DHS reveals July DeepSeek removal order
A DHS notice filed October 19 describes a July 24 order barring civilian agencies from buying DeepSeek products and removing them from agency systems.
The DHS DeepSeek ban reached public view through a notice filed on October 19: the Department of Homeland Security says Secretary Markwayne Mullin issued Order #2026-01 on July 24, directing federal civilian agencies to stop buying IT products and services from DeepSeek and its affiliates, and to remove DeepSeek products plus third-party offerings developed using DeepSeek implementations. The October filing was scheduled for publication on October 20; it did not mark the order’s original issue date.
Key points
- The attached order is numbered 2026-01 and gives July 24, 2026, as its original release date; the Federal Register notice was filed at 8:45 a.m. on October 19 for publication the next day.
- Procurement exclusions cover DeepSeek, affiliated entities and their products; system removal also reaches third-party products developed using DeepSeek implementations.
- Agencies seeking an exception had to submit a written request within 60 days of the order, explaining the scope, justification and alternative mitigations.
Background
DHS invoked the Federal Acquisition Supply Chain Security Act (FASCSA, 41 U.S.C. §§ 1321–1328) and its implementing rules. The notice says the secretary acted after reviewing a Federal Acquisition Security Council recommendation and related evidence. The order covers federal civilian systems; national-security systems and sensitive compartmented information systems sit outside its stated scope, with Defense and intelligence authorities retaining their own remit.
Engadget places the move in a broader US effort to restrict DeepSeek in government. Its October 19 report notes that lawmakers had proposed a government-device ban the previous year. That proposal and DHS’s procurement and system-removal order are different actions, with different legal forms and reach. This is a federal purchasing and IT-systems restriction, not a nationwide ban on consumers or private businesses using DeepSeek.
A supply-chain order can affect what federal customers may buy and therefore what contractors can provide to agencies. DHS’s action is bounded to procurement and IT systems at federal civilian agencies; the notice does not describe it as a nationwide consumer ban on DeepSeek use by US individuals or businesses.
What the order says
The notice describes two tracks: exclude products from procurement and remove covered items from agency IT systems. The procurement restriction took effect immediately after the order’s issuance. It reaches approved-product lists, service-provider equipment lists, e-commerce marketplaces and other channels used to acquire IT hardware, software or services. The removal requirement also began immediately. Agencies were directed to remove covered products or seek an exception; the order does not provide one universal end date for every agency’s cleanup.
| Document or step | Date | Meaning |
|---|---|---|
| DHS Order #2026-01 | July 24, 2026 | Original release date printed in the attached order |
| Federal Register notice filed | October 19, 2026, 8:45 a.m. | Filing time for FR Doc. 2026-21447 |
| Scheduled publication | October 20, 2026 | The notice’s planned Federal Register publication date |
CyberScoop reports a June 26 letter from Mullin calling for DeepSeek’s exclusion. The official attachment instead identifies July 24 as Order #2026-01’s original release date. The documents available here do not explain the relationship between those dates, so the June letter should not be presented as the order’s issue date. The order defines an affiliate by reference to 48 CFR 2.101: entities are affiliated when one controls or can control the other, directly or indirectly, or a third party controls both.
An exception could cover an agency, a particular action, or a delay in compliance. A written request had to identify the order and provisions, the covered article or service, a compelling justification, and alternative steps to reduce the risks. The order lists mission-critical functions and national-interest or national-security considerations as possible grounds. CISA may provide technical assistance to agencies without enough internal capacity. The 60-day period ran from the order’s issuance; the October notice did not restart it.
DHS’s security rationale
The order cites data flows and software risks. It says DeepSeek operates servers in China and that accounts for hosted instances collect personally identifiable information and may track or digitally fingerprint users. Prompts and responses may also carry sensitive information to China when government employees or vendors use the service. DHS argues that such data, alone or combined with public information, could produce actionable intelligence about US people or government programs.
The attachment also says DeepSeek models may contain malware or other vulnerabilities and cites 2025 security research on the DeepSeek iOS app that found multiple critical vulnerabilities. Those are the government’s stated grounds for the order. The notice itself presents no new independent test data and does not establish that every DeepSeek implementation contains malware. CyberScoop and Engadget summarize the concerns as possible exposure of sensitive data to the Chinese government, security flaws, and China’s legal environment. Readers should keep DHS’s security case distinct from independently verified technical findings.
For the transition period, the order encourages agencies to monitor incoming and outgoing network traffic, strengthen logging and controls against data exfiltration, and detect and flag anomalous activity. The operational path therefore combines procurement blocks, system cleanup and monitoring while removal is under way. The secretary must review the order within one year and annually afterward, so the document also sets a recurring review requirement.
Where “using DeepSeek” gets fuzzy
The hardest phrase for suppliers is “developed using DeepSeek implementations.” A footnote says this includes third-party implementations used to provide products and services to civilian agencies. The text does not offer a test that vendors can apply to every situation, or say whether indirect dependencies, resold services, or developers’ use of DeepSeek for coding automatically falls within the rule.
The Register quotes Luta Security CEO Katie Moussouris, who said blocking DeepSeek’s own app and API was workable while the third-party language would be difficult to audit. A conventional software bill of materials lists components, but generally does not record which coding tools developers used. The article also points to model gateways such as OpenRouter and Vercel AI Gateway, whose provider routing can send a request to DeepSeek unless an agency restricts available providers. Gateways are not separately named as prohibited products; they complicate the question of which downstream services use DeepSeek.
The boundary around covered agencies matters too. The order applies to federal civilian executive-branch agencies, excluding national-security systems and sensitive compartmented information systems. DHS’s authority does not replace the Defense secretary’s or Director of National Intelligence’s authority over systems assigned to them. Private companies and individual users should not infer that the order prohibits their own use of DeepSeek in the United States. Software suppliers serving federal customers, however, need to assess whether their products or services fit the order’s definition and resolve edge cases with agency procurement, legal and security teams.
A one-minute check
If your product serves a federal civilian agency, start by checking model-provider settings and service inventories for DeepSeek. Then inspect whether a gateway can automatically fall back to or select that provider, and list APIs, wrappers and third-party services that may expose a DeepSeek implementation. Compare those findings with Order #2026-01 and ask the contract or security owner to confirm which systems serve government customers and what supplier evidence is needed. A repository search alone can miss routing inside a hosted gateway, so this is triage, not a compliance determination.
Our take
For model companies, software vendors and cloud providers working on federal contracts, both procurement records and running systems need review. Direct DeepSeek deployments are relatively easy to identify. The official text leaves more room for interpretation around third-party implementation, service provenance, gateway routing and whether developer tooling is relevant. Teams serving government clients should begin with product inventories, routing logs and supplier statements; searching source code for the model name alone may miss the path that matters.
The October 19 filing made the full order attachment public; it did not create a new July policy or restart the 60-day exception period. Useful next signals include whether DHS clarifies the third-party boundary during its annual review and how CISA assists agencies with removal. For vendors serving federal clients, the immediate work is still to inventory products, inspect routing and ask suppliers for documentation. Our earlier DeepSeek Search and Fetch API entry can help identify the product names to check; procurement owners still need to decide how the order applies. The order spells out procurement and removal requirements, while leaving the scope of third-party products developed using DeepSeek implementations open to further interpretation.