{"slug": "the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in", "title": "The DHS DeepSeek removal order explained: what it covers, the 60-day window, and where DeepSeek hides in a stack", "summary": "The Department of Homeland Security published Exclusion and Removal Order #2026-01 on October 20, 2026, directing federal civilian executive branch agencies to immediately stop purchasing DeepSeek products and remove them from agency IT systems, including third-party products and services developed using DeepSeek implementations. The order, signed by Homeland Security Secretary Markwayne Mullin and copied to Office of Management and Budget Director Russell Vought, carries an original release date of July 24, 2026, and runs under the Federal Acquisition Supply Chain Security Act of 2018; agencies that cannot comply must request a written exception within 60 days, with CISA reviewing the requests. The order covers civilian agencies only, excluding national security systems and secure compartmented information systems, and does not name open weights, self-hosted copies or AI gateways, which the notice identifies as the places a DeepSeek model is easiest to miss.", "body_md": "# The DHS DeepSeek removal order explained: what it covers, the 60-day window, and where DeepSeek hides in a stack\n\nOn October 20, 2026, the Department of Homeland Security published an order telling federal civilian agencies to stop buying DeepSeek products and remove them from their systems. The signed order inside the filing is a scanned image, so most coverage skipped its terms. This page sets them out in plain words, explains the law behind it, and maps where a DeepSeek model can sit in a stack without anyone noticing.\n\n**This explains reporting by**\n\n[U.S. Department of Homeland Security, \"Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements\" (Federal Register document 2026-21447, published October 20, 2026)](https://public-inspection.federalregister.gov/2026-21447.pdf).\nRead the original first:\n\n[https://public-inspection.federalregister.gov/2026-21447.pdf](https://public-inspection.federalregister.gov/2026-21447.pdf)\n\n## In one minute\n\n- DHS Exclusion and Removal Order #2026-01 tells federal civilian agencies to stop buying DeepSeek products and to remove them from their IT systems. It reaches third-party products and services developed using DeepSeek, not just DeepSeek's own apps.\n- Both steps take effect immediately. An agency that cannot comply can ask for an exception, in writing, within 60 days of the order. CISA reviews those requests.\n- The order runs under the Federal Acquisition Supply Chain Security Act of 2018. It covers civilian agencies only; military and intelligence systems fall under other officials' authority.\n- The signed order shows an original release date of July 24, 2026. It was filed for public inspection on October 19 and published on October 20.\n- The order does not name open weights, self-hosted copies or AI gateways. Those are the places a DeepSeek model is easiest to miss, so they are where an inventory should start.\n\n## What the order says\n\nThe Federal Register notice is two pages of plain text. The order itself sits in an appendix as four scanned pages, titled Exclusion and Removal Order #2026-01. It is signed by the Secretary of Homeland Security, Markwayne Mullin, copied to Russell Vought, Director of the Office of Management and Budget, and carries an original release date of July 24, 2026.\n\nIt applies to federal civilian executive branch agencies, except for their national security systems and secure compartmented information systems. It gives two instructions:\n\n- Exclude DeepSeek, its affiliated entities and their products from civilian agency purchasing, effective immediately. The order names the places that covers: agency-approved product lists, service provider equipment lists, e-commerce markets and similar buying channels.\n- Remove products provided by DeepSeek and its affiliates, and third-party products and services developed using DeepSeek implementations, from civilian agency IT systems, immediately after the order is issued, or seek an exception.\n\nA footnote on the purchasing rule spells out the reach: it includes third-party implementations of DeepSeek used to provide products and services to civilian agencies. In plain words, a vendor's product that runs on DeepSeek counts too.\n\nWhile removal is under way, agencies are encouraged to watch traffic in and out, turn on more logging, add controls against data leaving the network, and flag unusual activity. CISA may help agencies that lack the staff to comply, and the Secretary must review the order within one year and every year after.