DHS orders civilian agencies to purge DeepSeek technology and related third-party services from their networks due to data risks.
Key points
- DHS bans procurement and requires removal of DeepSeek products and affiliated services from federal civilian IT systems.
- Officials cite risks of personally identifiable information collection and potential malware within the AI models.
- The order covers third-party tools using DeepSeek implementations, not just branded applications.
The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek AI technology from their systems. This action bans new purchases and requires the elimination of existing tools, including third-party services that rely on DeepSeek models.
What happened
The Department of Homeland Security posted a notice on Monday ordering federal civilian agencies, such as the State Department, to remove products from the Chinese AI lab DeepSeek. The directive also covers third-party services that utilize DeepSeek AI models, according to Cyber Security News. Homeland Security Secretary Markwayne Mullin stated that DeepSeek’s account generation process collects personally identifiable information and may digitally fingerprint users. The administration fears this sensitive data could be transferred to the Chinese government. Mullin also warned that the models themselves might include malware.
View the original post on X
This order creates a government supply chain restriction rather than a nationwide ban on private use. Businesses and individuals are not prohibited from using DeepSeek by this specific order, according to Cyber Security News. The notice was filed for public inspection on October 19, 2026, with publication scheduled for October 20. It cites the Federal Acquisition Supply Chain Security Act of 2018 as the legal basis for the action.
DeepSeek use had already been restricted in parts of the government, including the Navy and the Department of Commerce, which previously deemed the lab a national security threat. The Chinese AI lab gained attention early last year for its R1 model, which offered high capabilities at lower costs than American counterparts.
Why it matters
AI tools often function as opaque supply chain components. When an agency uses a third-party service, the underlying model powering that service may come from a different vendor entirely. Security teams usually must look beyond the brand name of the application to identify the core technology. This means reviewing technical documentation and contract records to determine if a tool relies on prohibited implementations. Understanding these dependencies is critical for maintaining compliance and protecting sensitive data from unauthorized collection or tracking.
The fix
- Review all AI tools currently in use to identify those powered by DeepSeek models.
- Check technical documentation and vendor contracts for mentions of DeepSeek implementations.
- Remove any identified products or services from agency technology systems immediately.
- Exclude DeepSeek and its affiliates from future procurement processes.
Why it matters
Organizations treating AI as a supply chain issue must verify the origin of every model component. Teams usually need to map all AI services to their underlying providers to ensure compliance with new restrictions. Checking whether a third-party tool uses prohibited implementations helps prevent accidental exposure to data collection practices. This approach ensures that security reviews cover the entire technology stack, not just the user-facing interface.
Background: Supply chain attacks
Verify code signatures and hash values before installing any update. Monitor for unexpected outbound traffic or permission requests. If anomalies appear, isolate the system immediately and revert to a known good state. Treat third-party updates as untrusted until proven otherwise.
Read the full guide: Supply Chain Attack Warning Signs and Response Steps
What to do and how to stay safe: DeepSeek
- Audit your organization's AI tool inventory to identify any services using DeepSeek models.
- Consult vendor documentation to confirm the underlying technology of third-party AI applications.
- Monitor official government notices for updates on prohibited technology lists and compliance requirements.
- Ensure procurement teams are aware of the ban to prevent future acquisition of restricted tools.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this ban apply to private individuals and businesses?
No, the order creates a government supply chain restriction and does not prohibit private use by businesses or individuals.
What is the reason for the ban?
Officials cited concerns about the collection of personally identifiable information, digital fingerprinting, and potential malware in the models.
Are third-party services included in this ban?
Yes, the order covers third-party products and services developed using DeepSeek implementations, not just branded DeepSeek tools.
