Tran Minh Chien, LL.M.[2]
 |
| A press conference on the signing ceremony of the United Nations Convention against Cybercrime in Hanoi on October 8, 2025__Photo: Pham Kien/VNA |
Introduction
In efforts to develop multilateral cooperation mechanisms to prevent and combat cybercrime that is considered a severe global challenge, after nearly five years of negotiations, on December 24, 2024, the United Nations General Assembly adopted the United Nations Convention against Cybercrime (the Convention). The Convention establishes a common legal framework for member states to criminalise cyber-related offences and sets up mechanisms for judicial cooperation, extradition, the sharing of electronic evidence, and technical assistance among member states.
Vietnam had, over the years, gradually built a legal framework to prevent and combat cybercrime, as reflected through the enactment of specialised provisions of the 2015 Penal Code (as revised in 2017, 2021, 2024 and 2025) and relevant laws such as the 2018 Law on Cybersecurity. The country’s accession to the Convention exerts significant impacts, both in terms of improving the Penal Code’s provisions on the offences and criminal procedural mechanisms concerning electronic evidence, extradition, mutual legal assistance, and enforcement cooperation as well as cybercrime prevention policies.
Improvement of the Penal Code’s provisions on cybercrime
First of all, regarding specific offences, it can be noted that Vietnam’s current criminal law is fundamentally compatible with the criminalisation requirements of the Convention. As early as the 1999 Penal Code (revised in 2009), Vietnam added the first offences treated as hi-tech crime. In the current Penal Code, a whole new chapter was established, containing Articles 285 thru 294 on crimes related to information technology and telecommunications networks. Specifically, Article 285 on producing, trading, exchanging or donating devices, equipment and software for unlawful purposes corresponds to “misuse of devices” in the Convention; Article 286 on spreading software programmes harming the operation of computer networks, telecommunications networks and electronic devices corresponds to “data/system interference”; Article 287 on obstructing or disordering the operation of computer networks, telecommunications networks and electronic devices aligns with “system interference”; Article 289 on illegally accessing computer networks, telecommunications networks and electronic devices of other persons corresponds directly to “illegal access”; and Article 290 on using computer networks, telecommunications networks or electronic devices to appropriate property meets the requirement of criminalising the act of “computer-related fraud”.
Some other offences such as illegally uploading information on, or using information of, computer networks and telecommunications networks (Article 288), though possessing Vietnam’s specific characteristics, can cover part of the act of “illegal interception” under the Convention. Similarly, Article 291 on illegally collecting, storing, exchanging, trading and making public information on bank accounts; Article 293 on illegally using radio frequencies which are exclusively used for emergency, safety, search, rescue, salvage or national defence and security purposes; and Article 294 on intentionally causing harmful radio frequency interference, though not specified by the Convention, clearly demonstrate Vietnam’s efforts to respond to specific forms of domestic cybercrime.
Thus, when compared with the Convention, it is evident that the Penal Code almost fully covers main criminal acts from illegal access, data/system interference, malware spreading, provision of criminal tools and online scams to particular acts such as bank account information theft. Some acts mentioned by the Convention, e.g., computer-related forgery, have not been explicitly codified into an independent offence, but in practice might be handled as traditional crimes. For example, if data is altered to forge electronic documents for fraudulent purposes, prosecution can be imposed under Article 341 on forging seals and documents of agencies or organisations or under Article 174 on appropriating property through swindling.
Likewise, acts of producing and disseminating child sexual abuse materials online, which are required to be criminalised under the Convention, are handled under the Penal Code’s Article 326 on disseminating debauched cultural products with aggravating circumstances if minors are involved. Although “child debauched cultural products” have not been separated as a distinct crime, current provisions basically meet the requirements for handling this particularly serious type of crime.
Acceding to the Convention will create a momentum for Vietnam to review and further refine relevant provisions. For instance, authorities may consider supplementing or clarifying the offence of data theft during transmission (illegal interception). Although part of this act can already be handled under Article 288 or offences on illegal access, a dedicated article would be more in line with international practices. They may also take into account prescribing the crime of “computer forgery” instead of referring to traditional offences of document forgery, in order to create a clear legal basis for handling acts of altering data or creating fake data to deceive systems or users.
As the Convention allows member states to expand the criminalisation of certain new acts not yet covered, Vietnam may consider adding offences such as large-scale spam attacks, disseminating fake news causing public panic (if deemed necessary and appropriate to the freedom of information), or emerging hi-tech crimes (e.g., crimes related to cryptocurrencies and virtual assets, which currently pose difficulties due to the lack of explicit sanctions).
