> ## Content Index
> Fetch the complete content index at: https://www.theamericanquorum.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# DHS Discloses DeepSeek Ban Reaching Third-Party Federal Software
- URL: https://www.theamericanquorum.com/dhs-discloses-deepseek-ban-reaching-third-party-federal-software/
- Published: 2026-10-20T06:27:47.000Z
- Updated: 2026-10-20T06:27:47.000Z
- Description: A newly disclosed DHS order reaches DeepSeek-based software supplied by other vendors, not just its chatbot. The July directive covers federal civilian systems; its public release does not establish how much technology agencies have removed.
- Author: News Desk
- Tags: Tech

The Department of Homeland Security publicly disclosed an order October 19 requiring federal civilian agencies to remove DeepSeek technology, including third-party products and services developed using its implementations, from their information systems. The [official notice](https://public-inspection.federalregister.gov/2026-21447.pdf?ref=theamericanquorum.com) also excludes the Chinese artificial-intelligence company and affiliated products from civilian procurement. Its appendix carries an original release date of July 24, 2026, making this a new public disclosure of an earlier directive, not a newly issued October ban.

The distinction matters for agencies and vendors assessing the scope and timing of compliance. The notice was filed for public inspection October 19 and scheduled for Federal Register publication October 20\. It does not provide an inventory of affected systems or demonstrate that agencies have completed removal. Its reach nevertheless makes the underlying AI technology relevant even when software arrives under another supplier’s name.

## A supply-chain restriction beyond one chatbot

The order operates through the Federal Acquisition Supply Chain Security Act framework. Under the [implementing regulation](https://www.law.cornell.edu/cfr/text/41/201-1.303?ref=theamericanquorum.com), exclusion orders can reach products supplied through prime contractors and subcontractors, while removal orders can cover agency-operated systems and systems contractors operate on an agency’s behalf. That structure explains why a restriction can follow a technology through the supply chain rather than stop at the company directly selling to the government.

Authority is divided among civilian, defense and intelligence officials, rather than exercised through a single universal order. The regulation assigns civilian-agency orders to the homeland security secretary and separate responsibilities to defense and intelligence authorities. This DHS order expressly excludes national-security and secure compartmented information systems. Those boundaries should not be read as approving DeepSeek for excluded systems; they identify the limits of this particular instrument.

## Data practices underpin the government’s concern

[Reuters](https://www.reuters.com/technology/us-banning-chinese-ai-deepseek-government-agency-it-systems-2026-10-19/?ref=theamericanquorum.com) reported that DHS cited possible transfers of sensitive government or vendor data to China and the possibility that such information could support intelligence collection. The department also raised potential malware and vulnerability risks. Those are the government’s stated grounds for restricting use, not proof that every installation has leaked information or contains malicious code. Reuters said the Chinese Embassy in Washington did not immediately comment.

DeepSeek’s [privacy policy](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html?ref=theamericanquorum.com), updated February 10, 2026, says it collects user inputs that can include prompts, uploaded files and chat histories, alongside device and network information. It states that personal data are collected, processed and stored in China. The company also says it maintains technical, administrative and physical safeguards, and warns users not to submit sensitive personal data. These disclosures establish stated processing practices; they do not independently establish government access to any particular user’s information.

The policy has another important boundary: it does not govern end-user data processing by downstream applications built by developers using DeepSeek’s open-platform services. Those developers are responsible for disclosing their own policies. An application’s branding therefore cannot, by itself, resolve where data go or who controls their processing.

## App testing is evidence, but not a universal verdict

The DHS appendix cites a February 2025 [NowSecure investigation](https://www.nowsecure.com/blog/2025/02/06/nowsecure-uncovers-multiple-security-and-privacy-flaws-in-deepseek-ios-mobile-app/?ref=theamericanquorum.com) of DeepSeek’s iOS application. The mobile-security vendor said it tested the application on physical devices and found unencrypted transmission of some registration and device information, along with weaknesses involving encryption and embedded keys. This is a concrete technical record underlying part of the government’s concern, rather than an inference based solely on the developer’s nationality.

Its limits are equally important. The report describes the application examined in 2025, not a fresh October 2026 assessment of every DeepSeek model or deployment. NowSecure itself distinguished the mobile app from self-hosted models and versions hosted by other providers. Its commercial interest in mobile-security testing should also be recognized. The findings support scrutiny of implementation and data handling, but should not be extended into an unsupported assertion that every current third-party deployment shares the tested app’s defects.

## Exceptions require more than a different vendor label

The signed directive requires removal immediately after issuance or an exception request, with written requests due within 60 days of issuance. Its October disclosure does not restart that period. Under the broader [compliance rules](https://www.law.cornell.edu/cfr/text/41/201-1.304?ref=theamericanquorum.com), an agency seeking an exception must identify the affected product, describe the relief sought, offer a compelling justification and specify alternative risk mitigations.

The regulation allows requests covering particular actions, some requirements or a delay before compliance becomes practicable. It specifically recognizes effects on mission-critical functions as a possible justification. The [order rules](https://www.law.cornell.edu/cfr/text/41/201-1.303?ref=theamericanquorum.com) also require review at least annually and permit modification or rescission. That creates a review process, not an automatic exemption: an agency must explain why the restriction should be modified for its circumstances and how the associated risks would be reduced.

The immediate public consequence is greater clarity about a restriction that extends beneath the visible application to its AI components. What the disclosed record does not establish is the scale of agency use, completed removals or approved exceptions. Those implementation outcomes remain distinct from the existence and breadth of the order itself.