A United States federal order published on 20 October 2026 tells civilian agencies to remove one company's artificial intelligence products from their systems. The question behind it is the one a new large-print book, How to Become Safer Online, helps every family, library and employer answer: what should go into an artificial intelligence assistant, and what should stay out?
By Lindsay McDonald, UtilForge spokesperson
Facts checked on 22 October 2026. Later guidance from federal agencies may add detail.
On 20 October 2026 the Department of Homeland Security published an order in the Federal Register, the daily journal of the United States government. The order, signed on 24 July 2026, tells federal civilian executive branch agencies to stop buying products and services from Hangzhou DeepSeek Artificial Intelligence Co., Ltd, the Chinese company behind the DeepSeek assistant, and to remove them from their computer systems, together with other companies' products built using DeepSeek technology. An agency that cannot comply can request an exception, which the Cybersecurity and Infrastructure Security Agency reviews. The order rests on the Federal Acquisition Supply Chain Security Act of 2018, a law that lets the government shut a risky supplier out of its own purchasing. It applies to government purchasing and government computers, national security systems fall under separate authorities, and it places no restriction on individuals or private businesses.
News reports set out the reasons. BleepingComputer, a technology news site, reported concern that the Chinese government could reach DeepSeek's systems, collect personal information, track users and receive sensitive government data, along with concern about malicious software. What staff type into an assistant could therefore leave the devices of the people who typed it and reach systems their agency does not control.
The questions travel further than the order
Although the order names one company, the questions behind it fit every assistant: where does what I type go, who can reach it, and which law governs it? Whatever a person types into an assistant goes to the company that runs it, in whichever country that company's servers stand, and the company's own rules decide how long it is kept, who can read it and whether it helps train the next model.
The government asked these questions about its own systems. Families, libraries and employers can ask them about their own phones and computers, and an assistant becomes easier to use with confidence once the habits are in place.
What the book gives a household
How to Become Safer Online launched on 20 October 2026 for Cybersecurity Awareness Month. It is a large-print guide for families, libraries, educators, care homes, community groups and employers. Part One sets out five signs that a message is not what it claims to be, each with a real result from a UtilForge check. Part Three gives educators a 45-minute group session plan and a family safe word. Part Five covers what to keep out of an artificial intelligence tool, and how hidden instructions and invisible characters can sit inside text that is handed to an assistant.
That last part is the household version of the federal order. A government can remove one company's products from its own offices. A family deciding whether to paste a hospital letter into an assistant, a librarian helping a visitor fill in a benefits form and a small employer whose staff use whichever assistant is quickest each make that decision themselves, and the book gives them the habit to make it well.
A rule with a history
The order continues a pattern that is nine years old, and each step in it concerns where data goes and who could reach it. On 13 September 2017 the Department of Homeland Security told federal agencies to find every product made by the Russian security company Kaspersky Lab within 30 days and to begin removing them within 90. On 13 August 2018 the defence budget law, in its Section 889, barred federal purchases of telecommunications and video surveillance equipment from five Chinese companies, among them Huawei Technologies and ZTE Corporation. In December 2022 the No TikTok on Government Devices Act removed that application from federal phones. On 15 September 2025 the Office of the Director of National Intelligence posted the first order under the 2018 Act, against the Swiss software company Acronis AG. The DeepSeek order follows it and concerns an artificial intelligence company.
Governments outside Washington acted on DeepSeek earlier. Texas barred it from state devices on 31 January 2025, and by 14 April 2025 fourteen states had done the same. Italy's data protection authority limited the processing of Italian users' data on 30 January 2025, Taiwan and Australia barred the assistant from government devices in February 2025, and the Czech Republic barred it from public administration in July 2025. Each decision covered the government's own systems, and the habits for everyone else rest with households, libraries and employers.
