Nghị định 73/2007/ND-CP

DECREE

ON ACTIVITIES OF STUDYING, PRODUCING, TRADING AND USING CRYPTOGRAPHY TO PROTECT INFORMATION NOT CLASSIFIED AS STATE SECRETS

GOVERNMENT

Pursuant to the December 25, 2001 Law on organization of Government;

Pursuant to the April 15, 2001 Ordinance on Cipher;

At the proposal of Head of the Cipher Board of Government,

DECREES:

Chapter 1:

GENERAL PROVISIONS

Article 1. Scope of regulation

This Decree provides for activities of studying, producing, trading and using cryptography to protect information not classified as state secrets; state management on civil cryptography, inspection, examination, handling of violations and settlement of complaints, denunciation on civil cryptography.

Article 2. Subjects of application

This Decree applies to organizations and individuals participating in activities of studying, producing, trading and using cryptography to protect information not classified as state secrets.

In case a treaty to which the Socialist Republic of Vietnam is a contracting party otherwise provides, such treaty will prevail.

Article 3. Interpretation of terms

In this Decree, the following terms are construed as follows:

1. “Information not classified as state secrets” means information not classified “absolute secret”, “top secret” and “secret” information as prescribed in the December 28, 2000, Ordinance on state secrets protection.

2. “Cryptography” means rules used specially to change form of information with purpose of keeping secret of content of such information.

3. “Civil cryptography” means cryptography used to protect information not classified as state secret.

4. “Civil cryptography product” means documents, technical equipment, software programs on cryptography used to protect information not classified as state secret.

5. “Business in civil cryptography product” means implementation of one or many stages of the investment process, from producing to sale of civil cryptography products or providing civil cryptography services in the market for profits.

6. “Civil cryptography services” include services of consultancy, provision, installation, training, warranty, repair of civil cryptography products and other concerned services to protect information not classified as state secret.

Article 4. Technical regulations and application of technical regulations for civil cryptography products

1. List of civil cryptography products must apply the national technical regulations in each period which the Cipher Board of Government has assumed the prime responsibility for, and coordinated with the Ministry of science and technology in elaborating and submitting to competent agencies for promulgation. This List shall be reviewed annually to add civil cryptography products that are required to apply the national technical regulations under current regulations.

2. List of civil cryptography products must be certified technical regulation in line with the national technical regulations in each period which the Cipher Board of Government has assumed the prime responsibility for, and coordinated with the Ministry of science and technology in elaborating and submitting to competent agencies for promulgation on the basis of list of civil cryptography products that must apply the national technical regulations as prescribed in Clause 1 this Article.

Article 5. Policy of State on activities of studying civil cryptography, producing, trading and using civil cryptography products

1. To attach special importance to investment in building material-technical facilities, training human resource in serve of state management on activities in domain of civil cryptography.

2. To encourage activities of scientific and technology development research and application in serve of activities in domain of civil cryptography.

3. To encourage and facilitate for organizations and individuals in use of civil cryptography products satisfying requirements on economic-social development.

4. To protect lawful rights and benefits of organizations and individuals participating in activities of studying civil cryptography; producing, trading and using civil cryptography products as prescribed by law.

5. To encourage the international cooperation expansion in domain of civil cryptography.

Article 6. Prohibited acts in activities of studying civil cryptography, producing, trading and using civil cryptography products

1. To distort or oppose undertakings and policies of the Communist Party of Vietnam and laws of the State of the Socialist Republic of Vietnam; disrupting the great national unity.

2. To invade benefits of the Socialist Republic of Vietnam, lawful rights and benefits of organizations and individuals.

3. To infringe intellectual property; collect, occupy, cheat, forge, illegal transfer civil cryptography products.

4. To invade, discover illegally secrets of cryptography and information cryptography legally by organizations and individuals; reveal information of civil cryptography products, information of customers who use legally civil cryptography products causing damage to organizations and individuals; reveal state secret information in any form.