\n\n## The 60-day window\n\nNone of the coverage we read gave a deadline, because the order does not set one for removal. Removal is immediate. What has a clock is the exception process.\n\nAn agency can ask the DHS issuing official for an exception: that the order not apply to it, not apply to certain actions, or give it more time. The request must be in writing within 60 days of the order and must include five things: which order it concerns, what exception is sought, which product or service is involved, a compelling justification such as harm to mission-critical work, and any steps the agency will take to reduce the risk in the meantime.\n\nCISA reviews the requests and answers in writing. So the real schedule is this: stop buying now, pull it out now, and if you cannot, make the case within 60 days.\n\n## The law behind it, in plain words\n\nThe Federal Acquisition Supply Chain Security Act of 2018 created the Federal Acquisition Security Council, a group that looks at supply-chain risk in what the government buys. When the council recommends that a product be kept out, the Secretary of Homeland Security can issue an exclusion order, a removal order, or both, for civilian agencies. The Secretary of Defense and the Director of National Intelligence hold the same power for their own systems.\n\nExclusion means you cannot buy it. Removal means you must take out what you already have. This order does both, and it is the first one numbered for 2026.\n\n## Why DHS says DeepSeek is a risk\n\nThe order lists its reasons. DeepSeek is a privately owned company in the People's Republic of China, and its servers are there. Chinese law gives government cyber and intelligence services broad power to reach into private company systems. On DeepSeek-hosted models, account sign-up collects personal information and may track and fingerprint users.\n\nThen the core point. Using DeepSeek's apps means sending prompts to the model, and a prompt from a federal employee or vendor can carry sensitive data. The order says that data, alone or combined with public information, could give China useful intelligence on US persons and government programs. It adds that the models themselves may contain malware or other security flaws, and cites a February 2025 NowSecure report on critical flaws in DeepSeek's iOS app.\n\nTechCrunch reports that China's Foreign Ministry opposes what it called overstretching the concept of national security, and that Beijing will defend Chinese companies' rights and interests.\n\n## Where DeepSeek hides in a stack\n\nThe phrase that matters most for vendors is developed using DeepSeek implementations. Few agencies installed the DeepSeek chat app on purpose. A DeepSeek model is much more likely to arrive inside something else.\n\n- AI gateways. The Register points out that services such as OpenRouter and Vercel AI Gateway can route a request to DeepSeek models, so an app can call one without its owner choosing it. OpenRouter's account-wide ignore list keeps requests off a named provider, but DeepSeek models hosted by other providers still need a model ID check.\n- Vendor features. A SaaS product's summarizer, search or agent may run on a cheap open model. Ask each AI vendor in writing which models sit behind each feature.\n- Open-weight copies. DeepSeek publishes weights under the MIT license, and anyone can host them on US servers. The order does not mention weights. The Register quotes Luta Security's Katie Moussouris saying the order applies to US-hosted versions of DeepSeek's models. We have not seen DHS confirm that reading.\n- Coding agents and harnesses. A coding agent can be pointed at any model. In the Cairn report we covered on October 19, NorForge read one worker label as a Claude Code harness driving DeepSeek V4.1 Flash. Check what model each agent setup actually calls.\n- DeepSeek's own open-source tools. On the same day the order was published, DeepSeek open-sourced DeepInfer, the Apache 2.0 inference engine it says powers its production service. Our reading is that it counts as a product provided by DeepSeek. Agencies should treat it that way until CISA says otherwise.\n\n## How to check, this week\n\nSearch code, config files, environment variables and gateway logs for model IDs that contain deepseek. A plain text search finds most of them:\n\n```\ngrep -rniI \"deepseek\" --exclude-dir=node_modules --exclude-dir=.git .\n```\n\nThen cover what a search cannot reach: the models behind each vendor's AI feature, any fine-tuned model whose base you do not know, and any agent or gateway that picks a model for you at run time. If you find DeepSeek in something you supply to an agency, tell the agency now, because it has 60 days to request an exception and needs your facts to do it.