The US Department of Homeland Security has ordered every civilian federal agency to remove DeepSeek products from its IT systems and to stop buying them. CyberScoop and Engadget both reported the order on October 19, 2026, and The Wall Street Journal also covered it. The order itself is older than the coverage. CyberScoop reports that Homeland Security Secretary Markwayne Mullin signed the exclusion letter on June 26, so the news is the public notice and the instruction to remove products that are already in use.
According to CyberScoop, the order rests on the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council. It covers DeepSeek’s parent company, Hangzhou DeepSeek Artificial Intelligence, along with its affiliates and products. Agencies must keep DeepSeek products out of future purchases and remove any versions they already run. Engadget adds that DeepSeek is barred from taking part in federal contracts, and it names the EPA and the FCC as examples of agencies that must comply.
The stated concerns centre on data. Mullin pointed to servers in China, where the government can request information from domestic companies, and to the collection of personal information. CyberScoop quotes him describing DeepSeek’s models as presenting “multiple threat vectors” to civilian IT systems. He also warned that prompts and responses could pass sensitive information to the Chinese government. Engadget reports that DHS said the models could “contain malware or other security vulnerabilities.”
Until removal is complete, CyberScoop reports, agencies are encouraged to monitor network traffic, improve logging, control data leaving their networks and flag unusual activity. Exceptions are possible, but CyberScoop says a request must be filed 60 days in advance and include a “compelling justification.” The article gives no removal deadline, so the timetable for agencies to finish the work is not public.
The order is more disruptive than a simple purchasing rule. It asks agencies to take out tools they already depend on, and Engadget’s note that DeepSeek is barred from federal contracts suggests the reach extends beyond agencies’ own systems. Neither outlet explains how contractors should handle products built on DeepSeek models, which is likely to be the first practical question for vendors that sell to government.
Neither article includes a statement from DeepSeek. CyberScoop says it asked CISA and DHS for more detail and did not report a reply. The Federal Register notice that accompanies the order was set to be published the following Tuesday, according to CyberScoop, and its text should answer the scope questions that the news coverage leaves open.
What is still unknown is how many agencies use DeepSeek today, which specific products are covered beyond the parent company and its affiliates, and how removal will be checked. The public reporting does not say whether DHS has identified any security incident involving DeepSeek data, and it does not say how the agencies will replace the tools they remove. Until the notice is published and agencies respond, those details remain unverified.