The US orders every civilian agency to rip out DeepSeek, even tools built on it

The Department of Homeland Security has ordered every federal civilian executive-branch agency to stop buying DeepSeek products and remove DeepSeek software, services and third-party products developed using DeepSeek implementations from their IT systems. Order 2026-01, signed by Homeland Security Secretary Markwayne Mullin and dated July 24, 2026, was publicly noticed for Federal Register publication on October 20 under docket DHS-2026-0628. The requirement excludes military, national-security and secure compartmented information systems. DHS said DeepSeek presents supply-chain, privacy and cybersecurity risks because its servers are in China, Chinese law can permit government cyber and intelligence access to private-company infrastructure, and its services may collect and digitally fingerprint users. The order also cites a February 2025 NowSecure audit that found critical flaws in DeepSeek’s iPhone app. DHS did not identify a confirmed case in which U.S. government data reached DeepSeek. Because DeepSeek releases open-weight models, the order can also cover outside vendors’ tools, though it does not name affected products or explain how it applies to DeepSeek models hosted on U.S. companies’ servers. Agencies seeking an exemption or delay must submit a written, compelling justification within 60 days; CISA will evaluate requests. Agencies must monitor network traffic, increase logging and strengthen controls against data exfiltration until removal is complete.