The US Department of Homeland Security has issued an order requiring federal civilian agencies to remove all DeepSeek products from government IT systems, a BleepingComputer-reported DeepSeek ban that also extends to products from the Chinese AI company’s affiliates and any third-party services built on DeepSeek technology. The full legal name of the company in question is Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
The order, published in the Federal Register on 20 October 2026, covers large language models, the DeepSeek chatbot, API services, and models used for coding and reasoning tasks. Federal agencies are directed to immediately exclude covered products from procurement lists and purchasing marketplaces, and to remove them from agency systems or apply for a formal exception.
What agencies must do, and when
Agencies that cannot comply due to internal capability constraints have up to 60 days from the order’s issuance to submit exception requests, outlining their justification and proposed risk mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) will review those requests and issue written approvals or denials. For agencies lacking the technical means to remove the software themselves, CISA has said it will provide assistance.
DHS indicated that the order is driven by fears that the Chinese government could access DeepSeek infrastructure, harvest personal information about users, monitor their activity, and potentially route sensitive government data to China. The order explicitly does not constitute a ban on private or consumer use of DeepSeek products.
Security flaws cited in the order
The DHS document points to a February 2025 report from mobile security firm NowSecure as part of its rationale. In February 2025, NowSecure examined the DeepSeek iOS app and found that it transmitted data without encryption, relied on weak encryption algorithms, stored data insecurely, exposed users to fingerprinting risks, and shared data with ByteDance, the Chinese company behind TikTok.
In February 2025, Devolutions reported on those NowSecure findings in further technical detail, noting that the DeepSeek iOS app used outdated Triple DES encryption, reused initialisation vectors, and hardcoded encryption keys, practices it described as violations of established security best practices. Insecure storage of usernames, passwords, and encryption keys was also flagged, alongside the app bypassing Apple’s privacy controls.
Andrew Hoog, whose team at NowSecure conducted the assessment, told ABC7 Chicago in February 2025 that the app used encryption ‘which is 10 years old’ and that user data ends up ‘in the hands of the Chinese company which owns it’. NowSecure’s report ran to 23 pages and found three serious vulnerabilities alongside multiple privacy issues.
The DHS order also raises concerns about potential malware in DeepSeek models, though the document’s immediate practical requirements (removal and procurement exclusion) are directed at the products as a class rather than at any single identified incident. Agencies have until the 60-day deadline to file any exception requests with CISA.
