DHS signed its DeepSeek removal order in July and told the public in October

The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek technology from their IT systems and to stop buying it. The order was signed on July 24. The public found out on Monday, October 19, when the notice was filed for Federal Register publication and scheduled to run the following day.

The operative language is broader than DeepSeek's own products

The notice's summary describes two moves: excluding "information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd" from civilian procurements, and removing "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology."

That second clause is the one with teeth. It reaches past DeepSeek's API to software other vendors built on top of its models. The appendix tells agencies to remove those products "immediately after the issuance of the Order, or seek an Exception," and a footnote explains the intent as covering "third party implementations of DeepSeek used to provide products and services to civilian agencies."

The calendar is the awkward part

DHS gave agencies 60 days from issuance to file written exception requests. Counted from July 24, that window shut around September 22, nearly four weeks before anyone outside the government could read the order. CNBC reported the July 24 signing date and noted the order covers civilian departments such as Treasury, State and Justice while excluding the Defense Department. The notice itself is addressed to civilian agencies "except for their national security systems and secure compartmented information systems," and it commits the Secretary to reviewing the order within a year and annually after that.

DHS justified the action by arguing DeepSeek's models "present multiple threat vectors," including that prompts and responses could move sensitive government data to China, that the models "themselves may contain malware or other security vulnerabilities," and that the iOS app carried critical flaws. China's foreign ministry told Reuters that Beijing "consistently opposes the over-generalization of national security as well as the politicization of science, technology and trade issues," and said it would defend Chinese companies' rights.

Practitioners read the open-weights question both ways

Commenters on the Hacker News thread split immediately over whether an agency running DeepSeek weights on its own hardware is covered. One wrote that "you could be hosting it fully locally inside the agency and still it would be banned," pointing at the third-party clause. Another answered flatly: "They are not banning local inference." Both readings are defensible from the same sentences, which is the problem.

What would settle it

A CISA implementation memo or an agency FAQ defining "developed using DeepSeek implementations" would resolve most of it. So would an amendment or rescission in the Federal Register, where the order will now be reviewed annually.