DHS Orders Sweeping DeepSeek Ban Across Federal Civilian Agencies
Homeland Security Secretary Markwayne Mullin cites data espionage and malware risks in an order removing DeepSeek models and tools from civilian systems.
In short
- DHS Exclusion and Removal Order #2026-01 bars federal civilian agencies from purchasing DeepSeek products and mandates removing existing deployments.
- The directive explicitly extends to third-party software and enterprise tools developed using DeepSeek implementations.
- Homeland Security Secretary Markwayne Mullin cited Chinese national security laws, account fingerprinting, data leakage, and potential malware as key risks.
- The 60-day window for agencies to submit exception requests to CISA had already elapsed when the order was published in October 2026.
The United States Department of Homeland Security has enacted a sweeping DeepSeek ban across federal civilian agencies, prohibiting the procurement of products from the Chinese artificial intelligence developer and ordering the immediate removal of its models from government networks. Detailed in a regulatory filing published for inspection ahead of its formal appearance in the Federal Register, the directive marks the US government's broadest move yet against a Chinese AI lab. The mandate requires civilian departments to strip out not only standalone tools from Hangzhou DeepSeek Artificial Intelligence, but also any third-party commercial software built on the firm's open-weight implementations.
According to reporting by Engadget, DHS framed the models as a national security hazard capable of facilitating the transfer of sensitive government personnel and contractor data to Chinese authorities. The order applies across civilian executive branch entities, such as the Environmental Protection Agency, the Federal Communications Commission, and the Department of State, while formally excluding national security systems and secure compartmented information systems managed under the Department of Defense and the Director of National Intelligence.
Scope of the DeepSeek Ban and Third-Party Implementations
The formal directive, issued under the Federal Acquisition Supply Chain Security Act and designated Exclusion and Removal Order #2026-01, carries two immediate operational mandates. First, agencies must instantly bar Hangzhou DeepSeek Artificial Intelligence, its corporate affiliates, and all related products from federal purchasing pipelines, encompassing agency-approved vendor lists and e-commerce procurement portals. Second, agencies must eliminate all existing DeepSeek applications and third-party tools that integrate DeepSeek technology from their active IT infrastructure.
As reported by MadRobot, the requirement targeting downstream integrations creates a significant audit burden for commercial software providers. Because DeepSeek provides open-weight releases that software engineers frequently embed into proprietary enterprise products, government contractors will now have to inspect internal dependencies. The order does not say how agencies should treat a DeepSeek model running on a US company's servers, leaving enterprise vendors to verify that no underlying components originate from the Hangzhou-based developer.
Security Vulnerabilities and Data Transfer Risks
Homeland Security Secretary Markwayne Mullin signed the underlying order on July 24, 2026, though it remained out of public view until its October release under Federal Register docket DHS-2026-0628. In an accompanying memorandum reviewed by CyberScoop, Mullin outlined several "multiple threat vectors" associated with the laboratory's architecture. Chief among them is the legal jurisdiction governing the company: DeepSeek maintains servers in China, where national intelligence and cyber statutes grant authorities wide leeway to compel private companies to turn over digital records.
Mullin also highlighted risks stemming from DeepSeek's operational mechanisms. The company's account registration system gathers personally identifiable information and may trace user digital fingerprints. Furthermore, DHS warned that the conversational prompt-and-response framework inherent to large language models creates an ongoing channel through which federal staff or technical contractors could inadvertently submit non-public information. When aggregated with publicly available datasets, DHS argued that such inputs could generate actionable intelligence regarding American personnel or operational initiatives.
Beyond privacy concerns, federal officials warned that DeepSeek software might conceal malware or underlying technical defects. As detailed by MadRobot, the order referenced a February 2025 security audit conducted by NowSecure, which uncovered multiple critical security flaws within DeepSeek's iOS mobile application.
Supply Chain Deadlines and Exception Protocols
The mandate establishes a mechanism for agencies to request administrative waivers. Agencies seeking an exemption must submit a formal written application demonstrating a compelling justification, such as an inability to execute mission-critical operations or distinct national security considerations. Waiver evaluations are handled directly by the Cybersecurity and Infrastructure Security Agency.