Generally, in terms of substantive law, the Convention will not demand breakthrough changes in the Penal Code because Vietnam’s existing legal framework is already quite close to international standards. This reflects Vietnam’s efforts over the past decade in updating its criminal law, which has been influenced by the Budapest Convention on Cybercrime and domestic hi-tech crime prevention practices. However, to be fully compatible with the Convention, Vietnam needs to refine details, fill a few small gaps regarding offences, and impose proportionate penalties.
Currently, cybercrimes in the Penal Code are mainly classified as serious or particularly serious crimes. For instance, Article 290 on using computer networks, telecommunications networks or electronic devices to appropriate property carries a maximum penalty of up to 20 years’ imprisonment. This meets the Convention’s requirement for a level of sufficiently deterrent sanctions (which is also important in extradition cooperation, as many treaties only permit extradition for offences with penalties above a certain threshold).
Impacts on procedural measures and international cooperation in cybercrime investigation
The Convention is expected to exert strong impacts on Vietnam’s law in the sphere of criminal procedures regarding cybercrime and electronic evidence, as well as mechanisms for international cooperation in criminal procedure.
Firstly, regarding electronic evidence collection measures and special investigative measures, the Convention sets standards that Vietnam needs to incorporate into domestic regulations or amendments and supplementations to the 2015 Criminal Procedure Code (CPC) or relevant specialised legal documents. Measures such as expedited preservation of data, production order for computer data, remote search and seizure of computer systems, real-time traffic data collection, and interception of content data are all mentioned in the Convention (in a manner similar to that of the Budapest Convention).
The CPC does not have separate provisions on expedited preservation of data. When there is a need to preserve electronic data (such as connection logs) pending a collection order, Vietnamese investigation bodies often have to persuade data holders to cooperate voluntarily, as there is no legal basis for mandatory cooperation yet. As a member state of the Convention, Vietnam may need to add provisions allowing procuracies or courts to issue orders requiring telecommunications and Internet service providers to preserve data in status quo for a short period (e.g., 90 days) pending formal mutual legal assistance procedures. Similarly, a production order requiring an individual or organisation to provide specific information or data for investigation purposes should also be clearly stipulated by law (because this is currently applied mainly under the articles on evidence collection in general).
Secondly, with respect to search and seizure of electronic data, the CPC permits searching digital devices and seizing data contained therein[3]. However, the definitions of electronic evidence and procedures for collection, sealing and expert assessment of electronic data need more specific guidance to ensure the evidentiary value before courts. According to a survey by the United Nations Office on Drugs and Crime (UNODC), over 60 per cent of countries do not distinguish electronic evidence from physical evidence, but also note the need to emphasise such principles as integrity and authenticity of data when presented as evidence. Vietnam should also provide guidance on procedures for bit-by-bit imaging and hashing, which are internationally recognised standard techniques in digital forensics, to ensure data remains unaltered. At present, though the Ministry of Public Security has a digital forensics unit, but the legal framework governing this process remains unclear.
Regarding real-time traffic data collection and interception of content data, the Law on Cybersecurity and sub-law documents have vested the Public Security and Security forces with authority for surveillance and information collection in cyberspace to serve the assurance of national security. However, in criminal procedure, eavesdropping or interception to investigate ordinary crimes (other than those against the national security) is not explicitly regulated by the CPC like wiretapping[4]. Upon joining the Convention, Vietnam may need to expand the legal bases for interception in investigating particularly serious cybercrimes[5]. Naturally, this must be accompanied by strict control and approval authority (which could be granted to courts, similar to wiretapping procedures) to prevent abuse and ensure compliance with the Convention’s requirements on privacy protection.
Thirdly, as for international cooperation on procedure, being a member state to the Convention will facilitate Vietnam’s improvement of domestic regulations and practices of organising the implementation thereof.
First of all, Vietnam will need to designate a round-the-clock focal point. It is highly likely that the Department of Cybersecurity and Hi-Tech Crime Prevention and Control or the Hi-Tech Crime Police Department under the Ministry of Public Security will be assigned this task. This Department will have to maintain round-the-clock operation to receive and send requests from/to abroad. According to experience from the implementation of the Budapest Convention, this focal point plays a crucial role during emergency phases.
