DHS Bans DeepSeek AI Tools, Halts Federal Agency Purchases Over National Security Risks
Homeland Security directs agencies to remove DeepSeek tools and stop buying related services due to data risks and national security concerns.
Key points
- DHS bans DeepSeek AI products and services in federal civilian agency IT systems.
- The order covers affiliated entities and third-party tools built on DeepSeek technology.
- Agencies must remove existing deployments and halt future acquisitions immediately.
Security operations teams face immediate pressure to remove DeepSeek artificial intelligence tools from federal civilian agency networks. The Department of Homeland Security (DHS) issued a directive mandating the elimination of these products and services. This action stems from concerns that the technology exposes sensitive government data to foreign access. Teams must assess the underlying AI technology in products to ensure compliance with the new restrictions.
In plain English
The ban extends beyond standalone DeepSeek applications to include any third-party product that utilizes DeepSeek’s underlying AI implementations. According to DHS, this broad scope means agencies cannot rely on vendor branding alone to determine compliance. If a tool is built using DeepSeek technology, it falls under the removal requirement. This approach treats the origin of the AI model as a critical compliance factor, regardless of the final supplier’s name or the application’s interface.
The background
DHS issued this order under the Federal Acquisition Supply Chain Security Act of 2018, citing statutory authority. The department followed a recommendation from the Federal Acquisition Security Council and reviewed supporting evidence. Reports indicate DHS warned that DeepSeek models present multiple threat vectors. The agency stated that using the tool requires providing data, which the company can use to track and digitally fingerprint users. This capability reflects the department’s risk assessment rather than confirming data theft.
What changes now
Federal civilian agencies, including the Treasury, State, and Justice departments, must stop acquiring DeepSeek-related products and services. They must also remove existing installations from their IT environments. The Defense Department is excluded from this specific civilian agency order, though it banned DeepSeek in January 2025. Congress previously restricted DeepSeek use in intelligence community systems late last year. The Commerce Department also advised its staff against using the tool in March.
What made it possible
Security teams should recognize that AI models often require extensive data ingestion to function, which creates inherent exposure risks. When organizations deploy external AI tools, they typically transfer control of the input data to the vendor. This dynamic allows the provider to analyze, store, and potentially profile users based on their queries. Teams usually evaluate whether third-party AI integrations comply with data retention policies. Assessing the underlying technology stack rather than just the front-end interface is essential for identifying hidden dependencies that may bypass standard security controls.
Background: Supply chain attacks
Small businesses face supply chain attacks because attackers target weaker vendors to reach you. Protect your network by enforcing least privilege, verifying software signatures, and demanding strict access logs from your IT provider. Isolate critical data and assume third-party tools can be compromised at any time.
Read the full guide: Supply Chain Attack Risks and Protection for Small Business
What to do and how to stay safe: DeepSeek
- Audit all AI tools and third-party applications to identify any use of DeepSeek implementations.
- Review procurement contracts to ensure no new DeepSeek-related services are being acquired.
- Verify that data handling policies prohibit sending sensitive information to external AI platforms.
- Monitor vendor documentation for disclosures regarding underlying AI model origins.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which agencies must remove DeepSeek AI tools?
Federal civilian agencies, including Treasury, State, and Justice, must remove the tools, while the Defense Department is excluded from this specific order.
Does the ban cover third-party products?
Yes, the directive includes third-party products and services developed using DeepSeek implementations, not just direct DeepSeek applications.
Why is DHS banning DeepSeek?
DHS cites multiple threat vectors, including the risk of user tracking, data fingerprinting, and potential access by the Chinese government.
