DeepSeek Chatbot Linked to Banned Chinese Telecom Company

WASHINGTON | A new concern has arisen regarding DeepSeek, a popular Chinese artificial intelligence company whose chatbot app has become the most downloaded app in the United States. Recent findings by security researchers indicate that the website for DeepSeek contains hidden computer code that may transmit some user login information to China Mobile, a state-owned telecommunications company banned from operating in the U.S.

The suspicious web code is found in the login page for DeepSeek’s chatbot, where highly complex scripts have been identified. When analyzed, these scripts reveal connections to the infrastructure controlled by China Mobile. This code seems to play a role in user account creation and login procedures for DeepSeek.

Although DeepSeek's privacy policy states that user data is stored on servers within China, the discovery linking DeepSeek more closely with the Chinese state raises new alarms, especially given the past claims by the U.S. government regarding the close relationship between China Mobile and the military, which has led to limited sanctions against the company. DeepSeek and China Mobile have not responded to requests for comments.

Concerns surrounding the influence of Chinese-controlled digital services have heightened among U.S. national security officials. Last year, Congress reached a bipartisan decision to force TikTok's Chinese parent company to divest its interests in the platform or face an outright ban, although the app has since been granted an extension by the President while a sale is being negotiated.

A cybersecurity firm called Feroot Security, which is based in Canada, first identified the problematic code linking DeepSeek to China Mobile, and these findings were confirmed by another team of computer experts. Though no data was observed being sent to China Mobile during testing of logins from North America, researchers could not discount the possibility that some user data is indeed being transmitted.

This analysis is specific to the web version of DeepSeek, as researchers have yet to examine the widely downloaded mobile version available on both Apple and Google app stores.

The U.S. Federal Communications Commission rejected China Mobile’s request for permission to operate in the U.S. back in 2019 due to significant national security concerns. These were reiterated in 2021 when the Biden administration enforced sanctions limiting American investments in China Mobile following Pentagon reports linking the company to the Chinese military.

Ivan Tsarynny, the CEO of Feroot, expressed disbelief at the current situation, stating, "It's mindboggling that we are unknowingly allowing China to survey Americans and we're doing nothing about it." He further emphasized the unusual nature of the findings, saying, "Where there’s smoke, there’s fire. In this instance, there’s a lot of smoke."

Stewart Baker, a lawyer and former top official at the Department of Homeland Security and National Security Agency, indicated that DeepSeek poses not just similar problems to TikTok, but also a higher level of risk given the nature of the information it collects. Users often share sensitive data with generative AI systems, raising fears about exposure of confidential business information and personal details.

Tsarynny argues, "The implications of this are significantly larger because personal and proprietary information could be exposed. It’s like TikTok but at a much grander scale and with more precision. It’s not just sharing entertainment videos; it’s sharing queries and information that could include highly personal and sensitive business information."

Feroot has detailed how the computer code is triggered when users log into DeepSeek, potentially capturing comprehensive information about their devices through a method known as fingerprinting, a common practice for security and advertising. The researchers have found evidence that this code connects to China Mobile's authentication systems, indicating that it might be used during logins for DeepSeek.

Two academic cybersecurity experts, Joel Reardon from the University of Calgary and Serge Egelman from the University of California, Berkeley, verified Feroot’s findings, confirming the presence of a link between DeepSeek's login system and China Mobile. "It's clear that China Mobile is somehow involved in registering for DeepSeek," Reardon noted. Although he did not observe any data being transferred in his own tests, he suggested it is likely happening under certain user circumstances.

DeepSeek, China, Security