The Pulse
DHS Orders DeepSeek Removed From Federal Civilian IT
The Department of Homeland Security has ordered federal civilian agencies to exclude DeepSeek products from procurement and remove them from agency IT systems. The directive also covers third-party products and services developed using Deep
AI.info Team · Written with AI · fact-checked ·
“DeepSeek’s models present multiple threat vectors.”
Markwayne Mullin, Secretary of Homeland Security, in the signed order
A July order surfaces in October
The Department of Homeland Security has ordered federal civilian agencies to stop procuring DeepSeek products and remove them from agency IT systems. The order also covers products and services from third parties that use DeepSeek implementations, extending the removal requirement beyond the company’s own applications.
DHS filed public notice of the order on October 19, 2026; the Federal Register scheduled it for publication the following day. The notice says the underlying order, signed by Homeland Security Secretary Markwayne Mullin, carries an original release date of July 24, 2026. DHS says the decision followed review of a recommendation from the Federal Acquisition Security Council and related evidence.
The order invokes the Federal Acquisition Supply Chain Security Act of 2018 and its implementing regulations. Its scope is federal civilian executive-branch agencies, except for their national security systems and secure compartmented information systems. It does not announce a general ban on DeepSeek use outside federal civilian procurement and agency IT.
Removal reaches third-party products
Agencies must exclude DeepSeek, affiliated entities and their products from civilian procurement, including approved product lists, service-provider equipment lists and online marketplaces used to acquire IT. The order defines an affiliate through direct or indirect control, including a third party that controls or is controlled by DeepSeek.
Agencies must also remove products supplied by DeepSeek or its affiliates, as well as third-party products and services developed using DeepSeek implementations. The order directs agencies to act immediately after issuance or seek an exception. It does not set a separate, later deadline for completing removal.
Executive agencies may ask DHS for an exception, including one allowing a delay or limiting the order’s application. Requests must be in writing within 60 days of issuance and explain the requested exception, identify the affected product or service, justify the request and describe alternative steps to reduce risk. DHS says CISA will review requests and provide written approval or denial.
DHS cites data exposure and software flaws
The order’s risk discussion says DeepSeek servers are located in China and cites concerns about Chinese government access to private-company infrastructure. It says account creation for hosted DeepSeek services collects personally identifiable information and may track or digitally fingerprint users. DHS warns that prompts could result in sensitive information reaching China when government employees or vendors use those services.
The department also argues that information sent to China, combined with publicly available data, could produce actionable intelligence about U.S. people or government programs. Separately, the order says DeepSeek models may contain malware or other security vulnerabilities and cites security research that found multiple critical flaws in the company’s iOS app. Those are DHS’s stated risk assessments; the order does not describe a breach of federal systems.
Agencies urged to watch traffic during removal
While agencies remove covered products, DHS encourages them to monitor traffic into and out of their systems, strengthen logging and controls against data exfiltration, and flag unusual activity. CISA may provide technical help to agencies that lack the internal capacity to comply.
The Secretary of Homeland Security must review the order within one year and annually after that, under the text. Its immediate effect is a federal procurement exclusion paired with a broader system-removal directive: agencies are told to remove not only DeepSeek products, but also third-party tools built using its implementations.