US orders civilian agencies to remove DeepSeek from their systems

What happened

The Department of Homeland Security published an order on Tuesday 20 October barring federal civilian agencies from buying products of the Chinese AI developer DeepSeek and requiring them to remove those in use. ^{[1, 2]}

The order is dated Friday 24 July and signed by Homeland Security Secretary Markwayne Mullin. Reuters reported the notice on Monday 19 October, the day it was filed for public inspection. ^{[1, 3, 4]}

Why it matters

The removal reaches past DeepSeek's own app to third-party products and services developed using DeepSeek implementations. A vendor's tool built on a DeepSeek model falls under the same order. Until now agencies used their own discretion to block models like DeepSeek, CyberScoop reported. ^{[1, 5]}

What agencies must do

Agencies must exclude DeepSeek, its affiliates and their products from purchasing, effective immediately, including approved product lists and e-commerce markets. They must remove the products from their systems immediately or seek an exception. ^[1]

An agency may ask for an exception, such as a delay, in writing within 60 days of the order's issuance. The request needs a compelling justification, such as the effect on mission-critical work, and the Cybersecurity and Infrastructure Security Agency approves or refuses it in writing. ^[1]

Counted from 24 July, that window closed on Tuesday 22 September, by the desk's arithmetic. CyberScoop read the same text differently, as a request made 60 days in advance, and said the order was dated 26 June. ^{[1, 5]}

The order applies to civilian executive branch agencies only, and not to their national security systems. The Defense Department and the intelligence agencies fall under their own authority. ^[1]

The stated risks

The order said DeepSeek's servers are in China and that prompts from government employees or vendors 'may result in the transfer of sensitive data to the PRC.' It added that the models 'may contain malware or other security vulnerabilities.' ^{[1, 3]}

Asked about the order on Tuesday 20 October, foreign ministry spokesperson Mao Ning said China 'consistently opposes overstretching the concept of national security and politicizing tech and trade issues.' She said China would safeguard its businesses' lawful rights. DeepSeek did not comment in Reuters' or Bloomberg's reports, The Next Web noted. ^{[6, 7]}

What settles it next

Under the 2018 supply chain law, the Secretary must review the order within one year and every year after. Counted from 24 July, the first review falls due by July 2027, by the desk's arithmetic. In the meantime, CISA may give technical help to agencies that cannot comply on their own. ^[1]

Who it reaches

No company is tagged. DeepSeek has no US listing, and no source read for this story names a listed cloud provider or vendor that serves a DeepSeek model to a civilian agency. ^{[1, 5]}