DHS signed its DeepSeek ban 88 days before publishing the notice

The Department of Homeland Security order stripping DeepSeek out of federal civilian agencies reached the Federal Register on October 20. But it was signed on July 24, because the order itself carries that date. The 60 day window agencies had to request an exception closed on September 22 by our count, nearly a month before anyone outside government could read the text.

The signed order sits as a scanned appendix inside the five page notice, numbered Exclusion and Removal Order #2026-01. Its header reads “Original Release Date: July 24, 2026”. Homeland Security Secretary Markwayne Mullin signed it, with a copy to Russell Vought at the Office of Management and Budget. The notice was filed at 8:45 am on October 19 and published the next morning across pages 66346 to 66350.

Date	What the documents show
July 24, 2026	Order #2026-01 signed, exclusion and removal effective immediately after issuance
September 22, 2026	60 day deadline for agency exception requests passes (our calculation)
October 19, 2026	Notice filed with the Office of the Federal Register at 8:45 am
October 20, 2026	Notice published, pages 66346 to 66350, docket DHS-2026-0628

What the order actually requires

None of the obligations are new, which is the part the coverage skipped. Civilian agencies have to exclude DeepSeek, its affiliated entities and their products from procurement “effective immediately after issuance”, including approved product lists and e-commerce markets. They also have to remove DeepSeek products and “third-party products and services developed using DeepSeek implementations” from their IT systems. That second limb is the wide one, because it reaches software a vendor built on DeepSeek weights, and commercial routing stacks that put DeepSeek first are already on the market.

Agencies can still ask for relief, but that clock was already running down. The order lets an executive agency request an exception under 41 CFR 201-1.304(b), including a delay in compliance, and says requests must be “submitted in writing within 60 days of the issuance of this order”. CNBC reported both the 60 day rule and the July 24 issuance date. What nobody drew was the arithmetic between them, which is that the window shut in September.

The evidence behind it is from 2025

The risk case is older than this week’s framing suggests. Engadget placed the ban on the heels of DeepSeek’s V4.1-Flash-1017 release, which landed days before publication, but the order’s own footnotes point somewhere else entirely. The newest source footnoted in the order’s risk section is a TechTarget explainer dated August 25, 2025, and the security research it leans on is dated February 6, 2025.

That research is NowSecure’s teardown of the DeepSeek iOS app, and it’s carrying more weight in the order than it can hold. NowSecure ran the consumer iPhone app on real devices and found unencrypted registration traffic, a hardcoded key with a broken 3DES cipher, and user data going to servers run by ByteDance. The order cites it to support the claim that the models themselves “may contain malware or other security vulnerabilities”. Still, an iOS app and a set of weights aren’t the same artefact.

NowSecure’s own mitigation was to run the model somewhere else, by self-hosting it or using a hosted version from a company like Microsoft. The order removes that route too.

Reading footnote 7 of Order #2026-01

The scope line is narrower than the headlines read, though that cuts both ways. The order covers federal civilian executive branch agencies “except for their national security systems and secure compartmented information systems”. CNBC described it as excluding the Department of Defense, which is true as far as it goes. The carve-out also sits inside civilian agencies, not only outside them.

Beijing has pushed back since the notice appeared. China’s foreign ministry told Reuters it would safeguard the rights and interests of its companies, as CNBC reported. Ministry spokesperson Mao Ning said that “China consistently opposes the over-generalization of national security as well as the politicization of science, technology and trade issues”.

The review cycle is worth more attention than the announcement. The order commits the Secretary to review it within one year and annually after that, which puts the first review in July 2027 on the issuance date it carries. Exception requests go to CISA at a FASCSA mailbox, so the public trail runs through docket DHS-2026-0628 on regulations.gov. This administration already has a record of renaming AI policy without touching the underlying legal text, and here the text was three months old before it became news.