National Cyber and Information Security Agency - NÚKIB and Microsoft Confirm Cybersecurity Cooperation by Signing a Memorandum

02 July 2025

At the international security forum Globsec, held on Thursday, June 12, 2025, in Prague, representatives of the National Cyber and Information Security Agency (NÚKIB) and Microsoft signed the Memorandum of Understanding. The memorandum was signed on behalf of NÚKIB by its director Lukáš Kintr, and on behalf of Microsoft by Amy Hogan-Burney, Vice President, and Michal Stachník, General Manager of Microsoft Czech Republic and Slovakia.

This memorandum represents a significant step forward in developing cooperation between the public and private sectors in cybersecurity, contributing to the overall strengthening of the Czech Republic’s cyber resilience. It builds on the shared commitment of both NÚKIB and Microsoft to foster a safer and more resilient cyberspace. It also provides a framework for practical collaboration in areas such as sharing expertise, supporting education, and leveraging emerging technologies, including artificial intelligence, to defend against cyber threats. The memorandum further confirms the intent of both parties to engage in a regular dialogue and jointly enhance cybersecurity capacities.

‘Cooperation with technology leaders such as Microsoft is the key to strengthening the cybersecurity of the Czech Republic,’ emphasized Lukáš Kintr, Director of NÚKIB. ‘The signed memorandum sets a clear framework for knowledge sharing and joint threat response. It is another concrete step towards greater resilience of our state in cyberspace,’ he said, adding: ‘Protection against cyberattacks is not possible without trust and open communication. Timely information sharing and swift coordination have already prevented several attacks in the past. NÚKIB has long been building a community of people and institutions who see cybersecurity as a shared responsibility, and this collaboration is a clear example of that.’

Amy Hogan-Burney, Microsoft’s Global Director for Customer Security and Trust, praised the recent public disclosure of the cyberattack by a Chinese actor targeting the Czech Ministry of Foreign Affairs, and the open communication, which helps build trust – something she called vital in the current geopolitical landscape. She added: ‘Our goal is to share as much information as possible and to be transparent about attacks on our systems or those of our customers. It is very important that governments take the same approach. Only then can we effectively deter future attacks. I personally look forward to continuing our cooperation with you.’

Michal Stachník, General Manager of Microsoft Czech Republic and Slovakia, also highlighted the importance of long-term partnerships with strong institutions like NÚKIB. He mentioned today’s key geopolitical topics as well: ‘The signing of this memorandum builds upon our commitments to Europe, including the expansion of cloud and AI infrastructure aimed at strengthening digital sovereignty and economic competitiveness across the continent. Microsoft has also made a legal commitment to protect Europe’s digital resilience – even in the face of geopolitical pressures, including legal challenges against any attempt to disrupt services in Europe – and has reinforced its focus on compliance with European laws and data protection.’

News

NÚKIB Issues a Warning Regarding Certain Products of the Company DeepSeek

On 10 July 2025 the National Cyber and Information Security Agency (NÚKIB) issued a WARNING regarding a cybersecurity threat associated with the use of products, applications, solutions, websites, and web services, including application programming interfaces (so-called APIs), provided by the company DeepSeek or any of its predecessors, successors, parent, subsidiary, or affiliated companies (hereinafter collectively referred to as ‘affected products’) on devices that access the information and communication systems of critical information infrastructure, information systems of essential services and important information systems. The Warning takes effect for obligated entities under the Act on Cyber Security from the moment it is published on NÚKIB’s official notice board.

Based on the issued Warning, entities obligated under the Act on Cybersecurity must take the threat into account in their risk analyses and respond to the identified risks by implementing adequate security measures. The threat is rated as ‘High’, corresponding to a probability ranging from likely to very likely.

At the same time, we also recommend that the public carefully assess the use of the affected products, or alternatively, consider what kind of information they put into them. For so-called persons of interest, i.e. individuals in high political, public, or decision-making positions, we recommend refraining from using the affected products altogether. The issued Warning and the above-mentioned recommendations are in accordance with the Act on Cyber Security, which tasks NÚKIB, among other responsibilities, with ensuring cybersecurity prevention.

The primary security concerns stem from insufficient protection of data transmission and handling, from the collection of data types which, in greater volume, may lead to user de-anonymization, and lastly, from the legal and political environment of the People’s Republic of China to which the company DeepSeek is fully subject.

This Warning does not apply to security testing, research, or analysis of the affected products, nor to open-source large language models developed by the company DeepSeek, whose source code is publicly accessible and which are deployed locally, without any capability to communicate with servers used by the company DeepSeek or its related entities (i.e. predecessors, successors, parent, subsidiary, or affiliated companies).

‘In the analysis that led to this Warning, we relied on a combination of our own findings and information from our international partners. The affected products of the company X handle data in a way that may pose a security risk for entities falling under the Act on Cyber Security. In the context of the legal environment of the People’s Republic of China – which allows state authorities access to such data – these concerns are entirely justified. This is further confirmed by the recent public attribution of a cyberattack by the APT31 group, linked to China, against the Czech Ministry of Foreign Affairs. It shows that Beijing is prepared to act in direct contradiction to the interests of the Czech Republic,’ said NÚKIB Director Lukáš Kintr.

You can find the full text of the warning here.

Simultaneously with this Warning, the Government of the Czech Republic approved a resolution on 9 July 2025 concerning the affected products of the company DeepSeek, which will soon be available here. By this resolution, government members, ministries, and other central administrative authorities are instructed to ensure that their subordinate ministries and other administrative bodies do not use, in the execution of their duties, products, applications, solutions, websites, and web services (including APIs) provided by the company DeepSeek or any of its predecessors, successors, parent, subsidiary, or affiliated companies.

The ban applies to use of the aforementioned on any state-owned devices. According to Article IV, paragraph 4 of the Government’s Rules of Procedure, the obligation imposed by the resolution must be fulfilled within 30 days.

As with the NÚKIB Warning, this resolution does not apply to open-source large language models (LLMs) developed by the company DeepSeek, provided their full source code is publicly available for review and analysis and they are deployed locally without any capability to communicate with servers used by the company DeepSeek or its related entities.

Celá zpráva 2025-07-10