On October 20, a notice moved through United States federal agencies ordering the removal of DeepSeek from government systems. Sixty days to comply. No published text. No docket number. No named issuing authority. No stated legal basis. A purge, in the phrasing that circulated, of a model family from federal IT estates.
I read security advisories for a living and I read order books for a living. This is the first time I have seen a policy instrument behave like a black box in the strict engineering sense: an input, an output, and no observable internal state.
Read the notice as written and it asks for one thing. Remove tools built on DeepSeek implementations from federal systems inside sixty days. Read it against physics and it fails at the first step, because the thing being removed is not in the systems. It is in the world.
Those weights shipped in January 2025 under an MIT license at a marginal distribution cost of zero. They have been quantized to 4-bit and run on consumer cards. They have been fine-tuned on hospital records, legal corpora, and synthetic trading data. They have been distilled into 1.5B-parameter students that fit on a phone. They sit on laptops in Reston, Riyadh, Reykjavik, and Shenzhen. Some of them now live inside other people's frameworks under other people's names.
When the code bleeds, the ledger keeps the truth. The ledger records two facts here. Distribution is irreversible. Procurement is not.
That asymmetry is the entire event. Everything else is commentary, and most of the commentary is wrong in the same direction, because it treats an administrative memo as a technical control.
What Actually Got Banned
Strip the narrative and look at the artifact. DeepSeek released R1 on January 20, 2025 under an MIT license. Open weights. Not open source. The distinction matters and almost nobody in the coverage makes it.
Open weights means you get the parameters. You do not get the training data, the data mixture, the full training code, or the compute recipe. The community cannot reproduce the model. It can only replicate it. That is capability openness, not reproducibility openness. I have watched this distinction get buried under a hundred threads calling the release "fully open source," and it is the single most consequential technical error in the discourse.
Now the cost structure, because cost structure is the only honest competitive analysis. V3 was trained on roughly 2,048 H800 GPUs across about 2.788 million GPU-hours. At a $2 per GPU-hour accounting rate, that lands near $5.576 million for the training run. The reinforcement learning increment on R1 added roughly $294,000. Those are the disclosed numbers. I would flag that they almost certainly understate total cluster investment, because they exclude the surrounding infrastructure, failed runs, and data pipeline work. But even doubled, the figure sits one to two orders of magnitude below what the Western frontier labs spend.
That gap is not a marketing claim. It is a balance sheet fact, and it survives every procurement notice ever written.
The timeline matters more than the text. October 2022: advanced computing export controls. Early 2025: agency-level device bans at NASA, the Navy, the Pentagon, and more than twenty states moving on government devices. July 2025: a policy directive pushing agencies toward removal. October 20, 2025: a system-level purge notice with a sixty-day exception window.
Trace the escalation. Hardware to model. Device to system. Each step upward is a public admission that the step below did not finish the job.
The Sixty-Day Window Is the Data
Here is the detail everyone skipped. Sixty days of exception.
You do not grant a transition period for a system nobody is running. You grant it because there is inventory to unwind, and unwinding takes time. That window is a confession about shadow IT.
I have done this work from the inside. In 2019, while finishing my master's in Paris, I audited the BZRX lending logic before mainnet and found a reentrancy path everyone else missed. That exercise taught me the operational lesson I apply to policy documents now: the artifact tells you what the announcement will not. A contract that has a guard clause has it because someone expected the attack. A notice that has a sixty-day window has it because someone counted the deployments.
So count them. Federal staff pulling open-weight models onto local machines. Research groups running inference on grant-funded hardware. Contractors embedding a cheap API into a prototype that quietly became a production dependency. None of that appears in an asset inventory. All of it appears in a transition period.
And here is the trap inside the trap. The notice covers tools built on DeepSeek implementations. It does not, on the text available, resolve the derivative problem. Quantized builds. Domain fine-tunes. Distillations into smaller student models. Merges into other open frameworks. At the file level, a 4-bit community quantization of a fine-tuned variant is not identifiable as DeepSeek without a fingerprinting program that, as far as I can tell, does not exist in any federal procurement office today.
Which means enforcement is not a technical problem. It is an attestation problem. The agency will ask the contractor to sign something. The contractor will sign something. That is the entire control mechanism, and it is the same mechanism that made every supply chain security questionnaire a work of fiction.
