Seek and ye shall find, as the saying goes. The Department of Homeland Security just made the seeking part official for DeepSeek, and I suspect a lot of agency security teams are about to discover the finding part is the hard bit.

Here’s what the order actually does. Using the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council, DHS barred civilian federal agencies from buying any IT products or services from Hangzhou DeepSeek Artificial Intelligence. The letter from Secretary Markwayne Mullin is dated June 26, so this has quietly been in effect for months before it hit the Federal Register. Agencies have to keep DeepSeek out of future procurements and pull out anything already deployed, and exceptions need 60 days’ notice plus a compelling, mission-critical justification.

The stated reasons are what you’d expect: data stored on servers in China under laws that let Beijing ask for it, PII and digital fingerprinting from the hosted service, and the plain fact that every prompt you type into someone else’s model is data you’ve handed over. Mullin even acknowledged that some of those privacy and mass collection concerns apply to other AI models, U.S. ones included. Fair enough. The headline writes itself: feds ban Chinese AI. The part worth your time is what a procurement ban can and can’t reach.

You don’t have to buy a model to run it

Procurement is the lever the federal government has, and for the hosted DeepSeek app and API it’s a perfectly reasonable one. If you’re paying a vendor, you can stop paying them. The catch is that DeepSeek’s whole claim to fame is open weights. Nobody needs a purchase order to pull a model down from a public repository, run it on a workstation with Ollama, wire it into a Python script, or stand it up as an agent with a service account so it can “help” with a backlog of tickets. Every one of those happens without a contract, a vendor, or anything a procurement office would ever see.

I want to be honest about the nuance here, because it cuts in an interesting direction. A copy of DeepSeek running on hardware you control isn’t shipping your prompts off to a server in Hangzhou, so a good chunk of the data-in-China argument really applies to the hosted service. That shifts the risk around instead of removing it. With a local model, the questions become what the thing can touch, which credentials it holds, where those weights actually came from (a repackaged upload from some random account is a supply chain problem with a fun file extension), and what happens when an agent built on top of it does something nobody expected. Those are access control questions, and they’d be the same questions if the model came from Paris or Palo Alto.

The order tells on itself

The most telling paragraph in Mullin’s letter isn’t about China at all. For the window between the order and full removal, agencies are encouraged to monitor traffic in and out, turn up logging, put controls on data exfiltration, and flag anomalous activity. Read that again with your CISO hat on: the plan for enforcing a procurement ban is network visibility. That’s an admission, and a sensible one, that removal depends entirely on finding the stuff first.

Anyone who has run an asset discovery project knows how that goes. The inventory says one thing, the network says another, and the difference is usually somebody’s well-intentioned side project that turned into a dependency. Shadow AI is the same story with a GPU attached. You can’t enforce a policy at the procurement layer when you have no visibility at the access layer, and a ban on paper doesn’t tell you which agents are already running, what they authenticate to, or how you’d cut them off on a Tuesday afternoon without breaking the thing finance quietly built on top of one.

What I’d actually do with this

Whether you’re a federal agency, a contractor who’ll see this flow down in a contract clause, or a private company whose board just read the headline and asked whether you run DeepSeek, the work looks about the same. Start by finding it through behavior, since nobody is going to self-report. Look for hosts talking to known model API endpoints, multi-gigabyte weight downloads from public model hubs, and machines that suddenly start listening on local inference ports (Ollama’s default is 11434, for the curious). Workstations that went from spreadsheets to pegged GPUs overnight are worth a friendly conversation.

Then follow the identities. An agent is only as dangerous as what it can log into, so the service accounts, API keys, and tokens these things run under deserve the same scrutiny you’d give a new admin. Scope them down, put an owner’s name on each one, and make sure you can revoke them quickly.

Finally, make access conditional on what a device is actually doing rather than what it was when it got onboarded. A laptop running unapproved inference software probably shouldn’t have the same path to your sensitive segments as one that isn’t. Modern network access control and risk-based access policies for AI identities were built for this kind of problem: knowing what’s on the network, checking its posture continuously, and deciding in real time what it’s allowed to reach. None of that depends on which country the model came from, which is exactly the point, because DeepSeek is one name on a long list. Kimi and Qwen have drawn the same national security attention, and the next one will show up on Hugging Face before the next Federal Register notice does.

The auditors are coming, and they’ll want receipts

In the same news cycle, the Government Accountability Office put AI oversight at the top of its 2027 to 2032 strategic plan, alongside monitoring how agencies protect themselves from cyberattacks. Put the two stories next to each other and you can see the next conversation coming. An agency saying “we banned it” is going to get asked to prove it’s gone, and “we didn’t buy any” is a procurement answer to an access question.

The DeepSeek ban is a reasonable policy pointed at a real risk. It just stops at the purchasing department, and the models don’t. If you want to actually be able to answer the question when someone asks, the place to start is your own network, because that’s where these things live once they’ve been downloaded, and nobody files an expense report for a free model.