DHS bans China's DeepSeek AI from federal agency computers and purchases

Who signed it: Homeland Security Secretary Markwayne Mullin issued the order, numbered #2026-01, under the Federal Acquisition Supply Chain Security Act of 2018. Its cover page lists an original release date of July 24, 2026, so the ban has been in force for months. It applies to civilian agencies, not to their national security systems or classified compartmented systems, which fall under the Pentagon and intelligence agencies.

DHS's reasons: The order says DeepSeek's servers are in China and that Chinese law gives the government wide access to company systems. It says DeepSeek-hosted versions collect personal information and may fingerprint users, and that prompts could send sensitive data to China. Reuters noted the Commerce Department, the Navy and states including New York, Tennessee and Virginia had already barred DeepSeek on their devices.

In the order's words: "The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs. The models themselves may contain malware or other security vulnerabilities."

What agencies must do: Exclude DeepSeek from purchasing right away, including approved-product lists and online marketplaces, and remove covered products right away or seek an exception. Exception requests had to be filed in writing within 60 days of the order, with a "compelling justification" such as a mission-critical need. Until removal is complete, agencies are urged to watch network traffic, add logging and guard against data leaks.

What the evidence shows: The order backs its data-transfer concern with DeepSeek's own privacy policy, which places servers in China. Its malware warning is hedged ("may contain"), and the one finding it cites is a 2025 NowSecure audit of DeepSeek's iOS app, not of the open-weight models agencies could run on their own servers. (Source: DHS order, pp. 1-2 — https://public-inspection.federalregister.gov/2026-21447.pdf)

Timeline: Feb. 2025, NowSecure reports flaws in DeepSeek's iOS app. July 24, 2026, order's listed release date. Oct. 19, notice made public. Oct. 20, Federal Register publication. Oct. 29, the FCC votes on barring Chinese labs from testing U.S. electronics, Reuters reported.

What's still unknown: How many agencies or vendors were using DeepSeek; whether any exceptions were granted; why the order was made public nearly three months after its listed date; and whether DHS will act on other Chinese open-weight models such as Alibaba's Qwen or Moonshot's Kimi, which CyberScoop said have drawn similar concerns. DeepSeek and the Chinese Embassy had not commented in the reports cited.

Details of the order come from the DHS notice filed for public inspection Oct. 19 and scheduled for the Federal Register on Oct. 20, which includes the signed order. The order's cover lists an original release date of July 24, 2026; CyberScoop reported a June 26 date. DeepSeek and the Chinese Embassy had not commented in the reports cited.