The lawsuit from the Electronic Privacy Information Center cites Mullin's signature as setting in motion what the plaintiffs say is a series of illegal actions.
Mullin is named as a defendant along with the Department of Homeland Security, the Social Security Administration, the State Department and U.S. Citizenship and Immigration Services. The group behind it is a national privacy organization based in Washington.
"Defendants' actions are flagrantly unlawful," the group wrote in the complaint.
"[D]efendants are running roughshod over critical safeguards of the Social Security Act, the Privacy Act, and the Administrative Procedure Act … and the constitutional separation of powers," the Electronic Privacy Information Center wrote.
Trump signed the order the memo carries out, Executive Order 14399, on March 31, according to the complaint. Section 2(a) of that order directs Homeland Security to build a list for every state of people it has confirmed are U.S. citizens, are old enough to vote and live in that state, the complaint says.
The lists must go to each state's chief election official at least 60 days before a federal election, the complaint says. States would then be able to use them to check their own voter rolls.
The Constitution gives states, not the president, the power to decide who is eligible to vote, and it gives states and Congress the power to set the rules for federal elections, EPIC wrote in the filing.
"Yet, in its attempt to seize control over elections, the Trump Administration has brushed aside these laws and constitutional limits by ordering the mass centralization and sharing of Americans' data for ultimate use in determining voter eligibility," the group wrote.
Under a heading labeled "Signature Level Justification," the memo says that building and sending the lists spans the whole department and requires coordination with three other agencies, so the decision had to come from the top.
"[A] DHS Secretary level signatory is required to authorize USCIS to proceed with the approach outlined in this memorandum," the memo says.
The Supreme Court stayed a lower-court injunction against the order on Aug. 24, but did so on threshold grounds without ruling on whether the program is legal, the complaint says. The court suggested that plaintiffs needed proof that the Trump administration was moving forward with its plans. They say that the Mullin memo gives them that.
"By focusing first on a federated, state-facing portal and by planning citizenship-facing transparency as a follow-on enhancement, DHS can meet the EO's near-term requirements while positioning itself for further improvements once legal and privacy work is complete," the memo signed by Mullin says.
As part of its plan, Homeland Security made a website portal available to the states first to check voter eligibility, leaving ordinary citizens with no meaningful way to address challenges to their voting access. The DHS memo said that the portal would be made available to voters " later in 2026."
Through the portal, states would sign in and download separate files from three agencies containing names, dates of birth and agency identification numbers, the memo says. For the Social Security Administration, that identifier is a Social Security number, the complaint says. The agency has called the number one of the most sensitive pieces of information it holds.
Only twenty-two days separated Mullin's signature from June 30, the date the memo set for opening the portal to states. The Privacy Act requires an agency to publish notice in the Federal Register at least 30 days before it starts using people's records in a new way, and to give the public a chance to comment, according to the complaint.
"[T]he Implementation Memo's timelines and 'phased delivery' approach are facially inconsistent with the Privacy Act's notice-and-comment requirements," the group wrote.
No such notice has been published for the citizenship lists or the portal, and the memo describes no plan to publish one, the complaint says.
The lists themselves would be built from records the agencies have already called unreliable, the complaint says.
"Defendants are creating the State Citizenship Lists by repurposing data the government admits is unreliable, outdated, and incomplete," EPIC wrote.
Anthony Nel, a Denton County, Texas, resident who became a citizen through his parents, is one of the voters who already experienced this, the complaint says. Texas officials canceled his registration after running it through the federal system.
Nel proved his citizenship and got his registration back, the complaint says, but he now checks his status regularly because the new lists would draw on the same records that flagged him.
"Disregarding these known problems, DHS has pushed states to bulk upload their entire statewide voter lists into the Modified SAVE system for mass citizenship checks," EPIC wrote. "The President is particularly fixated on baseless claims about widespread voting by non-citizens."
Voting by noncitizens is rare, according to the Associated Press, which also reported that a proof-of-citizenship rule in Kansas blocked roughly 30,000 eligible people from registering before a federal court overturned it.
U.S. District Judge Denise Casper permanently barred most of Trump's first election order in June, according to NBC News.
In a separate action, U.S. District Judge Colleen Kollar-Kotelly blocked two more citizenship provisions of that order, the Associated Press reported. Trump's proof-of-citizenship bill passed the House and stalled in the Senate.
"Defendants' list-making scheme is well underway," the group wrote.
Homeland Security has secured a web domain for the portal, and a banner on the page reads "Coming Soon," according to the complaint. Mullin has said election officials who refuse to use the lists could face investigations, fines and prison time, the complaint says, citing The New York Times.
The deadline is Sept. 4, 60 days before the November election. The memo says USCIS "must" meet it, and the government told the Supreme Court in July that it would.