Chain One: The Procurement Rewrite
Federal AI acquisition runs through the Federal Acquisition Regulation and a thicket of agency-specific policy. A removal notice does not enforce itself. It propagates through contract clause revisions, vendor self-attestation, and supply chain traceability requirements.
That propagation is expensive. My rough estimate, and I mark it as an estimate, is a compliance services market in the low hundreds of millions of dollars across the federal IT base, plus meaningful schedule slippage. The slippage is the real cost. Programs that had a working prototype in March now have a legal review in November.
Watch the FAR case. If a formal rulemaking follows, this becomes structural. If nothing follows within two quarters, this was a posture, and posture decays.
Chain Two: The Balkanization of Enterprise AI
The more important transmission is outside government entirely.
A federal removal notice hands every compliance department in America a pre-approved reason to say no. Financial services. Healthcare. Defense contracting. Anyone with a regulator looking over their shoulder. The cost is not lost revenue to DeepSeek. The cost is lost optionality for the buyer, and it is paid in gross margin.
I have run this calculation on my own book. During DeFi Summer 2020 I levered ETH five times on MakerDAO, minted DAI, and rotated it into Compound. Three hundred percent in four months. What that trade actually taught me was not that leverage works. It was that borrowing cost is a sentiment instrument, and sentiment instruments reprice faster than collateral does. Same mechanic here. The model is the collateral. The compliance regime is the borrowing cost. When the cost of holding a model rises, you do not liquidate the model. You liquidate the product built on it.
So the market splits into two procurement blocs. Bloc one: regulated Western buyers converging on a trusted-model whitelist, meaning closed American frontier models plus domestic open weights like Llama and Mistral. Bloc two: cost-first markets in the Gulf, Southeast Asia, Latin America, and Africa, running sovereign deployments of whatever is cheapest per useful token.
That split is the actual news. Not the memo. The split.
Chain Three: The Compliance Industry Nobody Priced
Every control regime creates an audit class. Model provenance auditing. Weight fingerprinting. Localized isolation deployment. AI supply chain security assessment.
Before this notice, that was a niche. After it, it is a line item. This is the most under-priced consequence of the entire event, and it is under-priced because it is boring.
I have a personal stake in this observation. In 2024 I wrote a Python harness against Deribit's on-chain options data to hunt dislocations between implied and realized volatility. Fifty thousand dollars of notional, roughly fifteen percent a month, and it got me a desk in Paris. The lesson I carried out of that work is that the money is never in the loud instrument. It is in the plumbing that prices the loud instrument.
Compliance tooling is the plumbing here.
The Loophole Is the Cloud, and It Is Obvious
The notice targets use. It does not, on available text, target existence. And use can be laundered through an inference endpoint in Singapore in about four lines of code.
If a federal contractor calls a third-party host that serves DeepSeek weights behind an OpenAI-compatible API, what exactly has been removed? The weights never entered the building. The request left the country, hit a GPU somewhere, and came back as tokens. There is no artifact on the federal estate to delete.
That is why the single most important indicator to track is not the notice. It is the hosting policy of Azure, AWS, Bedrock, and the aggregators. If those listings hold, the ban is a signage exercise. If they drop, you have a real secondary sanctions effect and the compliance math changes by an order of magnitude.
This is also where the next rule almost certainly lands. Content-based traceability for derivative models. Something functionally equivalent to a rules-of-origin test for weights. That is the escalation that would actually hurt, because it converts an unenforceable use restriction into an enforceable market access restriction.
The Cost Arbitrage Does Not Care
Here is the number that decides this fight. V3.2-Exp pushed input pricing to roughly $0.28 per million tokens. Western closed frontier pricing sits one to two orders of magnitude above that.
Arbitrage is just violence disguised as math. That spread is not a discount. It is a structural attack on the pricing power of every closed Western lab, and no procurement notice prices it away. A developer in Lagos, a fintech in Jakarta, a research lab in Sao Paulo, and a startup founder in Ohio building a prototype on a credit card all read the same number and reach the same conclusion.
This is why I keep saying the federal ban's direct financial impact rounds to zero. The federal government was never the customer. Agency bans were already in place across NASA, the Navy, and the Pentagon before October. This notice institutionalized a fait accompli. Symbolic weight: high. Revenue weight: negligible.
The Competitive Matrix, Honestly Drawn
Lay the field out and the asymmetry is stark.
DeepSeek: open weights, extreme low cost, banned from federal use, strong in non-aligned markets, low-to-medium ecosystem stickiness.
