A report by the Washington, D.C. based Center for Strategic and International Studies (CSIS) warns that China’s newly developed AI technology, DeepSeek, could enhance cyber security attacks and cybercrimes:” Beyond its design risks, DeepSeek is the latest tool in the PRC’s cyber espionage toolkit to obtain more comprehensive intelligence and support the country’s strategic and geopolitical objectives.”
The CSIS eport goes on to explain:“DeepSeek raised alarms around the world about its security risks. Thus far, Italy, Taiwan, Australia, and South Korea have blocked or banned access to the app on government devices due to national security concerns regarding the app’s data management practices. In the United States, some federal agencies like NASA and the U.S. Navy have instructed employees against using DeepSeek due to national security concerns … DeepSeek presents risks that may affect the (Trump) administration’s calculus of balancing innovation and security. These same risks also present challenges to the United States’ partners and allies, as well as the tech industry.
DeepSeek’s open-source structure means that anyone can download and modify the application. While open-source models can be made secure when built with strong safety guardrails, DeepSeek’s design allows users to alter not only its functionalities but also its safety mechanisms, creating a far greater risk of exploitation. The absence of robust safeguards leaves the model exposed and makes it particularly vulnerable to jailbreaking, where attackers can bypass what little safety infrastructure exists to force the model to generate harmful content. This vulnerability was highlighted in a recent Cisco study, which found that DeepSeek failed to block a single harmful prompt in its security assessments, including prompts related to cybercrime and misinformation. In comparison, OpenAI’s GPT-4o blocked 86 percent of harmful prompts, while Google’s Gemini blocked 64 percent. Further research indicates that DeepSeek is 11 times more likely to be exploited by cybercriminals than other AI models, highlighting a critical vulnerability in its design.”[1]
CSIS says Western companies such as OpenAI, Anthropic, and Google, take a more controlled approach to reduce these risks: “They implement oversight through their application programming interfaces, limiting access and monitoring usage in real time to prevent misuse. Companies like Open AI and Anthropic invest substantial resources into AI security and align their models with what they define as “human values.” They have also collaborated with organizations like the U.S. AI Safety Institute and the UK AI Safety Institute to continuously refine safety protocols through rigorous testing and red-teaming.”[2]
CHINA’S CYBER WEAPONS
According to media and other reports, China uses other weapons Salt Typhoon, Volt Typhoon and APT-41 to perform large scale cyber attacks.
Volt Typhoon is focused on carrying out espionage and stealth operations against key infrastructure companies in the United States and its territories.
According to a University of Maryland report: “Volt Typhoon uses malicious software that penetrates internet-connected systems by exploiting vulnerabilities such as weak administrator passwords, factory default logins and devices that haven’t been updated regularly. The hackers have targeted communications, energy, transportation, water and wastewater systems in the U.S. and its territories, such as Guam.” [3]
Another University of Maryland report says: “Salt Typhoon, began as far back as 2022. Its purpose, according to U.S. officials, was to give Chinese operatives persistent access to telecommunications networks across the U.S. by compromising devices like routers and switches run by companies like AT&T, Verizon, Lumen and others.”[4]
According to a MandIant report, APT-41 is focused on obtaining information from various industries to advance China’s own economic capabilities and produce higher-end products: “FireEye Threat Intelligence assesses with high confidence that APT41 is a Chinese state-sponsored espionage group that is also conducting financially motivated activity for personal gain. APT41 espionage operations against the healthcare, high-tech, and telecommunications sectors include establishing and maintaining strategic access, and through mid-2015, the theft of intellectual property. The group’s operations against higher education, travel services, and news/media firms provide some indication that the group also tracks individuals and conducts surveillance. FireEye Threat Intelligence assesses with high confidence that APT41 carries out an array of financially motivated intrusions, particularly against the video game industry, including stealing source code and digital certificates, virtual currency manipulation, and attempting to deploy ransomware. APT41 has executed multiple software supply chain compromises, gaining access to software companies to inject malicious code into legitimate files before distributing updates.”[5]
THREAT TO BANKS
Reuters cited a recent study that found: “Fake news generated by artificial intelligence and spread on social media is heightening the risks of bank runs, according to a new British study that says lenders must improve monitoring to detect when disinformation risks impacting customer behaviour. Generative AI can be used to create fake news stories saying that customer money is not safe, or memes appearing to joke about security issues, which can be spread on social media using paid adverts, said the study, published by UK research company Say No to Disinfo and communications firm Fenimore Harper.”[6]
False social media reports started panicked withdrawals of $42 billion dollars in a day from Silicon Valley Bank (SVB) in 2023, which caused the bank to collapse. According to Reuters: “Reports on social media during the week of March 6 that some venture capital firms, including influential investor Peter Thiel’s Founders Fund, were advising companies to pull cash from tech-focused SVB snowballed into a stock rout and sent customers scrambling for the exit.[7]
POWER GRID VULNERABILITIES
At the same time, the U.S. power grid is undermined by older infrastructure while struggling to meet higher energy demands and distribution. In addition, the networks used by U.S. power companies, which are used to improve efficiency in infrastructure operations are more vulnerable to cyberattacks. The Government Accountability Office (GAO) recommended that the Department of Energy coordinate with the Department of Homeland Security, state and industry officials to fully address the risks in the grid distribution systems and their potential impact in future cybersecurity plans.