5. Trading civil cryptography products with unidentified origins

Chapter 2:

STUDYING CIVIL CRYPTOGRAPHY, PRODUCING, TRADING AND USING CIVIL CRYPTOGRAPHY PRODUCTS

SECTION 1: STUDYING CIVIL CRYPTOGRAPHY

Article 7. Rights and obligations of organizations and individuals participating in activities of studying civil cryptography

Organizations and individuals conducting activities of studying civil cryptography shall be entitled to enjoy rights and execute obligations as prescribed in Article 15, Article 16, Article 17, Article 18 of Law on science and technology and provisions in Article 6 and Article 8 of this Decree.

Article 8. Application of provisions on product and goods quality for result of studying civil cryptography

1. For civil cryptography products are result of studying, organizations and individuals conducted study are encouraged to announce on standard conformity prescribed by the Ministry of science and technology and permitted to transfer to enterprises for producing and trading civil cryptography products or organizations and individuals for using legally.

2. For civil cryptography products are result of studying not in list of civil cryptography products required to apply the national technical regulations as prescribed in Article 4 of this Decree, organizations and individuals conducted study are encouraged to announce on technical-regulation conformity as prescribed by the Ministry of science and technology and permitted to transfer to enterprises for producing and trading civil cryptography products or organizations and individuals for using legally.

3. For civil cryptography products are result of studying in list of civil cryptography products required to apply the national technical regulations as prescribed in Article 4 of this Decree, organizations and individuals conducted study must conduct announcement on technical-regulation conformity as prescribed by the Ministry of science and technology and permitted to transfer to enterprises for producing and trading civil cryptography products or organizations and individuals for using legally.

4. The Cipher Board of Government shall appraise, assess and certify standard conformity for civil cryptography products which are result of study when having request for certifying standard conformity in line with national standards.

5. If civil cryptography products which are result of studying fall in list of civil cryptography products required to certify technical-regulation conformity in line with the national technical regulations as prescribed in Article 4 of this Decree, the Cipher board of Government shall appraise, assess and certify technical-regulation conformity for such products before transfer to enterprises for producing and trading civil cryptography products or organizations and individuals for using legally.

SECTION 2: PRODUCING, TRADING CIVIL CRYPTOGRAPHY PRODUCTS

Article 9. Rights and obligations of organizations and individuals participating in activities of producing, trading civil cryptography products

1. They have the following rights:

a) To select civil cryptography products for producing, trading;

b) To sign contracts of investment in producing, trading, exporting and importing civil cryptography products with domestic and foreign organizations and individuals as prescribed by law;

c) To refuse provision of products and services involving civil cryptography when detecting that organizations and individuals have breached law on using civil cryptography products, violated the agreed commitments on use of products provided by enterprise.

d) To enjoy other rights as prescribed by law.

2. They have the following obligations:

a) To manage dossiers, documents on technical solutions, production technology;

b) To apply measures on security, safety;

c) To take responsibilities before law for quality of civil cryptography products and services, protecting customers who use legally civil cryptography products provided by enterprise;

d) To suspend temporarily or stop provision of civil cryptography products and services in emergency cases to ensure national security;

e) To coordinate and facilitate for competent agencies in executing professional measures as requested;

f) To fulfill other obligations as prescribed by law.

Article 10. Conditions for producing, trading civil cryptography products

The civil cryptography products and services fall in list of goods and services limited business. Organizations and individuals participating in activities of producing, trading civil cryptography products must satisfy the following requirements:

1. They must establish enterprises and register for producing and trading as prescribed by Law on enterprises.

2. Possessing license for producing, trading civil cryptography products granted by the Cipher Board of Government as prescribed in Article 11 of this Decree.

3. They satisfy the state management regulations on product, goods and service quality.

Article 11. Conditions for granting license for producing, trading civil cryptography products

1. Condition on entity: They are enterprises established under Law on enterprise.

2. Conditions on personnel:

a) Head of an enterprise producing and trading civil cryptography products must have clear curriculum vitae; have legal knowledge and professional qualification in domain of information security and safety;

b) The contingent of technical staff, managers, executive staff, security staff and customer service staff have professional qualification and signed labor contracts as prescribed by law.

3. Other assurance conditions:

a) To assure conditions of security, safety, prevention of fire and explosion, and protection of natural resources and environment.

b) To have technical plans and the production and business plans which are feasible and consistent with provisions, technical regulations and standards on quality of civil cryptography products.

