Skip to content
AI Security Wire

Published

- 4 min read

By

DHS Orders Federal Civilian Agencies to Remove DeepSeek Products

DeepSeek DHS FASCSA federal procurement AI supply chain policy
img of DHS Orders Federal Civilian Agencies to Remove DeepSeek Products

The Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and to pull them from their systems. The notice (document 2026-21447, 91 FR 66346) was filed for public inspection on October 19, 2026 and published in the Federal Register on October 20. The order it announces, Exclusion and Removal Order #2026-01, carries an original release date of July 24, 2026.

What the order says

Per the Federal Register notice and BleepingComputer’s summary, the order covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd, its affiliates, and third-party products and services built with DeepSeek technology. Agencies must immediately exclude those products from procurement, including approved-product lists and purchasing marketplaces, and immediately remove them from agency IT systems or seek an exception.

Exception requests are due within 60 days of the order’s issuance, with justification and proposed risk mitigations. CISA reviews them and issues written approvals or denials. Per the order, CISA may provide technical assistance to agencies that cannot comply for capability reasons (BleepingComputer writes “will”).

The notice cites the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328) and implementing regulations at 41 CFR 201-1, following a Federal Acquisition Security Council recommendation. The order is signed by Homeland Security Secretary Markwayne Mullin. It applies to civilian executive branch agencies except for their national security systems and sensitive compartmented information systems. GovInfoSecurity adds, and the order does not say, that such orders can reach prime contractors and subcontractors because a 2023 FAR update requires contractors to follow them. That point is single-source.

Why DHS says it did it

BleepingComputer lists concerns about the Chinese government accessing DeepSeek infrastructure, collecting personal information, tracking users and potentially moving sensitive government data to China, plus possible malware in the models. It also cites a February 2025 NowSecure report on the DeepSeek iOS app.

The order says the models present “multiple threat vectors”, that their use “could produce actionable intelligence on U.S. persons and/or government programs”, and that “The models themselves may contain malware or other security vulnerabilities.” As of October 23, 2026 we found no evidence of malware in the models in the order, BleepingComputer, GovInfoSecurity or TFTC. The order says only that they “may contain” it. We did not check the sources it cites.

Dates and scope

The timeline is awkward. The order’s release date is July 24, 2026, and it went public 87 days later (our arithmetic). It sets exception requests at 60 days from “the issuance of this order” without defining issuance. Counting from the release date, day 60 fell on September 22. Our inference is that the exception window appears to have closed before the public saw the order. TFTC and a Cloud Security Alliance note say the same. We have not seen DHS explain how it treats the window.

On scope, the order applies to civilian agencies except national security systems and sensitive compartmented information systems. A footnote ties the Secretary’s authority to the extent it is not covered by the Secretary of Defense and the Director of National Intelligence, which matches TFTC’s statement that the order does not cover the Department of Defense.

GovInfoSecurity adds that a targeted company has 60 days after notice to challenge an order in the D.C. Circuit, and that agencies including the Navy and NASA had already blocked DeepSeek’s chatbot on their own. Both points are single-source, from a summary of the page, and we did not check the statute.

What it means for defenders

Our assessment: the hard part is not the chatbot. It is finding where DeepSeek weights or APIs sit inside other products. The scope covers third-party tools developed using DeepSeek implementations, so an agency, or a contractor serving one, needs a software and model inventory that goes beyond the DeepSeek app. If you supply civilian agencies, check your own stack for DeepSeek-derived models and hosted endpoints, and ask your vendors the same question.

The order encourages agencies, before full removal, to monitor traffic in and out of the agency and add logging and controls on data exfiltration. That is sensible but generic. In our view egress monitoring will not tell you whether a fine-tuned open-weight model inside a vendor product descends from DeepSeek, and whether the order reaches such derivatives is an open question, so model provenance is the gap to close.

BleepingComputer, quoting the notice, says this is not a general ban on private or consumer use. Contractors serving agencies may still be reached indirectly.

References

Frequently Asked Questions

Does the DHS DeepSeek order ban private or consumer use?
No. BleepingComputer, quoting the notice, says the order is not a general ban on private or consumer use. It applies to federal civilian agencies within DHS's authority, and reportedly can reach contractors who supply those agencies.
Does it cover software built on DeepSeek models?
Yes, in part. The notice covers third-party products and services developed using DeepSeek implementations. GovInfoSecurity reads that as likely including tools built on DeepSeek's open-weight models. That is its reading: the order does not say whether derivative or fine-tuned models count.
When was the order dated?
The order, Exclusion and Removal Order #2026-01, carries an original release date of July 24, 2026 over Secretary Markwayne Mullin's signature block. The notice was filed on October 19, 2026 and published in the Federal Register on October 20.