No DeepSeek on Government Devices Act
- Sponsor
- Rep. Gottheimer, Josh [D-NJ-5]
- Committees
- Oversight and Government Reform Committee (primary)
- Last action
- Feb 7, 2025
Bottom line
This bill aims to enhance federal cybersecurity by banning a specific application, DeepSeek, from government devices due to potential national security risks, with provisions for critical exceptions.
What it actually does
This bill prohibits federal executive agencies from using the DeepSeek application, or any successor application or service developed by High Flyer or an entity owned by High Flyer, on government information technology. It mandates the Director of the Office of Management and Budget (OMB) to develop standards and guidelines for the removal of such applications within 60 days, while providing exceptions for law enforcement, national security, and security research activities, provided risk mitigation actions are documented.
Proponents argue
Proponents argue that banning DeepSeek is a crucial step to safeguard sensitive government data and national security interests from potential foreign adversaries. They emphasize the importance of preventing data exfiltration and espionage through applications developed by entities linked to foreign governments, especially those with adversarial intentions, thereby protecting federal systems from undue influence or compromise.
Opponents contend
Opponents might argue that a blanket ban could stifle innovation, limit agency choices for effective tools, or be perceived as a disproportionate response without publicly disclosed evidence of specific threats. They might also raise concerns about setting a precedent for banning specific software without a transparent, evidence-based process, potentially leading to arbitrary restrictions on technology use.
The bill is very short and can be read quickly, allowing ample time for detailed consideration of its implications.
Section 2(b)(1)
Mandate to Prohibit DeepSeek on Executive Agency Information Technology
This provision directs the Director of the Office of Management and Budget (OMB) to develop standards and guidelines within 60 days of the bill's enactment. These standards will require all executive agencies to remove the DeepSeek application, or any successor application from its developer High Flyer, from all government information technology systems. The directive is to be carried out in consultation with key cybersecurity and intelligence agencies, ensuring a coordinated federal response to the perceived security threat.
Supporters argue
Supporters argue this is a necessary cybersecurity measure to protect sensitive government data from potential exploitation by foreign entities. They believe that applications developed by certain foreign-linked companies pose inherent risks that cannot be fully mitigated by other means, making a direct ban the most effective course of action.
Critics contend
Critics might argue that such a broad prohibition without publicly disclosed specific evidence could be seen as an overreach or a protectionist measure. They may also contend that it could hinder agencies' ability to use effective tools if DeepSeek offers unique functionalities not easily replicated by approved alternatives, potentially impacting operational efficiency.
Tradeoffs
The bill balances national security concerns and data protection against potential impacts on agency operational flexibility and the broader technology market. It also navigates the tension between a proactive security posture and the need for transparent, evidence-based policy decisions regarding specific technologies, especially when a blanket ban is imposed.
Section 2(b)(2)
Exceptions for National Security, Law Enforcement, and Research
This provision carves out specific exceptions to the general prohibition on DeepSeek. It allows for the continued use of the covered application in limited circumstances, specifically for law enforcement activities, national security interests and activities, and by security researchers. For any authorized use under these exceptions, agencies are required to develop and document specific risk mitigation actions to ensure that security is maintained despite the continued use of the prohibited software.