DHS Orders Federal Agencies to Cease Use of DeepSeek Products

The U.S. Department of Homeland Security (DHS) has mandated that federal civilian agencies stop using DeepSeek products and remove them from government systems.

This directive also extends to products from the Chinese AI company’s affiliates and third-party services utilizing DeepSeek technology.

DeepSeek, officially known as Hangzhou DeepSeek Artificial Intelligence Co., Ltd, develops large language models and provides a chatbot, API services, and models designed for coding and reasoning tasks.

While its AI tools gained significant popularity, they were soon followed by reports highlighting security risks and concerns regarding the potential for Chinese authorities to access user conversations.

In response, the DHS is taking regulatory action to restrict the use of DeepSeek and its derivatives on critical systems within the United States. The department has issued a notice of order requiring agencies to:

• Immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces.
• Immediately remove covered products from agency IT systems or seek an exception.
• Submit any exception requests within 60 days of the order’s issuance, detailing the justification and proposed risk mitigations. The Cybersecurity and Infrastructure Security Agency (CISA) will review these requests and provide written approvals or denials.

This order specifically applies to federal civilian agencies under DHS’s jurisdiction and does not constitute a blanket ban on private or consumer use.

DHS cited concerns over the Chinese government potentially accessing DeepSeek infrastructure, collecting personal information, tracking users, and possibly transferring sensitive government data to China.

The order also raises alarms about potential malware within DeepSeek models, referencing a February 2025 report from NowSecure that identified security vulnerabilities in the DeepSeek iOS app.

NowSecure’s examination revealed unencrypted data transmissions, weak encryption algorithms, insecure local storage, risks of user fingerprinting, and data sharing with ByteDance, the Chinese company behind TikTok.

The order was published in the Federal Register on October 20, a day after it appeared on Public Inspection.

Executive agencies have 60 days from the issuance date to request exceptions. For agencies unable to comply due to internal capability limitations, CISA will offer the necessary technical assistance.

Source: BleepingComputer