The US Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their IT systems and barred them from buying DeepSeek or any third-party service built on the Chinese company’s models, in a notice published on Monday, October 19. The order, titled “Exclusion and Removal of DeepSeek Products from Federal Civilian Executive Branch Information Technology Systems and Procurements,” was filed at the Federal Register on Monday morning for official publication on October 20, and its removal and purchasing bans take effect immediately.
DeepSeek is the Hangzhou-based lab whose open-weight models upended the AI market in early 2025 by matching frontier performance at a fraction of the expected cost — the story told in our explainer on what DeepSeek is. Monday’s order makes it the first AI model company to be formally excluded from the civilian side of the US federal government by name.
What The DHS Order Requires: Removal And A Buying Ban
The order works in two directions at once. First, agencies must remove DeepSeek products, products from DeepSeek affiliates, and “third-party products and services developed using DeepSeek implementations” from their IT systems. Second, they must exclude Hangzhou DeepSeek Artificial Intelligence, its affiliates and their products from purchasing effective immediately — including agency-approved product lists, e-commerce marketplaces and similar buying channels.
The third-party clause is the wide one. Because DeepSeek releases its models as open weights, its technology turns up inside other companies’ tools as well as in DeepSeek’s own app and API. The order does not publish a list of affected third-party products, and it does not say how agencies should treat a DeepSeek model hosted on a US company’s servers — a question agencies will have to inventory their way through, since finding embedded models is a prerequisite for removing them.
The order’s scope has one explicit boundary: it applies to federal civilian executive branch agencies except for their national security systems and secure compartmented information systems, which sit under the Pentagon and the Director of National Intelligence. It is issued under the Federal Acquisition Supply Chain Security Act of 2018, and it stops short of placing DeepSeek on the Commerce Department’s Entity List or adding export controls.
The Stated Risk: Data To China, Intelligence On US Persons, Malware
DHS said DeepSeek models pose “multiple threat vectors.” In the reporting of the notice, the department warned that use of the product “may result in the transfer of sensitive data to the PRC if used by US government employees or vendors,” that agency use “could produce actionable intelligence on US persons and/or government agencies,” and that “the models themselves may contain malware or other security vulnerabilities.”
The order did not arrive without a trail. In a July memo made public on Monday, DHS had already told federal agencies to monitor flows of traffic in and out of government websites to address potential risks from DeepSeek. Individual agencies moved earlier still: the Department of Commerce and the Navy had already banned DeepSeek on government devices, and several states — including New York, Tennessee and Virginia — had taken similar steps for state systems. Monday’s order converts those patchwork bans into a single civilian-government rule.
The timing sits days after DeepSeek’s latest product move — the V4.1-Flash update and search API covered in our report on DeepSeek’s V4.1-Flash-1017 release — and in the same week Washington is widening its technology restrictions on China, with the FCC set to vote on October 29 on barring Chinese labs from testing electronic devices for the US market.
Why It Matters
The central entity is DeepSeek, and the attribute that changed is its legal status inside the US government: from a popular open model that agencies handled case by case to a named exclusion in federal procurement law. Its neighbours are every vendor whose product embeds a DeepSeek model — for them the order creates an immediate disclosure and inventory problem, because a tool built on DeepSeek weights is now as unwelcome on a civilian network as DeepSeek itself. For rival model providers, the civilian federal market just lost a low-cost competitor by rule rather than by benchmark. And for the open-weight debate, this is the sharpest test yet of the argument that open models cannot be un-shipped: the US government is not trying to recall the weights, only to keep them — and anything built on them — off its own systems, a distinction that will decide how much of the order is enforceable in practice. The move also mirrors, from the opposite direction, the controls covered in our report on China’s proposed export controls on 23 AI technologies: both governments are now writing model-level restrictions into procurement and trade rules.
Background
DeepSeek, founded in Hangzhou in 2023 as an offshoot of the High-Flyer quant fund, became a household name in January 2025 when its R1 reasoning model matched leading US systems at strikingly low reported training cost, briefly knocking trillions in combined value off US tech stocks. Its open-weight release strategy made its models the default base for thousands of derivative products worldwide — the same openness that now complicates Washington’s attempt to keep DeepSeek technology out of federal systems, eighteen months of state and agency bans having culminated in Monday’s government-wide civilian order.
Source: Reuters; Channel NewsAsia
0 Comments