Trump's much-vaunted election security tool keeps messing up: 'Not ready for prime time'

When county clerk Brianna Lennon got an email in November saying a newly expanded federal system had flagged 74 people on the county’s voter roll as potential noncitizens, she was taken aback.

Lennon, who’d run elections in Boone County, Missouri, for seven years, had heard the tool might not be accurate.

The flagged voters’ registration paperwork confirmed Lennon’s suspicions. The form for the second person on the list bore the initials of a member of her staff, who’d helped the man register — at his naturalization ceremony. It later turned out more than half the Boone County voters identified as noncitizens were actually citizens.

The source of the bad data was a Department of Homeland Security tool called the Systematic Alien Verification for Entitlements, or SAVE.

Once used mostly to check immigrants’ eligibility for public benefits, SAVE has undergone a dramatic expansion over the last year at the behest of President Donald Trump, who has long falsely claimed that millions of noncitizens lurk on state voter rolls, tainting American elections.

At Trump’s direction, DHS has pooled confidential data from across the federal government to enable states to mass-verify voters’ citizenship status using SAVE. Many of the nation’s Republican secretaries of state have eagerly embraced the experiment, agreeing to upload all or part of their rolls.

But an examination of SAVE’s rollout by ProPublica and The Texas Tribune reveals that DHS rushed the revamped tool into use while it was still adding data and before it could discern voters’ most up-to-date citizenship information.

As a result, SAVE has made persistent mistakes, particularly in assessing the status of people born outside the U.S., data gathered from local election administrators, interviews and emails obtained via public records requests show. Some of those people subsequently become U.S. citizens, a step that the system doesn’t always pick up.

According to correspondence between state and federal officials, DHS has had to correct information provided to at least five states after SAVE misidentified some voters as noncitizens.

Texas and Missouri were among the first states to try the augmented tool.

In Missouri, state officials acted on SAVE’s findings before attempting to confirm them, directing county election administrators to make voters flagged as potential noncitizens temporarily unable to vote. But in hundreds of cases, the tool’s determinations were wrong, our review found. Lennon was among dozens of clerks statewide who raised alarms about the system’s errors.

“It really does not help my confidence,” she said, “that the information we are trying to use to make really important decisions, like the determination of voter eligibility, is so inaccurate.”

In Texas, news reports began emerging about voters being mistakenly flagged as noncitizens soon after state officials announced the results of running the state’s voter roll through SAVE in October.

Our reporting showed these errors were more widespread than previously known, involving at least 87 voters across 29 counties. County election administrators suspect there may be more. Confusion took hold when the Texas secretary of state’s office sent counties lists of flagged voters and directed clerks to start demanding proof of citizenship and to remove people from the rolls if they didn’t respond.

“I really find no merit in any of this,” said Bobby Gonzalez, the elections administrator in Duval County in South Texas, where SAVE flagged three voters, all of whom turned out to be citizens.

Even counting people flagged in error, the first bulk searches using SAVE haven’t validated the president’s claims that voting by noncitizens is widespread. At least seven states with a total of about 35 million registered voters have publicly reported the results of running their voter rolls through the system. Those searches have identified roughly 4,200 people — about 0.01% of registered voters — as noncitizens. This aligns with previous findings that noncitizens rarely register to vote.

Brian Broderick leads the verification division of U.S. Citizenship and Immigration Services, the DHS branch that oversees SAVE. In an interview this month, he acknowledged the system can’t always find the most current citizenship information for people not born in the U.S. But he defended the tool, saying it was ultimately up to states to decide how to use SAVE data.

“So we’re giving a tool to these folks to say, ‘Hey, if we can verify citizenship, great, you’re good. If we can’t, now it’s up to you to determine whether to let this person on your voter rolls,’” Broderick said.

In Texas, Secretary of State Jane Nelson declined an interview request. Her spokesperson, Alicia Pierce, said the office hadn’t reviewed SAVE’s citizenship determination before sending lists to counties because it isn’t an investigative agency. In a statement, Pierce added that the use of SAVE was part of the office’s “constitutional and statutory duty to ensure that only eligible citizens participate in Texas elections.”

A spokesperson for Missouri Secretary of State Denny Hoskins called SAVE a valuable resource even though some people it flagged might later be confirmed as citizens. “No system is 100% accurate,” Hoskins said in an interview, “but we’re working to get it right.”

