Homeland Security’s “SAVE” Program Exacerbates Risks to Voters

The Systematic Alien Verification for Entitlements, or “SAVE,” program was designed to help states verify the citizenship and immigration status of people applying for government benefits. Some state and local governments also use it to verify citizenship for voting. But SAVE’s results — sometimes based on incomplete or outdated information — have never been perfect. For that reason, the information gleaned from the SAVE program should be considered useful, but not definitive, in assessing an individual’s citizenship.

Recent developments with the SAVE program raise significant concerns. Working with DOGE, the Department of Homeland Security has expanded the range of personal data that agencies can access through SAVE. At the same time, DHS has allowed state and local election officials to search for hundreds of thousands of voters simultaneously. This increases the risks that state officials will carry out erroneous voter purges and disenfranchise eligible voters. SAVE could also mislead, either because it incorrectly identifies someone as a noncitizen or fails to confirm immigration status, fueling false conspiracy theories about the integrity of U.S. elections.

Under federal law, only U.S. citizens are eligible to vote in federal elections. Multiple systems ensure that only citizens are registering and voting, and they have proven to be enormously effective. Voter fraud, including voting by people who are not citizens, is extremely rare. Any person registering to vote in a federal election must swear to U.S. citizenship under the penalty of perjury. Someone who falsely swears to citizenship could face severe criminal consequences under both state and federal law, including fines or jail time. For people who are not U.S. citizens, penalties include possible deportation.

In addition, federal law requires states to update and maintain voter lists regularly. Election officials reference several databases to ensure voter roll accuracy, including cross-checking against jury lists where jurors provided their citizenship status and interstate data-sharing organizations like the Electronic Registration Information Center, which draws on a variety of state and federal data sources.

DHS’s U.S. Citizenship and Immigration Service (USCIS) operates the SAVE program primarily to give state governments an additional method to verify the citizenship and immigration status of people applying for government benefits, such as food stamps and Medicaid. DHS also permits states to use it to help determine eligibility to vote in elections. (The USCIS SAVE program is distinct from the SAVE Act, a now-stalled federal bill that has prompted a public outcry and would require documents such as a birth certificate or passport to register or re-register to vote, potentially blocking millions of American citizens from voting.)

The SAVE program is not itself a data repository, nor does it contain a comprehensive record of citizens. Rather, it is a tool for querying various datasets. In the past, it has largely only included information on noncitizens, naturalized citizens, and some children of U.S. citizens born overseas.

To access the SAVE program, an election office enters into a written agreement with USCIS to establish policies and terms of use. The agreement requires offices to allow prospective voters to prove citizenship if SAVE should fail to verify it. Currently, at least 21 states and 32 county election offices have such agreements, according to a USCIS search tool. (Several states gained access to the SAVE program after its recent overhaul.)

Prior to the overhaul, user agencies would input an individual’s DHS-issued immigration-related identification number, name, and birth date to do an initial verification. The SAVE program performed an automated check against certain federal databases. The program allowed users to query the system for only one name at a time. SAVE then informed the requestor that the individual was a U.S. citizen, a noncitizen, or of unconfirmed status. If this initial step identified the person as a noncitizen or could not verify an immigrant’s citizenship, agreements with USCIS required election offices to seek additional verification through a manual search of other federal databases. 

The Brennan Center, among others, has identified some of the SAVE program’s data sources as unreliable. These faulty sources increase the likelihood of errors and lack adequate safeguards for privacy, civil rights, and civil liberties. Those datasets include U.S. Customs and Border Protection’s Automated Targeting System (ATS) and TECS (not an acronym), and the State Department’s Student and Exchange Visitor Information System (SEVIS).

There is little information about data quality in ATS, but DHS’s inspector general urged the department to improve it amid a review of another program that relies heavily on the system. ATS itself in part relies on information from the FBI’s terrorism watchlist, which is full of unreliable information — including mistaken identities — and is biased against certain religious, racial, and ethnic minorities. TECS — which incorporates that same FBI watchlist information, as well as travel records and other data sources — has been used for unlawful activities, including retaliation against migrant rights activists’ exercise of their First Amendment rights. 

SEVIS’s data about foreign students in the United States relies in part on the accuracy of information provided by U.S. universities and the ability of decentralized school officials to input it accurately.

