Washington orders DeepSeek out of civilian agencies

The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek products and to remove them from their IT systems, according to a notice in the Federal Register on Tuesday, 20 October. The signed order, attached to the notice, is dated 24 July 2026. DeepSeek is the Hangzhou-based AI developer whose R1 reasoning model unsettled markets in January 2025.

The order, "Exclusion and Removal Order #2026-01", is signed by the Secretary of Homeland Security, Markwayne Mullin. It is made under the Federal Acquisition Supply Chain Security Act of 2018, a law that lets the secretary bar risky technology from civilian agencies on the recommendation of the Federal Acquisition Security Council, an interagency body. The notice says the secretary acted "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence". It does not explain why publication came almost three months after the order was released.

The order has two parts. Agencies must exclude DeepSeek, its affiliates and their products from procurement, "effective immediately after issuance of this Order", including approved-product lists and e-commerce marketplaces. And they must remove products from DeepSeek, its affiliates, and "third-party products and services developed using DeepSeek implementations" from their systems immediately, or seek an exception. Until removal is complete, agencies are encouraged to monitor traffic, step up logging and controls on data leaving their networks, and flag anomalous activity.

Exceptions must be requested in writing "within 60 days of the issuance of this order", with a justification and any mitigations, and the Cybersecurity and Infrastructure Security Agency (CISA) will approve or refuse them. By our arithmetic, 60 days from 24 July was 22 September. The notice does not say whether agencies get a new window from Tuesday's publication. CISA may also give technical help to agencies that cannot comply on their own, and the secretary must review the order within a year and every year after.

The order states its reasons briefly. It says DeepSeek's servers are in China, where "the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure"; that its account sign-up collects personal information and may track and fingerprint users; and that prompts from US government employees or vendors could send sensitive data to China. "The models themselves may contain malware or other security vulnerabilities," it adds, citing a February 2025 NowSecure report that found critical flaws in DeepSeek's iOS app.

The reach is limited. The order applies to federal civilian agencies "except for their national security systems and secure compartmented information systems", which fall to the Pentagon and the Director of National Intelligence. BleepingComputer noted that it "is not a general ban on private or consumer use". TechCrunch said it extends to civilian agencies restrictions that a law passed in December 2025 placed on DeepSeek in intelligence agencies' national-security systems. Neither report carried a statement from DeepSeek.

Beijing objected. Foreign Ministry spokesperson Mao Ning said China opposes "overstretching the concept of national security and politicizing technology and trade issues", according to TechCrunch, and added: "We will resolutely safeguard the legitimate rights and interests of Chinese enterprises." China is tightening its own controls: Komposite reported last week that Beijing proposed adding 40 technologies, 23 of them in AI, to its export-control catalogue.

The order lands in a wider dispute over Chinese labs. TechCrunch cited a September report accusing DeepSeek and five other Chinese AI companies, including Alibaba and Moonshot AI, of large-scale distillation, training on the outputs of US systems. It said OpenAI told US lawmakers it had seen suspected DeepSeek distillation attempts and that Anthropic said it had found unauthorised attempts by DeepSeek and other Chinese labs to collect outputs from Claude. Those are the companies' claims; DeepSeek has not responded in the reports we read.

The clause with the widest effect is the one on third-party products. A vendor that sells agencies software built on DeepSeek's open-weight models now falls inside the order, and the notice does not say how agencies are to find such products. Komposite has followed US scrutiny of AI developers, including the FTC's request to two labs for their incident files and eight state attorneys general's action on a single chatbot.