Asked whether it was problematic that his office directed clerks to temporarily bar voters from casting ballots before verifying SAVE’s findings, Hoskins said that was a “good point.”

While 27 states have agreed to use SAVE, others have hesitated, concerned not only about inaccuracies, but also about privacy and the data’s potential to be used in immigration enforcement. Indeed, speaking at a recent conference, Broderick said that when SAVE flags voters as noncitizens, they are also referred to DHS for possible criminal investigation. (It is a crime to falsely claim citizenship when registering to vote.)

People who’ve been flagged by SAVE in error say it’s jarring to have to provide naturalization records to stay eligible to vote when they know they’ve done nothing wrong.

Sofia Minotti, who lives north of Dallas in Denton County, was born in Argentina but became a U.S. citizen years ago. Nonetheless, she was one of 84 Denton County voters identified by SAVE as a potential noncitizen. She and 11 others have since provided proof of citizenship, giving the system an error rate in the county of at least 14%.

The real rate is probably higher, a county official acknowledged, since some of those sent notices to prove their citizenship might not respond in time to meet the deadline. They’ll have to be reinstated to vote in the midterms later this year.

Minotti, though still on the rolls, felt singled out unfairly.

“I’m here legally, and everything I’ve done has been per the law,” she said. “I really have no idea why I had to prove it.”

Election administrators in many states have long hungered for better access to federal information on citizenship status.

States don’t typically require people to provide proof of citizenship when they sign up to vote, only to attest to it under penalty of perjury. Previous efforts to use state data to catch noncitizens on voter rolls have gone poorly. Texas officials had to abandon a 2019 push after it became clear their methodology misidentified thousands of citizens, many of them naturalized, as ineligible voters.

Until recently, SAVE hadn’t been much of a resource. State and local election officials needed to have voters’ DHS-assigned immigration ID numbers — information not collected in the registration process — to verify their citizenship status. Plus, officials had to pay to conduct searches one by one, not in bulk.

In March, Trump issued an executive order that required DHS to give states free access to federal citizenship data and partner with the Department of Government Efficiency to comb voter rolls.

The order triggered a series of meetings at USCIS designed to comply with a 30-day deadline to remake SAVE, a document obtained by the American Civil Liberties Union and reviewed by ProPublica shows.

The system’s main addition was confidential Social Security Administration data, which allowed states to search using full or partial Social Security numbers and incorporated information on millions of Americans who were not previously in Homeland Security databases.

David Jennings, Broderick’s deputy at USCIS, had pressed his team to move quickly, he said on a June video call with members of former Trump lawyer Cleta Mitchell’s Election Integrity Network, which has spread false claims about noncitizen voting.

“We tested it and deployed it to our users in two weeks,” Jennings said on the call, which ProPublica obtained a recording of. “I think that’s remarkable. Kind of proud of it.”

Jennings added that to get quick access to the Social Security data, which has been tightly guarded, USCIS partnered with DOGE. (In an unrelated matter, DOGE has since been accused of misusing Social Security data.) Jennings did not respond to questions from ProPublica and the Tribune.

Perhaps because of its accelerated timetable, USCIS expanded the system before meeting legal requirements to inform the public about how the data would be collected, stored and used, according to voting rights organizations that sued. (UCSIS did not respond to a request for comment about this.) It also blew past concerns from voter advocacy groups about the accuracy of SSA’s citizenship data, which multiple audits and analyses have shown is often outdated or incomplete. This is particularly true for people not born in the U.S., who often get Social Security numbers well before they become citizens.

According to emails obtained by ProPublica and the Tribune, SAVE first checks SSA’s citizenship information. If that shows a voter isn’t a citizen, DHS searches other databases, but it can be difficult to locate and match all the data the systems have on a person. This can lead to errors.

Broderick said in the interview that Trump’s executive order dramatically accelerated the timetable for launching SAVE, getting agencies to cooperate and move quickly. But he insisted the work was done responsibly.

“Do I think it was reckless? Do I think it wasn’t planned? Do I think it wasn’t tested? Absolutely not,” he said.

