US DHS Bans DeepSeek Products Across Federal Agencies
The United States Department of Homeland Security has issued a sweeping regulatory order mandating the immediate removal and exclusion of DeepSeek products across all federal civilian agencies and government information systems.
Radwan AbdulhadiEditor and technology writer
DHS Directive Targets DeepSeek Across Civilian IT Systems
The United States Department of Homeland Security (DHS) has officially ordered federal civilian agencies to halt the use of all DeepSeek products and eliminate them from government systems, as detailed in an official directive <a href="https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive">published in the Federal Register</a> <a href="https://www.federalregister.gov/public-inspection/2026-21447/order-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive">Federal Register</a> <a href="https://public-inspection.federalregister.gov/2026-21447.pdf">issued a notice of order</a>. The sweeping administrative action targets products developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd, alongside offerings from its affiliates, third-party services, and any software solutions built using DeepSeek's underlying artificial intelligence technology.
DeepSeek has gained widespread international recognition for developing advanced large language models, conversational chatbots, application programming interface services, and specialized models optimized for software coding and reasoning tasks. While these tools quickly grew <a href="https://www.bleepingcomputer.com/news/security/deepseek-halts-new-signups-amid-large-scale-cyberattack/">extremely popular</a> among developers and enterprise users globally, they have also attracted intense scrutiny <a href="https://www.bleepingcomputer.com/news/security/germany-asks-google-apple-remove-deepseek-ai-from-app-stores/">soon followed</a> regarding potential cybersecurity risks, data privacy compliance, and questions surrounding how user interactions are managed and stored.
Strict Timelines and CISA Exception Procedures
Under the terms of the new DHS directive, executive agencies must immediately exclude covered DeepSeek products from any procurement pipelines, purchasing marketplaces, and official approved-product listings. Furthermore, agencies are instructed to purge these technologies from existing information technology systems unless an official exception is successfully granted through formal administrative channels.
Federal civilian organizations that require continued use due to operational necessity must submit formal exception requests within a strict 60-day window following the issuance date of the order. These filings must provide comprehensive justifications along with detailed risk mitigation strategies. The Cybersecurity and Infrastructure Security Agency (CISA) is tasked with reviewing every submitted request, ultimately issuing formal written approvals or denials. For agencies facing internal capability restrictions or technical challenges in maintaining compliance, CISA will provide the necessary technical assistance.
Security Vulnerabilities, Malware Concerns, and Data Risks
The regulatory decision is heavily rooted in concerns that the Chinese government could gain access to DeepSeek infrastructure, track users, collect personal information, and potentially transfer sensitive United States government data to overseas entities. The official documentation also highlights the risk of malicious code within DeepSeek models, explicitly referencing a February 2025 security assessment from NowSecure.
The NowSecure investigation <a href="http://www.nowsecure.com/blog/2025/02/06/nowsecure-uncovers-multiple-security-and-privacy-flaws-in-deepseek-ios-mobile-app/">report from NowSecure</a> uncovered several significant technical and privacy flaws within the DeepSeek iOS mobile application. Those findings included unencrypted data transmissions, weak encryption algorithms, insecure local device storage, user fingerprinting vulnerabilities, and data sharing practices linked to ByteDance, the Chinese technology enterprise that operates the TikTok short-form video platform.
Scope of the Directive and Broader Industry Context
It is important to note that the DHS order specifically governs federal civilian agencies operating under the department's institutional authority. It does not constitute a comprehensive general ban on private consumer use or commercial enterprise adoption within the broader public sector outside federal civilian executive branch jurisdictions.
The federal action arrives amidst a rapidly shifting artificial intelligence landscape characterized by intense competition and regulatory friction. DeepSeek recently released its <a href="https://x.com/deepseek_ai/status/2111375640717033777">latest model</a>, designated as V4.1-Flash-1017, which the company markets as faster, smarter, and significantly more efficient. These releases follow earlier economic strategies where the company <a href="https://www.engadget.com/2180062/deepseek-permanently-reduces-the-price-of-its-flagship-v4-model-by-75-percent/">cheaper AI models</a> disrupted traditional market pricing structures by undercutting established industry leaders like ChatGPT and Gemini.
Before this comprehensive executive order, lawmakers <a href="https://www.engadget.com/ai/us-lawmakers-want-deepseek-banned-from-government-devices-212230100.html">proposed a bill</a> aimed at restricting DeepSeek products from government hardware. As the regulatory framework hardens, federal contractors, agencies, and technology vendors must carefully audit their software supply chains to ensure full compliance with the new DHS and CISA mandates.
Sources
- BleepingComputerDHS bans DeepSeek products across US federal civilian agencies
- EngadgetHomeland Security bans DeepSeek use in federal civilian agencies
Continue chronologically
Related stories
CISA Orders Federal Agencies to Patch Exploited Zyxel Flaw
CISA has added a high-severity Zyxel GS1900 series switch vulnerability to its KEV catalog, ordering federal agencies to patch it by Thursday.
Deepseek Unveils V4.1 Flash 1017 AI Model
Deepseek has upgraded its V4.1 Flash open-weight AI model, delivering lower running costs and high efficiency alongside notable hallucination challenges.
Atlassian Patches Critical Vulnerability Affecting 8 Products
Atlassian has released critical security patches for an unauthenticated arbitrary file access vulnerability impacting eight enterprise products.
Ivanti Patches Two More Connect Secure Zero-Days
Ivanti releases security updates for two additional Connect Secure gateway flaws chained in zero-day attacks since October, following a prior bug fix.
