DHS Orders Federal Civilian Agencies to Remove DeepSeek Technology

What happened

According to the DHS filing submitted October 19 (Federal Register document 2026-21447, docket DHS-2026-0628), the exclusion and removal order targets Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities. It was issued under the Federal Acquisition Supply Chain Security Act of 2018, following a recommendation and supporting-evidence review by the Federal Acquisition Security Council. The document is currently in public inspection, with the official version scheduled for publication on October 20.

The order requires all federal civilian executive branch agencies to immediately stop procuring DeepSeek-related IT products and services and to remove existing DeepSeek products, affiliate products, and "third-party products and services developed using DeepSeek implementations" from their information systems. It does not apply to the Department of Defense or national security systems, and imposes no export controls on the private sector. Agencies could request exceptions in writing within 60 days of issuance, with proposed mitigations, handled by the Cybersecurity and Infrastructure Security Agency (CISA) — a window that had already elapsed before the October 19 public filing, counting from the July 24 signature date.

In the notice, DHS said DeepSeek's models "present multiple threat vectors": use by government employees or vendors "may result in the transfer of sensitive data to the People's Republic of China," could be used to build "actionable intelligence" on U.S. persons or government agencies, and the models "may contain malware or other security vulnerabilities." The notice cited no specific instances of data transfer. The disclosure came just days after DeepSeek released its latest model, V4.1-Flash-1017; last year, two U.S. Congressmembers proposed a bill to ban DeepSeek's chatbot from government devices.

Key facts

1. Order and authority: Exclusion and Removal Order No. 2026-01, signed July 24, 2026 by the DHS secretary under the Federal Acquisition Supply Chain Security Act of 2018, following a Federal Acquisition Security Council recommendation and evidence review.
2. Disclosure timeline: DHS filed the notice for Federal Register public inspection on October 19 (document 2026-21447, docket DHS-2026-0628), with formal publication scheduled for October 20 — nearly three months after the order was signed.
3. Scope: Covers all federal civilian executive branch agencies: no new purchases of DeepSeek or affiliate IT products and services, and removal of existing deployments plus "third-party products and services developed using DeepSeek implementations." Excludes the Department of Defense and national security systems.
4. Exceptions: Agencies could seek written exceptions within 60 days of issuance, with compelling justification and mitigations, via CISA; that window had elapsed before the October 19 public filing.
5. Stated rationale: DHS said DeepSeek models "present multiple threat vectors": use by employees or vendors "may result in the transfer of sensitive data to the People's Republic of China," could build "actionable intelligence" on U.S. persons or agencies, and the models "may contain malware or other security vulnerabilities"; no specific incidents were cited.
6. Timing: The disclosure came just days after DeepSeek released its latest model, V4.1-Flash-1017.