The U.S. government and nonprofit groups have warned that overreliance on the SAVE program for the purposes of voter list maintenance can lead to errors, false negatives, and wrongful voter purges. A 2018 report from the U.S. Commission on Civil Rights found that “SAVE is not a comprehensive list of U.S. citizens . . . [,] is not updated to include all naturalized citizens, and it does not include [all] derivative citizens born to U.S. parents outside the country.” In 2012, the American Immigration Council observed that the SAVE program’s data was incomplete and that even DHS officials worried that data accessed by SAVE was not comprehensive enough for voter verification.

DHS has also failed to guarantee that election offices comply with the SAVE program’s prescribed verification processes. Those processes are critical. According to a 2017 Government Accountability Office report, DHS claims that the SAVE process has a high, but still imperfect, degree of accuracy when second-stage additional verification is triggered. But the accountability office also found in 2017 that USCIS did not have sufficient controls to ensure that state and local agencies initiated that additional verification when necessary.

While USCIS has since taken steps to educate user agencies, including election offices, about the need to complete further verification when prompted by the SAVE software, there is little public information showing how successful that effort has been. This means the election offices that use SAVE could potentially strip eligible American citizens from the rolls without following all the steps required by USCIS to properly verify an individual’s legal status.

DHS and DOGE recently announced a dramatic overhaul of the SAVE program. Sweeping changes implemented in May allow user agencies to search SAVE using just social security numbers, names, and dates of birth, which expand the search universe beyond people who had gone through the DHS immigration system or had applied for a citizenship certificate. DHS and the Social Security Administration have given the SAVE program access to information about vast numbers of citizens born in the United States in the administration’s central social security number database. And DHS now permits user agencies to query SAVE for information about hundreds of thousands of voters in a single search. Previously, searches could only be conducted for one individual at a time.

USCIS claims that access to social security information will help root out fraud in voter registration, but this claim is misleading. The Social Security Administration’s central social security number database, Numident, does not provide definitive citizenship information in every instance. Only in 1972 did Congress first require the Social Security Administration to establish the citizenship of applicants for social security numbers. The agency only began asking for and maintaining citizenship information for all applicants in 1978. As such, the database does not have comprehensive citizenship information for Americans born before 1978. Naturalized citizens may also not have updated citizenship information in the Social Security Administration database if they did not take action to notify the agency of their naturalization.

These changes follow DOGE intrusions into other federal data systems — those of the Department of Labor and the Internal Revenue Service, among others — that have prompted widespread consternation about DOGE’s access to and handling of Americans’ personal data. They also occur amid revelations that DOGE has fudged or mishandled data to falsely inflate the perceived significance of its activities.

States that collect full social security numbers can conduct bulk SAVE searches with social security numbers in their voter file. But few states currently collect full social security numbers as part of voter registration, rendering this option moot for those states for the time being. Searches in SAVE may also generate a large volume of non-matches because of missing, outdated, or inconsistent citizenship information in the Social Security Administration database and DHS immigration records. In recent guidance, USCIS itself appeared to acknowledge that SAVE’s use of outdated Social Security Administration information may result in non-matches.

Moreover, if a voter cannot be identified using their social security number, the user agency is prompted to resubmit the search using a DHS-issued identification number or direct the voter to the Social Security Administration to update their record. This puts the user agency back in the same position it was in prior to the SAVE program overhaul, or it puts the onus on voters to correct federal records when they are likely already eligible to vote.

Additional Privacy and Oversight Challenges

Beyond its tendency to provide false information, the updated SAVE program raises privacy concerns. Depending on how DHS and DOGE use or disclose data obtained from the Social Security Administration, it may run afoul of federal law, including the Privacy Act and the Administrative Procedure Act. As of publication of this article, the new access to social security data comes without any new or updated system of records notice, required by the Privacy Act to explain to the public how agencies use their data. The Privacy Act also prohibits federal agencies’ unauthorized disclosure of citizens’ and permanent residents’ personal information — a concern in other instances involving DOGE access to similar data. The Administrative Procedure Act, meanwhile, guards against federal agency action that is “contrary to law,” such as a violation of the Privacy Act.

Further exacerbating risks for voters and the election process, oversight of programs like SAVE — and the data that feeds them — is ineffective, with many agencies overseeing themselves. As the Brennan Center has previously explained, internal oversight offices within these agencies can serve to sideline DHS’s main civil rights, civil liberties, and privacy offices instead of fostering accountability in their own programs.