Regarding extradition and mutual legal assistance (MLA), Vietnam enacted the Law on Mutual Legal Assistance in 2007 and has become a contracting party to numerous bilateral and multilateral treaties. The country’s accession to the Convention will help add a multilateral legal basis for Vietnam to execute extradition/MLA with countries without bilateral treaties with it. The Convention clearly defines procedures, request contents, reply time limit, etc. Therefore, the country will need to include these procedures in domestic laws to ensure uniform enforcement. A major benefit is that Vietnam can proactively request mutual assistance from many member states based on the Convention, especially in tracing offenders using offshore cyber hideouts.
Vietnam should also pay attention to performing the obligation to guarantee human rights in cooperation. For example, if a country requests the extradition of a citizen seeking political asylum in Vietnam on cybercrime charges, Vietnam needs to apply the principle of refusing extradition for political reasons (in accordance with Vietnam’s extradition law and international practices). This aligns with the spirit of the Convention demanding the protection of human rights and preventing cooperation from being abused.
Another important aspect is the capacity of proceedings-conducting bodies. The Convention emphasises capacity building for investigators, procurators and judges in handling cybercrime cases. In Vietnam, cybercrime is a relatively new field, so the capacity of these personnel remains limited. For instance, according to a study, the computer skills of procurators generally fall well below those of specialised investigators; even 40 per cent of judges have not yet been trained in processing electronic evidence. Therefore, upon joining the Convention, Vietnam may ask for training support from UNODC and the developed countries, thereby improving the skills of judicial officers. Reality shows that although the number of cybercrime cases in Vietnam has surged sharply (the number of prosecutions during 2018-23 increased more than tenfold compared to the previous period), the trial rate remains much lower (due to difficulties in detection and evidence collection). Building capacity and fostering international cooperation (such as tracing cross-border cash flows in online scams) will help increase the enforcement efficiency against cybercrime.
Impacts on cybercrime prevention policies and cooperation in Vietnam
Acceding to the Convention will exert broader impacts on strategies and policies and the way Vietnam cooperates with foreign countries in preventing and combating cybercrime.
Vietnam will need to adjust or draft a new national strategy for cybercrime prevention and control suitable to the context of international integration. The Convention requires member states to integrate the content on cybercrime prevention into their national cybersecurity strategies and digital transformation strategies. Vietnam may consider promulgating a National Programme on Cybercrime Prevention and Control, clearly assigning responsibilities to the Ministries of Public Security, National Defence, Justice, etc., for implementing the Convention.
Becoming a contracting party to the Convention also means Vietnam will have to be more active in international cooperation forums on cybercrime prevention. The country will have opportunities to access international resources, e.g., UNODC and Interpol projects on upgrading digital forensics labs and training digital investigation experts. Along with this, Vietnam is also obliged to contribute and share cybercrime information with the international community, such as participating in early warning networks, and sharing malware samples and malicious IP addresses. This not only helps Vietnam receive early warnings from foreign countries but also demonstrates the nation’s responsibility within the global cybersecurity chain.
Another significant impact is raising awareness and fostering collaboration from the domestic private sector. The Convention lays emphasis on public-private partnership, promoting the participation of technology enterprises in combating cybercrime. As for Vietnam, major telecommunications and Internet enterprises will have to comply with new requirements (such as mechanisms for data preservation and quick provision of information upon valid orders). Simultaneously, they will benefit from a safer online environment and increased customer trust. Banks and financial institutions will also collaborate more closely with authorities in combating online scams and cyber money laundering - areas where the Convention has established standards.
Finally, as a contracting member of the Convention, Vietnam should consider joining the Budapest Convention in order to expand cooperation with its member states and to make full use of the existing cooperation channels, as recommended by international law experts. However, this is a long-term strategic matter.
In conclusion, the Convention creates a favourable legal framework and cooperative environment for Vietnam to improve its laws and policies, and to enhance the effectiveness of fighting cybercrime. The country gains additional legal instruments to pursue cross-border cybercrimes while receiving further impetus to refine its criminal law system, ensuring compatibility with international practices and better safeguarding the rights and interests of citizens in cyberspace.-
[1] The full text of the Vietnamese version of this article is published on the State and Law Review, the Institute of State and Law under the Vietnam Academy of Social Sciences, issue No. 3 (446), 2026.
[2] Institute of International and Comparative Law, University of Economics and Law, Vietnam National University Ho Chi Minh City.
[3] Article 196 on forfeiture of electronic devices and data, and Article 198 on seizure of objects and documents during a search, which are applicable to electronic data.
[4] At present, there are only procedures for wiretapping under Article 223 of the CPC for a number of very serious crimes.
[5] For example, investigation into online child sexual abuse networks needs permission for secret access to collect evidence.
