How the DeepSeek Ban Actually Works

On July 24th, 2026, the Secretary of Homeland Security ordered every civilian federal agency to stop buying DeepSeek's products and remove them, or ask for an exception within 60 days. That window closed around September 22nd. The public found out on October 19th, a day before the order ran in the Federal Register. Its reasons are mostly about where data goes. What it orders removed is wider: third-party products and services developed using DeepSeek implementations. The order never says what that means. We read the four-page order itself: seven public sources, one technical audit (of DeepSeek's iPhone app), and a footnote about a DeepSeek AG that appears nowhere else in it. Then the quiet 2018 law behind it, the Federal Acquisition Supply Chain Security Act. This is Homeland Security's first order under it and the first in the Federal Register. We cover the heavier tools Commerce hasn't used, and Kaspersky's seven-year climb. A disclosure: this show is made with Claude, Anthropic's model, and Anthropic competes with DeepSeek. The Pentagon used the same law against Anthropic in March, and on September 25th the appeals court in Washington upheld it, two votes to one. Then what those two words reach. DeepSeek gives its model away: about 50 million downloads of R1 on Hugging Face, 524 models built from it, copies sold by Amazon and Microsoft, and a top DeepSeek model on OpenRouter served by 29 companies, none of them DeepSeek. We weigh the case for the broad reach (NIST's own test of the downloaded model, CrowdStrike's Tibet-prompt finding) and the case against it, how a contractor would ever check, and who pays. Then China's answer, including the October 16th draft whose compute line for model weights is the one the United States drew in January 2025 and scrapped that May. Plus what it means for you, and two dated calls. CHAPTERS 00:00 Issued in July, public in October 01:50 Four pages, printed as images 02:58 The order's reasons: where data goes 03:37 Seven public sources, one app audit 04:34 App versus model, and a stray footnote 05:23 The quiet 2018 law behind it 06:36 The heavier tools nobody used 07:19 Kaspersky's seven-year ladder 08:04 A disclosure, and the Anthropic case 09:23 Two words: developed using 10:11 Read literally: Amazon, Microsoft, NVIDIA, vLLM 11:14 One model, 29 companies serving it 11:53 The line earlier bans drew 12:41 NIST's test of the downloaded model 13:24 CrowdStrike and the Tibet prompt 14:26 The case for the broad reach 15:04 The case against it 15:45 A release on the day of the order 16:12 How would anyone enforce it? 17:41 Who pays: the Huawei precedent 18:09 Who in government was using DeepSeek? 18:54 Beijing's answer 19:40 China's draft export list 20:08 The line Washington walked away from 21:15 Response or coincidence? 21:58 What it means for you 22:51 Two calls, with dates 23:25 Where the two words end SOURCES The order, Federal Register, Oct 20, 2026: https://www.govinfo.gov/content/pkg/FR-2026-10-20/pdf/2026-21447.pdf 41 U.S.C. 1323 (the 2018 law): https://www.govinfo.gov/content/pkg/USCODE-2024-title41/html/USCODE-2024-title41-subtitleI-divsnB-chap13-subchapIII-sec1323.htm Lawfare on Anthropic's rehearing petition: https://www.lawfaremedia.org/article/why-anthropic-is-asking-for-a-rehearing-en-banc National Law Review on the D.C. Circuit ruling: https://natlawreview.com/article/dc-circuit-upholds-anthropic-fascsa-designation-and-endorses-broad-interpretation NIST CAISI evaluation of DeepSeek: https://www.nist.gov/news-events/news/2025/09/caisi-evaluation-deepseek-ai-models-finds-shortcomings-and-risks CrowdStrike research: https://www.crowdstrike.com/en-us/blog/crowdstrike-researchers-identify-hidden-vulnerabilities-ai-coded-software/ The Register, Oct 20, 2026: https://www.theregister.com/security/2026/10/20/deepseek-deep-sixed-at-all-us-federal-civilian-agencies/5304010 Global Times on China's draft list: https://www.globaltimes.cn/page/202610/1372405.shtml