Will federal civilian workers' data be safe after DHS mandates DeepSeek removal?
Homeland Security orders the removal of DeepSeek tools from civilian federal IT systems, citing risks of data leakage to China and potential malware.
Key points
- DHS bars civilian agencies from procuring or using DeepSeek products and services.
- The order requires the removal of any existing DeepSeek implementations from agency networks.
- Officials cite risks including data storage in China, malware, and mass data collection.
The short version
- The Department of Homeland Security has banned the use of DeepSeek AI models in federal civilian agencies.
- Agencies must exclude DeepSeek from future procurement and remove any current instances from their IT systems.
- The ban covers products from parent company Hangzhou DeepSeek Artificial Intelligence and its affiliates.
The details
The Department of Homeland Security is prohibiting civilian federal agencies from using the Chinese AI model DeepSeek, according to CyberScoop. A notice set for publication in the Federal Register cites the Federal Acquisition Supply Chain Act to bar purchases from parent company Hangzhou DeepSeek Artificial Intelligence. Secretary of Homeland Security Markwayne Mullin ordered the exclusion of DeepSeek products on June 26, indicating the restriction has been active for months. The order mandates that agencies remove any versions of the software already in place.
Mullin stated that DeepSeek models present multiple threat vectors to civilian federal IT systems. He highlighted concerns that the models store data on servers in China, where national security laws allow the government to access domestic company data. The models also collect personally identifiable information and trace digital fingerprints. Mullin warned that this data transfer could produce actionable intelligence on US persons and government programmes.
The context
The ban arrives shortly after DeepSeek released its latest model, V4.1-Flash-1017, which the company described as smarter and more efficient, according to Engadget. DHS characterised the risks as potentially resulting in the transfer of sensitive data to the Chinese government. The notice also disallows DeepSeek from participating in any federal government contracts. This follows previous accusations that the company systematically distilled models from US frontier AI firms.
Next steps
Civilian agencies, including the Environmental Protection Agency and Federal Communications Commission, must comply with the directive. They are required to exclude DeepSeek products from future procurements. Additionally, they must remove any versions that might have been put in place prior to the ban. The order extends to third-party products and services developed using DeepSeek implementations, raising supply-chain compliance questions.
What defenders should look for
Security teams should review cloud access logs for connections to unknown or foreign-hosted AI endpoints. Check whether employees have installed unofficial AI tools or browser extensions that process data externally. Look for unusual outbound traffic patterns that match large data uploads typical of prompt-and-response AI interactions. Verify that shadow IT policies are enforced to prevent the use of unapproved generative AI services. Ensure that data loss prevention rules block sensitive information from reaching external AI inference engines.
Background: Personally identifiable information
Personally identifiable information refers to any data that can identify a specific individual, either alone or when combined with other details. This includes names, addresses, and digital identifiers. Understanding the scope prevents accidental exposure through seemingly harmless records.
Read the full guide: What Does Personally Identifiable Information Mean and How to Protect It
What to do and how to stay safe: DeepSeek
- Audit network traffic for connections to known DeepSeek endpoints or similar foreign-hosted AI services.
- Review procurement records to ensure no new contracts involve DeepSeek or its affiliates.
- Scan endpoints for installed DeepSeek applications or related third-party software.
- Monitor data exfiltration alerts for large transfers to external AI processing servers.
Step-by-step guide: Immutable Backups: Stop Ransomware Deleting Your Data Copies
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which agencies are affected by the DeepSeek ban?
The ban applies to all federal civilian agencies, including the EPA and FCC, as stated by DHS.
When was the DeepSeek ban ordered?
Secretary Markwayne Mullin ordered the exclusion of DeepSeek products on June 26.
Why is DHS banning DeepSeek?
DHS cites risks of data transfer to China, potential malware, and mass data collection concerns.
