DHS orders US federal civilian agencies to remove and stop procuring DeepSeek products over China data-access concerns
The U.S. Department of Homeland Security (DHS) has issued an order requiring federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from DeepSeek's affiliates and third-party products or services built on DeepSeek technology. DHS cites concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users and receive sensitive government data. It is not a general ban on private or consumer use. The order was published in the Federal Register after appearing on Public Inspection the day before.
Technical Details
- DHS also raises concerns about potential malware in DeepSeek models.
- It cites a February 2025 NowSecure report on the DeepSeek iOS app. NowSecure found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks and data sharing with ByteDance.
- The article gives no IOCs, CVEs or confirmed compromise.
Remediation
- Agencies must immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces.
- Agencies must immediately remove covered products from IT systems or request an exception.
- Exception requests are due within 60 days of the order's issuance, with justification and proposed risk mitigations. CISA will issue written approvals or denials.
- CISA will provide technical assistance to agencies that cannot comply because of internal capability limits.
Linha do tempo
-
DHS orders US federal civilian agencies to remove and stop procuring DeepSeek products over China data-access concerns
ler a análise desta fonte ocultar
The U.S. Department of Homeland Security (DHS) has issued an order requiring federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from DeepSeek's affiliates and third-party products or services built on DeepSeek technology. DHS cites concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users and receive sensitive government data. It is not a general ban on private or consumer use. The order was published in the Federal Register after appearing on Public Inspection the day before.
Technical Details
- DHS also raises concerns about potential malware in DeepSeek models.
- It cites a February 2025 NowSecure report on the DeepSeek iOS app. NowSecure found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks and data sharing with ByteDance.
- The article gives no IOCs, CVEs or confirmed compromise.
Remediation
- Agencies must immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces.
- Agencies must immediately remove covered products from IT systems or request an exception.
- Exception requests are due within 60 days of the order's issuance, with justification and proposed risk mitigations. CISA will issue written approvals or denials.
- CISA will provide technical assistance to agencies that cannot comply because of internal capability limits.