Security researchers have discovered that DeepSeek, a Chinese AI chatbot, contains code that could potentially transmit user login information to China Mobile, a state-owned telecommunications company that is banned from operating in the United States. The finding comes amid growing concerns about data privacy and security in AI applications, particularly those with connections to Chinese state-owned enterprises.
Researchers at Feroot Security, a Canadian cybersecurity firm, identified obfuscated computer code within the web-based version of DeepSeek’s chatbot that connects to China Mobile’s infrastructure during the account creation and user login process. The discovery is particularly significant given China’s strict requirements for mobile account registration, which now includes mandatory facial recognition scans.
The U.S. Federal Communications Commission denied China Mobile authority to operate in the U.S. in 2019, citing national security concerns regarding its connections to the Chinese state. In 2021, the Biden administration implemented investment restrictions against China Mobile due to its suspected ties to the Chinese military. These actions were part of a broader pattern of increasing scrutiny of Chinese telecommunications companies, which has led to tensions affecting the mobile biometrics market.
“It’s mindboggling that we are unknowingly allowing China to survey Americans and we’re doing nothing about it,” said Ivan Tsarynny, CEO of Feroot Security. “There are so many unusual things to this. You know that saying ‘Where there’s smoke, there’s fire’? In this instance, there’s a lot of smoke.”
“It’s clear that China Mobile is somehow involved in registering for DeepSeek,” said Joel Reardon, a cybersecurity expert from the University of Calgary. While Reardon did not observe data transfer during his testing, he indicated it may be activated for certain users or login methods. The selective activation pattern matches sophisticated data collection techniques that have prompted recent FBI and NSA guidelines on smartphone security.
DeepSeek’s privacy policy acknowledges that user data is stored on servers within the People’s Republic of China. The chatbot processes various types of user queries, including business, research, and personal information, raising additional concerns about data privacy and potential surveillance capabilities.
Sources: Feroot, Bitdefender, Slashdot, KHQ, SAN
Follow Us