Joint Circular No. 06/2008/TTLT-BTTTT-BCA dated November 28, 2008 of the Ministry of Information and Communication and the Ministry of Public Security on assurance of infrastructure safety and information security in post, telecommunications and information technology activities

ON ASSURANCE OF INFRASTRUCTURE SAFETY AND INFORMATION SECURITY IN POST, TELECOMMUNICATIONS AND INFORMATION TECHNOLOGY ACTIVITIES

Pursuant to the 2006 Law on Information Technology;

Pursuant to the 2004 Law on National Security;

Pursuant to the 2002 Ordinance on Post and Telecommunications;

Pursuant to Decree No. 160/2004/ND-CP of September 3, 2004, detailing the implementation of a number of articles of the Post and Telecommunications Ordinance regarding telecommunications;

Pursuant to Decree No. 157/2004/ND-CP of August 18, 2004, detailing the implementation of a number of articles of the Post and Telecommunications Ordinance regarding post;

Pursuant to Decree No. 128/2007/ND-CP of August 2, 2007, on delivery services;

Pursuant to Decree No. 187/2007/ND-CP of December 25, 2007, defining the functions, tasks, powers and organizational structure of the Ministry of Information and Communication;

Pursuant to Decree No. 136/2003/ND-CP of November 14, 2003, defining the functions, tasks, powers and organizational structure of the Ministry of Public Security;

Pursuant to Decree No. 151/2005/ND-CP of December 14, 2005, on powers and responsibilities of national security protection agencies and officials;

The Ministry of Information and Communication and the Ministry of Public Security jointly guide the assurance of infrastructure safety and information security in post, telecommunications and information technology activities as follows:

I. GENERAL PROVISIONS

1. Scope of regulation and subjects of application

a/ This Circular guides the assurance of infrastructure safety and information security in post, delivery, telecommunications, Internet, signal transmission and broadcasting and information technology activities (below referred to as post, telecommunications and information technology activities).

b/ This Circular applies to organizations and individuals engaged in the establishment of networks; provision and use of services; equipment manufacture and trading; and construction and installation of post, telecommunications and information technology facilities in Vietnam.

2. Interpretation of terms

a/ Assurance of infrastructure safety means assurance of the integrity of the system of post, telecommunications and information technology equipment, networks and facilities; the integrity and confidentiality of mails, postal items and parcels, cargo packages and bales and information delivered through post, telecommunications and information technology networks; and the safety of parties engaged in the establishment, provision and use of post, telecommunications and information technology services.

c/ Assurance of information security means the management, control, prevention, detection of and fight against acts of using or abusing post, telecommunications and information technology infrastructure to infringe upon national security, social order and safety and citizens interests.

3. General principles on assurance on infrastructure safety and information security

a/ Parties engaged in post, telecommunications and information technology activities shall assure infrastructure safety and information security, promptly detect and remedy incidents; and take responsibility before law for the contents of mails, postal items and parcels, cargo packages and bales and information which are stored and delivered through their post, telecommunications or information technology networks.

b/ Assurance of infrastructure safety and information security in post, telecommunications and information technology activities must neither obstruct production and business activities of post, telecommunications and information technology enterprises nor cause damage to lawful rights and interests of parties engaged in post, telecommunications and information technology activities.

c/ Only competent persons of national security protection agencies defined in Article 9 of Decree No. 151/2005/ND-CP of December 14, 2005, on powers and responsibilities of national security protection agencies and officials may control information security in post, telecommunications and information technology activities.

d/ Violations that adversely affect infrastructure safety and information security must be promptly detected and strictly handled in accordance with law.

4. Prohibited acts

a/ Providing, using or abusing post, telecommunications and information technology infrastructure or services to infringe upon national security, social order and safety or badly affect the national traditions and customs.

b/ Unlawfully obstructing post, telecommunications and information technology activities.

c/ Destroying or damaging post, telecommunications or information technology facilities or using or abusing networks, devices and hardware and software tools to interfere in or disturb the operation of post, telecommunications and information technology infrastructure.

d/ Stealing and unlawfully using passwords, cipher keys or private information of organizations and individuals; unlawfully obstructing organizations and individuals access to information.

dd/ Producing, selling, purchasing, storing, transporting and using counterfeit postal stamps; appropriating, opening, exchanging, or disclosing the contents of, mails, postal items and parcels, cargo packages and bales and information delivered through post, telecommunications and information technology networks.

e/ Other illegal acts related to post, telecommunications and information technology activities.

II. ASSURANCE OF INFRASTRUCTURE SAFETY AND INFORMATION SECURITY

1. Assurance of infrastructure safety in post, telecommunications and information technology activities

Assurance of infrastructure safety in post, telecommunications and information technology activities covers:

a/ Protection of post, telecommunications and information technology infrastructure to prevent hacking, illegal access and sabotage; prevention of and fight against fire, explosion and other incidents caused by natural disasters, humans or animals.

b/ Application of contingency solutions and backup devices to ensure the continuous and safe operation of post, telecommunications and information technology infrastructure.

c/ Application of solutions and measures to prevent the use or abuse of networks, devices or hardware and software tools to obstruct, interfere in, damage or destroy the operation of post, telecommunications and information technology infrastructure; prevention and control of computer viruses, spams and spywares; prevention of and fight against acts of stealing or unlawfully using passwords, cipher keys or private information of organizations and individuals.

d/ Assurance of safety for post, telecommunications and information technology equipment and operators of post, telecommunications and information technology networks.

dd/ Inspection and examination and handling of violations related to infrastructure safety in post, telecommunications and information technology activities.

2. Assurance of information security in post, telecommunications and information technology activities

Assurance of information security in post, telecommunications and information technology covers:

a/ Application of professional measures to control information delivered through post, telecommunications and information technology networks in accordance with law in order to detect, prevent and promptly handle violations; suspension of the provision and use of services and handling of cases of providing, using or abusing post, telecommunications and information technology networks and services to infringe upon national security and social order and safety.

b/ Application of solutions and measures to assure the confidentiality of secret state information and private information of organizations and individuals, contents of mails, postal items and parcels, cargo packages and bales and information delivered through post, telecommunications and information technology networks.

c/ Coordination in the grant of licenses and determination of business conditions for assuring information security in post, telecommunications and information technology activities.

d/ Inspection and examination and handling of violations related to information security in post, telecommunications and information technology activities.

Click Download to see full text

JOINT CIRCULAR