2.3 million disaster survivors' addresses and bank details shared with a contractor without adequate protections. Your house was destroyed by a hurricane. You applied for help. FEMA shared your data with a contractor and potentially with ICE. People fleeing floods and fires had to choose between asking for help and being deported. $1 billion in fraudulent FEMA payments after Katrina. Millions more after COVID. People used stolen identities to claim disaster relief, funeral assistance, and housing aid. The app that asks for your Social Security number to help you after a disaster couldn't tell the difference between you and someone using your stolen data.
What they claim: FEMA states disaster assistance data is protected and used for relief purposes
What we found: In 2019, the DHS Inspector General found FEMA had shared personal data of 2.3 million disaster survivors with a contractor without adequate privacy protections. The data included home addresses and bank account information. Separately, immigrant advocacy groups documented cases where FEMA data sharing with other DHS agencies led to ICE enforcement actions against undocumented disaster survivors.
What they claim: FEMA app enables streamlined disaster relief applications with identity verification
What we found: GAO investigations found widespread fraud in FEMA disaster relief programs. After Hurricane Katrina, the GAO documented $1 billion in improper and fraudulent payments. After COVID-19, FEMA's funeral assistance program was exploited for millions in fraudulent claims using stolen personal data. The identity verification in the FEMA app failed to prevent mass fraud.
What they claim: FEMA app collects location data to provide relevant local emergency alerts
What we found: The FEMA app requests persistent location access, even when not in use. Privacy researchers noted the app's third-party analytics SDKs could transmit location data to advertising networks. During disasters, this creates a detailed movement profile of evacuees — showing where they fled, where they sheltered, and when they returned — data that could be exploited by insurers, landlords, or law enforcement.