DeepSeek Ban: What the DHS Order Tells Federal Agencies to Do
DeepSeek ban: DHS orders civilian agencies to drop DeepSeek and tools built on it. We read the July order’s terms, exceptions and what the notice omits.
WASHINGTON, 20 October 2026 – The Department of Homeland Security has ordered every federal civilian agency to stop buying DeepSeek products and to strip them from its computer systems. The notice appeared in the Federal Register on Tuesday under docket DHS-2026-0628, a day after it was filed for public inspection. The four-page order attached to the notice shows that the ban is not new inside government: it carries an original release date of 24 July 2026.
The publication came on the same day Washington took a second step against Chinese technology firms. The State Department sanctioned five entities linked to Linwei Ding, a former Google engineer convicted on 29 January 2026 of seven counts of trade-secret theft. This report looks at what the DeepSeek order says, how it differs from earlier attempts to ban the app and what remains unclear.
What Exclusion and Removal Order #2026-01 says
The order is titled “Exclusion and Removal Order #2026-01” and is signed by Homeland Security Secretary Markwayne Mullin, with Office of Management and Budget Director Russell Vought copied. It rests on the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), which created the Federal Acquisition Security Council and lets the homeland security secretary act on its recommendations for civilian systems. The Pentagon and the Office of the Director of National Intelligence keep that power for their own networks, so the order exempts national security systems and secure compartmented information systems.
It gives two instructions. Agencies must exclude Hangzhou DeepSeek Artificial Intelligence and its affiliates from procurement “effective immediately,” including agency-approved product lists and e-commerce markets. They must also remove DeepSeek products “immediately” or ask for an exception.
The second instruction reaches further than the chatbot. It covers “third-party products and services developed using DeepSeek implementations.” DeepSeek’s models are open source, and US companies such as Perplexity had added them to their own platforms by February 2025, Stanford’s Mok noted. The wording therefore appears to cover commercial tools that run a DeepSeek model under another name, not only the app itself.
The order lists the risks DHS relied on. It says DeepSeek’s servers are in China and that “the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure.” It adds that DeepSeek’s account process collects personal data and “may also track and digitally fingerprint users,” and that prompts typed by federal staff could move sensitive data to China. That data, “either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs,” the order states. Its footnotes cite a 2020 DHS business advisory, the House China committee and a February 2025 analysis by Charles Mok of Stanford’s Cyber Policy Center.
Exception requests had to be filed in writing “within 60 days of the issuance of this order,” with a “compelling justification” and a plan for “alternative mitigations.” Until removal is complete, agencies are told to monitor traffic, add logging and controls on data exfiltration, and flag anomalous activity. DHS must review the order within one year and every year after that.
How the DeepSeek ban developed: a timeline
- 27 January 2025: Nvidia shares fall 18%, losing $589 billion in market value, after DeepSeek’s R1 and V3 models draw global attention, Stanford’s Mok wrote.
- 31 January 2025: Texas Governor Greg Abbott bans DeepSeek and five other Chinese apps from state-issued devices.
- 7 February 2025: Rep. Josh Gottheimer introduces the No DeepSeek on Government Devices Act (H.R. 1121), with Rep. LaHood among 17 cosponsors. A Senate version, S. 765, follows on 27 February.
- 16 April 2025: The House Select Committee on the CCP publishes DeepSeek Unmasked. It says the app “funnels Americans’ data to the PRC” through infrastructure connected to a US-designated Chinese military company.
- 24 July 2026: DHS issues Order #2026-01 to agencies.
- 22 September 2026: The 60-day exception window closes on this date, by our count, if it ran from 24 July.
- 19–20 October 2026: The notice is filed and then published, and China’s Foreign Ministry responds.
Congress’s bill and the DHS order compared
| Question | H.R. 1121 (2025 bill) | DHS Order #2026-01 |
|---|---|---|
| Who acts | OMB writes standards, consulting GSA, CISA, DNI and Defense | Homeland Security secretary orders agencies directly |
| What is covered | The DeepSeek app and successor apps from High Flyer | DeepSeek, its affiliates and third-party products built on DeepSeek |
| Deadline | Standards within 60 days of enactment | Exclusion and removal immediately |
| Exceptions | Law enforcement, national security and security research | Case-by-case requests within 60 days, reviewed by CISA |
| Status | Referred to committee on 7 February 2025, per Congress.gov | In force; published 20 October 2026 |
Beijing’s response
Asked by an AFP reporter on 20 October about the order, Foreign Ministry spokesperson Mao Ning said China “has always opposed overstretching the concept of national security and politicizing technology and trade issues,” and that Beijing “will firmly safeguard the legitimate rights and interests of Chinese companies,” according to the ministry’s transcript (our translation). The transcript does not mention the Ding-related sanctions.
Why it matters
Peter’s World analysis, based on the sources cited above.
The order turns a ban that existed in pieces into one federal rule. Texas acted by proclamation more than a year and a half earlier, while the congressional bill has not moved past committee. FASCSA let DHS reach the same goal without new legislation, and the order goes further than the bill by covering affiliates and products built on DeepSeek models.
That third-party clause is the part with the widest reach. Because DeepSeek’s models can be downloaded and rebuilt, a vendor could sell a tool that runs on DeepSeek without naming it. Agencies now have to find such dependencies in software they already own, a supply-chain audit rather than an app deletion. The text itself allows for agencies “without internal capabilities sufficient to comply” and offers them technical help from CISA.
The timing is the main open question. The order is dated July, but the public saw it only in October, after the exception window appears to have closed. The notice does not say how many agencies asked for exceptions, whether any were granted, or how many DeepSeek installations were found and removed.
What to watch: any CISA guidance on detecting DeepSeek inside third-party tools; whether the Defense Department or the intelligence community issues matching orders for their own systems; similar FASCSA orders against other Chinese AI developers; and the first annual review due by July 2027.
Sources
- Federal Register: Notice of order regarding exclusion and removal of DeepSeek products from federal civilian IT systems (Oct. 20, 2026)
- U.S. Department of State: Imposing sanctions to protect Americans from intellectual property theft (Oct. 19, 2026)
- House Select Committee on the CCP: DeepSeek Unmasked (Apr. 16, 2025, PDF)
- Stanford Cyber Policy Center: Taking Stock of the DeepSeek Shock (Feb. 5, 2025)
