The US government has ordered federal civilian agencies to remove technology developed by Chinese artificial intelligence company DeepSeek, citing concerns about data security and potential access by Chinese authorities.
The Department of Homeland Security (DHS) made the directive public on October 19, although the underlying order was issued on July 24 by Homeland Security Secretary Markwayne Mullin.
The order prohibits agencies from purchasing DeepSeek products and requires their removal from government computer systems. It also covers affiliated companies and third-party products developed using DeepSeek technology.
DHS warned that information entered into DeepSeek's online services could be transferred to China, potentially exposing sensitive government material. The company's own privacy policy confirms that personal data collected through its services is processed and stored in China.
The department also warned that such information could be combined with publicly available records to gather intelligence on American citizens and government operations. It raised concerns about possible malware and other security vulnerabilities, although the publicly released order did not establish that DeepSeek had engaged in espionage.
Separately, a February 2025 investigation by mobile security firm NowSecure identified vulnerabilities in DeepSeek's iPhone application, including unencrypted transmission of some device information and insecure data storage.
However, there is an important distinction between DeepSeek's online services and its downloadable AI models.
DeepSeek's open-weight models can run entirely on privately operated computers, including Linux servers using software such as Ollama. When configured to operate locally without cloud connections, these models process information without sending prompts or responses to DeepSeek's servers in China.
Although local operation does not eliminate all security risks, it removes the need to transmit information to DeepSeek for processing.
Nevertheless, the DHS order extends to third-party technology developed using DeepSeek implementations, making no explicit exemption for models operated independently of the company's online services.