According to a Forbes report: “Although in recent years the grid has been augmented with automation and some emerging tech, It is still mostly dependent on legacy technologies. In fact, 70 percent of transmission lines are at least 30 years old and approaching the end of their lifecycle, and 60 percent of the circuit breakers are more than 35 years old, compared to useful lives of 20 years. Aging grids drive $51B in annual utility distribution spending”[8]
THREAT TO U.S. PORTS
In addition, U.S. ports are also under threat from cyberattacks. One example of the intensity of the attacks can be understood by the experiences of the busiest port in the United States, the Port of Los Angeles.
Between 2014 and 2023 cyber-attacks against the Port of Los Angeles increased from 7 million attacks per month in 2014 to 60 million monthly attacks in 2023, according to Tony Zhong, Chief Information Security Officer, Port of Los Angeles.
Zhong said that digitalization and digitalization have many benefits in improving data flow but also makes it easier to mount cyber-attacks: “With the digitalization nowadays, it’s definitely easier for the bad guys to launch an attack anywhere around the world … They can just sit behind the keyboard. And then with some programming skills (and) with some I would say technical skills, they could potentially disrupt an organization that does not have proper security controls and say policies and procedures in place. So, it makes it very easy to compromise organizations … We are seeing over 60 million monthly … attack attempts that has been the most recorded ever in the existence of our 10 years of operations.”
Cyber attackers also focus on companies that have low levels of cyber defenses:
“What we usually see is the threat actors using older known vulnerabilities … that are available to test those systems. So basically, it’s like … try to compromise the organization with the lowest … hanging fruit there so we don’t have to deploy these sophisticated malware that they have in the arsenal. So, … the bad guys all also have a specific tool set. So, … they want to get in the easiest way without doing too much work. And then if that doesn’t work, they implement more sophisticated techniques.”[9]
THREAT TO FEDERAL PAYMENT SYSTEMS
The Washington, D.C. Center for Budgetary Priorities (CBP) reported “ On January 31, reports began emerging from the Treasury Department that senior civil servants were resisting requests from the “Department of Government Efficiency” (DOGE) concerning access to the payment systems the Bureau of the Fiscal Service (BFS).”[10]
The CBP report explained: “DOGE access to or control over BFS systems raises serious concerns, including the risk that payments will be illegally stopped based on Musk’s own or the Trump Administration’s political or policy preferences; the possibility of severe cybersecurity and privacy breaches; and the potential that payments could be inadvertently delayed to millions of individuals, including retirees and veterans, to organizations and businesses providing public services on behalf of the federal government, as well as to states, localities, territories, and tribal nations for providing services like Medicaid and transportation.”[11][12]
U.S. RESPONSE
The CSIS report noted that DeepSeek’s debut comes at a time when U.S. President Donald Trump is reenvisioning U.S. AI leadership: “In his first weeks in office, Trump revoked the Biden administration’s executive order on AI regulation, requested a new AI action plan within 180 days, and pushed for greater AI leadership from the private sector.”[13]
The U.S. has been making strides to counter the growing cyber security threat.
