DHS Mandates Full Purge of DeepSeek AI From All Civilian Federal IT Infrastructure

The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek technology from their systems, citing national security concerns over data collection. This directive, filed for public inspection on October 19, 2026, requires agencies to stop purchasing DeepSeek products and to purge existing implementations, including third-party services that rely on the Chinese AI lab’s models.

The risk

Homeland Security Secretary Markwayne Mullin warned that DeepSeek’s account generation process collects personally identifiable information and may digitally fingerprint users. According to Mullin, this sensitive data could be transferred to the Chinese government. He also stated that the AI models themselves might contain malware. The U.S. government deemed DeepSeek a “profound threat” to national security, prompting earlier restrictions by the Navy and Department of Commerce.

Who is exposed

The order applies to federal civilian agencies, such as the Department of State, rather than the entire government. While the Navy and Department of Commerce had previously restricted DeepSeek use, this new notice creates a broader supply chain restriction. It covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and any third-party products developed using DeepSeek implementations. Private businesses and individuals are not prohibited from using DeepSeek by this specific order.

Cost and compliance

Agencies must exclude DeepSeek and affiliate IT products from procurement and remove them from technology systems. This requirement is broader than a simple block on new purchases. The notice does not provide a public list of every affected third-party vendor. Suppliers and agency buyers must assess whether particular tools use DeepSeek implementations, using contract records and technical documentation to support their review. The legal basis is the Federal Acquisition Supply Chain Security Act of 2018.

What should you do?

Federal IT managers should immediately audit their AI service contracts to identify any hidden dependencies on DeepSeek models. Teams need to verify whether third-party vendors are using DeepSeek implementations, as the ban covers indirect usage. Procurement officers must update their purchasing guidelines to explicitly exclude DeepSeek and its affiliates to ensure compliance with the new DHS order.

The background in plain language

Supply chain security in software means ensuring that every component of a system is trustworthy, not just the final product. In AI, this is complex because models are often embedded within other services. Teams usually check vendor disclosures to see which underlying technologies power a tool. If a third-party app uses a restricted AI model, it falls under the same risk category as the model itself. This approach treats AI infrastructure as a critical supply chain element that requires rigorous vetting before integration into sensitive environments.

What to do and how to stay safe: DeepSeek

• Review all active AI service contracts to identify any mention of DeepSeek or its affiliates.
• Request technical documentation from third-party vendors to confirm the underlying AI models they use.
• Monitor vendor communications for updates regarding model changes or supply chain adjustments.
• Once the vendor provides an update, verify that new implementations do not rely on restricted technologies.

Step-by-step guide: Browser security settings are the architectural walls of your digital life

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this ban apply to private companies using DeepSeek?

No, the DHS order specifically targets federal civilian agencies and does not prohibit private businesses or individuals from using DeepSeek.

Why is the government concerned about DeepSeek?

Officials fear the company collects personally identifiable information and digital fingerprints that could be shared with the Chinese government, and that the models may contain malware.

Are third-party apps included in this ban?

Yes, the order covers third-party products and services that are developed using DeepSeek implementations, even if they do not carry the DeepSeek name.