It is expected that this afternoon, November 24, at the 51st session, the National Assembly Standing Committee will give opinions on the draft Law on Cyber Security 2025.
The draft law is a merger of the 2018 Law on Cyber Security and the 2015 Law on Network Information Security, and has many new points.
One of these is the enterprise providing services on the cyberspace responsible for identifying the internet address ( IP) of organizations and individuals using internet services, providing it to the specialized force in charge of protecting network security for management to serve the work of ensuring network security.
According to the draft law, the specialized force for protecting cyber security is arranged at the Ministry of Public Security and the Ministry of National Defense.
Lieutenant Colonel Trieu Manh Tung, Deputy Director of the Department of Cyber Security and High-Tech Crime Prevention (Ministry of Public Security)
Why do we need to identify IP addresses?
Speaking at a discussion on draft laws chaired by the Ministry of Public Security to be submitted to the 10th session, Lieutenant Colonel Trieu Manh Tung, Deputy Director of the Department of Cyber Security and High-Tech Crime Prevention, said the above content is an important point.
Mr. Tung analyzed that IP address is a digital address assigned to internet subscribers or mobile phone subscribers, helping to identify users of digital devices and media accessing the network.
In reality, due to many reasons such as the conversion from IPv4 to IPv6, the infrastructure upgrade process of service providers, unsynchronized resources, IP identification is facing many difficulties.
Some IP addresses cannot accurately identify users, leading to insufficient investigation, verification, and handling of violations, and insufficient basis to determine whether the user of that IP address committed an illegal act.
Therefore, regulations on IP address identification are necessary to serve state management and investigation and handling of violations.
Explaining further about the new regulations in the draft, Major General Vu Huy Khanh, a member of the National Assembly's Committee on National Defense, Security and Foreign Affairs, emphasized that the identification of IP addresses is done by businesses and service providers, not the Ministry of Public Security. This issue has been regulated for a long time, but the implementation is "not standardized".
Because of the above "non-standard" situation, when there is a request from the management agency related to IP address, the units cannot do it, it is very difficult.
To overcome this, the draft requires units to identify IP addresses. This information is only provided to specialized agencies upon request. The requirement is also set out to serve public service activities or to fight and prevent cybercrime.
Ministry of Public Security builds IP identification management mechanism
According to the draft Law on Cyber Security in 2025, domestic and foreign enterprises providing services on telecommunications networks, the internet, and value-added services on cyberspace in Vietnam are responsible for authenticating information when users register for digital accounts; and securing user information and accounts.
These units must provide user information to the specialized force for cybersecurity protection under the Ministry of Public Security no later than 24 hours upon request in writing, by email, by telephone or by another confirmed form of communication to serve the investigation and handling of violations of the law on cybersecurity.
In case of emergency that threatens national security or human life, information must be provided within 3 hours at the latest.
Along with that is storing personal information of service users, data created by service users, including: account name, service usage time, service fee payment information, access IP address and other related data for the time prescribed by law after the user finishes using the service.
The Ministry of Public Security is responsible for ensuring information security in cyberspace and data security; building a mechanism to manage IP identification; authenticating digital account registration information; warning and sharing information on cyber security and cyber security threats.
