The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek's products from their computers and to stop buying more, and the order reaches past the company's name. Software other firms built on DeepSeek's models is covered too, including copies of those models running on American servers. The notice of the order was filed for public inspection on October 19 and scheduled for publication in the Federal Register on October 20. What prompted it is a list of risks DHS describes, not a breach: the order itself points to no leak of US government data. And the rule stops at government, leaving private businesses and individuals in the United States free to keep using the same tools.
What the order actually requires #
The notice sets out two actions. It excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, including affiliated entities, from federal civilian agency procurements. And it requires the removal of all DeepSeek and DeepSeek affiliate products, and third-party products and services built on DeepSeek's technology, from civilian agency information technology.
In practice, agencies must stop signing new contracts for anything covered and clear the covered tools out of systems they already run. The removal half is where the order gets broad: the notice says a tool "developed using DeepSeek implementations" is covered, so software that carries someone else's brand but runs on DeepSeek's models underneath is in scope.
The order was issued under the Federal Acquisition Supply Chain Security Act of 2018, after a review of a recommendation from the Federal Acquisition Security Council, a body that weighs risks in federal purchasing. The exclusion also covers DeepSeek products on agency-approved product lists, service provider equipment lists and e-commerce markets, International Business Times UK reported. The signed order calls for removal immediately after it is issued unless an agency asks for an exception, and until removal is finished it encourages agencies to monitor data flowing in and out of their systems.
Why the models count as much as the app #
DeepSeek's models can be downloaded and run by other companies, not only used through DeepSeek's own app. Those open-weight models can be hosted locally or by third parties, including on servers in the United States, implicator.ai reported, while DeepSeek's own servers are in China, the order notes.
That split is the center of the argument about the order's breadth. "The risks the order cites are mostly about data flowing to DeepSeek's servers in China, its data collection, and its app," Katie Moussouris, founder of the security firm Luta Security, told The Register. "US hosting avoids most of those."
What DHS says the risk is #
DHS says the models present "multiple threat vectors", its phrase for several different ways things could go wrong. DHS says Chinese law gives the government's cyber and intelligence services "extensive authority" to access private companies' infrastructure. When DeepSeek runs the models itself, the order says, its account sign-up collects personal information and the company "may also track and digitally fingerprint users". The models themselves may contain malware or other security vulnerabilities, it adds. The department said use by US government employees or vendors may result in the transfer of sensitive data to the People's Republic of China, and that the models could produce actionable intelligence on US persons or agencies.
These are risks the department states, not findings it has demonstrated. The notice does not detail the council evidence sitting behind them, implicator.ai reported.
So far, no breach #
The signed order points to no leak of US government data and no other incident. It rests on the risks DHS describes and on outside research, including a finding that DeepSeek's iPhone app has multiple critical security flaws.
Who is covered, and who is not #
The directive applies to civilian executive branch agencies, which include departments such as Treasury, State and Justice, implicator.ai reported. National security systems and secure compartmented information systems are exempt and fall under separate authorities, with orders for those systems issued by the Department of War and the Director of National Intelligence, according to International Business Times UK.
Nothing in the order bans DeepSeek for private companies or individuals in the United States, Yonhap reported.
The 60 days is not a removal deadline #
Agencies can ask DHS for an exception in writing within 60 days of the order's issuance, with a justification such as the effect on mission-critical work, but the exclusion and the removal both take effect immediately unless an agency obtains one, International Business Times UK reported. That window is for exception requests, not for carrying out the removal, and it does not start from the public notice date.
The dates around the order are easy to mix up. The notice was filed for public inspection on October 19, 2026 and scheduled for Federal Register publication on October 20. The order it publishes is older: the signed copy attached to the notice gives July 24, 2026 as its release date and carries the name of Homeland Security Secretary Markwayne Mullin. Counting from that date, the 60-day exception window closed in late September, before the notice became public.
The restrictions arrived in pieces first #
Several agencies had already acted. The Department of Commerce and the Navy banned DeepSeek on government devices, and states including New York, Tennessee and Virginia took similar steps, Reuters reported. South Korea restricted DeepSeek's use across its foreign, trade and defense ministries in February 2025, Yonhap reported.
DeepSeek is also among the Chinese AI companies US agencies have flagged over the alleged extraction of US frontier models, POLITICO reported. In a September report, Anthropic accused DeepSeek and six other China-based labs of illicit distillation, meaning training their own models on answers drawn from Anthropic's Claude. That is Anthropic's accusation, not a court or agency finding.
What happens next #
The exclusion from new purchases took effect immediately, and removal was due as soon as the order was issued unless an agency sought an exception. The order is set to be revisited: it says the secretary of homeland security will review it within a year and every year after that. Reuters also reported that the Federal Communications Commission is due to vote on October 29 on a proposal to bar Chinese labs from testing electronic devices for use in the United States.