U.S. Orders Removal of DeepSeek From Civilian Agency IT Systems and Blocks New Purchases

The United States has ordered civilian federal agencies to take DeepSeek off their systems and to stop buying it. A notice published in the Federal Register on October 20 records an order by the Secretary of Homeland Security, issued under the Federal Acquisition Supply Chain Security Act of 2018. The order does two things. It excludes information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., and its affiliated entities, from federal civilian agency procurements. It requires the removal of all DeepSeek and DeepSeek-affiliate products, and of third-party products and services developed using DeepSeek implementations, from civilian agency information technology. The signed order is dated July 24. The public notice is this week. The scope is the federal civilian executive branch — Treasury, State, Justice, and the rest of the civilian agencies. Department of Defense systems are outside this order. Private companies and individual users in the United States are not covered. DHS said the models pose “multiple threat vectors.” Use “may result in the transfer of sensitive data to the PRC if used by US government employees or vendors.” It “could produce actionable intelligence on US persons and/or government agencies.” “The models themselves may contain malware or other security vulnerabilities.” A July memo, made public with the notice, had already told agencies to monitor traffic to and from government websites for DeepSeek-related risks. The order followed a recommendation from the Federal Acquisition Security Council. What Must Come Off the Systems The removal is not limited to the DeepSeek app or the DeepSeek.com service. It covers third-party products and services “developed using DeepSeek implementations.” A civilian agency tool that calls a DeepSeek model, or that was built on top of one, falls inside the order even if the vendor is American. That is the broader cut. An agency that embedded an open-weight DeepSeek model in an internal workflow, or that bought a service whose backend uses one, has to remove it. Procurement of new DeepSeek products or of third-party services developed with DeepSeek is barred going forward. Earlier, narrower bans already existed. The Commerce Department and the Navy had restricted DeepSeek on their own devices. New York, Tennessee, and Virginia had taken state-level steps. The DHS order is the civilian-government-wide version, with the force of a supply-chain security exclusion rather than an agency memo. Why DeepSeek Drew the Order DeepSeek’s models are open-weight and inexpensive relative to leading U.S. closed models. That combination made them widely downloaded and widely wrapped into other products after the company drew global attention. Open-weight means the weights can be run by anyone with the hardware. It does not mean the company that trained them has no ongoing relationship to users of its hosted service, or that a model file is free of supply-chain questions. DHS’s stated concerns are the standard ones applied to technology from a Chinese firm: data that could reach the PRC, the possibility of intelligence value from government use, and the possibility of vulnerabilities in the model or its tooling. The notice does not publish a specific exploited vulnerability or a specific incident of data exfiltration. It publishes the risk assessment that justified the exclusion. The White House has criticized Chinese AI firms this year. Michael Kratsios has written about malicious exploitation of American AI, mainly by rivals in China. The DeepSeek order is a concrete procurement consequence of that stance, limited to civilian federal systems. What the Order Does Not Do It does not ban DeepSeek for U.S. companies or consumers. A startup can still download the weights and run them. It does not cover Defense Department systems under this particular order. It does not seize models already in private hands. It does require civilian agencies to find and remove not only the official product but third-party implementations, which is an inventory problem. An agency that does not know a vendor used DeepSeek in a tool has to find out. The July traffic-monitoring memo is the operational companion to that search. The Chinese embassy in Washington did not immediately comment in the first reports. DeepSeek has not, in the coverage available, issued a detailed public response to the Federal Register notice. What to Watch Agency compliance deadlines and any public accounting of what was removed. Whether third-party vendors disclose DeepSeek use to keep civilian contracts. Any extension of similar exclusions to other Chinese AI firms. State actions that mirror the federal civilian ban. Whether the Defense Department issues a parallel order, which this notice does not contain. The United States has ordered the removal of DeepSeek products and of third-party services built on DeepSeek from federal civilian agency IT systems, and has barred civilian agencies from buying them. The order, signed in July and published this week, cites risks of data transfer to China, intelligence collection, and malware. It does not apply to the Defense Department or to private users. It does apply to any civilian-agency tool that implements the models. That is the scope of the ban. Digital8Hub will update if agencies publish removal totals or if the exclusion is extended.