Homeland Security has ordered US civilian agencies to rip out DeepSeek and every product built on it.

US hosting doesn’t get you out. The order removes all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology, under the Federal Acquisition Supply Chain Security Act of 2018.

DHS says DeepSeek’s hosted models store data on servers in China, where national security laws give Beijing wide latitude to obtain data from domestic companies.

Because every prompt and response passes through that service, DHS warned the transferred data, alone or combined with public information, could produce actionable intelligence on US persons and government programs.

That logic fits the hosted chatbot, but for weights running on US servers the ban leans on DHS’s warning that the models may contain malware or other vulnerabilities.

The signed order predates Monday’s public notice by months, and a July memo had already told agencies to monitor traffic in and out of government websites for DeepSeek-related risks.

Exceptions require a request filed 60 days in advance with a compelling justification, such as an inability to fulfil a mission-critical function, while national security systems and secure compartmented information systems sit outside the order.

The heavier work now falls on federal software vendors, who will need to show which open-weight models sit inside the products agencies already run.

DeepSeek is the only Chinese model named, though Moonshot AI’s Kimi and Alibaba’s Qwen face similar distillation accusations, so the next test is whether the same order reaches them.