Closed grey laptops with coiled power cords, each with a blank paper tag, lie in rows on a folding table in a beige office beside grey plastic bins, as a person in a dark cardigan, seen from behind, holds a clipboard.

Security

Homeland Security Orders DeepSeek Off Federal Civilian Systems

A Homeland Security order with a July 24 release date, published Tuesday, bars civilian agencies from buying DeepSeek and orders it, and products built on it, removed.

WASHINGTON, Oct. 20 — The Department of Homeland Security has ordered federal civilian agencies to stop buying from DeepSeek, the Chinese artificial-intelligence company, and to remove its products from their systems, along with any product another company has built using DeepSeek’s technology. The order, signed by Markwayne Mullin, the homeland security secretary, was published in Tuesday’s Federal Register. It gives July 24 as its original release date; the notice does not explain the gap.

The reach is the point. Agencies must take out “third-party products and services developed using DeepSeek implementations,” and DeepSeek gives its models away, posting them for anyone to download.Open WeightsDeepSeek posts its models on Hugging Face. The card for one, DeepSeek-V4.1-Flash, says: “This repository and the model weights are licensed under the MIT License.”

The burden reaches the companies that sell to the government. Contractors whose agreements carry the standard clause on such orders, FAR 52.204-30, must check for new orders at least every three months, look into whether they have supplied or used an affected product and, if so, report it within three business days. For rival model makers, the order bars from agencies’ approved product lists a competitor whose applications, it notes, are “available widely and free of charge.”

The order’s case is about where data goes. DeepSeek’s servers are in China, it says, and “the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure.” Its most widely used applications work by prompt and response, the order says, a process that “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.” “The models themselves may contain malware or other security vulnerabilities,” it adds.

The published order’s footnotes cite public sources, among them DeepSeek’s privacy policy, an April 2025 report by the House select committee on the Chinese Communist Party and NowSecure’s February 2025 research, which the order says found “multiple critical vulnerabilities” in DeepSeek’s iOS app. The notice says the secretary acted after reviewing the Federal Acquisition Security Council’s recommendation “and affiliated evidence,” which it does not include.

The order spares agencies’ national security systems and sensitive compartmented information systems, which fall to the defense secretary and the director of national intelligence.The LawThe Federal Acquisition Supply Chain Security Act of 2018 lets the homeland security secretary exclude or remove risky technology from civilian agencies; the defense secretary and the intelligence director issue their own orders. The first public order under it, against Acronis AG, came from the intelligence director’s office in September 2025, according to the law firm Covington & Burling. The exclusion took effect “immediately after issuance.” An agency that wanted to keep a DeepSeek product had to ask in writing within 60 days of the order’s issuance, with a “compelling justification”; CISA, the department’s cybersecurity agency, approves or disapproves. If the order was issued on its July 24 release date, that window closed on Sept. 22.

The order arrives in a week of moves on AI by both governments. On Monday the State Department sanctioned five entities connected to Linwei Ding, a Chinese national whom a federal jury convicted in January of stealing Google’s trade secrets “related to super intelligence (SI) technology.” On Oct. 16 China’s commerce and science ministries proposed adding 23 artificial-intelligence technologies, related to large models, agents, computing clusters and information processing, to the catalogue of technologies whose export China prohibits or restricts, and told exporters to register before exporting them in the meantime. The draft leaves out technology already in the public domain through open-source release or academic papers.

Comments on Beijing’s draft are due by Nov. 15. In Washington, the secretary must review the order within a year and every year after. What the notice leaves out is the count: how many agencies were running DeepSeek or products built on it, and how many exceptions, if any, CISA granted.

Sources

  1. U.S. Department of Homeland Security (Federal Register), “Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements, 91 FR 66346 (Docket No. DHS-2026-0628),” Oct. 20, 2026.
  2. U.S. Department of Homeland Security (via GovInfo), “Exclusion and Removal Order #2026-01, the signed order, printed as the notice’s appendix, 91 FR 66347–66350,” Oct. 20, 2026.
  3. Acquisition.gov, “FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.”
  4. DeepSeek, on Hugging Face, “DeepSeek-V4.1-Flash model card.”
  5. U.S. Department of State, “Imposing Sanctions to Protect Americans from Intellectual Property Theft,” Oct. 19, 2026.
  6. China’s Ministry of Commerce and Ministry of Science and Technology, “Announcement No. 48 of 2026: draft revision of the Catalogue of Technologies Prohibited and Restricted from Export, with interim registration (in Chinese),” Oct. 16, 2026.
  7. Covington & Burling, Inside Government Contracts, “First Order Issued under the Federal Acquisition Supply Chain Security Act, Triggering Immediate Requirements on Contractors,” Sept. 29, 2025.