methodology and made me understand my research topic better, Dr Thiem has pointed out for me which theories should I use in this thesis and give me advices to improve my paper. Without their guidance, this thesis cannot be finished. Next, I want to send my gratitude to Dr. Thuy Anh and Dr.
Hoang Linh for giving me helpful comments and supporting me mentally at VJU. I also want to give my special thanks to all teachers and everyone at Tsukuba University, especially the staffs at Global Initiative Office for their warmly welcome and helping me with my internship in Japan. Through the internship, I had had the opportunities to collect documents for this thesis and had time to understand Japan better. Moreover, I would love to thanks all the teachers at VJU and our program assistant, Mrs.
Ha, for helping me with the procedure related to this thesis and other works. Last but not least, there are my family and my friends – all the people who has supported me from the beginning until the end of this thesis. Thank you, for always stay by my side and encourage me. iv LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com ABBREVIATION AI: Artificial Intelligence APT: Asia-Pacific Telecommunity CII: Critical information infrastructure IoT: Internet of things NISC: National center of Incident readiness and Strategy for Cybersecurity NSC: National Security Council (Japan) VGCA: Vietnam Government Certification Authority VNISA: Vietnam Information Security Association v LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com CHAPTER 1: INTRODUCTION 1.
Overview: Nowadays, cybersecurity has become one of global issues since Internet has been the center of many crucial activities of human beings due to its convenience, including connecting with other people, online shopping, entertainment… and collecting information. However, this environment is totally not safe as it seems: The more people using Internet, the more of their private information will be put onto it and this information can be used for cybercrime and malicious cyberattack, threatening human rights and properties of the owners. The target could be any legal person, from individuals to groups, organizations, and even government agencies. Cybercrime are also creating more heavy damages than ever before: According to the report from McAfee (2018) – One of worldwide security companies, the cost of cybercrime in 2016 was $4.2 trillion; In the case of WannaCry ransomware attack only in 2017, the losses could reach $4 billion with more than 100.000 groups over 150 countries had been affected (CBS News, 2017).
Consider the number of cyberattacks which increases sharply in these decades, together with the awareness about the possible damages which cyberattack can create, many governments have made their moves by built cybersecurity legal framework, including Vietnam. On June 12th 2018, Vietnamese Cybersecurity Law was officially passed with the approval of 423 Assembly members (86,86% of the total members of the National Assembly), and has been enforced from January 1st 2019. After being approved by the Assembly, there are many people who has raise their voice referring to the content of this law. Many people worried that their basic human rights will be violated, including the freedom of speech, the right of access to information and their privacy since the law has mentioned about the responsibilities of Internet service providers and other enterprises provide their services on the Internet, which includes verify the identification of the users, provide the information regarding the users to the professional cybersecurity force of the Ministry of Public Security when they request, prevent and delete the 1 LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com information which is considered as illegal, including: Against the Vietnamese government, disturbing the public, national secrets.
A large number of organizations, groups and activists in Vietnam are also shown their concerns regarding how the Cybersecurity Law will affect their activities in the future, including UN Human Rights, American Chamber Commerce, and so on. Why choose this topic? a) Cyberspace is important to our current life: With the increasing of Internet users and activities which are happening on the cyberspace, it is clear that the cyberspace is becoming an inseparable part of our life. According to Statista (2019), approximately 4.4 billion people were active Internet users as of April 2019, encompassing 58% of the global population. In some countries such as UAE, Iceland, Norway, Qatar… the online usage rate is 99% (Statista, 2019).
Being able to store and exchange a massive amount of information without limitation of time and space are also some of the strongest characteristics of cyberspace. Over the last two years alone, 90 percent of the data in the world was generated and each day, there are 2.5 quintillion bytes of data created at our current pace (Marr B. Thanks to these amounts of information and the speed of information flows, human being can connect to each other, despite of distance and time, together with doing other activities such as online shopping, mobile banking, studying through online classes and so on. Regarding the number of possibility activities are increasing, the barrier between cyberspace and real space is also become blur.
