Multiple Governments Block or Propose Restrictions on DeepSeek Over Data and Security Concerns
Security researchers reported that DeepSeek's iOS application transmits unencrypted user data to ByteDance servers with multiple security flaws. Multiple governments including Australia, Italy, Taiwan, and South Korea responded by restricting access, while U.S. lawmakers proposed banning its use on government devices citing national security concerns.
What happened
Security researchers at NowSecure found that the DeepSeek iOS application transmits user data through unencrypted channels and disables Apple Transport Security (ATS) globally, allowing potential interception. The application reportedly sends data to servers belonging to ByteDance, TikTok's parent company.
NowSecure identified multiple security issues: sensitive data sent without encryption accessible to network traffic observers; use of outdated Triple DES encryption not recommended by NIST since 2016; and static encryption keys embedded in the application and identical for all iOS users. According to NowSecure founder Andrew Hoog, the application 'failed to provide basic protection of user data.'
Reported impact
Multiple governments have responded with restrictions. Australia, Italy, and Taiwan reportedly implemented bans, and South Korea began blocking DeepSeek due to security concerns. In the United States, members of Congress proposed a ban on DeepSeek use on government devices, citing national security risks and concerns about the Chinese Communist Party exploiting the tool to weaken U.S. security and collect data on Americans.
Index analysis
The incident reflects broader geopolitical tensions between the United States and China over AI technology control. Governments cited connections between DeepSeek and ByteDance, a company previously scrutinized for its relationship with the Chinese government, as a basis for their concerns about data security and national security implications.
Governance controls
NowSecure's audit remained incomplete at the time of reporting, with founder Andrew Hoog stating numerous questions and details remained unanswered or unclear. He noted the findings were concerning enough to warrant public disclosure without delay despite the incomplete audit.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.