One signal

Update What changed

CyberScoop reports that the DHS order cites a review by the Federal Acquisition Security Council and the Federal Acquisition Supply Chain Act. The order covers DeepSeek products and services from its parent company, Hangzhou DeepSeek Artificial Intelligence, and requires agencies to remove existing deployments as well as stop future procurement.

The department’s letter, quoted by CyberScoop, says DeepSeek-hosted models store data on servers in China and may collect personally identifiable information and users’ “digital fingerprints”. DHS also warns that prompts and responses could transfer sensitive information, and that the models may contain malware or other security vulnerabilities.

Agencies can seek an exception, but CyberScoop says they must apply 60 days in advance and provide a compelling justification, such as a mission-critical need.

Sources and evidence

• DHS to ban DeepSeek from federal civilian agencies - CyberScoop: CyberScoop reports that DHS’s DeepSeek order cites data and security risks and allows agencies to seek exceptions with 60 days’ advance notice and a compelling justification.

Independent WittyWires Watcher; not an official account or feed.

Update What changed

The Department of Homeland Security says DeepSeek models pose “multiple threat vectors”, including the possibility that use could transfer sensitive information to China or produce “actionable intelligence” about US people and agencies. Those are the department’s stated grounds for the restriction, not independently established findings.

The reported restriction reaches beyond DeepSeek’s own service: it covers third-party products and services built using the model. Decrypt notes that DeepSeek is open-weight software that can be run locally or hosted by other providers, so the department’s concerns about data handling do not automatically describe every deployment.

A July DHS memo, made public on Monday, had already told agencies to monitor traffic to and from government websites for DeepSeek-related risks, according to Decrypt and The Straits Times.

Sources and evidence

• US Orders Civilian Agencies to Rip DeepSeek Out of Government Systems - Decrypt: Decrypt reports that DHS cited possible sensitive-data transfers, actionable intelligence and security vulnerabilities as reasons for its DeepSeek restrictions. The Straits Times and CyberScoop report that the restriction also covers third-party services built using DeepSeek, and that DHS had previously issued traffic-monitoring guidance.

Independent WittyWires Watcher; not an official account or feed.

Update What changed

The newly public order applies to federal civilian executive agencies, but excludes the Department of Defense, the intelligence community and national security systems, according to MeriTalk. DHS says the restrictions took effect in late July, after the order was signed on 24 July, even though the department made it public on 19 October.

The order also reaches third-party products and services built using DeepSeek implementations, as well as products from DeepSeek and its affiliates. That makes the scope a software-provenance question for agencies, not simply a matter of uninstalling one company’s hosted service.

During removals, DHS advised agencies to monitor network traffic, increase logging and use data-loss-prevention controls. MeriTalk says the Cybersecurity and Infrastructure Security Agency will oversee implementation.

Sources and evidence

• DHS Orders Civilian Agencies to Remove DeepSeek AI Products - MeriTalk: MeriTalk says the DHS order, signed on 24 July and made public on 19 October, covers federal civilian executive agencies but excludes defence, intelligence and national security systems; DHS advised monitoring, logging and data-loss-prevention measures during removal, with CISA overseeing implementation.

Independent WittyWires Watcher; not an official account or feed.