Article 12. Dossier of applying for license for producing, trading civil cryptography products

1. Dossier of applying for license for producing, trading civil cryptography product includes:

a) Application for grant of license for producing, trading civil cryptography products make according to the set form;

b) A valid copy of certificate of business registration or investment certificate of enterprise;

e) Technical plan and the production and business plan of civil cryptography products;

d) Curriculum vitae of head of enterprise and members in charge of technique certified by the People's Committee of ward, commune, or township where they reside.

2. Enterprise applying for license for producing and trading civil cryptography products shall be responsible before law for contents declared in dossier.

Article 13. Appraisal of dossier and grant of license for producing, trading civil cryptography products

1. Within 10 (ten) working days, after receiving a valid dossier of enterprise requesting for grant of license for producing and trading civil cryptography product, the Cipher board of Government shall appraise dossier and grant license for producing and trading civil cryptography product to enterprise.

2. If enterprise fail to satisfy full conditions as prescribed in Article 11 of this Decree, the Cipher board of Government shall notify in writing enterprises in which clearly stating reason of refusal for grant of license for producing and trading civil cryptography product.

Article 14. Withdrawal of license for producing, trading civil cryptography product

1. Licenses for producing, trading civil cryptography product shall be withdrawn in the following cases:

a) Enterprise is dissolved, bankrupt under Law on enterprise;

b) Enterprise is withdrawn certificate of business registration;

c) Enterprise is no longer eligible as prescribed in Article 10 of this Decree;

d) Enterprise fails to deploy operation within six months from the day of being granted license for producing and trading civil cryptography product without legitimate reason.

2. After duration of 3 months, from being withdrawn license for producing and trading civil cryptography product, if enterprises satisfy full conditions as prescribed in Article 10 of this Decree, enterprises may apply for re-grant of license for producing and trading civil cryptography product. Procedures are like procedures for granting new license

Article 15. Dossier of applying for certificate of standard conformity for civil cryptography product, certificate of technical-regulation conformity for civil cryptography product

1. Dossier of applying for certificate of standard conformity for civil cryptography product, or certificate of technical-regulation conformity for civil cryptography product includes:

a) Application for certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product made according to the set form;

b) Copy of ID card or passport for individuals; valid copy of certificate of business registration for enterprises or decision on establishment for organizations;

c) Technical documents, documents on origin of product, design documents, algorism, professional solutions, and technical explanation;

d) Model of product.

2. Organizations and individuals applying for certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product shall be responsible before law for contents declared in dossier.

Article 16. Verification and assessment the conformity with standards, technical regulations and grant of certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product

1. Within 30 (thirty) working days, after receiving a valid dossier of organization or individual requesting for grant of certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product, the Cipher Board of Government shall verify, assess and grant certificate.

2. If civil cryptography product fails to satisfy full standards and technical regulations of product as prescribed by current law, the cipher board of Government shall not grant certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product, and state clearly reason thereof in writing.

3. In special case where need time for verification and assessment on quality of civil cryptography product, time for verification, assessment, grant or refusal for certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product shall not exceed six months. The cipher board of Government shall notify in writing organizations and individuals requesting for certificate thereof

Article 17. Responsibilities of enterprises producing and trading civil cryptography product for application of standards, technical regulations

1. Enterprises producing and trading civil cryptography products must announce standard conformity applicable to product with competent state agencies.

2. Enterprises producing and trading civil cryptography products must announce technical-regulation conformity applicable to products provided that such products fall in list of civil cryptography product required to apply technical regulations as prescribed in Article 4 of this Decree, with competent state agencies.

3. Enterprises producing and trading civil cryptography products organizing production and business of civil cryptography products, upon requesting for certificate of standard conformity, shall be tested, verified, assessed and granted certificate of standard conformity for those products by the cipher board of Government.

4. Enterprises producing and trading civil cryptography products organizing production and business of civil cryptography products in list of civil cryptography products required to certify technical-regulation conformity as prescribed in Article 4 of this Decree must be tested, verified, assessed and granted certificate of technical-regulation conformity for those products by the cipher board of Government, before putting into circulation in the market.

