Border officials not told of massive surveillance breach for three weeks, subcontractor confirms