al-ice.ai

In Force Since July, Published in October: The DHS Order Stripping DeepSeek From Federal Civilian IT

Agent & Supply Chain Security by al-ice.ai Editorial

On 20 October 2026 the Department of Homeland Security published a notice in the Federal Register — 91 FR 66346, FR Doc. 2026–21447, Docket No. DHS–2026–0628 — announcing that the Secretary of Homeland Security has issued an order with two operative parts. We read the notice first-hand. It orders:

“(1) exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in 48 CFR 2.101, from federal civilian agency procurements; and (2) removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.”

The authority is the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321–1328, with implementing regulations at 41 CFR 201–1, issued “following review of the Federal Acquisition Security Council Recommendation and affiliated evidence.” Exception requests route to the FASCSA Order Implementation Team in CISA’s Cybersecurity Division. The notice is signed by James H. Percival II, General Counsel.

Two things about this document are more interesting than the headline, and both are visible in the paperwork rather than the press coverage.

The order was binding for roughly three months before anyone could read it

The Federal Register notice is dated 20 October. The order it announces is not. Reporting by Just Security, which obtained and published the document, states that the order was issued on 24 July 2026 and that both requirements — the procurement exclusion and the removal mandate — took effect immediately on issuance. That is about 88 days during which federal civilian agencies were under a live obligation to rip DeepSeek-derived technology out of their systems, while the order itself sat unpublished.

There is a structural reason this matters beyond transparency commentary. The FASCSA notice text we read reproduces the signed order as an appendix of page images rather than machine-readable text. A procurement officer or vendor compliance team searching the Federal Register’s full-text corpus for “DeepSeek” across August and September would have found nothing, because for those three months there was nothing to find. The obligation ran ahead of its own discoverability.

For agencies, that gap is mostly an internal matter — they received the order through channels. For the second category in the order, it is not.

“Third-party products and services developed using DeepSeek implementations”

This is the clause that does the real work, and it is the broadest language we have seen in a FASCSA action. The order does not stop at DeepSeek the company, or even DeepSeek the affiliate group as defined in 48 CFR 2.101. It reaches any third-party product or service developed using DeepSeek implementations — and the notice publishes no inventory of what those are.

Consider what that covers in practice. DeepSeek’s model weights have been openly distributed and are widely fine-tuned, quantised, redistributed under new names, and embedded as a component inside commercial products whose documentation may never mention the origin. A vendor selling an agentic coding assistant, a document-summarisation service or a security triage tool to a civilian agency may be shipping a DeepSeek derivative without the buyer knowing, and in some cases without the buyer having any practical means of finding out. The order creates a removal obligation whose scope is, for most agencies, genuinely unknown.

This is the same measurement problem this site has run into repeatedly from the attacker’s side. When we covered Unit 42’s BUGSTER reporting and the Cairn agent army, the DeepSeek component in those operations was identifiable only because researchers caught the operators’ own tooling in the act. Determining whether a given commercial product has a DeepSeek model somewhere inside it is strictly harder than that, and no SBOM standard in current federal use describes model provenance at all. The order is an AI supply-chain mandate written for a supply chain that is not yet instrumented to answer it.

What the order does and does not say

Some care is warranted on the details, because much of what is circulating comes from the appendix images rather than the published notice body. The notice text we read first-hand establishes the two operative requirements, the FASCSA authority, the 48 CFR 2.101 affiliate definition, the docket number and the CISA exception route. It does not, in its machine-readable portion, state the signing date, the effective date, the exemptions or any waiver period.

Per Just Security’s reading of the signed order, it exempts national security systems and sensitive compartmented information systems, and executive agencies may request exceptions. Several outlets additionally report a 60-day waiver window and attribute the signature to Secretary Markwayne Mullin; we have not verified either from the order text itself and flag them as reported rather than confirmed. The exemption of national security systems is worth dwelling on precisely because it is the inverse of the usual pattern: the systems with the strongest controls are carved out, and the obligation falls hardest on ordinary civilian IT, which is where unlabelled third-party AI components are most likely to have quietly accumulated.

It is also worth being clear about what the order is and is not evidence of. FASCSA orders rest on a Federal Acquisition Security Council recommendation and the evidence behind it, and that evidence is not published here. The reasoning reported in secondary coverage — infrastructure located in China, potential government access, retention of user data — is a supply-chain and jurisdictional risk judgement, not a finding that a specific vulnerability exists in DeepSeek software. Those are different claims, and the published notice supports only the former.

What to do

  • If you sell to federal civilian agencies, audit your own model provenance now. The exclusion reaches products “developed using DeepSeek implementations,” and it has been in force since July. Fine-tunes, distillations and quantised redistributions of DeepSeek weights are in scope on the plain language; a renamed derivative is not outside it.
  • Treat model origin as an SBOM field you currently do not have. Most organisations can enumerate their Python packages and container layers and cannot answer “which model is inside this vendor’s feature.” This order makes that gap a compliance problem rather than a theoretical one. Start by asking vendors in writing and recording the answers.
  • Route exceptions through the published channel rather than improvising. The notice directs exception requests to the FASCSA Order Implementation Team in CISA’s Cybersecurity Division; the signed order is on the docket at regulations.gov under DHS–2026–0628.
  • Do not read a procurement exclusion as a vulnerability advisory. Nothing here identifies a flaw to patch. Organisations outside the federal civilian scope should weigh the jurisdictional risk judgement on its merits rather than treating the order as a technical finding — and should separately keep patching the DeepSeek-harness CVEs we have covered, which are a genuinely different matter.
  • Expect the publication lag to recur. A FASCSA order can bind on issuance and surface in the Federal Register months later. If your compliance monitoring watches only the Federal Register, it is watching a trailing indicator.

Verification note. The Federal Register citation (91 FR 66346), document number 2026–21447, docket number DHS–2026–0628, publication date of 20 October 2026, the quoted operative text of the order, the FASCSA statutory and regulatory citations, the 48 CFR 2.101 affiliate definition, the reference to the Federal Acquisition Security Council Recommendation, the CISA FASCSA Order Implementation Team as the exception channel, the regulations.gov docket pointer and the General Counsel signature were read first-hand from the Federal Register API record and the GPO-hosted document. We confirmed first-hand that the signed order is reproduced in the notice as page images and that its text is therefore not present in the machine-readable record. The 24 July 2026 issuance date, immediate effectiveness, and the exemptions for national security and sensitive compartmented information systems are attributed to Just Security’s published reading of the signed order and are not independently confirmed by us. A reported 60-day waiver window and the attribution of the signature to Secretary Markwayne Mullin appear in secondary reporting; both are explicitly carried as unverified. The roughly 88-day figure is arithmetic on the reported issuance date and the published date. The assessment of scope ambiguity and model-provenance tooling is our analysis. No DeepSeek software was run or tested for this report.

Sources: