DHS orders federal civilian agencies to remove DeepSeek products and third-party tools built on them, and bars new purchases under FASCSA

Linha do tempo

1. securityaffairs.com ↗ · pub. 21/10/2026 09:06 · coletado 21/10 12:00

   DHS Orders Federal Civilian Agencies to Remove DeepSeek Products and Bars Procurement Under FASCSA

   ler a análise desta fonte ocultar

   The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. The order was signed by Secretary Markwayne Mullin on July 24, 2026 under the Federal Acquisition Supply Chain Security Act of 2018. It was published in the Federal Register on October 20 (document 2026-21447, docket DHS-2026-0628), 87 days after signing. It also covers third-party products and services built with DeepSeek implementations, a term the notice does not define. DHS cites national-security concerns: DeepSeek use may transfer sensitive data to the PRC, and the models may contain malware or other security vulnerabilities. China's Foreign Ministry rejected the order as an overstretched concept of national security.

   Technical Details

   • The order covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates, plus third-party tools with embedded DeepSeek models.
   • DeepSeek's privacy policy states that personal data is collected, processed and stored in the PRC. The article notes this does not prove wrongdoing.
   • The ban took effect on issuance. Existing contracts are covered only once the contracting officer formally updates them.
   • Agencies can request an exception with strong justification.
   • The ban does not apply to private companies or ordinary users. Government contractors generally cannot use covered products for federal contracts without a waiver.
   • The article states no technical evidence of malware in DeepSeek models. The malware claim is DHS's stated concern.

   Remediation

   • Federal agencies should inventory systems for DeepSeek models embedded in apps, services and development tools.
   • Agencies should ask suppliers which AI models they use, where those models process data, and whether information leaves the customer environment.
   • Contractors should assess their exposure and seek waivers where needed.
2. securityweek.com ↗ · pub. 21/10/2026 07:54 · coletado 21/10 09:00

   US DHS bans DeepSeek AI from federal civilian systems; China threatens retaliation

   ler a análise desta fonte ocultar

   The US Department of Homeland Security has directed federal civilian agencies to remove DeepSeek products, and third-party products and services built on DeepSeek, from their IT systems. The order, dating to late July and made public in the Federal Register on Monday, also blocks procurement of DeepSeek products and services. DHS says DeepSeek's models "present multiple threat vectors". China's Foreign Ministry and Ministry of Commerce rejected the ban as discriminatory and warned of "all necessary measures" in response. The dispute adds to wider US-China friction over AI, including chip export controls, US claims of large-scale model "distillation", and Beijing's own proposed limits on exporting advanced AI models.

   Technical Details

   • The stated concerns are that DeepSeek's servers are located in China and that Chinese authorities could potentially access private company infrastructure and sensitive US data.
   • The ban extends to downstream products and services developed using DeepSeek.
   • The article cites no vulnerabilities, exploitation, IOCs or specific incidents.
   • The US also alleges that Chinese AI startups, DeepSeek among them, extracted capabilities from frontier American AI models through "distillation". Beijing dismisses the claim.

   Remediation

   • Federal civilian agencies must remove DeepSeek products and DeepSeek-derived third-party products and services from their IT systems.
   • Federal civilian agencies must not procure DeepSeek products or services.
   • Other organizations may want to inventory DeepSeek usage and model lineage in their AI supply chain. This is an analyst suggestion and is not stated in the article.
3. thehackernews.com ↗ · pub. 21/10/2026 05:04 · coletado 21/10 07:00

   DHS orders DeepSeek removed from US federal civilian systems and bans new purchases under FASCSA

   ler a análise desta fonte ocultar

   The U.S. Department of Homeland Security (Secretary Markwayne Mullin) ordered federal civilian agencies to remove DeepSeek products, and any third-party products or services "developed using DeepSeek implementations", from their IT systems. The order is dated July 24, 2026, was issued under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), and was published in the Federal Register on October 20. It also bars new purchases from Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliates. The notice gives no reasons and does not define "DeepSeek implementations". China's foreign ministry condemned the move as an overstretching of national security.

   Technical Details

   • Scope is limited to civilian agency procurement and use. It does not restrict companies or the public.
   • The order names the developer of the R1 and V3 models. The company's privacy policy says it collects, processes and stores users' personal data in the PRC.
   • Contractors holding contracts with FAR clause 52.204-30 may not provide or use covered products or services unless the issuing official grants a waiver. They must search SAM.gov for "FASCSA order" at least every three months and make a reasonable inquiry into their supply chain when a new order could affect them. They must report any covered product to the contracting officer within 3 business days and send mitigation information within 10 business days. They must also flow the clause down to subcontracts.
   • The signed order is posted on regulations.gov under docket DHS-2026-0628. DHS filed it for public inspection 87 days after its date.
   • This is only the second known use of FASCSA. The first was the 2025 exclusion of Acronis by the Director of National Intelligence.
   • Earlier restrictions were device bans adopted one body at a time (Congress, NASA, the Navy, the Pentagon and Texas by February 2025). Federal bills on the subject had not advanced past committee as of October 21.

