On October 19, 2026, the US Department of Homeland Security (DHS) submitted a document to the Federal Register for public notice (Document No. 2026-21447, Docket DHS-2026-0628). The publication of this document made it known to the outside world for the first time that a federal ban called "Exclusion and Removal Order #2026-01" had already been enforced silently for nearly three months.
The ban was formally signed by Secretary of Homeland Security Markwayne Mullin on July 24, 2026, requiring all US federal civilian executive agencies to immediately stop purchasing DeepSeek products and to remove existing DeepSeek software—including any third-party products and services developed on DeepSeek implementations—from their IT systems. The named entity is "Hangzhou DeepSeek Artificial Intelligence Co., Ltd." and its affiliates.
The Most Notable Thing Is Not the Ban Itself, but the Time Lag
Eighty-seven days passed between the signing and the public notice.
The exception application process attached to the ban required agencies to submit applications 60 days in advance and provide "compelling reasons." According to Forkast News, when the public notice document appeared in the Federal Register's public search section on October 19, this 60-day window had in fact already closed—if agencies wanted to apply for an exemption, they should have completed their submissions well before the public notice date. In other words, before the ban was made public, it had already been implemented through private notification channels, and the public notice was merely the final step in completing the legal process.
This mode of operation itself sends a signal: Washington treats this removal as an accomplished fact, not as a policy proposal inviting public discussion.
The "Model Lineage" Clause: The More Radical Part Than the Ban Itself
There is precedent for a federal ban to shut out a Chinese technology company. In 2017, Kaspersky antivirus software was expelled from federal systems; in 2019, Huawei telecommunications equipment faced larger-scale restrictions. These precedents all point to the same legal track: the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA). Mullin invoked the same law this time, issuing the ban after review by the Federal Acquisition Security Council.
But this ban has one clear breakthrough: the scope of control is not limited to DeepSeek-branded products but extends to any third-party product built on a DeepSeek implementation.
This means that if a vendor white-labels or embeds the DeepSeek model and sells it under a different name, it is equally within the ban's reach. According to CyberScoop, federal agencies now need to audit the model provenance in their software stacks, not merely check vendor names. This is an extension of supply-chain security review logic from the hardware layer to the model weight layer—the government wants to know and control what model is running in the software stack.
Compare this with how Huawei was handled: federal restrictions ultimately transmitted to the private sector through procurement pressure, and federal contractors gradually became unable to use excluded equipment in classified projects. DeepSeek is very likely to follow the same path this time—CNBC reported that the industry already expects companies holding federal contracts may in the future need to prove that their AI tool stacks contain no DeepSeek lineage.
The Three Threat Vectors in the Official Allegations
In the attachment, DHS listed three categories of security concerns: first, DeepSeek servers are located in China, and Chinese national security laws give the government broad powers to obtain data from companies within its territory; second, models hosted on DeepSeek services collect users' personally identifiable information and track "digital fingerprints"; third, the model itself may contain embedded malicious code.
The first two threat vectors are not new, nor are they unique to DeepSeek—any cloud service operating under Chinese legal jurisdiction faces the same compliance dilemma. Mullin also acknowledged this in the document, saying: "Certain threat vectors are unique to the company's country of origin, while other threat vectors point to privacy and mass data collection issues that may apply equally to other Chinese and even US AI models."
The third—that the model itself may carry malicious code—is the truly new dimension of the allegation. This means the US government has come to regard AI model weight files as potential attack vectors, not merely as one end of a data pipeline. If this logic is solidified into a review framework, any future large model of opaque origin entering federal systems will face equivalent weight-level security review.
Open-Source Deployment Offers No Exemption
DeepSeek releases its models in an open-weight format, so in theory anyone can download the weights and run them on their own servers, with data not passing through DeepSeek's Chinese infrastructure. This feature is a major selling point in commercial scenarios—according to an analysis by MindStudio, DeepSeek V4 spread rapidly after its release in April 2026, and open-source models' share of enterprise compute consumption had reached 38% in the first quarter of 2026, far above 11% a year earlier.
But this ban makes clear that self-hosting cannot bypass the controls. The ban targets "products developed on DeepSeek implementations," not "products that connect to DeepSeek servers." The model weights themselves are the object of review. The government's logic is: even if data does not leave the country, whether there are hidden backdoors in the code and whether there is telemetry returning data along the call chain—as long as the source is untrustworthy, the deployment method is not the core issue.
This poses a structural challenge to the entire open-source large-model ecosystem: the "transparency" promised by open source means weights are downloadable and code is auditable—but the government's answer is that auditable does not mean audited, and the credibility of the source country takes priority over the openness of the technical architecture.
Legally, the Ban Covers Only Civilian Agencies; in Practice, It Reaches Further
The ban explicitly limits its scope to "federal civilian executive agencies" and does not cover the Department of Defense, military, or intelligence systems—according to The Guardian, the Department of Defense has made no public statement on the matter. The ban also does not touch the private sector; US citizens and companies are still legally free to use DeepSeek.
But the historical effects of federal exclusion orders show that pressure on the private sector will arrive indirectly. A report by technology analysis firm Tech-Insider noted that this ban has provided state governments, critical infrastructure operators, and corporate risk officers with a "federally endorsed baseline"—even without direct legal constraints, citing the DHS ban as grounds for internally restricting DeepSeek is sufficient at the compliance level.
Meanwhile, in early October, DeepSeek had just updated the lightweight version of V4 and was expanding its developer ecosystem globally. The public disclosure of the ban came right after this update, a timing that invites speculation—whether intentional or coincidental, it sent the market a clear signal at the most active moment.
Independent Judgment
The technical substance of this ban is far lower than its policy substance. The data-cross-border and server-location risks listed by DHS did not provide any new evidence of DeepSeek-specific vulnerabilities or confirmed intrusion incidents; the allegation that "the model may contain malicious code" also came without any public summary of technical findings.
What truly deserves attention is the precedent it establishes: the US federal government has incorporated "the country of origin of model weights" into the formal supply-chain security review framework and implemented it through FASCSA, a legal tool with an established enforcement history. This is not a temporary ban but a replicable template.
The next question is not whether DeepSeek can have the ban lifted, but: which models from which Chinese AI companies will be reviewed one by one under the same framework? And when the "lineage" of open-source models becomes a compliance requirement, will the geopolitical fragmentation of the global AI supply chain arrive faster than semiconductor controls?
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接