Skip to content
Hacker Posts

DHS orders DeepSeek stripped from federal civilian systems

A DHS FASCSA order bars civilian agencies from running or buying DeepSeek — and third-party products built on it. Contractors inherit search-and-report duties via FAR 52.204-30.

Published 3 min read
policydeepseekfascsaai-security

The Department of Homeland Security has issued an exclusion-and-removal order barring U.S. civilian federal agencies from running or buying products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates — and, critically for operators, from "third-party products or services developed using DeepSeek implementations." The order was signed by Homeland Security Secretary Markwayne Mullin, published in the Federal Register on 20 October 2026, and sits on regulations.gov under docket DHS-2026-0628.

What changed and when

The order is dated 24 July 2026 but was only filed for public inspection on 19 October and published on 20 October — an 87-day gap. It takes effect as a binding exclusion: agencies "shall comply with exclusion and removal orders," and an exception requires a written request with a compelling justification. The practical scope is two-fold: remove DeepSeek products already in civilian IT, and stop new procurement of covered products and services.

Who it applies to

  • Civilian agencies directly. The Defense Department and the intelligence community have separate FASCSA issuing officials and are not covered here.
  • Contractors, through FAR clause 52.204-30. An order issued after a solicitation binds an existing contract only once the contracting officer adds it by amendment.
  • Not private companies or the public — this is a procurement-and-removal order, not a nationwide ban.

The concrete obligations

For contractors subject to 52.204-30:

  1. Search SAM.gov for "FASCSA order" at least every three months.
  2. Report covered products found in your supply chain within 3 business days of identifying them.
  3. Send mitigation information within 10 business days of that report.

The order's reach into "third-party products or services developed using DeepSeek implementations" is the hard part, and DHS did not define the phrase. If you have inventoried for DeepSeek the model but not for downstream tools fine-tuned on or wrapping it, your inventory is incomplete.

The authority is the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA): the Federal Acquisition Security Council recommends such orders, and the Secretary of Homeland Security issues them for civilian agencies. The Federal Register notice itself states no security rationale; separate reporting attributes DHS's concern to data residency and intelligence risk, and DeepSeek's own privacy policy says it stores user data in the PRC. Earlier U.S. action was piecemeal — a Pentagon IT body blocked the chatbot in January 2025, and Commerce and the Navy barred it on devices — while bills to ban it on government devices, introduced in February 2025, stalled in committee. This order is the first government-wide civilian mechanism with contractor reporting teeth. China's foreign ministry said it "consistently opposes the overstretching of the concept of national security."

What to do

  1. Inventory for DeepSeek models and derived tooling: anything fine-tuned on, distilled from, or wrapping DeepSeek weights.
  2. If you sell to civilian agencies, wire the SAM.gov quarterly check and the 3-/10-day reporting windows into your supply-chain process now.
  3. Route implementation questions to CISA's FASCSA Order Implementation Team rather than guessing at the undefined "developed using" language.

Related stories