DeepSeek removed from federal agencies under a DHS supply-chain order

DeepSeek removed from federal agencies is not a rumour or a device policy any more. It is a formal order. Civilian federal agencies must remove DeepSeek products from their information technology systems, and they must also remove third-party products and services “developed using DeepSeek implementations,” according to reporting on the Department of Homeland Security order The Hacker News.

The order was published in the Federal Register on 20 October 2026. Homeland Security Secretary Markwayne Mullin dated it 24 July 2026, 87 days earlier, and DHS filed it for public inspection on 19 October The Hacker News. The docket is DHS-2026-0628.

Information verified through 25 October 2026.

DeepSeek removed from federal agencies: what the order actually covers

Start with the named company. The order names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., the developer of the R1 and V3 models, and covers its affiliates The Hacker News. Agencies may no longer buy information technology products or services from that developer or its affiliates.

Then look at the reach. Removal does not stop at an app with DeepSeek on the label. It extends to products and services from other suppliers if they were developed using DeepSeek implementations The Hacker News. That clause turns a vendor ban into an audit problem. An agency may not know, without asking, what sits inside a tool it bought from someone else.

The DHS DeepSeek exclusion and removal order and the law behind it

The legal vehicle is the Federal Acquisition Supply Chain Security Act of 2018. Under that law, the Federal Acquisition Security Council recommends action, and three officials can issue exclusion and removal orders: the Secretary of Homeland Security for civilian agencies, the Secretary of Defense for the Defense Department and national security systems, and the Director of National Intelligence for the intelligence community The Hacker News.

That division explains the order’s limits. This is a DHS order, so it covers civilian agencies’ buying and running of technology. It does not restrict companies. It does not restrict the public The Hacker News. A private firm can still make its own call. A person at home is not covered at all.

The law has been used before, but rarely. It was first used in 2025, when the Director of National Intelligence excluded Acronis from intelligence community procurement The Hacker News.

Why DeepSeek? Reuters reporting, carried by The Hindu BusinessLine, says DHS described the models as posing “multiple threat vectors” and warned that use “may result in the transfer of sensitive data to the PRC if used by US government employees or vendors” The Hindu BusinessLine. DHS also warned the models could produce actionable intelligence on US persons and agencies, and might contain malware or vulnerabilities, in that reporting. DeepSeek’s own privacy policy says it collects, processes and stores personal data in the People’s Republic of China The Hacker News.

Read those pieces separately. A privacy policy stating where data is stored is a documented fact. A warning that a model may contain malware is a government risk claim. Digital Watch makes the distinction plain: the order does not by itself establish that every covered product transmitted data or contains malicious code; it is a precautionary supply-chain measure Digital Watch.

DeepSeek ban civilian government IT: the contractor duties hiding underneath

The headline is removal. The workload sits with contractors.

Contractors covered by FAR 52.204-30 are barred from providing or using covered products, must search SAM.gov quarterly, must report a covered product within three business days of finding it, and must supply mitigation information within 10 days The Hacker News. The clause must also flow down into subcontracts.

Exceptions exist, but they are not a casual loophole. An agency needs a written request with a compelling justification The Hacker News, with mitigation measures attached Digital Watch.

Before this order, restrictions arrived one institution at a time. By February 2025, Congress, NASA, the Navy, the Pentagon and Texas had each barred DeepSeek from government devices in their own domains The Hacker News. Those were device bans. This order uses procurement law to push a product out of the supply chain feeding civilian systems.

Third-party products developed using DeepSeek: the undefined centre of the order

That third-party clause will decide how big this ban feels in practice.

Open models travel. They get embedded, adapted, wrapped in interfaces, and sold under other names. If “developed using DeepSeek implementations” is read broadly, agencies face a long trawl through supplier declarations and contracts. Read narrowly, the order mostly removes visible DeepSeek products. The notice does not define the phrase, and the Federal Register notice itself gives no reasons for the decision, with the signed order attached The Hacker News.

China has answered in predictable terms. Foreign ministry spokesperson Mao Ning said on 20 October that China “consistently opposes the overstretching of the concept of national security” and would safeguard the rights of Chinese companies, according to Associated Press reporting cited by The Hacker News The Hacker News. DeepSeek did not immediately respond to the AP’s request for comment.

Analysis: The practical test is not whether agencies can delete an app. They can. The test is whether the federal government can map its own AI supply chain well enough to enforce a ban on ingredients, not just brands. Expect the first fights to be definitional — what counts as a DeepSeek implementation, who must certify it, and how deep a contractor has to dig. Boring questions, large consequences.

Sources

1. The Hacker News — U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases, 21 October 2026 — https://thehackernews.com/2026/10/us-orders-deepseek-removed-from-federal.html
2. The Hindu BusinessLine — US orders removal of DeepSeek from civilian government IT systems (Reuters), October 2026 — https://www.thehindubusinessline.com/info-tech/us-orders-removal-of-deepseek-from-civilian-government-it-systems/article71603248.ece/amp/
3. Digital Watch — US bans DeepSeek AI from federal civilian agencies, October 2026 — https://dig.watch/updates/us-bans-deepseek-ai-federal-civilian-agencies