Key points
- DeepSeek restrictions extend to third-party products
- DHS's signed DeepSeek order predates publication by months
- Which federal systems DHS's DeepSeek order excludes
The Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their computer systems, including third-party products and services developed using DeepSeek. The order was published in the Federal Register on Oct. 20, though the signed copy lists an original release date of July 24.
Homeland Security Secretary Markwayne Mullin issued the order under the Federal Acquisition Supply Chain Security Act of 2018 after reviewing a recommendation from the Federal Acquisition Security Council, according to the notice. The notice doesn't explain the gap between the July date and this week's publication. The signed order is also posted in the DHS docket.
The order covers products built with DeepSeek
Agencies must drop DeepSeek and its affiliates from their purchasing, effective immediately after the order's issuance. That includes agency-approved product lists, service provider equipment lists, and e-commerce markets, the order says.
Agencies must also remove products from DeepSeek, its affiliates, and "third-party products and services developed using DeepSeek implementations" from their IT systems. A footnote says this includes third-party implementations of DeepSeek used to provide products and services to civilian agencies. The order names no third-party companies.
The order was published the same day DeepSeek released DeepInfer, software that lets outside companies run its V4.1 Flash model on their own servers.
DHS says DeepSeek's models present "multiple threat vectors"
The order describes DeepSeek as a privately owned company in China that offers AI applications "available widely and free of charge." The company's servers are located in China, and Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure," the order says.
For models DeepSeek hosts itself, the account sign-up process "collects personally identifiable information (PII) and may also track and digitally fingerprint users," according to the order. DHS also said DeepSeek's most widely used applications work through a prompt-and-response process that "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors."
"The models themselves may contain malware or other security vulnerabilities," the order says. The order also cites a February 2025 report from security firm NowSecure that found multiple critical vulnerabilities in DeepSeek's iOS app.
Defense and intelligence systems fall outside the order
The order applies to federal civilian executive branch agencies. It excludes their national security systems and secure compartmented information systems, which fall under the Defense Department and the Director of National Intelligence. The order doesn't impose a general ban on private or personal use.
Agencies can request an exception, including more time to comply, by submitting a written request with a "compelling justification" within 60 days of issuance. The notice doesn't clarify how that deadline relates to the July 24 date and the October publication. The Cybersecurity and Infrastructure Security Agency reviews the requests.
Until DeepSeek products are fully removed, agencies are encouraged to monitor traffic in and out of their systems, add logging, and flag unusual activity. DHS must review the order within one year and every year after that.
Before the order, individual agencies decided for themselves whether to block DeepSeek, CyberScoop reported. DeepSeek is the only Chinese AI developer named in the order.