This also means that the attacks come from cyberspace can also create heavy damage in reality, with a larger scale and it is much harder to find out the culprit. In order to prevent and keep the damage at minimum, governments have been put many efforts in improving cybersecurity and building a cybersecurity legal framework is one of them. b) There is no proper research about current Vietnamese cybersecurity legal framework in general and comparative research about Vietnamese 2 LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com cybersecurity legal framework and Japanese cybersecurity legal framework in particular: While Vietnamese Cybersecurity Law was just passed last year and the concept of cybersecurity still new to the people, Japan is the first country in G7 (including France, Germany, the U.S, England, Canada, Italy and Japan) implemented “Basic Act on Cybersecurity” as a specific law for cybersecurity (Kazuyasu S. Therefore, Japan has had a long time in implementing cybersecurity law than other countries.
Moreover, Japan is also well- known as a country with high technology, thus this country may have more experiences about dealing with cyberattack. Definitions: In this paper, some inportant key terms will be applied definitions as below: - Cybersecurity legal framework: Legal framework can be understood as a set of specialized legal regulations which manage same kind of social relations to ensure these relations can work in unity and maintain the social order. Cybersecurity legal framework is a set of specialized legal regulations manage relations between all the stakeholders which are related to cybersecurity. This can include the Constitution, Criminal Law, Cybersecurity Law and other legal documents.
- Cybersecurity: In order to point out what are the differences between two legal frameworks, this paper will use two definitons of cybersecurity which are mentioned in the main cybersecurity law of each system. a) In the case of Japan, the definition of cybersecurity will be taken from the Basic Act on Cybersecurity, which is “the necessary measures that are needed to be taken to safely manage information, such as prevention against the leak, disappearance, or damage of information which is stored, sent, in transmission, or received by electronic, 3 LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com magnetic, or other means unrecognizable by natural perceptive functions (hereinafter in this section referred to as "Electronic or Magnetic Means"); and to guarantee the safety and reliability of information systems and information and telecommunications networks (including necessary preventive measures against malicious activities toward electronic computers through information network or storage media for information created by electronic or magnetic means (hereinafter referred to as "Electronic or Magnetic Storage Media")), and that those states are appropriately maintained”. b) In the Cybersecurity Law in 2018 of Vietnam, the term “cybersecurity” can be understood as “assurance that activities in cyberspace do not harm national security, public order, the lawful rights and interests of any organization or individual” Similar to the term “cybersecurity”, other related terms such as cyberspace, cyberattack and cybercrime will also use two definitions from both countries: - Cyberspace and National cyberspace: a) In the Cybersecurity Strategy in 2015 of Japan, cyberspace has been defined as “an artificial domain for the free exchange of ideas without being constrained by national borders” and “an intangible frontier of infinite values generated by intellectual creations and innovations inspired by the ideas globally exchanged”. b) In Vietnam, “cyberspace” means a network of information technology (IT) infrastructure which includes telecommunications network, the Internet, computer network, communication systems, information processing and control systems, databases; cyberspace is where people’s activities are not limited by space and time.
(National Assembly, 2018) 4 LUAN VAN CHAT LUONG download : add luanvanchat@agmail.com Beside the definition of cyberspace, Vietnamese Cybersecurity Law also mentions the term “national cyberspace”, which has been defined as “a cyberspace established, managed and controlled by the Government”. - Cyberattack: a) In the Cybersecurity Law of Vietnam, “cyberattack” has been explained as “the use of cyberspace, information technology or electronic devices to sabotage or interrupt the telecommunications network, the Internet, computer network, communication systems, information processing and control systems, databases or electronic devices”. b) In Japan, while this terms is not defined in the cybersecurity law, according to Japanese Ministry of Defense (n.), “cyberattack” can be understood as “abuse of information and communications networks, information systems to make an unauthorized access, steal, falsify or destroy information, cause information systems to cease functioning or to malfunction, execute a malicious program or implement a DDoS attack (distributed denial of service attack) through cyberspace”.