Article 18. Export and import of civil cryptography product

1. List of civil cryptography products permitted export and import falls in list of products and goods limited business.

2. Organizations and individuals exporting and importing civil cryptography products must comply with Article 10 of this Decree and only export and import products in list of export/import civil cryptography products.

SECTION 3. USE OF CIVIL CRYPTOGRAPHY PRODUCT

Article 19. Rights and obligations of organizations and individuals using civil cryptography product

1. They have the following rights:

a) To select freely civil cryptography products and select enterprises providing civil cryptography products, civil cryptography services;

b) To transfer, give, exchange civil cryptography products;

c) To enjoy other rights as prescribed by law.

2. They have the following obligations:

a) To abide by provisions committed with supplier of civil cryptography products about: Management of enciphering key use, transfer, repair, maintain civil cryptography products and other related contents;

b) To coordinate and facilitate for competent state agencies in implementing measures to ensure safety of cryptography, information security, prevention of crimes in stealing information, cryptography and using civil cryptography products in unlawful purposes;

c) To fulfill other obligations as prescribed by law.

Chapter 3:

STATE MANAGEMENT ON CIVIL CRYPTOGRAPHY

Article 20. Content of state management on civil cryptography

1. To build mechanism, policy, strategy, planning and plan on cryptography science and technology development in serve of civil purposes.

2. To elaborate, promulgate legal documents and guideline on managing activities of studying civil cryptography, producing, trading and using civil cryptography products.

3. To manage grant of license, withdrawal of licenses for producing, trading civil cryptography products.

4. To test, verify, assess and certify standard conformity, certify technical-regulation conformity for civil cryptography products and grant certificate of standard conformity for civil cryptography product or certificate of technical-regulation conformity for civil cryptography product to organizations and individuals permitted production and business.

5. To manage safety, security in use of civil cryptography products.

6. To inspect, check, handle violations and settle complaints, denunciation in domain of civil cryptography.

7. To conduct the international cooperation in domain of civil cryptography.

Article 21. Responsibilities of the cipher board of Government

1. To assume the prime responsibility for, and coordinate with relevant Ministries and sectors in elaborating legal documents on managing civil cryptography, draft of standards, technical regulations for civil cryptography products, and submit them to competent agencies for promulgation and implementation guideline.

2. To assume the prime responsibility for, and coordinate with relevant Ministries and sectors in elaborating the national cryptography policy, strategy to develop science and technology potential in civil cryptography.

3. To organize apparatus of management, registration, appraisal, assessment, certification of standard conformity, certification of technical-regulation conformity for civil cryptography product and grant of license for producing, trading civil cryptography product; certificate of technical-regulation conformity for civil cryptography products, certificate of standard conformity for civil cryptography product.

4. To assume the prime responsibility for, and coordinate with relevant Ministries and sectors in inspecting, checking, handling violations and settling complaints, denunciation in activities of studying civil cryptography, producing, trading and using civil code products under its authority.

5. To conduct the international cooperation on civil cryptography.

Article 22. Responsibilities of ministries, sectors and provincial/municipal People’s Committees

1. The Ministry of Public Security shall assume the prime responsibility for, and coordinate with the cipher board of Government in implementing technical and professional measures to prevent and combat crimes, ensure national security, social safety in activities of studying civil cryptography, producing, trading and using civil cryptography products.

2. The Ministry of Science and Technology shall assume the prime responsibility for, and coordinate with the cipher board of Government in implementing state management on activities of studying science, technology in civil cryptography; appraise and announce the national standards for civil cryptography products; appraise the national technical regulations for civil cryptography products.

3. The Ministry of Trade shall assume the prime responsibility for, and coordinate with the cipher board of Government to submit to the Prime Minister for promulgation of: list of civil cryptography goods and services in list of goods and services limited business; list of civil cryptography products permitted export, import of Vietnam.

4. The Ministry of Finance shall assume the prime responsibility for, and coordinate with the cipher board of Government in providing for the collection level and regime of management and use for fees and charges involving the appraisal, assessment, certification of standard conformity, certification of technical-regulation conformity for civil cryptography products and grant of license for producing, trading civil cryptography products, certification of standard conformity for civil cryptography product, certification of technical-regulation conformity for civil cryptography product.

