NZ MPs get behind-the-scenes DeepSeek warning

Image / Getty Creative

DeepSeek, an AI app made by a Chinese firm, has taken the world by storm, topping Apple and Google’s app store charts as millions in the West download it to their smartphones - where, like ChatGPT, it can answer questions and deliver content in seconds. Many businesses are also eyeing it, given it can be integrated into other software for free on its open-source model.

But many government agencies around the world have taken precautionary measures to limit access to DeepSeek because of concerns about potential data leaks to the Chinese Government and weak privacy safeguards.

So far, New Zealand’s Government has only reiterated general advice to be wary of security and privacy issues when using generative AI - even if, behind the scenes, MPs have been offered sharper advice.

Others have acted more decisively - and cybersecurity experts say NZ should follow suit.

Earlier this week, Australia banned DeepSeek AI services from all government systems and devices. Home Affairs Minister Tony Burke said DeepSeek posed an “unacceptable risk”.

DeepSeek's maker, Chinese firm HighFlyer, claimed to have trained the AI for a bargain-basement US$5.5 million thanks to efficient software development techniques that required far fewer of Nvidia's super-expensive chips - sending Nvidia's shares into a US$590m tailspin. But ChatGPT maker OpenAI claimed DeepSeek had been trained through "distillation" or copying the American AI's responses. Photo / Getty Images

Italy ordered it to be blocked to protect consumers’ data. Ireland has asked for more information from the company over potential breaches of European Union privacy law. So has France. Several countries, now including South Korea, have expressed concern about DeepSeek’s data practices, including how it handles personal data and what information is used to train its AI system.

Japan already effectively bans the use of generative AI services for any government devices handling highly sensitive information, though it’s up to each ministry to decide on usage for other devices, according to Digital Transformation Minister Masaaki Taira.

In the US, Congress is still weighing a ban, but Texas has issued an order banning DeepSeek from state government devices. The US Navy, the Pentagon and Nasa have issued organisation-wide bans.

NZ Parliament stops short of a ban, but issues a strong warning

In March 2023, the NZ Parliamentary Service said TikTok would be removed from all devices with access to the parliamentary network on the advice of cybersecurity experts - a ban that is still in place. (Politicians can still use personal devices, or those controlled by their social media teams outside Parliament, to access and campaign on the social media platform - as Prime Minister Christopher Luxon and others did last election.)

The Herald asked the Parliamentary Service if DeepSeek would be allowed on MPs’ phones and/or other Government devices. It wouldn’t say.

“All applications are regularly reviewed to ensure they comply with Parliamentary Service security and privacy standards,” Mitch Knight, its acting chief executive, said in a statement.

He was not available for an interview and refused written questions, but one senior politician forwarded the Herald a message that Knight’s Parliamentary Service team sent to all MPs and parliamentary staff on January 28. It read:

As you may be aware, a new AI service called DeepSeek has been launched.

We strongly advise that all parliamentary staff refrain from using DeepSeek at this point, as we need to review the application to ensure it complies with Parliamentary Service security and data privacy standards. We are working directly with partners to provide future guidance. We recommend familiarising yourself with our guide on using AI technology to ensure our information and data is kept safe.

New applications are always reviewed to ensure they comply with Parliamentary Service security and privacy standards.

We will complete and advise on this review as soon as possible.

For Crown agencies outside the Beehive network, the New Zealand Government has not issued any guidance specific to DeepSeek, acting deputy chief digital officer Amy Allison told the Herald.

“The New Zealand Government should now follow Australia’s lead and ban DeepSeek on Government devices too," CyberCX's Alastair MacGibbon says.

“The recently released DeepSeek AI-powered chatbot, like other chatbots available publicly, is a form of Generative AI, or GenAI. The Public Service AI Framework outlines expectations around the responsible use of AI, and applies to all forms of AI used in New Zealand public services. This includes the use of GenAI tools like DeepSeek,” she said.

The Public Service AI Framework offers a series of general guidelines for the use of generative AI that is light on detail and heavy on buzzwords.

Beyond the public service advice, our Government - and the Cabinet - have had no specific advice on DeepSeek for the general public. Again, that’s a contrast with Australia, where the Government’s special envoy for cyber security, Andrew Charlton, said the app “raises serious concerns around data security and potential vulnerabilities ... The Government’s advice is that people should be vigilant when using DeepSeek.”

