FOIA Documents Reveal DHS Portal Exposed Americans' Sensitive Data to Foreign Governments for Two Months

A newly declassified batch of Freedom of Information Act (FOIA) documents has revealed that a Department of Homeland Security (DHS) intelligence-sharing portal inadvertently granted 14 foreign governments unrestricted access to the sensitive personal data of millions of American citizens. The exposure, which lasted for exactly 61 days between April and June 2026, bypassed standard constitutional safeguards that require warrants for domestic surveillance. The documents were obtained and published by the Electronic Frontier Foundation following a protracted legal battle over the agency's data-sharing practices.[1][5]

The breach centered on the Homeland Intelligence Exchange (HIE), a cloud-based platform designed to share counter-terrorism threat indicators with allied nations. According to internal emails obtained in the FOIA request, a software update deployed on April 12 accidentally stripped the "U.S. Person" masking filters from the database. These filters are legally mandated to automatically redact the identifying information of American citizens before intelligence is shared with foreign entities.[2]

As a result of the coding error, foreign intelligence analysts logging into the portal could view raw, unredacted files on approximately 4.2 million Americans. The exposed data included domestic travel logs, financial transaction metadata, border crossing records, and in some cases, intercepted communications metadata collected under controversial domestic surveillance programs. Because the system was designed for bulk analysis, foreign agencies were able to query this data seamlessly alongside international threat metrics.[1][4]

Alarmingly, the DHS did not detect the vulnerability internally. The exposure was only flagged on June 12 when a British intelligence liaison contacted the agency to inquire why they were suddenly receiving unmasked financial records of U.S. citizens who were not linked to any active investigations. Upon receiving the notification, DHS administrators immediately took the portal offline for emergency patching and initiated an internal audit.[2][3]

While the DHS has refused to publicly name all 14 countries that had access to the unmasked data, congressional sources confirm the list includes the "Five Eyes" intelligence alliance—the U.K., Canada, Australia, and New Zealand—alongside several Middle Eastern and European partners. Civil liberties advocates have expressed deep alarm that nations with differing human rights and privacy standards had unfettered access to American domestic data, warning of the potential for transnational repression.

In a statement released Wednesday morning, the DHS characterized the incident as a "technical misconfiguration rather than a targeted exploit," emphasizing that there is no evidence the data was downloaded in bulk by foreign adversaries. "We have secured the platform and are working closely with our international partners to ensure any inadvertently accessed U.S. person data is permanently purged from their systems," a spokesperson said, though they declined to answer questions about how such a purge could be verified.[1]

The revelation has triggered immediate bipartisan outrage on Capitol Hill, uniting lawmakers who rarely agree on national security policy. Republican lawmakers have accused the administration of gross negligence regarding the protection of American citizens, while progressive Democrats are renewing calls to dismantle the HIE portal entirely, arguing it serves as a backdoor for warrantless surveillance that inevitably leads to abuse.[3][4]

The House Homeland Security Committee has subpoenaed the DHS's chief information officer to testify in an emergency closed-door hearing next week. Meanwhile, legal experts warn that retrieving the exposed data is practically impossible; once digital records cross international borders and enter foreign intelligence databases, U.S. authorities have no technical mechanism to verify their deletion, leaving millions of Americans permanently exposed to foreign monitoring.[2][5]