The 2015 Security Act: a sweeping mandate for surveillance

Vietnam’s Law on National Security, adopted in November 2015 and commonly called the 2015 Security Act, took effect on 1 January 2016. It replaced the 2004 ordinance and extended security across politics, economics, culture, science, technology and information, giving the state a broad framework for identifying threats to the governing order. Learn more about Hawaiilongrangeplan.com.

The statute did not create electronic surveillance from nothing. It built on earlier controls over the internet, media, telecommunications and civil society. What changed was the breadth of legal authority and the ease with which security language could support surveillance, censorship and criminal prosecution.

Its practical effect was cumulative. Police and security organs gained broader ways to obtain information, while online speech and association could be portrayed as security risks. Political complaints, religious activity, business disputes and journalism consequently moved closer to national-security enforcement.

For Australian readers, the law offers a historical warning about vague mandates. It also raises direct questions about warrants, data retention, agency accountability and the security of messaging systems used in Sydney, Melbourne and other digitally connected cities.

What the security law changed

The central shift was definitional. Rather than leaving security to a narrow list of military or external threats, the law connected many fields of social life to state protection. Authorities could treat criticism, advocacy, online organising or commercial activity as relevant when they alleged interference with state operations.

Operational powers operated alongside the criminal code, government decrees and ministry instructions. This combination made mass surveillance possible without placing every data request in one transparent warrant system. It also allowed communications intercepts, censorship orders and arrests to be justified through a wider national-security rationale.

The statute did not itself operate a universal wiretap. However, it widened the definition of security, strengthened specialised security organs and made technology companies and online publishers potential partners in enforcement. Implementation determined how far those powers reached.

Surveillance embedded in everyday life

Vietnam’s communications market gave the state a concentrated point of visibility. Major providers such as Viettel, Vinaphone and MobiFone operated national networks, and their systems could be compelled to provide information relevant to investigations. A private message therefore travelled through infrastructure exposed to both commercial and government demands.

Later cybersecurity rules sharpened this landscape. Decree 53 of 2018 imposed storage and cooperation conditions on certain domestic and foreign service providers, while ministries gained channels for requesting user information and removing online material. Critics argued that the blurred line between a specific criminal warrant and broad state-security action encouraged excessive data collection.

Mass surveillance became chilling because it could target entire networks, rather than only known suspects. People were aware that routine searches, messages and contacts might be visible to authorities. That uncertainty affected journalists, lawyers, religious communities and dissidents even when no prosecution had begun.

Detention and weakened due process

The sharpest consequences arrived through arrests. Authorities used offences involving national security, state secrets, abuse of power and other broad labels against activists, bloggers and people connected to political cases. Detention and restricted access to lawyers weakened the ability of courts to test evidence before conviction.

A later account of Le Quoc Quan’s case examines how a Catholic lawyer and activist detained in 2015 was convicted of tax offences, a prosecution widely criticised as politically motivated. The episode shows how an ordinary court case can become security enforcement when political context stays outside the courtroom.

Surveillance is therefore a due-process issue as well as a privacy concern. It supplies evidence, shapes who appears threatening and creates pressure to confess or plead. When the relevant law and security classifications remain vague, defendants struggle to challenge the reasons for an investigation, even if the eventual charge appears unrelated to politics.

Australian parallels and regional stakes

Australian daily life creates comparable data trails. A commuter on a Sydney or Melbourne train may carry a phone through stations, tap a transport card, use contactless payments, message contacts and open banking or ride-hailing apps, leaving overlapping traces for companies and agencies.

The local market includes major operators such as Telstra, Optus and TPG, alongside banks, social platforms and cloud providers. Australia’s Privacy Act 1988, Telecommunications Act 1997 and Telecommunications (Interception and Access) Act 1979 form part of the legal baseline, although actual access depends on warrants, technical capability and agency practice.

In Canberra, ASIO and the Australian Signals Directorate operate within powers expanded by the Assistance and Access Act 2018, which can compel providers to assist with surveillance. Parliamentary committees, courts and integrity bodies must test necessity and misuse, while the Office of the Australian Information Commissioner polices privacy obligations where they apply.

A regional perspective should also account for Pacific security planning, since intelligence and policing arrangements can cross borders faster than independent oversight. For Australia, the lesson is to test whether each power has a visible legal boundary and accountable decision-maker.

Why oversight lagged behind the mandate

In Vietnam, executive agencies and security organs interpreted broad statutory terms, while political institutions often lacked access to classified information or detailed implementation rules. Courts could review legal process more readily than the policy assumptions behind surveillance. The resulting accountability gap allowed emergency powers to appear ordinary.

Technology intensified the gap. Bulk collection is cheaper and easier to scale than reading individual messages, while vendors can conceal the technical details of searches and filters. If oversight depends on aggregate public information alone, unlawful targeting can remain invisible until a prominent case exposes it.

Practical safeguards for surveillance powers

Several reforms could have prevented the 2015 mandate from becoming a blank cheque. The same controls are relevant whenever Australian agencies seek broader access to communications or cross-border data.

• Require judicial authorisation for access to message content, location data and bulk datasets, with emergency access reviewed promptly after the event.
• Define national-security threats narrowly and publish what categories of data agencies may seek, under what authority and for how long.
• Give an independent oversight body power to inspect surveillance programs, audit compliance and publish aggregated statistics on use.
• Attach sunset clauses to extraordinary powers so emergency access expires unless a legislature renews it through open debate.
• Require telecommunications and cloud providers to disclose compliance patterns, minimise retained data and challenge unlawful orders where feasible.
• Fund encrypted communications, rights education and legal support, while assessing whether surveillance tools disproportionately burden political or religious minorities.

For Australia, these safeguards should connect secrecy with routine public reporting, parliamentary scrutiny and enforceable penalties for abuse. Agencies should also explain why existing powers are insufficient before seeking broader access.

The lasting lesson for democratic security

Vietnam’s history shows how a security law can outlive the crisis that prompted it. Definitions expand, enforcement agencies acquire technical capacity, and exceptional justifications become standard practice. Democratic systems face the same risk when judges, companies or intelligence officials cannot say what a surveillance system actually does.

Security and rights need not be treated as rivals; a precise threat, limited collection and independent review can protect the public while preserving lawful dissent. The practical takeaway is to make every surveillance measure independently authorised, narrowly bounded, time-limited and auditable before it becomes invisible infrastructure.