   Remediation

   • Civilian agencies must inventory and remove DeepSeek products and third-party products built on DeepSeek implementations, and stop new purchases.
   • Agencies may request an exception in writing from the issuing official, with a compelling justification.
   • Contractors should check contracts for FAR 52.204-30, review their supply chains, and prepare to meet the 3-day and 10-day reporting deadlines.
   • Questions go to CISA's FASCSA Order Implementation Team at [email protected].
4. bleepingcomputer.com ↗ · pub. 20/10/2026 11:19 · coletado 20/10 12:00

   DHS orders US federal civilian agencies to remove and stop procuring DeepSeek products over China data-access concerns

   ler a análise desta fonte ocultar

   The U.S. Department of Homeland Security (DHS) has issued an order requiring federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from DeepSeek's affiliates and third-party products or services built on DeepSeek technology. DHS cites concerns that the Chinese government could access DeepSeek infrastructure, collect personal information, track users and receive sensitive government data. It is not a general ban on private or consumer use. The order was published in the Federal Register after appearing on Public Inspection the day before.

   Technical Details

   • DHS also raises concerns about potential malware in DeepSeek models.
   • It cites a February 2025 NowSecure report on the DeepSeek iOS app. NowSecure found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks and data sharing with ByteDance.
   • The article gives no IOCs, CVEs or confirmed compromise.

   Remediation

   • Agencies must immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces.
   • Agencies must immediately remove covered products from IT systems or request an exception.
   • Exception requests are due within 60 days of the order's issuance, with justification and proposed risk mitigations. CISA will issue written approvals or denials.
   • CISA will provide technical assistance to agencies that cannot comply because of internal capability limits.
5. techcrunch.com ↗ · pub. 20/10/2026 10:07 · coletado 20/10 11:00

   US orders federal civilian agencies to remove DeepSeek AI products and services from government IT systems

   ler a análise desta fonte ocultar

   The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek products and services and to remove them from government IT systems, citing national security concerns. The order also covers third-party products and services built on DeepSeek technology, though agencies may request exceptions. DHS warned that sensitive data from US government users could be accessible to Chinese authorities under Chinese law. China's Foreign Ministry rejected the move as politicizing technology and trade issues. The order extends a December 2025 law that restricted DeepSeek in intelligence and national security systems.

   Technical Details

   • The order covers both new purchases and existing deployments in federal civilian agencies.
   • The main stated risk is data handling: user data could be reachable by Chinese authorities.
   • A September report accused DeepSeek and five other Chinese AI companies, including Alibaba and Moonshot AI, of large-scale model distillation to extract information from American AI systems.
   • OpenAI told US lawmakers it had observed suspected DeepSeek distillation attempts. Anthropic said it had identified unauthorized attempts by DeepSeek and other Chinese AI labs to collect outputs from Claude.
   • Bloomberg reported that China is considering export restrictions on 23 AI-related technologies.

   Remediation

   • Federal civilian agencies must inventory and remove DeepSeek products and services, including third-party offerings built on DeepSeek technology.
   • Agencies that need to keep a product must request an exception.
   • Organizations outside government could review their own use of DeepSeek and downstream products as a precaution. The article does not say this.
6. gbhackers.com ↗ · pub. 20/10/2026 09:46 · coletado 20/10 11:00

   DHS orders federal civilian agencies to remove DeepSeek AI products and bars new procurement under FASCSA

   ler a análise desta fonte ocultar

   The U.S. Department of Homeland Security (DHS) has issued a Federal Acquisition Supply Chain Security Act (FASCSA) order directing federal civilian agencies to remove DeepSeek AI products from their IT systems and to stop acquiring them. The notice is due to be published in the Federal Register on October 20, 2026 and names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the targeted company. The order covers DeepSeek's affiliated entities and also third-party products and services built using DeepSeek implementations, which extends its reach across government software supply chains. DHS says DeepSeek models pose "multiple threat vectors" that could allow sensitive information to be transferred to the People's Republic of China. According to the article, this is a risk assessment and not confirmation of data theft in every covered deployment.