5. Ministries and Ministerial agencies, Governmental agencies shall, within their functions, tasks and powers, coordinate with the cipher board of Government, in guiding enterprises producing and trading civil cryptography products as prescribed by law.

6. The provincial/municipal People’s Committees shall perform function of state management over activities of producing, trading civil cryptography products in localities in accordance with this Decree.

Chapter 4:

INSPECTION, EXAMINATION, HANDLING VIOLATIONS AND SETTLEMENT OF COMPLAINTS, DENUNCIATION

Article 23. Inspection, examination

1. The cipher board of Government shall coordinate with relevant ministries, sectors and localities shall organize, direct inspection, examination on activities of studying civil cryptography, producing, trading and using civil cryptography products.

2. Organizations and individuals studying civil code, producing, trading and using civil cryptography products shall be inspected, checked by competent state agencies as prescribed by law on inspection.

Article 24. Handling of violations of regulations on studying civil cryptography, producing, trading and using civil cryptography product

1. A fine of between VND 5,000,000 and 10,000,000 for one of the following violations:

a) Leasing, lending license for producing, trading civil cryptography product,

b) Self writing additionally, erasing, and modifying contents in license for producing, trading civil cryptography product.

2. A fine of between VND 15,000,000 and 20,000,000, for trading improperly with content in license for producing and trading civil cryptography product.

3. A fine of between VND 25,000,000 and 30,000,000 for one of the following violations:

a) Violating Clause 4 Article 17 of this Decree;

b) Producing, trading civil cryptography product without license for producing, trading civil cryptography products granted by the cipher board of Government.

4. Other violations involving activities of studying civil cryptography, producing, trading and using civil cryptography product, depending on nature and seriousness of violation, will be handled as prescribed by law.

Article 25. Handling of violations of regulations on charges and fees

For violations on charges and fees in activities of granting license for producing, trading civil cryptography product, certificate of standard conformity for civil cryptography product and certificate of technical-regulation conformity for civil cryptography products shall apply the Government’s Decree No. 106/2003/ND-CP dated September 23, 2003, prescribing the sanctioning of administrative violations in the field of charge and fee.

Article 26. The authority to impose sanctions

1. Inspectors of the cipher board of Government on duty shall have authority to sanction administrative violations for administrative violations in activities of studying civil cryptography, producing, trading and using civil cryptography product, within the function on state management and sanction authority as prescribed by law.

2. Chairpersons of People’s Committees at all levels, other specialized Inspectors shall sanction as prescribed by law for administrative violations on activities of studying civil cryptography, producing, trading and using civil cryptography product stated in this Decree.

Article 27. Principles of, statute of limitations, time limit, procedures for sanction

1. Principles in determining the sanction authority, statute of limitations of sanction, time limit, procedures for and order of sanction for administrative violations on activities of studying civil cryptography, producing, trading and using civil cryptography product shall comply with Ordinance on handling of administrative violations.

2. Amounts collected from fines of administrative violations on activities of studying civil cryptography, producing, trading and using civil cryptography products must be remitted in state budget at State Treasuries. The regime of managing receipts of collecting fines and fines shall comply with the current law.

Article 28. Complaints, denunciation and settlement of complaints, denunciation

1. Organizations and individuals have right to make complaints, denunciation on violations in activities of studying civil cryptography, making up, trading and using civil cryptography products.

2. Competent organizations and individuals shall consider, settle and answer complaints, denunciation in accordance with law on complaints, denunciation.

Article 29. Compensation

Organizations and individuals cause damages to other organizations and individuals in activities of studying civil cryptography, producing, trading and using civil cryptography product must compensate as prescribed by law.

Chapter 5:

IMPLEMENTATION PRVISIONS

Article 30. Effect

This Decree takes effect 15 days from day of its publication in the Official Gazette.

Article 31. Implementation responsibility

Ministers, Heads of ministerial-level agencies, Heads of Governmental agencies, chairpersons of provincial/municipal People’s Committees shall implement this Decree.