\n\n## Who is affected\n\n| Case | Status | \n|---|---|\n| Federal civilian executive branch agencies | Covered. Stop buying DeepSeek products now and remove them, including third-party products built using DeepSeek, or request an exception in writing within 60 days. | \n| Vendors, resellers and MSPs selling IT or AI services to those agencies | Affected through what they supply. The order reaches third-party implementations of DeepSeek used to serve civilian agencies. Inventory the models behind every product you sell them. | \n| National security and secure compartmented information systems | Not covered by this order. The Defense Department and the intelligence community act under their own authority. | \n| State and local governments | Not named in this order, which applies to federal civilian executive branch agencies. | \n| Private companies with no federal customers | Not covered. The order is still a strong signal for any company that writes AI vendor rules, and the inventory steps work the same. | \n\n## What to do\n\n- Search code, configs and gateway logs for model IDs containing deepseek.\n- Ask each AI vendor in writing which models run behind each feature you use or resell.\n- If you route through an AI gateway, check which providers and models it can pick, and pin or block them on purpose.\n- If you supply a federal civilian agency and find DeepSeek, tell the agency now so it can request an exception within 60 days.\n- Treat open-weight DeepSeek copies on US servers as in scope until CISA says otherwise.\n\n## What is still unknown\n\n- Whether the order covers open-weight DeepSeek models hosted on US servers. The text does not mention weights; the in-scope reading comes from a security expert quoted by The Register, not from DHS.\n- Whether developed using means a product that calls a DeepSeek model, or also reaches code written with DeepSeek's help. The Register raised this and the order does not define it.\n- Why the order carries an original release date of July 24, 2026, nearly three months before publication. Neither the notice nor the coverage we read explains the gap.\n- The Federal Register notice names Hangzhou DeepSeek Artificial Intelligence Co., Ltd, while the signed order names Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. We read these as the same company, but the documents do not say so.\n- DHS had not answered The Register's request for comment when it published.\n\n## Sources\n\n- [U.S. Department of Homeland Security, \"Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements\" (Federal Register document 2026-21447, published October 20, 2026)](https://public-inspection.federalregister.gov/2026-21447.pdf) — the original report\n- [TechCrunch, \"US orders federal agencies to remove China's DeepSeek AI from their systems\" (Kate Park, October 20, 2026)](https://techcrunch.com/2026/10/20/us-orders-federal-agencies-to-remove-chinas-deepseek-ai-from-their-systems/)\n- [The Register, \"DeepSeek deep-sixed at all US federal civilian agencies\" (October 20, 2026)](https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010)\n- [The Decoder, \"US bans Deepseek technology across federal civilian agencies\" (October 20, 2026)](https://the-decoder.com/us-bans-deepseek-technology-across-federal-civilian-agencies/)\n- [OpenRouter docs, provider routing (ignore and only lists)](https://openrouter.ai/docs/features/provider-routing)\n- [NorForge, \"Inside Cairn\" (October 19, 2026)](https://norforge.com/blog/inside_cairn)\n\n[AI News Report](https://theainewsreport.com/)· every headline, every morning.", "url": "https://wpnews.pro/news/the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in", "canonical_source": "https://theainewsreport.com/2026-10-20-dhs-deepseek-removal-order-explained.html", "published_at": "2026-10-20 14:28:11+00:00", "updated_at": "2026-10-20 14:49:22.972726+00:00", "lang": "en", "topics": ["ai-policy", "artificial-intelligence", "large-language-models"], "entities": ["Department of Homeland Security", "DeepSeek", "Markwayne Mullin", "Russell Vought", "Office of Management and Budget", "CISA", "Federal Acquisition Supply Chain Security Act of 2018", "Exclusion and Removal Order #2026-01"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in", "markdown": "https://wpnews.pro/news/the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in.md", "text": "https://wpnews.pro/news/the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in.txt", "jsonld": "https://wpnews.pro/news/the-dhs-deepseek-removal-order-explained-what-it-covers-the-60-day-window-and-in.jsonld"}}