The Department of Homeland Security’s team charged with intelligence analysis may have exposed sensitive information to cyberattacks, according to a new report from DHS’ internal watchdog.

The Office of the Inspector General outlined the security risks it found in smartphones that intelligence staff used in 2023 and 2024, the report shows.

Apps developed by the DHS Office of Intelligence and Analysis, which were widely shared on public app stores with first responders and downloaded 375,000 times, had security vulnerabilities, the investigation found. The report,published Monday, was first reported by The New York Times.

Additionally, 76% of apps installed on smartphones used by the intelligence office were outright banned, and allowed users to do prohibited activities or had inherent security risks. Such apps included third-party VPNs, private messaging apps, video streamers and game apps, the report stated.

Allowing staff to download apps with risks “could enable an attacker to execute malicious code and compromise DHS systems or access unauthorized or sensitive data,” the report states.

DHS agreed with the recommendations from the inspector general and told the watchdog it planned to resolve all the issues by January 2027. The OIG said government shutdowns delayed the report.

A spokesperson for DHS said the security risks occurred under the Biden administration.

“DHS has worked diligently to fix the vulnerabilities Democrats created so that we can securely do our jobs in keeping Americans safe and secure in the homeland,” the spokesperson said in a statement.

The inspector general found that the department was maintaining records for only 11% of the smartphones issued to staff at the intelligence office, and that only three of 10 international trips audited followed the protocols for using the smartphones outside of the country.

“If compromised, a mobile device’s camera, microphone, Global Positioning System, functions, and other sensors could be used to eavesdrop on the user, and the mobile device could be used to steal information or attack DHS systems,” the report states.