DHS Orders DeepSeek Removed From Every Federal Civilian Agency

The U.S. government has moved from piecemeal bans to a blanket prohibition on DeepSeek. The Department of Homeland Security has ordered federal civilian agencies to remove the Chinese lab's AI products from their systems and to stop buying anything from the company or its affiliates. The notice was filed for public inspection on October 19 and published in the Federal Register on October 20.

It is the most sweeping federal action yet against a Chinese AI developer, and it uses a legal tool that until now had barely been tested.

What the order requires

Homeland Security Secretary Markwayne Mullin issued the order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), following a recommendation from the Federal Acquisition Security Council. It names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 model families. In practice, it does three things:

• Removal: agencies must take DeepSeek products off their networks, along with third-party products or services built on DeepSeek. ExecutiveGov reports this applies immediately unless an exception is granted.
• Exclusion: DeepSeek and its affiliates are barred from every acquisition channel, including approved product lists and online marketplaces.
• Contractors: companies whose federal contracts carry FAR clause 52.204-30 cannot use covered DeepSeek products to perform that work without a waiver, and must report any they find within three business days.

The order covers federal civilian executive branch agencies. It does not extend to national security systems, which fall under the Defense Secretary and the Director of National Intelligence, and it places no restrictions on private companies or the public.

The reasons DHS gave

The Federal Register notice itself does not explain the decision, but DHS spelled out its concerns in supporting material. According to CyberScoop, the department pointed to DeepSeek storing data on servers in China, where national security laws allow the government to demand information from domestic companies. It also flagged the collection of personally identifiable information and the risk that prompts and responses could channel sensitive data to Chinese authorities.

Mullin described the models as posing multiple threat vectors to civilian IT systems. ExecutiveGov added that DHS cited research finding critical vulnerabilities in DeepSeek's iOS app, and Engadget reported the department warned the models could contain malware or other security flaws.

A quiet order made public months later

One of the stranger details is the timing. The order was signed over the summer; The Hacker News puts the date at July 24, roughly 87 days before it was filed for public inspection. That gap creates an odd wrinkle: exception requests are due within 60 days of issuance, a window that by ExecutiveGov's reckoning closed before the public ever saw the order.

Agencies that want an exception must submit a written request with a compelling justification, such as harm to a mission-critical function, plus alternative steps to reduce risk. CISA will review each request. While removal proceeds, agencies are encouraged, though not required, to monitor network traffic, tighten logging and watch for data exfiltration. DHS has committed to reviewing the order within a year and annually after that.

How we got here

DeepSeek has been a target in Washington since its models jolted the industry in early 2025. Until now, restrictions came agency by agency. By February 2025, Congress, NASA, the Navy, the Pentagon and Texas had all barred the app from government devices, while bills to make that a federal rule stalled in committee, The Hacker News notes.

FASCSA itself has seen little use. Its first deployment came in 2025, when the Director of National Intelligence excluded Swiss firm Acronis from intelligence community procurement. Applying it to a frontier AI developer marks a significant expansion.

CyberScoop also places the order in the context of accusations by U.S. AI labs and the federal government that DeepSeek systematically distilled American models. DeepSeek is the only Chinese AI company named, even though other open-weight models from China, such as Moonshot AI's Kimi and Alibaba's Qwen, have drawn similar scrutiny. The announcement landed days after DeepSeek shipped its latest model, V4.1-Flash-1017.

Reaction and what comes next

China pushed back. Foreign ministry spokesperson Mao Ning said Beijing opposes stretching the concept of national security and will protect the rights of Chinese companies, according to The Hacker News. DeepSeek did not immediately comment.

Several practical questions remain open. The order does not define what counts as a product developed using DeepSeek, which matters because DeepSeek's openly licensed weights have been folded into countless downstream tools. Agencies and contractors will need to audit not just obvious DeepSeek apps but the models running inside vendors' software.

For the AI industry, the message is clear: model provenance is becoming a procurement issue. Vendors selling to the federal government should expect more questions about which base models sit under their products, and whether any of them now carry a FASCSA flag.