Jen Fifield, Propublica

This year, when states began using an expanded Department of Homeland Security system to check their voter rolls for noncitizens, it was supposed to validate the Trump administration’s push to harness data from across federal agencies to expose illicit voting and stiffen immigration enforcement.

DHS had recently incorporated confidential data from the Social Security Administration on hundreds of millions of additional people into the tool, known as the Systematic Alien Verification for Entitlements, or SAVE, system. The added information allowed the system to perform bulk searches using Social Security numbers for the first time.

The initial results, however, didn’t exactly back up President Donald Trump’s contention that noncitizen voting is widespread. Texas identified 2,724 “potential noncitizens” on its rolls, about 0.015% of the state’s 18 million registered voters. Louisiana found 390 among 2.8 million registered voters, a rate of about 0.014%.

Instead, experts say, the sweeping data-sharing agreement authorizing DHS to merge Social Security data into SAVE could threaten Americans’ privacy and lead to errors that disenfranchise legitimate voters.

The details of the agreement, which haven’t previously been reported, show it contains alarmingly few guardrails to ensure accuracy and scant specifics on how the data will be kept secure, election and privacy lawyers who have reviewed it say. Further, it explicitly does not bar DHS from deploying the SSA data for other purposes, including immigration enforcement.

Experts have raised similar concerns about other parts of the Trump administration’s data-pooling drive, which has sought to tap all sorts of traditionally tightly controlled federal information, even tax data.

Until this year, SAVE contained information only on immigrants who’d had contact with DHS, such as those with permanent resident status, and had been assigned immigrant identification numbers. State and local officials typically used the system to verify immigrants’ status when they applied for benefits such as SNAP or to check, one by one, whether individuals who were registering to vote were citizens.

Under the May 15 data-sharing agreement, which was posted recently on the Social Security Administration’s website, the system added information, including full Social Security numbers, on millions of Americans not in DHS databases. The combined dataset joins together this information with addresses, birth dates and criminal records, along with immigration histories.

The agreement allows the SSA’s data to be used for searches to check voters’ citizenship, along with “other authorized inquiries from Federal, State, territorial, tribal and local government agencies seeking to verify or ascertain the citizenship or immigration status of individuals within their jurisdiction.”

In doing these searches, SAVE stores not only the voter data that election officials upload but also the outcome of their queries, according to the data-sharing agreement and other documents from U.S. Citizenship and Immigration Services, the branch of DHS that oversees SAVE. The documents do not explain who can access this information or how it can be used.

Experts say adding Social Security data to SAVE could help election officials verify, en masse, if voters are U.S. citizens, but it shouldn’t be used to make final determinations that people aren’t citizens.

That’s because multiple audits and analyses have shown that SSA’s citizenship information is often outdated or incomplete, especially for people who became naturalized citizens. With the 2026 midterms about a year away, Caren Short, director of legal and research for the League of Women Voters of the United States, said she fears the expanded use of SAVE will lead to errors.

“The Trump administration is hunting people to try to purge people from the rolls who are lawfully registered, and they are doing it by looking at unreliable, outdated data,” Short said.

Several privacy lawyers said they believe it’s illegal for DHS to expand the use of SAVE without taking steps required in federal law, such as issuing a system of records notice to inform the public how the additional data will be collected, stored and used. Last month, advocacy groups sued the federal government, alleging that its expansion of SAVE and other data consolidation efforts violate the Privacy Act, a federal law that prohibits public agencies from misusing private information.

Officials at U.S. Citizenship and Immigration Services declined to answer questions from ProPublica.

In a filing responding to the advocacy groups’ lawsuit, federal officials said that another statute, the Illegal Immigration Reform and Immigrant Responsibility Act of 1996, explicitly allows information sharing to verify citizenship status and that agencies would exercise caution in determining whether voters are noncitizens.

“There is zero basis to assume that State officials have any interest in haphazardly and unlawfully removing large numbers of U.S. citizens from their voter rolls, and no credible evidence that any such thing has happened or is going to happen any time soon” the filing says.

Still, Leland Dudek, acting SSA commissioner until early May, told ProPublica he doesn’t trust that DHS will accurately flag noncitizens as officials try to cross-match data and files from multiple systems.

“They are probably going to make some massive mistakes,” he said.

This summer, the Justice Department started demanding access to state voter registration lists, saying this was necessary to ensure compliance with federal voter roll maintenance laws. The agency has filed lawsuits against a number of states that have refused to comply.

Some of the states that have refused to provide voters’ private information directly to the Justice Department have entered into agreements with DHS under which they upload that same information into the SAVE system.

According to a document obtained by the ACLU, which sued the administration for SAVE-related records, a growing number of states are signing agreements with DHS to use SAVE to vet voter rolls. Ten states had signed such agreements coming into 2025; as of July, another 10 had signed on, the document shows.

As counsel for Protect Democracy, a nonprofit voting rights group, Naomi Gilens specializes in issues related to privacy and technology. Gilens said it’s important for Americans to consider if they want the government — including future administrations, not just this one — to have so much consolidated information on them.

“That is a very invasive picture that starts to be painted, in one place, for every individual who lives here’s private lives,” she said.

As of last month, Homeland Security officials had run more than 33 million voters through SAVE, USCIS told NPR. So far, the agency has declined to say publicly what the outcome of these queries have been.

But the initial results are tucked into another document obtained by the ACLU.

As of late August, about 96.3% of the voters checked in the SAVE system were identified by the system as U.S. citizens. For an additional 3.1% of voters, the system either couldn’t find them or needed more information to determine their citizenship status. About 0.5% of voters checked had died, the system found. And 0.04% showed up as noncitizens.

According to copies of 12 state agreements with DHS obtained by the ACLU and reviewed by ProPublica, election officials are required to take additional steps to verify SAVE results for voters the system identifies as other than U.S. Citizens. Then, if SAVE still can’t verify citizenship, the election officials “must contact the registrant or registered voter to obtain proof of citizenship.”

Dudek and Kathleen Romig, a former Social Security official who now works at the Center on Budget and Policy Priorities, worry even those steps won’t be enough to prevent mismatches from happening.

People’s names can be misspelled or listed differently in the various datasets. Many states collect partial, not full, Social Security numbers from voters and matches using partial numbers will be even less accurate, since many people share the same names, Dudek and Romig said.

“If there’s Jane Smith that is a citizen, and a Jane Smith that isn’t, you don’t want to disenfranchise the citizen Jane Smith by accident,” Romig said.

Federal officials aren’t done adding data to SAVE. Next up, according to a recent USCIS presentation to election officials shared with ProPublica: passport information from the State Department. (The State Department referred ProPublica’s request for comment to DHS, which did not respond.)