DHS Disrupts DeepSeek AI Use Across US Federal Agencies

"Immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces." — the DHS order

DHS order: what agencies must do, and how quickly

The Department of Homeland Security has directed federal civilian agencies under its authority to stop using DeepSeek products and remove them from agency IT systems. The order requires agencies to immediately exclude covered products from procurement — explicitly calling out approved-product lists and purchasing marketplaces — and to immediately remove the products from government systems or seek a formal exception.

Agencies that choose to seek an exception must submit requests within 60 days of the order’s issuance, explaining the justification and proposed risk mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) will review those submissions and issue written approvals or denials. For agencies that cannot comply because of internal capability restrictions, CISA will provide the necessary technical assistance, the order says.

Scope: DeepSeek, affiliates, and third-party derivatives

The order is not narrowly limited to a single app or service. It covers DeepSeek products and also extends to affiliates of Hangzhou DeepSeek Artificial Intelligence Co., Ltd and to third-party products and services built using DeepSeek technology. DHS framed this as a regulatory action to limit the presence of DeepSeek-derived tools on critical systems in the United States, while clarifying that the measure applies to federal civilian agencies and is not a general ban on private or consumer use.

Security concerns cited: data access, tracking, and potential malware

DHS explained its action by pointing to concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users, and potentially transfer sensitive government data to China. The order also raises the prospect of malware within models, citing a February 2025 report from NowSecure that examined the DeepSeek iOS app.

NowSecure’s analysis reportedly found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks, and data sharing with ByteDance. Earlier in DeepSeek’s lifecycle the company’s AI tools gained rapid popularity, but that momentum was accompanied by reports of security risks and worries about potential access by Chinese authorities.

CISA’s role: exceptions, technical assistance, and written decisions

CISA is set to be the gatekeeper for exception requests. Agencies that need to keep using covered products for operational reasons must submit a written request within 60 days; CISA will review and provide written approvals or denials. Where agencies lack the internal technical capability to comply with the removal requirement, the order directs CISA to provide the necessary technical assistance to effect removal or mitigation.

The order was published in the Federal Register earlier today, a day after it appeared on Public Inspection, establishing the formal administrative timeline that triggers the 60-day exception window.

What this means for federal civilian agencies, CISA, and DeepSeek-related vendors

• Federal civilian agencies: Agencies must immediately exclude DeepSeek products from procurement lists and either remove them from systems or prepare exception requests within 60 days that explain justifications and risk mitigations.
• CISA and agency procurement teams: CISA will review exception requests and provide written approvals or denials; it will also supply technical assistance where agencies lack the internal capacity to comply with the order.
• DeepSeek, affiliates, and third-party vendors: Products built on DeepSeek technology are within scope. Vendors and resellers who appear on approved-product lists or purchasing marketplaces face immediate exclusion from federal procurement unless an exception is granted.

The DHS order draws a clear regulatory line: federal civilian IT environments must be purged of DeepSeek-linked tools unless an agency successfully documents and justifies a constrained exception. Agencies now face a 60-day clock for exceptions; CISA will decide those requests in writing, and — where needed — provide the hands-on assistance to implement removals. The public record accompanying the order connects those procurement controls to specific security findings, including a February 2025 NowSecure report and stated risks related to foreign access and data transfer.

Source: BleepingComputer — DHS bans DeepSeek products across US federal civilian agencies