DHS orders DeepSeek products removed from federal civilian systems
The order also covers third-party products built on DeepSeek implementations, gives agencies 60 days to seek exceptions, and carries a stated release date of 24 July, months before it was published.
- Government & policy
- Security & misuse
- Minor
The Department of Homeland Security published a notice in the Federal Register on 20 October of an order by Secretary Markwayne Mullin excluding DeepSeek products from federal civilian procurement and requiring their removal from civilian agencies’ information technology. It is issued under the Federal Acquisition Supply Chain Security Act (FASCSA), after a review of a recommendation from the Federal Acquisition Security Council.
The order, numbered #2026-01, names Hangzhou DeepSeek Artificial Intelligence and its affiliates, and extends removal to “third-party products and services developed using DeepSeek implementations”. It applies to civilian executive agencies but not to their national security systems or sensitive compartmented information systems, which fall under the Defense Department and the Director of National Intelligence. Agencies must act “immediately”, or request an exception in writing within 60 days with a “compelling justification”, such as mission-critical needs. DHS’s cybersecurity agency, CISA, reviews the requests.
The order’s stated reasons are that DeepSeek’s servers are in China, where the legal system permits extensive government access to private company infrastructure; that DeepSeek-hosted accounts collect personally identifiable information and may track users; that prompts sent by government employees or vendors “may result in the transfer of sensitive data” to China; and that the models “may contain malware or other security vulnerabilities”. It cites open-source security research on the DeepSeek iOS app. CyberScoop noted that some of these concerns could apply to other Chinese and US models, and that DeepSeek is the only company named.
The publication date understates the order’s age. The signed copy reproduced in the notice gives an “Original Release Date” of 24 July 2026. CyberScoop reported that the letter ordered exclusion on 26 June; the two accounts differ, and this entry follows the Federal Register image. Either way, the ban had been in effect for months before the notice. DeepSeek had not commented publicly.
Earlier US action on DeepSeek had been narrower: individual agencies had restricted its use at their own discretion, according to CyberScoop, and CAISI had published an evaluation of its V4 Pro model in May. The order replaces that agency-by-agency discretion with a single bar across civilian agencies.