By September, Texas had uploaded its entire list of more than 18 million registered voters into SAVE. Alabama, Arkansas, Indiana, Louisiana, Missouri, Montana, Tennessee, Utah and Wyoming put voter data into the system, too.

They would soon start to unveil what SAVE had found.

One of the first out of the gate was Texas. In late October, with early voting underway in state and local elections, Nelson, the secretary of state, announced SAVE had identified 2,724 potential noncitizens on the rolls.

But as Nelson delegated the task of investigating those voters’ statuses to local election officials, confusion took hold.

At a meeting, Nelson’s staff told county clerks’ offices to investigate flagged voters and then send notices to those for whom they were unable to confirm citizenship. In a follow-up email, Nelson’s staff told the clerks they should already have heard from someone in the office with more details.

That set off a chain of messages on the local officials’ email group

Travis County voter registration director Christopher Davis said he hadn’t been contacted and had just learned the county had 97 flagged voters. Marsha Barbee, in Wharton County near Houston, shared that she talked to a Nelson staffer who said she’d been directed not to tell local officials about their lists because they were in the middle of early voting.

“They said we have enough on our plates and didn’t want us to worry right now,” Barbee wrote.

In the absence of clear state guidance, clerks proceeded inconsistently. Some said they didn’t act on their lists, waiting for more direction. Others, unsure how to investigate flagged voters’ status, said they simply sent notices asking for proof of citizenship, though some opted not to remove nonresponsive voters from the rolls.

“I give them many chances; I don’t just expire them right away,” Dee Wilcher, a clerk in East Texas’ Anderson County, said about flagged voters, adding that she wanted to avoid removing citizens from the rolls and looking “stupid.”

Chris McGinn, executive director of the Texas Association of County Election Officials, said many clerks expressed frustration with the secretary of state’s lack of guidance and failure to help with investigations. When he shared clerks’ concerns, McGinn said Nelson’s staff didn’t respond, leading him to conclude that checking SAVE’s findings wasn’t an agency priority.

He called the state’s use of SAVE “more political and appearance-based” than a practical way to ensure election integrity.

One way to check SAVE’s findings would have been to get information from the Texas Department of Public Safety, which requires proof of citizenship if residents register to vote when obtaining a driver’s license. The secretary of state’s office didn’t do this and didn’t direct counties to either.

Several county officials said they hadn’t thought to ask DPS for information; those who did often found the agency had documentation showing some of the voters who SAVE identified as noncitizens were in fact citizens.

In the Texas Panhandle, Potter County elections officials quickly confirmed through DPS that three of nine voters on their list had proof of citizenship on file. In neighboring Randall County, DPS helped officials verify that one in five had a U.S. passport, according to interviews with the local officials.

In December, Travis County learned that 11 of the 97 voters flagged by SAVE had proven their citizenship to DPS. After getting the data, the county’s voter registrar, Celia Israel, said in an interview that she felt even more uncomfortable about moving forward with sending notices to voters, given SAVE’s errors.

“It has proven to be inaccurate,” she said. “Why would I rely on it?”

To be sure, SAVE also identified some people who weren’t eligible to vote, clerks said. Several came across instances in which voters marked on registration forms that they weren’t citizens, but were registered by election office staffers in error. Clerks also said voters have told them they’d misunderstood questions about eligibility when getting drivers’ licenses. (It’s not clear if any of those registered in error voted; overall, noncitizens rarely vote.)

ProPublica and the Tribune surveyed the 177 Texas counties that had voters flagged by SAVE, receiving data from 97 that had either checked DPS records or sent notices to voters to try to verify SAVE’s citizenship information. Overall, more than 5% of the voters SAVE identified as noncitizens proved to be citizens. In some smaller counties, most of those flagged were eligible to vote. That includes six of 11 in the Panhandle’s Moore County, and two of three in Erath County, near Dallas.

But some of those who didn’t respond to notices also might be citizens.

In Denton County, where Sofia Minotti lives, checks by elections administrator Frank Phillips’ staff delivered clear answers on the citizenship status of 26 of the 84 voters flagged by SAVE. Twelve, including Minotti, proved they were citizens. Fourteen more had marked on their registration forms that they weren’t and the blame rested with workers for registering them nonetheless.

Phillips said he removed anyone who didn’t provide proof by the deadline from the rolls to comply with the secretary of state’s instructions, but he fears some were eligible voters.