Why the habits matter
In April 2026 the Federal Bureau of Investigation reported that Americans lost $20.9 billion to online crime in 2025, 26 per cent more than the year before, and that people aged 60 and over reported about $7.7 billion of it. On 19 October 2026 the Federal Trade Commission told Congress that it estimates fraud cost older adults up to $119.5 billion in 2025. A Gallup and Stop Scams Alliance survey of 5,173 adults, fielded from 8 January to 18 February 2026 and reported in June 2026, found that of the people scammed in 2025 who did not report it, 58 per cent were unsure where to report. Cybersecurity Awareness Month, led in the United States by the Cybersecurity and Infrastructure Security Agency and the National Cybersecurity Alliance, rests on the idea that online safety is a shared responsibility, and this year's theme, "Don't Make It Easy for Them", puts the work in ordinary hands.
A family that agrees a safe word has done its part. A library that prints the book and leaves it by the public computers has done its part. An employer that writes down which assistants staff may use, and what they may paste into them, has done its part. A company that asks its suppliers in writing which artificial intelligence models sit inside a product, and in which country what is typed is stored, has asked the question the government asked.
What anyone can do this week
Before pasting into any assistant, take out the names, phone numbers, addresses and account numbers, and put them back in the answer afterwards. The UtilForge tool Hide Names from AI does the swapping on your own phone or computer, and what you paste stays there: https://utilforge.org/tools/hide-names-from-ai
Open the settings page of the assistant you use and find four answers: is what I type kept, for how long, can people at the company read it, and is it used to train models. UtilForge's guide to what happens to what you paste into an artificial intelligence sets out where each of the three largest companies publishes its answers: https://utilforge.org/learn/what-happens-to-what-you-paste-into-an-ai
Two more free UtilForge.org checks help here. "Before you paste into AI" looks at a prompt before it goes into an assistant, at https://utilforge.org/tools/before-you-paste-into-ai and "Prompt injection checker" looks at a web page, email or document for hidden instructions aimed at an assistant, at https://utilforge.org/tools/prompt-injection-check. All the free checks are listed at https://utilforge.org/tools
If you buy software for an organisation, ask the supplier three questions in writing before you sign: which artificial intelligence models are inside the product, which company runs them, and in which country what your staff type is stored. Keep the answer with the contract.
If you work for a federal agency or a federal contractor, follow your organisation's own rules on which assistants you may use. Contractors can search the System for Award Management, the government's contracting register, for the phrase "FASCSA order" (FASCSA is the short form of the Federal Acquisition Supply Chain Security Act), and their contracting officer can say what applies to them. This article is not legal advice.
The same week brought a second story that reaches every household through the websites it visits. On 21 October 2026 PHP, the programming language behind most websites, released emergency security updates, and government websites across Europe and the United Kingdom went offline while their owners installed them. UtilForge's guide to what that means for website owners and visitors: https://utilforge.org/learn/php2shell-what-website-owners-and-visitors-should-do
Watch: the short video
Where to find the book
How to Become Safer Online can be downloaded without paying as a Portable Document Format (PDF) file at https://utilforge.org/get/book, or from Gumroad as a pay-what-you-want edition starting at $0, which also brings each revised edition by email: https://utilforge.gumroad.com/l/safer-online-book
The book is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. Any library, employer or community group may print it, photocopy it and hand it out, provided it is shared whole and unchanged and nobody is charged more than the printing cost. The session plan and printable cards are at https://utilforge.org/clinics
UtilForge.org is a digital inclusion organisation offering free cybersecurity and online safety tools and guides, and a registered 2026 Champion of Cybersecurity Awareness Month. Its 42 checks for messages, payment pages, job offers, photos, documents and artificial intelligence prompts run on the user's own phone or computer, and what you type stays on your device. No UtilForge tool uses DeepSeek or any other outside artificial intelligence model.
Where does what I type go, who can reach it, and which law governs it? A federal order answered those questions for every federal civilian agency, and a printed copy of the book beside the public computers lets a library answer them for everyone who walks in.
Related guides
Free
If you doubt it,
UtilForge it.
Free checks that run on your own phone or computer. What you type stays on your phone or computer.