DeepSeek Products Banned from Federal Civilian Agencies; U.S. DHS FASCSA Order Published in Federal Register on Oct. 20

WASHINGTON

The U.S. Department of Homeland Security (DHS) published an order in the Federal Register (Vol. 91, No. 201, pp. 66346–66350) on October 20 directing the exclusion of DeepSeek products from federal civilian executive branch procurement and their removal from information technology systems. Under the Federal Acquisition Supply Chain Security Act (FASCSA), DHS required federal civilian agencies to exclude products from DeepSeek and its affiliates from procurement and to remove products currently in use from their systems. The notice is titled "Notice of Orders Concerning the Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurement," and the order number is 2026-01. Secretary of Homeland Security Markwayne Mullin signed the order, and DHS indicated July 24 as the date of initial issuance in the text of the order.

Federal Civilian Agencies Must Exclude DeepSeek Products from Procurement and Remove Them from Systems

DHS's first action is exclusion. All federal civilian agencies must exclude DeepSeek, DeepSeek affiliates, and their products from civilian agency procurements. DHS stated that this measure takes effect immediately upon issuance of the order. Features that facilitate the procurement of IT hardware, software, and services—such as agency-approved product lists, service provider equipment lists, and e-commerce marketplaces—are also subject to exclusion.

The second action is removal. Products provided by DeepSeek and its affiliates, as well as third-party products and services created using DeepSeek implementations, must be removed from federal civilian agency IT systems. This must also be implemented immediately upon issuance, and agencies unable to comply must apply for an exception. Here, IT refers to information and communications technology as defined in 41 U.S.C. § 1321.

The scope of affiliates follows the definition set forth in the Federal Acquisition Regulation (48 CFR 2.101). An entity is an affiliate if one directly or indirectly controls or has the power to control the other, or if a third party controls or has the power to control both. The scope of agencies subject to this order is also defined.

Order Applies to Federal Civilian Executive Branch Agencies, Excluding National Security Systems and Sensitive Compartmented Information Systems

DHS limited the application of the order to federal civilian executive branch agencies, excluding those agencies' national security systems and sensitive compartmented information systems from its scope. In a footnote, DHS explained the basis through federal statutory provisions. The Secretary of Homeland Security's authority to issue exclusion and removal orders does not extend to areas within the jurisdiction of the Secretary of Defense or the Director of National Intelligence (DNI). The Secretary of Defense may issue identical orders for Department of Defense systems and national security systems that are not sensitive compartmented information systems, while the DNI may do so for the intelligence community and sensitive compartmented information systems.

The underlying statute is the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). The statute is codified at 41 U.S.C. §§ 1321–1328, and its implementing regulations are in Title 41 of the Code of Federal Regulations, Part 201-1. Under this law, if the Federal Acquisition Security Council (FASC) recommends excluding risky products or services from federal procurement and IT systems, the Secretary of Homeland Security, the Secretary of Defense, and the DNI may issue orders within their respective authorities. The FASC final rule published in the Federal Register on August 26, 2021, took effect on September 27 of that year. DHS stated that the Secretary issued this order after reviewing the FASC's recommendation and relevant evidence. In the order's risk summary, DHS outlined the concerns regarding DeepSeek.

DHS Cites DeepSeek's China-Based Servers and Potential Collection of User Information as Risks

In the risk summary, DHS described DeepSeek as a privately owned foreign entity based in China. The company widely provides multiple artificial intelligence applications free of charge. DHS stated that DeepSeek's servers are located in China and explained that the Chinese legal framework grants broad authority for government cyber and intelligence functions to access private companies' infrastructure.

For models operated directly by DeepSeek, DHS stated that personally identifiable information is collected during account creation, allowing users to be tracked or digitally fingerprinted. DeepSeek's most widely used applications involve inputting information into the model and receiving responses. DHS explained that if U.S. government employees or contractors use them, sensitive data could be transferred to China. It noted that data transferred in this manner, either alone or combined with publicly available information, could yield actionable intelligence regarding Americans or government programs.

The order also noted that the models themselves may contain malicious code or other security vulnerabilities. DHS stated that open-source security research identified multiple critical vulnerabilities in DeepSeek's iOS mobile app. As supporting evidence in footnotes, DHS cited a DHS data security advisory dated December 22, 2020; an April 16, 2025 report on DeepSeek by the U.S. House Select Committee on Strategic Competition Between the United States and the Chinese Communist Party; and a February 6, 2025 analysis by security firm NowSecure, among others. Separately from this order, U.S. government agencies issued an advisory addressing China-based AI firms in September.

