On October 19 the Department of Homeland Security told civilian federal agencies to get DeepSeek off their systems. The timing is awkward in a way that only this market manages. Three days later the same lab was being reported as raising around $15 billion, and it had just open-sourced the engine that serves its models.
What the order covers
Civilian agencies. That is the scope in the reporting. It is an instruction to federal offices, the same family of directive that has already landed on other foreign-made apps when Washington decides the data path is the problem. It does not, by the text of those reports, switch off DeepSeek for a startup in Ohio or a student with a laptop.
The practical hunt inside an agency is rarely the website. It is an API key in a side project, a container someone pulled because the demo was good, and a weight file on a shared drive. Those survive a memo unless someone actually looks.
Two clocks
DeepSeek’s commercial clock and Washington’s policy clock are not synced. Publishing DeepInfer under Apache 2.0 makes the software easier to run, not easier to approve. A license is not a security review.
If you work with federal contractors, ask whether their environment is in scope before you paste DeepSeek into a deliverable. “The model is good” has not been a sufficient answer in a government office for a while, and this order makes that explicit for one lab.