Federal civilian agencies must stop buying from DeepSeek, the Chinese AI company, and pull its products out of their computer systems, under an order from the U.S. Department of Homeland Security. Products other companies build with DeepSeek's technology have to go too. The order, from Homeland Security Secretary Markwayne Mullin, is dated July 24. It was posted publicly on Monday, Oct. 19, and published in the Federal Register, the government's official journal, on Oct. 20.
The department gives its reasons in the order. It says DeepSeek's servers are in China, where the law gives the government's cyber and intelligence services extensive authority to get into private companies' computer systems. DeepSeek's most popular apps work by having people type in questions, and the order says that could send sensitive data to China when government workers or contractors use them. It adds that signing up for an account on DeepSeek's own service collects personal details and may track users, that the models themselves may contain malware or other security flaws, and that outside security researchers found several critical flaws in DeepSeek's iPhone app.
The ban reaches beyond DeepSeek's own chatbot. DeepSeek also makes its models free to download. For its newest model, the model's trained files are published, so anyone can download it and run it on their own computers. It has 763 billion parameters, the numbers a model tunes as it learns, far more than most home computers can handle. Other companies can build their own products on such models. The order covers those products too when they are used in civilian agencies' computer systems or to provide services to those agencies.
Agencies must stop buying from DeepSeek at once, including taking it off lists of approved products, and remove its products from their systems or ask for an exception. Exception requests were due within 60 days of the order being issued; counted from the July 24 date on the order, that window ended in late September. A request needs a compelling reason, such as the order getting in the way of an agency's most essential work; the Homeland Security department's own cybersecurity agency reviews the requests. Until removal is done, agencies are encouraged to watch traffic in and out of their networks and guard against data leaks. The department will review the order within a year and every year after.
Military and intelligence systems fall under other officials, so the order does not apply to the Pentagon or intelligence agencies. It also leaves out civilian agencies' own national security systems and their most sensitive intelligence systems. It tells only these agencies what to do, not businesses or the public, though agencies must also remove products that other companies, suppliers included, built with DeepSeek. The order does not say how many agencies use DeepSeek, which outside products it has in mind, or why it was made public nearly three months after its July 24 date.