NSA, CISA, and FBI Issued Separate Advisory on September 8 Warning of Distillation Campaigns by China-Based AI Firms

On September 8, the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) released Cybersecurity Advisory AA26-251A, titled "Industrial-Scale AI Distillation Campaigns by China-Based AI Companies Targeting U.S. AI Companies." The three agencies named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The agencies stated that DeepSeek has conducted systematic distillation campaigns targeting leading frontier models of U.S. AI companies since at least late 2024. While distillation is recognized as a legitimate and useful technique in AI research, the three agencies assessed this activity as aggressive and malicious.

In a press release issued the same day, the NSA stated that advancements in Chinese AI models could enhance military and cyber offensive capabilities that could be directed against the United States and its allies. CISA and NSA accounts announced the release of the advisory on X on the same day. DHS did not cite this advisory as a basis in its October 20 notice. Neither DHS nor the NSA clarified what relationship exists between the two actions. The order provides a waiver process for agencies facing difficulties with implementation.

Agencies May Request a Waiver in Writing Within 60 Days of Issuance

Federal executive agencies may request a waiver from the DHS issuing official pursuant to 41 CFR 201-1.304(b). Agencies may request that the order not apply to the agency, not apply to specific actions, or that the implementation deadline be extended. Requests must be submitted in writing within 60 days of the order's issuance. The application must include five elements: identification of the applicable order, an explanation of the scope of the requested waiver, the name or description of the product or service covered by the waiver, compelling reasons why the waiver should be granted, and alternative mitigation measures the agency will undertake to reduce risk. As examples of compelling reasons, DHS cited the order's impact on an agency's ability to conduct its core mission, as well as national interest considerations such as national security reviews, national security investigations, and national security agreements.

CISA reviews requests and provides written notice of approval or denial. Requests must be sent to FASCSA.Orders@cisa.dhs.gov. The same address serves as the point of contact for implementation support and reporting inquiries regarding this order. The contact listed in the Federal Register notice is the FASCSA Orders Implementation Team in CISA's Cybersecurity Division.

DHS recommended that federal agencies take measures to address system risks during the period leading up to full removal. This includes monitoring ingress and egress traffic, strengthening logging and controls on relevant systems to prevent data exfiltration, and detecting and flagging anomalous activity. CISA can provide technical assistance to agencies lacking internal capacity to implement the order. As stipulated by FASCSA, the Secretary of Homeland Security will review the order within one year and annually thereafter. Such orders are issued through procedures established by FASCSA.

Covered Entities May Submit Response Within 30 Days of FASC Recommendation and File for Judicial Review Within 60 Days of Order

According to the FASC final rule, the Council must notify entities named in a recommendation of the recommendation. The notice includes the criteria relied upon by the Council and the information supporting the recommendation to the extent consistent with national security and law enforcement interests. Entities may submit information and arguments in opposition to the recommendation within 30 days of receiving notice. FASC may modify or withdraw the recommendation based on the entity's response. Otherwise, appropriate officials from DHS, the Department of Defense, and the DNI may issue orders pursuant to the recommendation. FASC does not issue orders directly.

Entities may also challenge an order after it is issued. Under 41 U.S.C. § 1327, an entity may petition for judicial review within 60 days of receiving notice of the order's issuance. Setting the effective date of the order and notifying the entity is the responsibility of the issuing official, not the FASC. DHS did not disclose how DeepSeek responded to this order or when it received notice.

The date DHS indicated on the order is July 24, while the Federal Register notice was published on October 20. DHS did not explain the gap between the two dates. James H. Percival II, DHS General Counsel, signed the notice, and the DHS docket number is DHS-2026-0628. DHS advised that a copy of the signed order can be found on regulations.gov by searching this number. Russell Vought, Director of the White House Office of Management and Budget, was listed as a recipient on the order.

Sources (KST)

• Federal Register 91 FR 66346–66350, 2026-10-20, Document Number 2026-21447 · https://www.govinfo.gov/content/pkg/FR-2026-10-20/pdf/2026-21447.pdf
• NSA, CISA, and FBI Joint Advisory AA26-251A, 2026-09-08 · https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a
• NSA Press Release · https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4592113/
• X @CISACyber · https://x.com/CISACyber/status/2097398347048837149
• X @NSACyber · https://x.com/NSACyber/status/2097374444062732374