Paris (VNA) – As Vietnam accelerates digital transformation and implements the 2024 Law on Archives, building a secure electronic archives system that safeguards data sovereignty is becoming an urgent requirement for state agencies.
Talking to a Vietnam News Agency correspondent in Paris, Dr Ta Anh Phuong, CEO of Seinetime, a France-based technology and AI startup, said that developing a secure national digital archives system requires simultaneously ensuring data sovereignty, strengthening cybersecurity, and addressing technical vulnerabilities arising during document digitisation.
According to the expert, the risks associated with international cloud-computing platforms are not limited to the physical location of servers but also involve the operating legal entity, software systems, encryption keys, administrative control rights, and extraterritorial regulations such as the US’ CLOUD Act. He suggested organising data by sensitivity levels to ensure the right storage solutions are used.
For highly classified data related to defence, security, and strategic documents, he proposed storage on domestic infrastructure that is isolated or nearly isolated from the Internet, together with the development of a state-managed sovereign cloud model.
Regarding sensitive data such as population records, healthcare, taxation, and judicial information, he suggested a hybrid cloud model, noting that the original data and encryption keys remain under Vietnam’s control. Public data, meanwhile, could be stored on domestic or international cloud services if they meet security standards.
Phuong also recommended adopting the “Hold Your Own Key” (HYOK) mechanism, under which data is encrypted with keys managed by the Vietnamese side before being uploaded to cloud platforms, thereby reducing the risk of unauthorised access. He added that security risks associated with foreign software and platforms should be thoroughly assessed.
Regarding implementation of the 2024 Law on Archives, the expert said the digitisation process should not focus solely on investment in scanners and storage infrastructure, but must treat information security as a requirement throughout the entire process.
He identified the major risks as metadata leakage, the absence of mechanisms to ensure the integrity of digital documents, weak management of administrative accounts, the possibility of system log manipulation, and data exposure during optical character recognition (OCR) processing.
To mitigate these risks, he proposed standardising storage formats, applying digital signatures and time stamps, implementing multi-factor authentication for administrative accounts, storing logs on tamper-proof systems, and using OCR solutions that have undergone security verification.
According to Phuong, building a national electronic archives system is not merely a matter of investing in technological infrastructure. It must be designed in an integrated manner from the outset, encompassing system architecture, governance procedures, and data protection mechanisms, to ensure long-term security, integrity, and data sovereignty./.