   Technical Details

   • Authority: FASCSA of 2018 (41 U.S.C. 1321–1328; 41 CFR 201-1), following a recommendation from the Federal Acquisition Security Council.
   • Two parallel requirements: a procurement exclusion for future acquisitions and a removal requirement for products already in use.
   • Affiliation is determined under 48 CFR 2.101. The removal requirement explicitly includes third-party products built on DeepSeek implementations, so a third-party interface or rebranding does not exempt a product.
   • Docket DHS-2026-0628 on Regulations.gov. The point of contact is the CISA FASCSA Order Implementation Team.
   • Scope is limited to federal civilian procurement and IT systems. The notice does not prohibit private individuals from using DeepSeek.

   Remediation

   • Agencies should inventory the AI components and underlying models in their products, not just standalone DeepSeek chatbot installations.
   • Procurement and cybersecurity teams should jointly identify affected suppliers, products and underlying implementations, and block covered technology from procurement pipelines.
   • Direct implementation questions to the CISA FASCSA Order Implementation Team.
7. theregister.com ↗ · pub. 19/10/2026 21:11 · coletado 19/10 23:00

   DHS orders all US federal civilian agencies to remove DeepSeek and DeepSeek-derived products

   ler a análise desta fonte ocultar

   The US Department of Homeland Security issued an order directing federal civilian agencies to stop using products from Chinese AI lab DeepSeek and to remove existing implementations. The order also covers "DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." That wording is vague and hard to comply with. It is unclear whether it covers ongoing API access to DeepSeek models or any software written with DeepSeek's help. The move extends earlier bans by DISA (January 2025), the US Navy, NASA, the US House of Representatives and several US states. Security expert Katie Moussouris of Luta Security called a ban on DeepSeek's own app and API workable, but said the third-party clause and the inclusion of US-hosted model versions go too far.

   Technical Details

   • AI gateways such as OpenRouter and Vercel AI Gateway route requests to the "best available" provider by default. Agencies could therefore end up using DeepSeek models unintentionally unless they constrain their providers.
   • An AI software bill of materials does not record which tools developers used, so it cannot verify compliance with the "developed using" clause.
   • Stated concerns include collection of prompts and responses, data flowing to servers in China, and the possibility that the model contains malware or vulnerabilities.
   • A December 2025 report on the DeepSeek Android and iOS apps cited plaintext information leaks, links to servers run by Chinese tech firms, and a lack of SSL pinning. The article notes these are common mobile security problems.
   • NIST found DeepSeek more vulnerable to prompt injection and easier to jailbreak than US models.

   Remediation

   • Inventory direct DeepSeek use, including apps, APIs and self-hosted models.
   • Constrain AI gateway provider routing so DeepSeek models cannot be selected implicitly.
   • Ask vendors to attest whether their products depend on or were developed with DeepSeek, bearing in mind the article's point that such attestation is hard to verify.
   • Await DHS clarification on the scope of "developed using."
8. cyberscoop.com ↗ · pub. 19/10/2026 12:27 · coletado 19/10 17:55 primeiro registro

   DHS bans DeepSeek products from federal civilian agencies over China data-collection and supply chain risks

   ler a análise desta fonte ocultar

   The Department of Homeland Security is barring civilian federal agencies from buying or using IT products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates. The notice, due in the Federal Register, cites the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council. An accompanying letter from Secretary Markwayne Mullin is dated June 26, so the exclusion has been in effect for months. Mullin says DeepSeek models pose "multiple threat vectors", including storage of data on servers in China, where national security laws let the government obtain data from domestic companies. He also cites collection of personally identifiable information and user "digital fingerprints", and the prompt-and-response process, which may transfer sensitive data to the Chinese government. DeepSeek is the only Chinese AI model named in the order, though Moonshot AI (Kimi) and Alibaba (Qwen) have drawn similar national security concerns.

   Technical Details

   • Mullin's letter says data transferred to the PRC, alone or combined with public data, could produce actionable intelligence on U.S. persons and government programs.
   • Models hosted directly by DeepSeek collect PII and trace users' online "digital fingerprints".
   • Some risks are specific to China as the country of origin. Others, such as privacy and mass data collection, could also apply to other Chinese and U.S. AI models.
   • The article reports no confirmed compromise, CVE or IOC. The order only mentions the possibility that agency networks were compromised through the tool.

   Remediation

   • Agencies must exclude DeepSeek products from future procurements and remove any versions already deployed.
   • Exceptions require a request submitted 60 days in advance with a "compelling justification", such as an inability to perform a mission-critical function or other national security considerations.
   • Until full removal, agencies are encouraged to monitor traffic flowing in and out of the agency, enable enhanced logging and data exfiltration controls on relevant systems, and detect and flag anomalous activity.