DHS bans DeepSeek products across US federal civilian agencies

DHS has issued a directive banning the use of DeepSeek products across U.S. federal civilian agencies, citing risks of Chinese government access to infrastructure and sensitive data. The ban extends to affiliates and third-party products using DeepSeek technology. A February 2025 NowSecure report highlighted security vulnerabilities in the DeepSeek iOS app, including unencrypted transmissions, weak encryption, insecure storage, user fingerprinting, and data sharing with ByteDance. Agencies must remove these products or seek exceptions within 60 days. CISA will review exception requests and provide technical assistance if needed. The order is intended to mitigate risks of data exposure and potential malware embedded in DeepSeek models.

The directive addresses risks of unauthorized access to sensitive government information through DeepSeek products, including potential data exfiltration to the Chinese government. Vulnerabilities such as unencrypted data transmission and insecure storage increase the risk of data interception and compromise. The presence of user fingerprinting and data sharing with ByteDance raises privacy concerns. The ban aims to prevent these risks from affecting federal civilian agencies' IT systems, thereby protecting government data confidentiality and integrity.

Federal civilian agencies must immediately cease procurement of DeepSeek products and remove existing installations from their IT systems. Agencies unable to comply immediately may submit exception requests within 60 days, detailing justifications and risk mitigations for CISA review. CISA will provide technical assistance to agencies facing capability challenges. No action is required for private or consumer use. Agencies should follow the DHS order and coordinate with CISA for compliance and exception processing.