On the civilian side, organizations such as Mandiant[14] monitor and protect their cyber infrastructure from cyber-attacks. Mandiant was founded by former U.S. Air Force officer Kevin Mandia to enhance current cyber security practices. Mandiant is now a subsidiary of Google Cloud[15]
Another example is the Electric Grid Cybersecurity Alliance.[16] The Electric Grid Cybersecurity Alliance was formed by cybersecurity veteran John Miri:
“Miri says that the stated mission of the Alliance is to ‘unite utility leaders with one goal: to protect the world’s electric grids from cyberattack.’”[17]
The U.S. Cyber Command (USCYBERCOM), defends the Department of Defense’s information network, supporting mission commanders for execution of their missions and strengthening the U.S.’s ability to protect and respond to cyberattacks: “The Command unifies the direction of cyberspace operations, strengthens DoD cyberspace capabilities, and integrates and bolsters DoD’s cyber expertise. USCYBERCOM improves DoD’s capabilities to operate resilient, reliable information and communication networks, counter cyberspace threats, and assure access to cyberspace. USCYBERCOM is designing the cyber force structure, training requirements and certification standards that will enable the Services to build the cyber force required to execute our assigned missions. The command also works closely with interagency and international partners in executing these critical missions.”[18]
In 2023, the White House released a National Cybersecurity Strategy to address the nation’s cybersecurity challenges. The plan outlines efforts to address cybersecurity challenges and secure cyberspace to make sure the U.S. benefits from advances in computing and digital space. The plan covers the majority of the GAO’s characteristics for a national strategy.[19]
The GAO also published a report on the major challenges facing the U.S. government in their efforts to stop cyberattacks entitled What are the Biggest Challenges to Federal Cybersecurity? (High Risk Update)[20]
FOOTNOTES
[1]https://www.csis.org/analysis/delving-dangers-deepseek#:~:text=Security%20researchers%20at%20Check%20Point,sensitive%20information%20from%20compromised%20devices.
[2] Ibid.
[3]https://umbc.edu/stories/what-is-volt-typhoon-a-cybersecurity-expert-explains-the-chinese-hackers-targeting-us-critical-infrastructure/
[4]https://umbc.edu/stories/what-is-salt-typhoon-a-security-expert-explains-the-chinese-hackers-and-their-attack-on-us-telecommunications-networks/
[5] https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
[6]https://www.reuters.com/technology/artificial-intelligence/ai-generated-content-raises-risks-more-bank-runs-uk-study-shows-2025-02-14/
[7]https://www.reuters.com/business/finance/social-media-driven-bank-runs-burden-regulators-with-bigger-problem-2023-03-21/
[8]https://www.forbes.com/sites/chuckbrooks/2023/02/15/3-alarming-threats-to-the-us-energy-grid–cyber-physical-and-existential-events/
[9] https://www.ajot.com/insights/full/ai-port-of-los-angeles-hit-by-60-million-monthly-cyber-attacks-in-2023
[10]https://www.cbpp.org/research/federal-budget/doge-access-to-treasury-payment-systems-raises-serious-risks
[11]https://www.cbpp.org/research/federal-budget/doge-access-to-treasury-payment-systems-raises-serious-risks
[12] https://www.cbpp.org/sites/default/files/2-11-25bud.pdf
[13]https://www.csis.org/analysis/delving-dangers-deepseek#:~:text=Security%20researchers%20at%20Check%20Point,sensitive%20information%20from%20compromised%20devices.
[14] https://startuptalky.com/mandiant-success-story/
[15] https://cloud.google.com/security/consulting/mandiant-services
[16]https://www.forbes.com/sites/chuckbrooks/2023/02/15/3-alarming-threats-to-the-us-energy-grid–cyber-physical-and-existential-events/
[17] Ibid.
[18] https://www.cybercom.mil/About/Mission-and-Vision/
[19] https://www.gao.gov/blog/u.s.-now-has-national-cybersecurity-strategy-it-strong-it-could-be
[20] https://www.gao.gov/blog/what-are-biggest-challenges-federal-cybersecurity-high-risk-update