DHS orders removal of DeepSeek products from US federal civilian agencies

The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop procuring and remove products from Chinese artificial intelligence company DeepSeek, BleepingComputer reported. The "Notice of Order Regarding Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Agencies" appeared for public inspection in the Federal Register on October 19 and was formally published on October 20, extending the restrictions to products from DeepSeek's affiliates and to third-party services built with its technology.

What happened

According to BleepingComputer, the order applies to federal civilian executive branch agencies under DHS authority. It requires them to immediately exclude covered products from procurement channels, including approved-product lists and purchasing marketplaces, and to remove them from agency IT systems.

Agencies that believe they need to keep using a covered product must request an exception within 60 days of the order's issuance, providing a justification and proposed risk mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) will review those requests and issue written approvals or denials. Agencies that lack the internal capability to comply can receive technical assistance from CISA, the report said.

BleepingComputer stresses that the order is not a general ban on private or consumer use of DeepSeek.

Why it matters

The order cites concern that the Chinese government could access DeepSeek infrastructure, collect personal information and track users, as well as the risk that sensitive government data could be transferred to China. It also raises the possibility of malware in DeepSeek models, according to BleepingComputer.

As part of the rationale, the order points to a February 2025 NowSecure assessment of DeepSeek's iOS app, which reported unencrypted data transmissions, weak encryption, insecure local storage, user fingerprinting risks and data sharing with ByteDance, the publication said.

The scope is notable because it reaches beyond DeepSeek's own apps. Covering third-party products built with DeepSeek technology means agencies will have to examine software and services that integrate or are based on DeepSeek models, not only the company's chatbot and API.

DeepSeek's tools gained rapid popularity, followed by reports of security risks and concerns over Chinese authorities' access to user conversations. BleepingComputer also noted earlier action in Germany, where authorities asked Google and Apple to remove the DeepSeek app from their stores.

What to do

• US federal civilian agencies should inventory direct and indirect use of DeepSeek, including third-party tools built on its models, and plan removal or prepare exception requests within the 60-day window.
• Contractors and software suppliers to federal agencies should check whether their products embed DeepSeek technology, as these may fall under the procurement exclusion.
• Organizations elsewhere can use the order's stated risks as input for their own AI supplier and data-sovereignty assessments.