A new federal removal order follows New York’s earlier government-device restriction and raises questions about how agencies assess AI tools and third-party services in light of DeepSeek federal restrictions.

The Department of Homeland Security is ordering DeepSeek products and third-party services using the Chinese artificial intelligence model off U.S. civilian agency information systems, Reuters reported October 19.

The reported action also bars civilian federal agencies from acquiring the covered products and services. DHS cited potential exposure of sensitive information and security weaknesses as reasons for the restriction.

This new directive reflects the ongoing concern regarding DeepSeek federal restrictions and their potential impact on national security.

The development has a direct New York policy connection: Governor Kathy Hochul announced a prohibition on downloading the DeepSeek application to ITS-managed government devices and networks in February 2025.

What the federal report says

According to Reuters, DHS raised concerns that government employee or vendor use could transfer sensitive data to China or produce intelligence about U.S. people and agencies. It also warned about possible malware or other vulnerabilities.

Those are the government’s stated risk assessments. They should not be presented as proof that every DeepSeek user has suffered a breach or that every individual installation contains malicious software.

Reuters said a July DHS memorandum made public Monday instructed agencies to monitor relevant network traffic. The Chinese Embassy did not immediately comment to the news agency.

What New York had already done

Hochul’s February 10, 2025 announcement focused on devices and networks managed by the state Office of Information Technology Services. It cited concerns about surveillance, censorship, user data and technology secrets.

The state described DeepSeek as founded and owned by High-Flyer, a China-based stock trading firm. Officials placed the restriction within a broader policy for evaluating AI use in government.

That earlier action matters for chronology. The October 19 federal report is not the first announcement that New York government devices face a DeepSeek restriction, and it should not be described as a newly imposed statewide consumer ban.

A government restriction is different from a public ban

The reported federal action concerns civilian agency systems and acquisitions. New York’s cited announcement concerns ITS-managed government devices and networks.

Neither source establishes a general prohibition on every private New Yorker using an AI product. Readers should distinguish the entity subject to a rule from the population that happens to live in the same jurisdiction.

Local governments, school districts and private employers may have their own technology policies. This report does not establish that a federal civilian agency directive automatically changes each of those policies.

Why third-party services matter

The reference to third-party services is an important part of the federal report. An organization’s exposure to an AI system may involve more than an application bearing that system’s own name.

A separate vendor can offer a service that relies on another company’s underlying model. For policy purposes, the relevant question can therefore include what technology powers a service, rather than just what appears on its login screen.

This is an explanation of the distinction in the reported scope. The source does not provide a complete public list of every affected vendor, configuration or product version, so this article does not attempt to supply one.

New York’s broader approach to government AI

The state’s 2025 announcement said its restriction built on AI guidance issued in 2024. That guidance covered appropriate use, human oversight, fairness, transparency, risk assessment, privacy and security.

The distinction between evaluating a particular tool and rejecting all AI is significant. A government can pursue AI research and approved uses while deciding that a specific service is unsuitable for particular information systems.

For the public, the useful accountability question is how agencies make and document those choices. Which systems are covered? What information can enter an approved tool? Who reviews compliance? The answers should come from the relevant institution’s actual policy.

What this means for the Mohawk Valley

State employees in the region may already work under the ITS-managed environment referenced in Hochul’s announcement. Federal workers and contractors should look to their own organization’s implementation instructions for the newly reported action.

The report does not identify a breach at a Utica-area office, school or business. Nor does it announce that local residents’ personal records were taken. Adding such a claim would go beyond the evidence.

The regional relevance is the growing role of AI procurement and data governance in public institutions. Readers deserve clarity about what is known, what officials allege and which systems a directive actually reaches.

What remains to be clarified

This article relies on Reuters for the new federal action and the governor’s official announcement for New York’s earlier restriction. A full implementation account would require the operative federal notice and agency-specific instructions.

Until those details are established, deadlines, technical exceptions and the complete affected-product list should not be guessed. A reported security concern deserves attention, while precise reporting requires limits on what can be claimed from it.

The central reporting task is to connect each claim to its source and scope, without treating uncertainty as either proof of harm or proof that no risk exists.

Questions for institutions reviewing the news

The first question is scope: does the reported rule apply to the institution itself, to a service it supplies, or to a particular contract? A federal civilian agency and a private household are different policy settings.

The second is documentation: is the institution relying on the operative rule, implementation guidance or a news report? Those sources serve different purposes. A news story can explain a development without supplying every technical requirement.

The third is provenance: can an institution identify the underlying model and service provider involved in a tool? The third-party language in the federal report makes that distinction particularly relevant.

Finally, organizations should distinguish a policy review from an incident investigation. The announcement of a restriction does not itself establish that the organization suffered a breach. Claims of an actual incident require their own evidence.

These questions identify what remains to be established. This report does not provide a compliance determination for an individual employer, contract or software deployment.

Sources: Reuters October 19 report linked above; Governor Hochul’s official February 10, 2025 announcement linked above.