Comment by andrewssobral

The US government's decision to ban DeepSeek raises serious questions about whether this policy is based on actual technical security risks or simply geopolitical concerns.

*Using DeepSeek's API and running DeepSeek's open-weight models locally are fundamentally different things.*

When using an API, sensitive data may be transmitted to external servers. That's a legitimate security concern.

But when model weights are deployed on government-controlled infrastructure, especially in an air-gapped environment with no internet access, there is simply no network path for the model to transmit data back to China or anywhere else.

Of course, software supply-chain security matters. But those risks should be evaluated independently, regardless of whether a model comes from China, the US, or Europe.

*If this ban also covers locally hosted, isolated deployments, it is conflating the nationality of a model's developer with an actual cybersecurity vulnerability.*

Security policies should be based on concrete threat models and technical evidence, not on where a model was trained.

Otherwise, we're not really talking about cybersecurity anymore. We're talking about geopolitics disguised as cybersecurity.