The leading American closed lab: closed, high cost, federally available, strong in non-US markets through developer mindshare, very high stickiness.
Anthropic: closed, high cost, available, medium penetration, medium-high stickiness.
Google: mostly closed, mid cost, available, medium penetration, high stickiness.
Meta: open weights, self-hosted economics, available, strong penetration, medium stickiness.
Read the stickiness column. DeepSeek's ecosystem is built on cheap weights and cheap tokens. That is low adhesion, high diffusion. The American closed ecosystems are built on IDE integration, office suites, and cloud defaults. That is high adhesion, low diffusion.
A ban is a poor weapon against diffusion that has already happened. It is an excellent weapon for protecting adhesion you already own.
Which tells you what this policy actually is. Not national security hygiene. Ecosystem protectionism. If American enterprises standardize on a Chinese-origin base model, the substitution risk to domestic labs is not marginal. It is existential at the application layer. The notice exists to prevent that lock-in from forming.
One more structural point that gets almost no coverage. DeepSeek is funded by its parent quant fund's own capital and compute. No outside venture round. That makes it uniquely insulated from Western capital pressure, and it makes conventional valuation and dilution analysis useless here. You cannot starve a company that is not eating your food.
The Contrarian Read: This Is Weakness, Published
Everyone reads the purge as strength. I read it as an admission.
If chip controls had worked, you would not need a procurement ban. The movement from hardware controls in 2022 to device bans in early 2025 to a system-level purge in October 2025 is a documented record of a control regime escalating because each prior layer underperformed. V3 trained on H800s is the proof of concept that the hardware layer leaked.
Second contrarian point. The ban is a gift to DeepSeek's domestic brand. Being removed by the United States federal government is the strongest trust signal available inside the Chinese enterprise and government market. It converts a commercial decision into a patriotic one. That is free distribution.
Third. The safety case is unstated. No published risk assessment, no NIST-style evaluation, no appeals process, no exemption path for academic research. An exclusion justified by origin rather than by demonstrated property is a black box with legal force. And once that paradigm sets, it becomes the template. Any country can exclude any model on nationality grounds, and no amount of engineering improves your nationality.
Fourth, and this is the one that will actually cost someone money. Prohibition-style policy degrades visibility. Push federal developers off mainstream open models and they do not stop using them. They use them quietly, on personal hardware, with no logging. You have traded a monitored risk for an unmonitored one.
Fifth, the volatility mispricing. As a strategist I price events, not headlines. This event carried enormous implied volatility in the narrative layer and almost none in the realized layer. No revenue line moved. No compute supply changed. No weight was recalled. Traders who bought the story paid a premium for a move that never printed.
And the second-order hit nobody discusses. American startups that built products on cheap base models now face a migration cost to expensive ones. That compresses gross margin at the application layer, and application-layer margin compression is where the actual markdown lives.
What I Am Actually Watching
Forget the notice. Track four things.
One. Bureau of Industry and Security rule revisions, not Office of Management and Budget memos. The binding constraint on DeepSeek is compute, not procurement. Training scale needs interconnect bandwidth and HBM capacity that domestic substitutes still approximate rather than match. A procurement ban does not touch that curve. A tightened HBM rule does.
Two. Cloud hosting delistings at Azure, AWS, Bedrock, and the aggregators. That is the real-time read on whether this is policy or theater.
Three. Ally follow-on. The EU, UK, Japan, South Korea, India, and Australia. The follow-on ratio determines whether the addressable market contracts by ten percent or by forty.
Four. Any rules-of-origin mechanism applied to derivative models. That is the escalation with teeth, and it is the one that would force a genuine re-architecture of every product built on open weights.
On the compute side, one detail is worth holding onto. DeepSeek's inference optimizations, sparse attention, KV cache compression, FP8 training, mean the commercial service layer depends far less on cutting-edge silicon than the training layer does. The installed base can keep serving for a long time. The commercialization window on existing weights is wider than the consensus assumes.
So here is the question that actually matters. Not whether a federal agency can delete a model it never really hosted. But whether the next twelve months produce a world where a model's legal status is determined by the passport of the entity that trained it, and whether the compliance industry that grows up around that rule ends up larger than the models it polices.
Because when the code bleeds, the ledger keeps the truth. And the ledger has already recorded the weights as distributed, the cost spread as intact, and the notice as a document that cannot reach the thing it names.