DHS Bars DeepSeek as Federal AI Security Tightens

The Department of Homeland Security ordered federal civilian agencies to remove China’s DeepSeek AI from their systems and barred future purchases of its products and services, including third-party services built using DeepSeek. The move invokes the Federal Acquisition Supply Chain Security Act of 2018, using federal procurement to control which technologies agencies can use.

DHS said the models “present multiple threat vectors” and their use “may result in the transfer of sensitive data to the [People’s Republic of China] if used by US government employees or vendors.” The notice didn’t explain the specific security concerns or give agencies a deadline.

DeepSeek offers cheaper alternatives to products from Anthropic and OpenAI. Its models had trailed leading U.S. systems, though some measures showed the gap narrowing over the previous year. DeepSeek is an open-weight model, making it easier to customize than closed models from Anthropic, Google and OpenAI.

Procurement and security

The Federal Acquisition Security Council reviewed a recommendation and supporting evidence before DHS issued its notice. The order follows other restrictions. The Commerce Department barred DeepSeek from government devices the previous year, and the U.S. Navy told members not to use the model over potential security concerns. New York state also blocked it on government devices and networks, citing “serious concerns” about possible data privacy and censorship risks.

DeepSeek’s arrival on the AI scene early the previous year carried major market stakes. Its cheaper models contributed to a $1 trillion rout in major U.S. technology stocks, including Nvidia, Microsoft and Tesla. The federal order now removes the product from civilian agencies’ systems as the government weighs the risks of using it.

The Federal Chief Information Security Officer’s Council plans a governmentwide tabletop exercise in early November to test responses to AI-enabled cyberattacks. Cyberattacks using artificial intelligence rose by 89 percent in 2025 compared with 2024, and the report said AI use in cyberattacks is increasing this year.

At ACT-IAC’s Cybersecurity Summit on Oct. 14, acting federal CISO Mike Duffy said the exercise would bring security operations center directors together to determine whether the federal enterprise has the capabilities, processes and people needed to respond. The council held its first all-government CISO-level tabletop the previous year, focusing more broadly on cybersecurity readiness and resilience.

Duffy said CrowdStrike’s 2026 report found hackers using AI-accelerated phishing and automated reconnaissance were reducing the time between initial access and impact. The report said AI attacks had elevated less sophisticated threat actors and amplified the most advanced ones.

Systems, workers and public data

Duffy said a CISO Council sprint was assessing how much progress agencies could make with current resources before the end of the fiscal year, including removing outdated edge devices and infrastructure. A binding operational directive requires agencies to secure and modernize endpoint devices. The long-term aim, he said, is to maintain operational resilience by repeatedly assessing which systems and infrastructure need attention.

The council restarted its AI working group, focused on security governance, and launched a post-quantum cryptography working group in the previous month. Duffy called the post-quantum effort a multiyear project that requires expertise and workforce migration. He cited the National Institutes of Standards and Technology and the Cybersecurity and Infrastructure Security Agency among government organizations working on next steps.

In a separate Federal News Network commentary, Travis Rosiek, public sector chief technology officer at Rubrik, argued agencies should prepare to keep critical missions running during cyberattacks instead of relying only on preventing intrusions. Rosiek said disaster recovery plans for natural disasters, power outages, floods and hardware failures don’t adequately address cyberattacks. He urged agencies to test recovery plans with security, cloud, IT and backup administrators, inventory data, identify its owners and map dependencies.

Data Foundation vice president for data policy and impact Taka Ariga called for a national data strategy. He said the United States has no national strategy, while the United Kingdom published one in 2020 and China developed national policy and a dedicated agency around data as a strategic asset. The Data Foundation launched a community-led effort to guide a national strategy, planning a living document open to feedback, discussion and critique. Ariga said the effort isn’t meant to create a new federal strategy, but to build on the existing federal foundation and extend it across society.