Plot hole: The only reason Kate is brought onto Matt's team is to give the CIA legal authority to operate on US soil. Given that he already has DEA agents and US Marshals on the team, all of whom seem to be fully aware of what he is doing and have no problem with it, this doesn't make a great deal of sense. Her idealism makes her a poor choice for the sort of operations the team is doing, and there are already domestic US agents available.
Plot hole: Garriga shows a small thumb-sized device, claiming it changes his password every 15 minutes, thus protecting his servers against brute-force attacks. In real life, remote servers are resilient to brute-force attacks because they restrict wrong guesses. Worse, changing the password every 15 minutes means Garriga would never know a password that can be reused indefinitely within 15 minutes! In real life, we use time-based one-time passwords (TOTP) and 2FA instead.
Plot hole: Echelon controlled satellites hit targets on Earth with pinpoint accuracy. A lot of them involve creating storms to ravage an objective. One of them is started over 18 hours away from the target (how they know is another mystery), but this is what gives the characters time and allows the movie plot to continue to the end to defeat Echelon.