DHS issues order banning DeepSeek from federal civilian networks, using supply chain authorities

The DHS order is targeted at “excluding information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in applicable regulations, from federal civilian agency procurements,” according to a notice set for Oct. 20 publication in the Federal Register. The notice says the ban also includes “removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” The FASC was established by Congress in the 2018 Federal Acquisition Supply Chain Security Act and a 2021 final rule created policies and procedures for the interagency body.

Another interim final rule was published in 2023 to amend the Federal Acquisition Regulation to address removal and exclusion orders. The FASC is responsible for recommending exclusion or removal orders. The order itself must be issued by the Homeland Security Secretary, the Secretary of Defense or the Director of National Intelligence.

The first order under the FASC was issued in 2025 by the Director of National Intelligence against Acronis and focused on the intelligence community. The notice contains the DeepSeek exclusion and removal order as an appendix, originally released on July 24 and signed by Homeland Security Secretary Markwayne Mullin. On risks, the order says, “DeepSeek’s models present multiple threat vectors.

DeepSeek servers are located in the [People’s Republic of China] and the PRC legal system permits extensive authority to government cyber and intelligence functions to access privacy company infrastructure.” “For DeepSeek-hosted instances of their models, DeepSeek’s account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users. DeepSeek’s most widely used applications function through a prompt-and-response process that requires presenting information to the model, and which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors,” according to the order. The order adds, “The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs.

The models themselves may contain malware or other security vulnerabilities. Indeed, open-source security research has found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities.” DeepSeek’s work to develop a new AI system emerged as a threat to U.S. competitors in late 2024 and interest has grown significantly among policymakers and on Capitol Hill. NIST’s Center for AI Standards and Innovation published an evaluation in 2025 of DeepSeek AI models.