DHS Bans DeepSeek at U.S. Civilian Agencies: What the Order Requires, the Law Behind It, and What It Does (and Doesn't) Cover

The U.S. Department of Homeland Security ordered federal civilian agencies to remove DeepSeek products and not buy them again. The order reached the Federal Register between October 19 and 20, but the letter behind it dates back months. What matters for a business is not the headline but the scope: it includes third-party tools built on those models.

What the Order Says, Exactly

According to CyberScoop, the order covers all IT products and services from parent company Hangzhou DeepSeek Artificial Intelligence and requires agencies to exclude them from future purchases and to remove any version already installed. Other coverage (PYMNTS, Decrypt) says the scope also reaches third-party tools built on its models; the CyberScoop text doesn't spell that out. Agencies can request exceptions, 60 days in advance and with a "compelling justification," for example if they can't perform a critical mission function or for national security reasons. CyberScoop's article mentions neither a removal deadline nor penalties for noncompliance.

The Legal Basis and the Arguments

The order rests on the Federal Acquisition Supply Chain Act, through a review by the Federal Acquisition Security Council. The letter from Homeland Security Secretary Markwayne Mullin argues that data is stored on servers in China, where national security laws allow the government to demand it from local companies; that models hosted by DeepSeek collect personal information and can track usage "fingerprints"; and that the flow of prompts and responses could transfer sensitive data and produce "actionable intelligence" about U.S. people or programs. The letter acknowledges that some of these concerns could also apply to other Chinese and American models.

As interim measures, agencies are "encouraged" to monitor network traffic, strengthen event logging, control exfiltration and flag anomalies, on the assumption that networks may already have been compromised through the tool.

A Date Discrepancy Worth Not Hiding

Sources differ on the date of the original letter (June 26 per CyberScoop; July 24 per other coverage), and CyberScoop notes the ban has been in effect for months. What's new is the formal publication, not necessarily the start. Before this, each agency decided on its own; Commerce and the Navy had already blocked it, as had New York, Tennessee and Virginia.

What It Doesn't Cover

According to CyberScoop, DeepSeek is the only Chinese model named. Other open-weight models such as Moonshot AI's Kimi and Alibaba's Qwen have raised national security concerns or accusations of distilling American models, but they are not in this order. The article contains no response from DeepSeek and no statements from CISA or DHS.

What This Means for a Company That Buys or Integrates AI