Homeland Security has ordered civilian federal agencies, from the Environmental Protection Agency to the Federal Communications Commission, to take DeepSeek out of their systems. The order also covers outside products built on DeepSeek and bars the company from federal contracts. Agencies that think they need it anyway must ask for an exception 60 days ahead and give a compelling reason.
The rule follows the model, not the app
Earlier restrictions were smaller. The Commerce Department and the Navy blocked DeepSeek on their own devices, and a few states did the same. A device ban is easy to enforce: you look for one app on one phone. This order is about purchasing, so it reaches the supplier whose product has DeepSeek's model working inside it, even when the supplier's name is the only one on the box.
That is why the 2017 Kaspersky order is the right comparison. Agencies had to count every affected product and every computer it ran on, and report how they had searched. The searching was the real work, and it was work that contractors had to do too.
A model is harder to find than an antivirus program
Kaspersky was software with a name, a vendor and an installer. DeepSeek is also a set of model files that anyone can download and run on their own servers, and that is much of its appeal, because it is cheap and a company can control where it runs. A product built that way can be fully DeepSeek underneath and show no sign of it.
Consider a 40-person company that sells software which summarizes long documents for federal agencies. At the start it picked the cheapest capable model, and that was DeepSeek, run through a cloud provider. Now it has to find every customer who bought the tool, tell them, and replace the model.
How long that takes depends on one choice made long ago. If the model's name appears in a single setting, and the company keeps a set of sample documents to check the summaries, the swap is an afternoon of changes and a few days of testing. If the instructions to the model were tuned over months to suit DeepSeek's habits, it is weeks of rework, with customers waiting. The company that kept the model easy to replace loses almost nothing. The one that did not may lose the contract.
The next ban will not name DeepSeek
The order names only DeepSeek, but the same worries have been raised about other Chinese open models such as Kimi and Qwen. I expect more models to be named, and each time the same question will go down the line of suppliers: which model is in this product, who runs it, and how fast can you change it.
That makes the ability to switch models worth more than the small saving from choosing the cheapest one. It also gives an ordinary buyer something to do now. A hospital finance director or a shop owner can keep one short list of every AI tool the business pays for, the model behind each, and who runs it. It is the same kind of list agencies had to produce in 2017, and it is far easier to write before a customer asks for it.