DHS ordered federal agencies to strip DeepSeek AI from their systems over Chinese data-access fears

The Department of Homeland Security has ordered civilian federal agencies to stop buying DeepSeek products and to pull them from their information systems, citing fears that the Chinese government could reach the company’s infrastructure. The notice appeared in the Federal Register on Oct. 20, 2026, as document 2026-21447, after being filed for public inspection the day before. It targets DeepSeek and the third-party tools built on its technology, and it stops short of any ban on private or consumer use.

AI, explained every day: The Deep View is the go-to daily newsletter for 600,000+ founders, knowledge workers and professionals who want to stay up to date with artificial intelligence.

Get The Deep View →

We may earn a commission if you sign up.

What the DHS order covers

The order has two parts, as the notice sets out in docket DHS-2026-0628, published at 91 FR 66346. The first excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., along with affiliated entities, from the procurements of federal civilian agencies. The second requires the “removal of all DeepSeek and DeepSeek-affiliate products,” and of third-party products and services developed using DeepSeek implementations, from civilian agency IT. The notice is signed by James H. Percival II, DHS general counsel. Anyone checking the wording can read the order in the Federal Register, which is where the department published it.

The authority is the Federal Acquisition Supply Chain Security Act of 2018, which lets the department act on a recommendation from the Federal Acquisition Security Council. DHS says the order followed “review of the Federal Acquisition Security Council Recommendation and affiliated evidence,” and the notice publishes the order itself as an appendix, also available in the public inspection PDF. The notice names the FASCSA Order Implementation Team in the Cybersecurity Division of the Cybersecurity and Infrastructure Security Agency as the contact for implementation.

The affected products are not limited to the DeepSeek app or website. Because the removal requirement reaches “third-party products and services developed using DeepSeek implementations,” an agency that adopted a vendor’s tool built on DeepSeek technology would have to treat it the same way as a direct DeepSeek product, and would need to ask the vendor what is under the hood. The notice describes the covered company as Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and extends the exclusion to its affiliates, using the definition in the federal acquisition rules at 48 CFR 2.101.

BleepingComputer, which reported the order on Oct. 20, adds the operating detail: agencies are to exclude covered products from procurement immediately, including approved-product lists and purchasing marketplaces, and to remove them from agency systems or seek an exception.

The stated worry: Chinese access to DeepSeek infrastructure

BleepingComputer’s report by Bill Toulas says DHS cited concerns about the Chinese government accessing DeepSeek infrastructure, collecting personal information and tracking users, and about government data reaching Chinese authorities. The order also raises concerns about potential malware in DeepSeek models. As BleepingComputer describes it, DHS points to a February 2025 report by the mobile security firm NowSecure on the DeepSeek iOS app, which found unencrypted data transmissions, weak encryption, insecure local storage, user fingerprinting risks and data sharing with ByteDance.

Outside analysts had argued the same point before the order. In a February 2025 commentary, Matt Pearl, Julia Brock and Anoosh Kumar of the Center for Strategic and International Studies wrote that DeepSeek’s terms are governed by the laws of the People’s Republic of China and that its privacy policy stores user data in that country, which they argued would let Beijing reach the data without the legal process a rule-of-law country would require. The CSIS commentary went further than the DHS order does, recommending a formal presidential determination that DeepSeek threatens national security.

The CSIS authors also cited a Cisco study in which DeepSeek failed to block any harmful prompts in its tests, compared with 86 percent for GPT-4o and 64 percent for Gemini. The DHS notice itself, in the text available through the Federal Register, gives no such figures; its stated basis is the council recommendation and evidence behind it.

Exceptions, deadlines and what is left unanswered

The order is not blanket. Agencies that cannot comply can submit exception requests within 60 days of the order’s issuance, explaining their justification and the risk mitigations they would apply, and CISA will review each request and issue a written approval or denial. Agencies that cannot comply because of internal capability limits can get technical assistance from CISA. Those exception details come from BleepingComputer’s account, because the Federal Register’s text rendering does not state the exceptions process or deadlines.

The reach is limited to federal civilian agencies within the department’s authority. BleepingComputer reports that the order is not a general ban on private or consumer use, so a person who downloaded the DeepSeek app on a personal phone is outside its scope.

Several points remain unclear from the records reviewed. The Federal Register notice does not state the date the order was signed, and it does not name a Secretary-level signatory in the text available. NowSecure’s report is cited as reported by BleepingComputer rather than read directly. What is on the record is narrower than the sweeping phrase “strip DeepSeek from the government” suggests: a procurement exclusion, a removal requirement and a short window for waivers, all administered through DHS and CISA.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

AI, explained every day: Get The Deep View →

We may earn a commission if you sign up.