DHS Orders Federal Civilian Agencies to Remove DeepSeek

What happened

At 8:45 a.m. Eastern on October 19, the Department of Homeland Security submitted a six-page public-inspection notice to the Federal Register (FR Doc. 2026-21447, docket DHS-2026-0628), disclosing Exclusion and Removal Order No. 2026-01 signed by Secretary Markwayne Mullin on July 24. The notice is scheduled for formal publication on October 20; the order has been in effect since it was signed — nearly three months before it became public.

The order requires all federal civilian executive branch agencies — excluding the Department of Defense and national security systems — to immediately stop procuring IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities, and to remove existing deployments from their information systems, including "third-party products and services developed using DeepSeek implementations." The notice sets no specific removal deadline; agencies are instructed to monitor network traffic, strengthen logging and data-exfiltration controls, and flag anomalous activity until removal is complete.

Agencies could have applied in writing for an exception within 60 days of issuance, with a compelling justification (such as mission impact) and mitigation measures; applications were handled by the FASCSA Order Implementation Team under CISA's Cybersecurity Division. Counted from July 24, that window had already closed before the October 19 publication. Earlier in July, the department had already circulated a memo directing agencies to monitor traffic to and from government websites for DeepSeek-related risks, according to Decrypt.

Key facts

1. Order and signing: Exclusion and Removal Order No. 2026-01, signed by DHS Secretary Markwayne Mullin on July 24, 2026, and copied to the OMB director. Submitted for Federal Register public inspection at 8:45 a.m. Eastern on October 19 (FR Doc. 2026-21447, docket DHS-2026-0628); formal publication set for October 20.
2. Agencies covered: All federal civilian executive branch agencies, "except for their national security systems and secure compartmented information systems" — the order text excludes systems under the Department of War and the Office of the Director of National Intelligence. Engadget cited the EPA and the FCC as examples of agencies in scope.
3. Products in scope: IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated entities ("affiliated" as defined in the Federal Acquisition Regulation), plus "third-party products and services developed using DeepSeek implementations." The order lists no specific products and does not explain how to handle DeepSeek models running on servers of U.S. companies.
4. Procurement exclusion: The ban covers approved product lists and e-marketplace procurement channels, effective immediately; the order also bars the company from federal government contracts (Bloomberg, Engadget).
5. Exception requests: Agencies could apply in writing within 60 days of issuance, with compelling justification and mitigation measures; applications were handled by the FASCSA Order Implementation Team under CISA's Cybersecurity Division. The window had already expired when the order was published.
6. Official threat rationale: The order says DeepSeek's models present "multiple threat vectors": use by employees or vendors "may result in the transfer of sensitive data to the PRC," which "could produce actionable intelligence on U.S. persons and/or government programs," and the models "may contain malware or other security vulnerabilities." Cited grounds include servers located in China, broad government access under Chinese law, PII collection and potential tracking/digital fingerprinting in account generation, and serious vulnerabilities found in DeepSeek's iOS app by open-source security research. The notice lists no documented instance of data transfer.

Background

The Federal Acquisition Supply Chain Security Act was enacted on December 21, 2018 (Pub. L. 115-390), creating the Federal Acquisition Security Council (FASC) and authorizing exclusion and removal orders; the FASC final rule was issued in August 2021, and since December 2023 contractors have been required to check the SAM system for FASC orders the way they check suspension and debarment lists. In public records, the mechanism had been used only once before: on September 15, 2025, the Director of National Intelligence issued an exclusion order against Acronis AG, a Swiss cybersecurity company (GSA delisted its products on September 18). The DeepSeek order is the first issued by DHS and the first directed at a Chinese AI model company.

By contrast, Huawei, ZTE and Hytera were not excluded through FASCSA orders but through Section 889 of the 2019 National Defense Authorization Act: effective August 13, 2019, federal agencies were barred from procuring Huawei and ZTE telecom equipment and Hytera, Hikvision and Dahua video-surveillance equipment, and from August 13, 2020 contractors were restricted from using them. The two are different legal paths.

DeepSeek already faced a string of device- and access-level restrictions across the U.S. government: a U.S. Navy internal email ban on January 24, 2025; the House Chief Administrative Officer barring staff from installing it on issued devices around January 30; a NASA memo on January 31; Texas Governor Greg Abbott's statewide ban on January 31 (the first at state level); the Pentagon blocking it on military networks in January; a Commerce Department internal email broadly prohibiting it in March; and follow-on state orders — New York on February 10, Virginia Executive Order 46 on February 11, Iowa on February 19. On February 6, 2025, Representatives Josh Gottheimer and Darin LaHood introduced H.R. 1121, the "No DeepSeek on Government Devices Act," which has not become law. Allies moved in parallel: Australia's nationwide government-device ban on February 4, Italy's app-store removal in late January, Taiwan's ban in early February, and a South Korean government-device ban. All of these were device- or access-level limits — none addressed whether DeepSeek could sell anything to the government.

The timing is notable: the order was signed on July 24, before DeepSeek released V4.1-Flash-1017 on October 17 — a 763B-parameter MoE model released with open weights under the MIT license on Hugging Face, alongside its own Search and Fetch APIs. The MIT-licensed open weights make the "third-party products" clause the crux of enforcement: the order text never uses the word "weights," and it does not explain how to handle DeepSeek models running on U.S. companies' servers. Reuters also reported that China is considering adding large AI models to its export-control list, and that DeepSeek is training its next-generation model on Chinese chips.

DeepSeek's account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users.

— DHS Secretary Markwayne Mullin, in the July attachment to the order