Risks of Relying on SAVE Program for Voter List Maintenance
Last year, the Trump administration rushed through sweeping updates to the SAVE program with the stated aim of ridding elections of the “taint” of “illegal aliens . . . defraud[ing] Americans.” Previously, the program only allowed users to search, one by one, for people who had immigration records or some other involvement in formal DHS processes — for example, individuals born overseas to American parents who applied for a certificate of citizenship. With the 2025 changes, the program allows users to conduct bulk searches for anyone with a Social Security number, enabling officials to query massive numbers of registered voters at once. The SAVE program can now also access passport data from the Department of State, according to emails between U.S. Citizenship and Immigration Services (USCIS) and a local election office, as well as interviews with local officials.
All states use data in some way to maintain voter lists. But large-scale data-matching programs always carry the risk of false positives, so registered voters flagged by such matching merit further investigation. Most election officials employ robust safeguards to protect voters from disenfranchisement, such as cross-referencing voter records against other state sources and giving voters a chance to clear up mistakes before they are removed from the rolls. But in past years, a small number of officials have tried to remove voters without taking proper precautions to verify their eligibility, jeopardizing eligible voters’ registration status and feeding unfounded doubts about election integrity. That risk is even greater in 2026 given the Trump administration’s efforts to use the flawed SAVE program to support false claims that noncitizens are voting in large numbers.
There are three principal reasons to be skeptical of voter fraud claims based on SAVE program results.
Error-Prone Methodology at Scale
Large-scale data matching consistently produces errors in a range of contexts. Individuals often appear in multiple databases, and inconsistencies in the listing of their name (for example, Juan Gonzalez appearing as J. Gonzales in some records), birthdate, or gender may prevent a data-matching system from querying all their associated records. Large data ecosystems can also struggle to integrate new information. For example, a system may fail to recognize that Anita Das’s name has changed to Anita Das-Reilly after marriage. These gaps and discrepancies create problems in the context of voter list maintenance. Consider the case of a naturalized voter whose U.S. citizenship is recorded in a USCIS database but not in the Social Security Administration database and other government records, which could lead to them being incorrectly flagged as a noncitizen voter.
Similar mistakes are highly likely. USCIS maintains many databases that collectively contain more than 100 million immigration records, and the SAVE program can access a large amount of that information. Managing that volume of data is enormously complex, and even under the best circumstances, USCIS makes mistakes when identifying people’s citizenship or immigration status. When data reconciliation is done at such a mammoth scale, a modest error rate (at least) is inevitable. Given the number of individuals processed, however, even a small error rate could translate into tens of thousands of voters being mistakenly identified as noncitizens.
To put that in perspective, consider that peer-reviewed social scientists have viewed false-positive error rates ranging between 0.9 percent and 2.5 percent as acceptable when drawing conclusions from large-scale data reconciliation. (There is no generally accepted false-positive error rate.) Then consider New York Times reporting from earlier this year revealing that DHS ran 49.5 million voter files through the SAVE program and seemingly identified around 10,000 registrants as potential noncitizens. That represents just 0.02 percent of the total number of registrants in the voter files searched, a percentage far lower than many typical error rates. In other words, when dealing with datasets of this size, it would not be unreasonable to expect at least 10,000 false matches. In fact, that would reflect a low error rate.
As such, the numbers the administration has disclosed could be entirely explained by errors inherent in any large-scale data-matching process. To be clear, there is no publicly available evidence that all those matches are false positives, but as discussed further below, there are plenty of indications that at least a large percentage of them likely are. The point is that even very low error rates in the SAVE program could produce a number of matches that seems quite large in absolute terms.
Like all systems that match and reconcile information across vast datasets, the SAVE program has a baseline error rate. If the administration successfully compiles a complete list of the roughly 174 million registered voters in the country and runs it against the SAVE program, that baseline error rate alone, even if small, could give the false impression that there is a massive number of ineligible or potentially ineligible voters on the rolls. Americans falsely flagged by the SAVE program could face unnecessary burdens to prove their citizenship or be disenfranchised altogether if they, for example, miss a notice from their local election official in the mail.
Faulty or Incomplete Data Sources
Beyond the matching errors that commonly afflict large data systems, the SAVE program has specific flaws that undercut its reliability.
First, the SAVE program can pull from particularly error-ridden datasets, including U.S. Customs and Border Protection’s Automated Targeting System and TECS, the primary system used to screen the admissibility of those arriving at a U.S. border. The ATS dataset incorporates information from the FBI’s terrorism watchlist, which contains unreliable information misidentifying people as terrorists and permits intentional biases against certain religious and racial minorities. TECS integrates that same FBI watchlist information, as well as travel records and other fallible data sources.
Compounding these pitfalls are newly SAVE-accessible data sources from the Social Security Administration and the Department of State, which have their own shortcomings. The Social Security Administration only began systematically collecting citizenship data in 1978, and the agency’s notations indicating that someone is foreign-born or a noncitizen may have been inferred for Social Security number holders born before that date. The Social Security Administration’s central database often lacks up-to-date citizenship information for naturalized citizens if they did not notify the agency of their naturalization. And roughly half of American citizens lack a passport, making Department of State passport data meaningless for tens of millions of Americans.
Second, no dataset feeding into the SAVE program is likely to contain the most up-to-date information on naturalized citizens. DHS publishes a list of hundreds of thousands of naturalized citizens each quarter. No matter when a search is run through the program, there will be substantial numbers of newly naturalized people whose records may not have been updated promptly for key datasets used by the SAVE program. Instances like these, where records reflect outdated information, illustrate why relying on the SAVE program alone for citizenship verification is unwise.
Third, USCIS’s hasty expansion of the SAVE program was finalized before updates to citizenship data could be processed and merged, resulting in blunders, according to news reporting. The agency has admitted that it initially provided incorrect information to at least five states through the SAVE program. The program wrongly flagged hundreds of voters across Missouri as noncitizens. One county clerk in Boone County, Missouri, said that more than half of registered voters flagged by SAVE as noncitizens in November turned out to be U.S. citizens. As another election official put it, the expanded SAVE program “is not ready for prime time.”
Track Record of Incorrect Results
States or localities that have supposedly identified substantial numbers of noncitizen voters by using the overhauled SAVE program have been proven wrong. The outcomes of these investigations, the inherent pitfalls of large-scale data matching, and the flawed data sources used by the SAVE program all demand significant caution regarding any future claims about noncitizens on voter rolls.
For example, around 35 percent of registered voters identified as noncitizens in St. Louis County, Missouri, by the SAVE program were, in fact, naturalized U.S. citizens who registered to vote at their naturalization ceremonies, according to the county’s Republican election director. Likewise, after Texas officials announced that the SAVE program had identified hundreds of registered Texas voters as potential noncitizens, subsequent public reporting found that they had failed to cross-check state records confirming the registrants’ citizenship.
A number of states have recently taken a more responsible approach to using the SAVE program that underscores the pitfalls of relying exclusively on federal data sources and confirms the rarity of noncitizen voting. For instance, after Utah completed a review of its voter rolls, it found zero occurrences of noncitizen voting. Last year, Louisiana reviewed its voter records going back four decades and identified only 79 potential noncitizens who voted, out of an estimated 74 million ballots cast during that period. Louisiana’s Republican secretary of state declared that “non-citizens illegally registering or voting is not a systemic problem in Louisiana.”