Italy Prohibits Chinese DeepSeek AI Due to Data Privacy and Ethical Issues
Italy Blocks Chinese AI Service DeepSeek
Italy’s data protection authority, known as the Garante, has taken action to block the services of the Chinese artificial intelligence (AI) company, DeepSeek, within its borders. This decision stems from concerns about how the company manages users’ personal data.
Reasons for the Block
The Garante initiated inquiries into DeepSeek’s data handling practices, seeking clarification on several key points:
- Data Collection: The authority wanted to know what personal data DeepSeek collects through its platforms, such as its web service and mobile application.
- Sources of Data: Questions were raised about where this data originates.
- Purpose of Data Use: The Garante sought clarity on the reasons for collecting this data, specifically the purposes behind it.
- Legal Basis for Data Storage: The authority inquired about the legal basis for data usage and whether such data is stored in China.
Despite responding to these questions, DeepSeek’s answers were deemed inadequate. The companies behind the AI service—Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence—claimed they neither operate in Italy nor comply with European data laws. This dismissal prompted the Garante to block access to DeepSeek services immediately and launch a formal investigation.
Previous AI Service Bans
This is not the first time Italy has restricted AI services. In 2023, the Garante imposed a temporary ban on OpenAI’s ChatGPT over concerns regarding data privacy. The ban was lifted after OpenAI acted to address the raised issues, but the company was later fined €15 million due to improper handling of personal data.
Rising Popularity Amid Concerns
Despite the ban, DeepSeek had been experiencing a surge in popularity, with users flocking to its services, driving its mobile apps to the top of app store download charts. However, alongside this growth, the company has faced numerous challenges, including:
- Cyber Attacks: DeepSeek has become a target for significant malicious cyber attacks.
- Scrutiny Over Privacy Practices: Lawmakers and regulators have raised concerns about its privacy policy, censorship in alignment with Chinese policies, and possible national security threats.
To address these cyber attacks, DeepSeek announced a fix as of January 31, while simultaneously gaining regulatory attention regarding its data practices.
Addressing Vulnerabilities
DeepSeek’s large language models (LLM) have shown vulnerability to jailbreak techniques, such as Crescendo, Bad Likert Judge, and others. These methods can be exploited by malicious actors to generate harmful or restricted content. Reports from cybersecurity analysts indicate that while DeepSeek’s LLMs initially seem harmless, cleverly crafted prompts can reveal structural weaknesses, potentially enabling the AI to provide detailed instructions for creating dangerous items or malicious code.
Ethical and Security Concerns
An investigation by AI security firm HiddenLayer into DeepSeek’s reasoning models uncovered that they are susceptible to prompt injections, which may inadvertently leak sensitive information. Additionally, there are concerns that DeepSeek may have used data from OpenAI in its training processes, raising serious ethical and legal questions.
In comparison, OpenAI’s own models experienced similar vulnerabilities, including the Time Bandit jailbreak technique. This vulnerability allows attackers to manipulate responses by directing the model towards specific historical events or contexts, facilitating access to illicit information.
Conclusion
DeepSeek’s rapid ascent in the AI landscape has brought forth critical conversations regarding data privacy, security vulnerabilities, and compliance with international laws. The scrutiny surrounding DeepSeek highlights the ongoing need for robust regulatory frameworks that can keep pace with rapid advancements in AI technologies and their implications for society.