‘New Zealand should follow Australian ban’

Cyber CX chief strategy officer Alastair MacGibbon told the Herald: “We welcome the decision by the Australian Government to ban Chinese AI app DeepSeek on Government devices. The New Zealand Government should now follow Australia’s lead and ban DeepSeek on Government devices too.

“Both the Australian and New Zealand Governments should take this a step further and instruct operators of critical infrastructure to restrict access to DeepSeek on company devices.”

He added: “This isn’t the first time we have had this conversation and it won’t be the last. Chinese EVs, security cameras, TikTok and now DeepSeek show that we are playing whack-a-mole with new technology products and services from high-risk nations.

“Any smart device or software that requires an ongoing connection with the manufacturer in an authoritarian state like China raises difficult questions for Western policymakers. These technologies are invasive in their data collection practices and can be weaponised against Australians and New Zealand by nations that might seek to do us harm.”

Can we trust American AI products?

Victoria University AI expert Dr Andrew Lensen says: “We’ve seen a proliferation of countries banning DeepSeek in their government agencies, including for their lawmakers. This is out of a concern that the Chinese Government will use the information that users provide to DeepSeek for geopolitical purposes, potentially exposing sensitive security information.”

While ChatGPT was met with a degree of caution - including MBIE’s temporary staff ban (now lifted) - DeepSeek has caused a much bigger scare, Lensen says.

“But with Trump back in power and the tech oligarchy surrounding him, should we really be trusting American AI products with our data?”

If we were to ban DeepSeek in New Zealand’s Government, we should consider banning the use of American AI products too, he says.

“With Elon Musk rummaging around in the US’s federal innards, how can we be sure that the US won’t have the same level of access as China?”

Stored in China

DeepSeek’s privacy policy and terms and conditions say it will store any information you share with it - and use it to train its software (to be fair, standard form for the free version of every Western AI, outside of Apple’s). The data is stored on servers in China.

“In essence, it comes down to trust,” says Ben Reid, a director of Memia and a former executive director of the AI Forum NZ.

“Does your organisation in New Zealand trust US cloud providers or Chinese cloud providers - and by implication the governments that effectively supervise them - to keep your confidential information secure? Given the increasingly complex geopolitical dynamics right now, many New Zealand organisations may start looking for more ‘sovereign’ arrangements hosted onshore by New Zealand-owned and operated cloud providers.”

There’s DeepSeek ... and then there’s DeepSeek

There are two main elements to the Chinese AI.

“The most important thing is to distinguish between the Deepseek app for a smartphones or web browser - which is hosted by DeepSeek themselves in China - and the underlying DeepSeek-R1 AI model, which can be downloaded and run locally under a very permissive open-source licence. It is a very good model and it’s available for free,” Reid says.

“For the app - as with any app; American, Chinese or other - every organisation needs to carry out a cybersecurity safety assessment and see whether there are risks that sensitive information could be lost by using the app. We do this all the time with US apps and cloud providers. ut it’s still a relative novelty to carry out a cybersecurity assessment on an AI app from China.

“For the model - which is where the DeepSeek-R1 model itself comes in: Because they are open source, LLMs like DeepSeek-R1 together with other open-source releases like Mistral and Llama provide a compelling opportunity to host onshore, sovereign AI apps and APIs which don’t rely entirely on overseas companies for hosting or security.”

Ben Reid sees opportunity for New Zealand in hosting DeekSeek's open-source model.

Mistral is a French gen-AI player, founded by ex-Google and Meta employees. Llama is Meta’s large language model.

“As I wrote in my book Fast Forward Aotearoa, last year, I think New Zealand needs to invest in an open-source technology foundation to maintain capability and sovereignty in an increasingly uncertain international technological environment,’ Reid says.

“Otherwise we are just technology takers from the largest global tech companies. Hosting DeepSeek-R1 - and others - in an onshore cloud provides that opportunity. Someone should do it.”

NZ’s Government is in the process of creating a new advanced technologies research organisation whose points of focus will include AI, quantum computing. However, unlike across the Tasman, it will be accommodated from within current science sector funding. And is part of a restructure that sees Callaghan Innovation disestablished, with no immediate role for its research scientists - many of whom are already job hunting as a June 30 defunding deadline looms, according to the Public Service Association.

Chris Keall is an Auckland-based member of the Herald’s business team. He joined the Herald in 2018 and is the technology editor and a senior business writer.