Recent government decisions further undermine oversight. In a unilateral move, the administration largely shut down the USCIS ombudsman and the DHS Office for Civil Rights and Civil Liberties, potentially in violation of statutory obligations. In doing so, it cast aside approximately 600 civil rights investigations, review of intelligence activities, and training for state and local police. This office, alongside privacy and legal advisers, participates in a council that oversees data transfers. With the new changes, the board’s fate remains unknown. So too do the impacts on USCIS, SAVE, and similar programs. But what is clear is that weakened oversight can only hinder steps to ensure data quality, unbiased use, and constraints on inappropriately expansive applications. 

When DHS, USCIS, and DOGE announced the overhaul of the SAVE program, they explicitly linked the effort to a campaign to combat the “taint” of noncitizen voter fraud, a long-standing claim tied to the lie that the 2020 presidential election was stolen. By all appearances, the administration is poised to use the SAVE program to prop up these false claims, and sympathetic local officials may deploy SAVE to concoct evidence. This move poses serious risks to voters and elections. Here are three potential scenarios.

False Assertions About Widespread Voter Fraud

In recent years, some election officials have falsely claimed that noncitizens are registering and voting at a large scale. In 2024, for example, several state election officials claimed they had identified large numbers of potential noncitizens on their voter rolls. Thousands of eligible American citizens were swept up in these spurious claims, based on premature findings. Eventually faced with evidence of their errors, at least two states completely abandoned plans to purge the voters they identified, while others acknowledged that their findings may include U.S. citizens.

Now SAVE program flaws and gaps in Social Security Administration data risk enabling a weaponization of the tool to spread the sort of falsehoods that ran rampant in the aftermath of the 2020 presidential election. The public should be highly skeptical of any claims of widespread voter fraud arising from searches in the overhauled SAVE system.

Improper Voter Purges

Election officials who fail to exercise caution or misunderstand the nature of SAVE’s overhaul risk undermining American citizens’ freedom to vote.

USCIS guidance released since the SAVE program overhaul recommends that election offices notify registered voters whose citizenship cannot be verified that they may contact the Social Security Administration to update their records. This is a departure from the previous practice of requiring election officials to pursue additional verification for all searches where citizenship could not be verified at the first step. Because of notable gaps in the Social Security Administration’s citizenship data, purging voters based solely on initial search data would likely be an unconstitutional denial of the right to vote in at least some cases.

Election officials may also violate the right to vote if they purge voters without following proper protocol in other circumstances. Where a requestor institutes additional verification and the SAVE program still cannot verify citizenship, USCIS generally requires election officials to contact the voter and provide the opportunity to present proof of citizenship. That notice is critical since SAVE lacks comprehensive citizenship information. But even with notice, the SAVE program’s failure to verify citizenship may impose hardships on voters who may then be required to prove their citizenship. Twenty-one million American citizens do not have easy access to common citizenship documents like passports or birth certificates, so large numbers of eligible voters risk being disenfranchised altogether. 

Improper Investigations into Election Officials

There is a grave risk of investigations or prosecutions of state or local election officials based on false claims that they permitted noncitizens to register to vote. This is no mere speculation: The federal government has threatened to prosecute election officials, targeted some officials who refuse to endorse the lie that the 2020 election was stolen, and filed litigation seeking voter list maintenance records regarding noncitizens.

Congress authorized the SAVE program to help states ensure eligibility for public benefits applications, not to block American citizens from voting. With substantial new changes to the SAVE program, there is even more reason for election officials to exercise caution when using the system and interpreting its results. SAVE is a tool for verifying citizenship. Like other large-scale data sources, it has flaws, exacerbated by an aggressive overhaul. To mitigate the risk of improper disenfranchisement, officials that elect to use the SAVE program should do so with great care. States have a variety of other tools at their disposal to help ensure that only eligible citizens are registering and voting. Meanwhile, Congress and the federal government should improve the underlying databases and their quality checks and transparency, as outlined in other Brennan Center analyses.

The public should approach any false allegations of widespread fraud that may arise from changes to the SAVE program with skepticism, keeping in mind the program’s pitfalls, the extensive evidence that this sort of fraud in our elections is vanishingly rare, and a long history of false and exaggerated findings about alleged noncitizen voting. Lawmakers, officials, and advocates must remain vigilant and defend against improper or unlawful voter purges. Election officials must be fastidious about observing important protocols for using SAVE that may be jettisoned or downplayed by the Trump administration. Without unified action to combat exploitation and misuse of the SAVE program, eligible voters stand to lose.