However, regulatory documents reveal that the 60-day window to file exception requests was pegged to the original signing date of July 24, 2026. As noted by RuntimeWire, that designated filing timeframe expired weeks before the public and affected vendors were alerted to the order on October 19. Agencies that have not yet purged the software have been instructed by DHS to implement interim defensive safeguards, including elevated logging protocols, tight data exfiltration filters, and real-time network monitoring to catch anomalous server traffic.
Preceding Bans and International Scrutiny
The federal exclusion solidifies an ongoing series of restrictions targeting DeepSeek across public institutions. The lab initially drew intense scrutiny in early 2025 following the release of its low-cost reasoning model, R1, which delivered high-end benchmark performances at lower expenditure than Western alternatives, sparking sharp financial market reactions. Shortly after R1 appeared, the U.S. Navy and the Department of Commerce advised personnel against deploying the tool, and individual states including New York, Tennessee, and Virginia instituted device prohibitions.
Allied governments have adopted similar postures over the past two years. Italy's data protection regulator blocked access to the DeepSeek application in early 2025, while Australia, South Korea, and Taiwan barred the software from official government hardware. Washington officials have also scrutinized the company's research methods. Last month, a joint advisory from the Federal Bureau of Investigation, the National Security Agency, and CISA accused Chinese AI developers, explicitly naming DeepSeek, of using model distillation campaigns to replicate the outputs of proprietary American models, an activity Treasury Secretary Scott Bessent characterized as intellectual property theft.
Implications for Federal IT Vendors
The enforcement action arrives immediately after DeepSeek released its latest model iteration, V4.1-Flash-1017, which the firm claimed improved coding performance and operational efficiency. Concurrently, authorities in Beijing have pursued tighter domestic oversight, proposing export controls on domestic frontier models while Chinese AI developers transition training operations toward domestic silicon.
For commercial technology companies doing business with the United States government, the DHS directive fundamentally shifts procurement verification. Federal contractors can no longer rely purely on vendor brand names; they must audit full software supply chains to ensure no components rely on DeepSeek code or model weights. As civilian departments move to enforce the exclusion, government IT vendors face mandatory transparency requirements that could influence how open-weight AI assets are managed across commercial public-sector contracts.
Questions people ask
Which agencies must comply with the DHS DeepSeek ban?
The order applies to all federal civilian executive branch agencies and their IT systems, such as the EPA, the FCC, and the State Department. It does not apply to military and intelligence systems managed by the Pentagon or the Director of National Intelligence.
Does the order affect third-party software built on DeepSeek models?
Yes. The order explicitly requires civilian agencies to remove third-party products and commercial services developed using DeepSeek implementations, even if sold under a different company's brand name.
What specific security concerns did Homeland Security cite?
DHS cited servers based in China subject to Chinese security laws, user digital fingerprinting and personal data collection during registration, risks of sensitive data exfiltration via user prompts, and security vulnerabilities identified in audits of DeepSeek's mobile app.
Can federal civilian agencies apply for an exemption?
Agencies can apply for exceptions through CISA by showing a compelling justification, such as an impact on mission-critical work. However, the order's stated 60-day request window from its July 24 signing date had already elapsed when the directive was published in October 2026.
Sources
- Homeland Security Bans DeepSeek Use In Federal Civilian AgenciesEngadget, Oct 19, 2026
- Trump Admin Bans DeepSeek From Federal Agenciesgizmodo.com, Oct 19, 2026
- The US is ordering every civilian agency to rip out DeepSeek, even tools built on itMadRobot, Oct 19, 2026
- DHS to ban DeepSeek from federal civilian agenciesCyberScoop, Oct 19, 2026
- DHS bars DeepSeek-powered products from federal civilian IT systemsRuntimeWire, Oct 19, 2026
How this story was made: the newsroom picked it up from Techmeme, Google News and Reddit, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (52 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published October 20, 2026 at 00:14 UTC
