The Department of Homeland Security has ordered civilian federal agencies to stop buying products from DeepSeek, the Chinese chatbot developer, and to remove its software from their information technology systems, according to a notice published Tuesday in the Federal Register. The removal requirement reaches past DeepSeek's own products and those of its affiliates. It also covers third-party products and services developed using DeepSeek implementations.
The secretary of homeland security issued the order under the Federal Acquisition Supply Chain Security Act of 2018 after reviewing a recommendation from the Federal Acquisition Security Council and the evidence that accompanied it, the notice says. The signed order is attached to the filing and posted in the department's public docket, and questions about putting it into effect go to an implementation team in the Cybersecurity Division of the Cybersecurity and Infrastructure Security Agency. James H. Percival II, the department's general counsel, signed the notice.
Homeland Security made the order public on Monday, but it has been in force for months. CyberScoop reported that the notice includes a letter from Homeland Security Secretary Markwayne Mullin ordering DeepSeek's exclusion on June 26, and the BBC reported that the ban took effect at the end of July.
In that letter, Mullin wrote that DeepSeek's technology presents "multiple threat vectors" to civilian agency systems, according to CyberScoop's account of the document. He pointed to the company's storage of data on servers in China, where national security laws give the government wide latitude to obtain information from domestic companies. Versions hosted by DeepSeek itself collect personally identifiable information from users and trace their "digital fingerprints" online, he wrote, and the ordinary exchange of a user's prompt and the chatbot's response "may result in the transfer of sensitive data" to the Chinese government. The order also cites the potential for malware.
Handing that information to China, "either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs," Mullin wrote.
Agencies can request an exception, but they must offer a "compelling justification," such as an inability to carry out a mission-critical function. Until the software is gone, the order encourages agencies to protect themselves by "monitoring the flow of traffic in and out of the agency," adding logging and controls against data exfiltration, and flagging anomalous activity, the outlet reported.
The order applies to civilian departments such as Treasury, State and Justice, while agencies within the Defense Department fall outside it, the BBC noted. Before it took effect, agencies used their own discretion to block tools like DeepSeek, as the Commerce Department confirmed to FedScoop last year.
DeepSeek's software is open source and free to access, and developers can use it for a fraction of what closed American alternatives cost, according to the BBC. Its free chatbot app is one of the most downloaded in Apple's App Store rankings, and the company released its newest version last week.
The order arrives amid a broader dispute over Chinese technology. OpenAI and Anthropic have claimed that Chinese firms, DeepSeek among them, essentially copied their work, and Michael Kratsios, the White House technology lead, wrote in an internal memo earlier this year that "malicious exploitation" of American companies had been occurring, mainly by rival firms in China, the BBC reported. American developers and the federal government have accused DeepSeek's makers of "systematically" distilling American systems, CyberScoop has reported.
DeepSeek is the only Chinese developer named in the order. CyberScoop observed that some of the privacy and mass data collection concerns it raises could apply to other chatbots, Chinese and American alike, and that other Chinese developers, among them Moonshot, maker of Kimi, and Alibaba, maker of Qwen, have also worried national security officials or been accused of illegally copying American systems.
The BBC said it had contacted the department, DeepSeek and the Chinese embassy in Washington for comment. CyberScoop said it had reached out to the department and CISA for further details.