Vietnam: Increasing Cyber Attacks on Activists Portray A Shrinking Internet Freedom

During the last week of November and in early December 2017, many of the independent media websites in Vietnam reported that access to their sites had been blocked. This includes The Vietnamese. Readers confirmed they could not access the attacked sites unless they installed VPN to get over the firewalls.

Another independent news project also runs by The Vietnamese’s editorial board, Luat Khoa online legal magazine, was also blocked in Vietnam starting around December 4, 2017. Luat Khoa has been in operation for the past three years with over 90k likes on Facebook and an average of 500,000 pageviews per month. This is the first time Luat Khoa gets blocked in the country.

In a more severe case, on December 5, 2017, Dan Luan – another well-known independent site – shared on Facebook that their website was under DDoS attack for about a week in late November. A DDos attack is defined as “an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources”.

Earlier last month, there were also failed attempts trying to inject Dan Luan’s website with malicious scripts via Cross-Site Scripting (XSS). Dan Luan frequently suffered cyber attacks, which they believed were the works of government-controlled hackers.

Also in November 2017, a handful of popular Facebookers lost access to their accounts because they were reported by anonymous users to Facebook for violations of community standards. Among them was blogger Nguoi Buon Gio, who now lives in exile in Germany.

It seems quite likely that the Vietnamese government would rely on cyber attacks as an important tactic for oppression in recent years when the numbers of Internet and social media users increased dramatically in the country.

In July 2017, We Are Social, a social media marketing and advertising reported Vietnam had surpassed Thailand to become the 7th country with the most Facebook users worldwide.

The government has not exactly been shy in expressing the desire to tighten their grip on controlling the virtual world. As previously reported, Vietnam claimed to have worked with Facebook and Google to remove thousands of videos and accounts that allegedly contained anti-state materials.

Earlier this year, in May 2017, Gen. Nguyen Danh Cong of the Ministry of Public Security stated during an intra-departmental meeting, that the MPS had successfully blocked thousands of websites which they deemed to be anti-state and reactionary contents.

Four years before that, on May 5, 2010, Gen. Vu Hai Trieu, the then Deputy Director of the MPS, announced: “Our technical departments have destroyed 300 Internet web pages and blogs posting unsuitable contents.”

Coincidentally, it was in early November 2017 that the Washington D.C.-based cybersecurity firm, Volexity, issued a report, confirming it has been – since May 2017 – monitoring an active operation of mass surveillance and cyber attacks operating out of Vietnam.

This operation includes the maintenance of an active group of hackers whose mission is to target Vietnamese activists and dissidents, as well as foreign citizens, corporations, and governments with interests in Vietnam.

It was not the first time that the international cybersecurity community had warned about hackers who seemed to have had a close tie with the Vietnamese government. In the past three years, besides Volexity, at least two other organizations, Electronic Frontier Foundation and FireEye, had issued similar reports.

Vietnam’s government is believed to have been maintaining a cyber espionage group calls OceanLotus since at least 2014. OceanLotus (or SeaLotus) is also known as APT-C-00 or APT32 according to these organizations.

There was also other information leading people to believe that OceanLotus was related to the hacker group Sinh Tu Lenh.

Sinh Tu Lenh became famous among Vietnamese cyber community about a decade ago when it was named as the party responsible for the numerous cyber attacks, aiming at dissidents, activists, and independent news sites, including Dan Luan, Talawas, Xcafevn, Anh Ba Sam, and Mother Mushroom.

Also recently, on November 14, 2017, Freedom House issued its Freedom on the Net report and named 30 countries where the government paid commentators and political bots to spread government propaganda. Vietnam was one of them.

According to Michael J. Abramowitz, president of Freedom House: “The effects of these rapidly spreading techniques on democracy and civic activism are potentially devastating.”

The report also quoted Sanjia Kelly, director of the Freedom on the Net project: “Governments are now using social media to suppress dissent and advance an anti-democratic agenda.”

“Not only is this manipulation difficult to detect, it is more difficult to combat than other types of censorship, such as website blocking because it’s dispersed and because of the sheer number of people and bots deployed to do it.”

But activists in Vietnam are not new to this form of government’s suppression. Back in 2014, our editorial board’s member, Pham Doan Trang, had met with Google and Facebook representatives in the U.S. where she forwarned them about the daily attacks these “paid opinion shapers” had fired at activists and bloggers in Vietnam and how such conducts affected democracy movement.

During the summer of 2014 alone, over 40 accounts of activists were reported, and in turn, got shut down by Facebook.

Calling themselves the government’s “cyber army forces”, these online bots repeatedly reported activists and bloggers’ Facebook accounts, effectively causing their shut-downs.

Taking advantages of Facebook’s loosely defined rules and standards of conducts for the users’ community, the troop of “opinion shapers” would abuse the Facebook’s “Report Abuse Button” with thousands of reports a day on a specifically targeted activist’s account.

Yet, to date, it seems that the activists and the democracy movement have proven their potential sustainability in Vietnam, because people are still actively promoting their causes and Facebook continues to be the main platform for advancing social changes, despite all odds.

Back in March 2015, facing the city government’s immediate decision to cut down some 6,700 trees in Hanoi, activists created a Facebook group and organized people for peaceful protests. They were able to mobilize residents of Hanoi and successfully stopped the city government from going forward with the plan.

In 2016, Facebook again proved its effectiveness, as it was one of the best platforms for informing the public about the Formosa environmental disaster in Central Vietnam. During the height of the weeks-long protests against Formosa Ha Tinh Steel Plant – the company responsible for causing the pollution – access to Facebook was blocked on a few weekends. But its popularity among the general public had caused the government to undo such decision almost immediately.

This year, in the recent months, drivers who were passing through a BOT toll in Cai Lay Ward, Tien Giang Province have been protesting the improper location of said toll. Their acts of civil disobedience – through various forms of slowing down the process of paying toll fees and causing the toll to close down – were followed closely by the public on Facebook and other social media platforms.

To protect themselves and fight back, Vietnamese activists have received technical assistance from organizations, such as Access Now, when they got reported by the government’s bots on Facebook or got struck by some other forms of cyber attacks.

In the meanwhile, the Draft Law on Cybersecurity – which mirrored that of China – is now waiting for the National Assembly’s approval.

And as such, the battle in the cyber world continues.