DHS Orders DeepSeek Out of Federal Civilian IT, Following the TikTok Playbook

Written By TNT Staff, Posted on October 20, 2026

Featured photo: Homeland Security Secretary Markwayne Mullin’s official portrait. DHS photo by Tia Dufour, public domain, via Wikimedia Commons.

The Department of Homeland Security has ordered every federal civilian agency to stop buying and to rip out software from DeepSeek, the Chinese artificial intelligence company. The ban also covers outside products built on DeepSeek’s technology.

The order, signed by Homeland Security Secretary Markwayne Mullin, was published in the Federal Register Tuesday. It directs agencies to “exclude DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements.” They must also remove “products provided by DeepSeek, DeepSeek-affiliated entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems.”

Both steps took effect immediately on issuance, the order says. It is labeled Exclusion and Removal Order #2026-01 and lists an original release date of July 24, 2026. Tuesday’s notice made it public 88 days later.

Why DHS says DeepSeek is a threat

The order lays out its case in plain terms. It calls Hangzhou DeepSeek “a foreign, privately-owned company, located in the People’s Republic of China (PRC)” whose AI apps are “available widely and free of charge.” It says that “DeepSeek’s models present multiple threat vectors.”

“DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure,” the order states.

It says DeepSeek’s account process “collects personally identifiable information (PII) and may also track and digitally fingerprint users.” Because the apps work by having users type information into the model, using them “may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors.”

That data, “either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs,” DHS wrote. “The models themselves may contain malware or other security vulnerabilities.” The order cites outside research finding that DeepSeek’s iPhone app “contains multiple critical vulnerabilities.” It also cites an April 2025 report on DeepSeek from the House Select Committee on the Chinese Communist Party.

How far it reaches

The ban on buying DeepSeek covers more than direct contracts. It extends to “agency-approved products lists, service provider equipment lists, e-commerce markets, and other similar functions that facilitate the procurement of information technology hardware, software, and services.”

The removal rule reaches past DeepSeek’s own app. Any third-party tool “developed using DeepSeek implementations” must go too. That matters because DeepSeek has released versions of its models that anyone can download and build on. A contractor’s product running a DeepSeek model under the hood is now off limits to civilian agencies.

DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018, after a recommendation from the Federal Acquisition Security Council. That 2018 law lets the Homeland Security secretary bar risky tech from civilian systems. The order does not apply to national security systems or secure compartmented systems, which fall under the Pentagon and the Director of National Intelligence.

Agencies could ask for exceptions in writing within 60 days of the order’s issuance. They had to make a “compelling justification,” such as harm to “mission-critical functions.” Counting from the July 24 release date, that window closed Sept. 22, about a month before the public notice. Until DeepSeek products are fully removed, agencies are “encouraged” to monitor network traffic and watch for data being sent out. DHS must review the order within a year and every year after.

The TikTok playbook

Washington has done this before. In December 2022, Congress passed the No TikTok on Government Devices Act. Two months later, the White House budget office gave agencies 30 days to remove the app. In April 2024, Congress went further with a law forcing TikTok’s Chinese owner to sell or face a ban.

DeepSeek drew the same scrutiny almost as soon as its chatbot shot to the top of app store charts in January 2025. The U.S. Navy told its personnel to steer clear of it, CNBC reported, and NASA blocked it days later. States including Texas and Virginia banned it on government devices.

Those were one-agency and one-state moves. This order applies one rule across the whole civilian government and reaches into the supply chain. Like the TikTok rules, it does not touch what private Americans can download.

The open question

The order is a sensible step. Federal workers should not be typing government business into a chatbot whose servers sit under Beijing’s legal reach. The harder question is timing. DHS says the order took effect in July, yet the public, and any contractors who weren’t told directly, are only learning the details now, after the exception window has closed. DHS’s notice does not explain the gap.

The order lists CISA’s FASCSA order team at fascsa.orders@cisa.dhs.gov as the contact for agencies.