DeepSeek Raises Significant Security Concerns Over Chinese AI

DeepSeek, a Chinese artificial intelligence application, has gained popularity in app stores; however, it has come under scrutiny from various experts and authorities due to serious security issues. Concerns include extensive user data storage, the potential for criminal manipulation, and the risk of access by Chinese governmental surveillance agencies.

Specialists from the Federal Office for Information Security (BSI) in Germany have raised alarms about the application's practices. Since its launch, DeepSeek has become one of the most downloaded AI applications in Germany, but its data handling methods have raised eyebrows.

A critical issue highlighted is the application's data collection methods, particularly the recording of keystroke patterns. DeepSeek's privacy policy states that it collects 'keystroke patterns or rhythms,' a technique that can be utilized to identify users. A BSI spokesperson noted that even keystrokes made within the app might be monitored before they are submitted.

The BSI has indicated that the manner in which these keystrokes are recorded could allow the creation and recognition of user profiles. They deem this practice problematic, especially in security-sensitive areas. In contrast, established competitors like OpenAI claim to avoid searching for personal data and do not use publicly available data to create user profiles. However, the U.S. Cloud Act mandates that American companies provide authorities access to data stored abroad.

Despite not being classified as a traditional keylogger, DeepSeek's data collection methods could still be exploited. Rüdiger Trost, an expert in cybersecurity, explained that while DeepSeek does not capture all keystrokes like a keylogger would, its operation can still lead to privacy concerns.

Moreover, a recent investigation by Palo Alto Networks revealed that DeepSeek can be easily manipulated for illicit purposes. Cybersecurity experts demonstrated that by using specific prompts, they could instruct DeepSeek to generate scripts capable of extracting data from emails and Word documents, tools often used by hackers to steal information.

Additionally, DeepSeek is required by Chinese law to store all data within mainland China. The Chinese National Intelligence Law obligates individuals and organizations to cooperate with state intelligence efforts, which raises significant concerns about potential government access to this data.

In response to these issues, data protection officials in Germany are preparing to initiate reviews of DeepSeek. The data protection officer for Rhineland-Palatinate indicated that several German data protection authorities are likely to act concurrently. Under the EU General Data Protection Regulation, companies without a presence in the EU must appoint a legal representative, which DeepSeek has apparently failed to do, potentially making it subject to fines.

Moreover, following the concerns regarding DeepSeek, various German ministries and large corporations are implementing strict measures against cybersecurity threats, including the use of external AI applications. The Federal Ministry of the Interior has outright banned the use of external cloud services, while other ministries have taken similar stances. For example, the Ministry of Finance prohibits the use of text-generating AI for official purposes, and the Ministry of Economics has outlined specific approved applications, excluding DeepSeek.

In line with these protocols, significant firms are also restricting the use of DeepSeek and similar applications on corporate devices. Wacker Chemie, a major player in the semiconductor industry, has implemented stringent rules against the use of such AI tools on company devices. Similarly, the Bavarian Ministry of the Interior has prohibited DeepSeek on official devices, and personal devices cannot be used for work.

Major corporations, including Siemens, limit access to AI applications through their secure systems, ensuring that sensitive data remains protected. They provide access to DeepSeek only in a secure environment that guarantees the safety of company data.