DeepSeek: An Innovator or a Surveillance Tool in Disguise?

The Path Your Data Takes to China

The AI “DeepSeek,” which appeared before us one day, seemed like a blessing. News that anyone could use the world’s top-performing AI cheaply and freely excited developers and users worldwide. But while we indulged in this sweet fruit, unseen forces were turning our most intimate information into part of a massive surveillance system crossing borders.

This is not just a simple personal data leak. Beyond a corporate technical mistake, it is a state-led systematic data collection effort and a signal that a new front in the US-China tech supremacy war has opened.

This article thoroughly exposes, with technical evidence, how the so-called “digital Trojan horse” DeepSeek infiltrated our daily lives and what dangerous code was hidden inside. It is time to face the chilling truth of how a single question you casually typed could become a weapon threatening national security.

1. The Two-Headed Monster: Secret Channels to China Mobile and ByteDance

The collapse of the DeepSeek myth began with the discovery of not one but two distinct secret channels. Like a two-headed monster, they targeted our data in different ways.

First Head: The “Backdoor” Directly Linked to National Security (China Mobile)

The first crack was found by Canadian security firm Feroot Security—an intentional backdoor hidden at the end of DeepSeek’s login page encrypted code. They traced a path connecting to China Mobile, a state-owned telecom company under US sanctions due to ties with the Chinese military.

This was clear evidence of espionage designed to funnel user account information directly to an agency tied to national security. It was not a simple bug but a deliberately planted “secret passage.”

Second Head: The “Data Pipeline” Penetrating Everyday Life (ByteDance)

But the threat did not end there. Investigations by the Korea Personal Information Protection Commission (PIPC) and others revealed another destination for DeepSeek’s data: ByteDance, the parent company of the global app TikTok.

This threat differs in nature from China Mobile’s and is more sophisticated and widespread.

• How was it discovered? PIPC analyzed data communication packets generated when running the DeepSeek app. They confirmed that various information, including users’ prompt contents, was sent to ByteDance’s cloud service affiliate, Volcano Engine.
• Why is this a problem? DeepSeek did not clearly inform users or obtain consent for sharing data with this third party. ByteDance already possesses immense technological capabilities to collect and analyze global user data through TikTok. If the intellectual data collected via DeepSeek—questions, interests, ideas—combines with TikTok’s behavioral data, it enables much more precise and multidimensional profiling of individuals.

In summary, DeepSeek posed a dual threat: siphoning sensitive national security information through the China Mobile backdoor while simultaneously collecting our everyday intellectual activities through ByteDance’s massive data pipeline.

2. Total Collapse: An Open Vault and a Car Without Brakes

While Feroot’s discovery revealed a “deliberately planted assassin,” subsequent reports from other security firms proved how poorly constructed the DeepSeek system was.

An Open Data Vault (Wiz Research)

Security firm Wiz Research found DeepSeek’s internal database exposed on the internet without any encryption or authentication. Imagine leaving a bank’s central vault wide open and abandoned in the middle of the street. This database contained over a million users’ chat logs, API keys, and other sensitive information in raw, unencrypted form.

This horrifying truth means that not only the Chinese government but any hacker worldwide could have accessed and stolen our information at will.

A Car Without Brakes (Cisco Red Team)

Global IT company Cisco raised a more fundamental issue by testing whether the AI model had any basic safety measures. When their team asked DeepSeek harmful questions about cybercrime methods and fake news generation, the result was shocking: 100% failure rate.

DeepSeek did not block a single harmful request and executed all of them. This was like a car without brakes. In stark contrast to OpenAI’s GPT-4 or Google’s Gemini, which block most harmful requests, DeepSeek showed it prioritized performance over ethics or safety.

3. The Invisible Hand: Orders in the Name of Law

“Why was DeepSeek built so recklessly?”

The answer lies not in corporate ethics but in Chinese law. Behind every action of DeepSeek looms the shadow of China’s National Intelligence Law.

Article 7 of China’s National Intelligence Law: “All organizations and citizens shall support, assist, and cooperate with state intelligence work according to law.”

This is not a mere recommendation but an unrefusable “order.” Every company on Chinese soil must submit data to state intelligence agencies upon request, with no right to refuse or judicial oversight.

From this perspective, DeepSeek’s backdoor and data pipeline are likely not bugs or mistakes but features designed to efficiently fulfill state orders.

4. A New Era: How to Protect Your Digital Sovereignty

The DeepSeek incident demands a fundamental shift in how we view technology in the AI era. The days of evaluating technology solely by performance and convenience are over. Asking “Who created this technology under what legal regime?” has become essential for survival.

Personal Code of Conduct: Internalize “Zero Trust”

• Minimize Data: Never input sensitive information into unverified AI. Treat every question you ask as if it were posted on a public forum.
• Assume Surveillance: Use services assuming all activities are recorded and analyzed.
• Technical Defenses: Use VPNs to mask IP addresses and adopt separate browsers or virtual machines (VMs) for sensitive tasks.

Corporate Survival Strategy: Analyze “Geopolitical Risks”

• Zero-Trust Principle for AI: “Never trust, always verify.” High-risk AI like DeepSeek should be blocked entirely from corporate networks.
• Strengthen Supply Chain Due Diligence: Make “geopolitical due diligence” mandatory when adopting AI solutions, analyzing the developer’s nationality and legal environment.

The low-cost innovation DeepSeek promised was an illusion. The price was our personal data and security as collateral. Technology is no longer neutral. Will we willingly hand over our data to surveillants for convenience, or choose the harder path to protect our freedom and sovereignty?

Before that costly bill arrives, it is time for all of us to answer.