“What is bugging me is I think our voter rolls may be more accurate than this database,” Phillips said. “My gut feeling is more of these are citizens than not.”

At least initially, Missouri took a more targeted approach to SAVE than Texas did. State officials used the system to search for information on a subset of about 6,000 voters they had reason to think might not be citizens, according to emails between federal and state officials.

The state had results by October, but in early November, a USCIS official wrote to Missouri and four other states to say some people flagged by SAVE as noncitizens were actually citizens, emails obtained through public records requests show.

“We have continued to refine our processes used to obtain and review the citizenship data available to us,” the official wrote, adding that one such improvement revealed the errors.

The staffer attached amended search results, but Missouri officials withheld the attachment from its response to a public records request and did not respond to a question about how many corrections were made.

Based on the updated data from USCIS, Missouri sent lists of flagged voters to county election administrators in November. ProPublica and the Tribune obtained these lists for seven of 10 most populous counties in the state, which show SAVE initially identified more than 1,200 people as noncitizens just in these areas.

The Missouri secretary of state’s office told election administrators it would work to verify SAVE’s citizenship determinations. In the meantime, local officials were instructed to change the status of flagged voters, making them temporarily unable to vote.

The lists were met with swift pushback from county election officials, who, like Lennon, soon spotted people they knew to be citizens and questioned the directive’s legality. On a group call in November, they traded examples, saying they recognized neighbors, colleagues and people they’d helped to register at naturalization ceremonies.

In St. Louis, the Board of Election Commissioners didn’t alter the eligibility of anyone on its flagged voter list after being advised not to by its attorney.

Rachael Dunn, a spokesperson for Hoskins, the Missouri secretary of state, said state law allows officials to change voters’ status during investigations into their eligibility — for example, if there are signs they’ve moved. The laws she cited don’t directly address investigations into citizenship status, however.

In early December, some 70 clerks, Republicans and Democrats, wrote a letter to Missouri House Speaker Jonathan Patterson saying there were better ways than SAVE to keep noncitizens off voter rolls.

Weeks later, the state’s election integrity director, Nick La Strada, wrote USCIS to ask why a voter that SAVE had identified as a noncitizen in October had showed up in a more recent search as a citizen.

A USCIS official replied that between the initial search and the follow-up, DHS had gotten access to passport data, which contains more up-to-date citizenship information on some people not born in the U.S.

The USCIS staffer explained that some of the most accurate citizenship information — which is within DHS’ own records — still wasn’t searchable in SAVE because running that kind of search would require the voter’s DHS identifier, which can’t always be located. The staffer said they were working on improvements but those could take until March.

“You don’t start with something at that scale until you work the bugs out, and that is not the case here,” Clinton Jenkins, president of the Missouri Association of County Clerks and Election Authorities, said in an interview. Jenkins is also the clerk for Miller County in the Ozarks.

In early January, in what was framed as a “SAVE review update,” the secretary of state’s office sent counties across Missouri revised lists with reduced numbers of voters identified as potential noncitizens. It instructed election administrators to move voters who’d been initially flagged in error by SAVE back to active status, restoring their eligibility to vote.

Dunn, Hoskins’ spokesperson, didn’t specify what prompted these adjustments. Even the new lists may not be final, she acknowledged. Once the review is complete, the state has said it plans to send letters to those still on the lists, demanding proof of citizenship and giving recipients 90 days to respond.

The addition of new data to SAVE makes it a more valuable resource, she maintained, “while also reinforcing the need for careful, layered review before any action is taken.”

After the January revision, St. Louis County’s initial list of 691 potential noncitizens dropped to 133.

Zuzana Kocsisova, who lives in St. Louis, was among those incorrectly flagged by SAVE on its first pass. Originally from Slovakia, she became a U.S. citizen in 2019. She showed ProPublica and the Tribune a copy of her naturalization certificate, which she keeps with a letter from Trump congratulating her for “becoming a citizen of this magnificent land.”

When a reporter told her that SAVE had initially identified her as a potential noncitizen, she said she wasn’t surprised. She saw it as part of the Trump administration’s targeting of immigrants. She was more frustrated than relieved to learn that she wasn’t on the smaller list of flagged voters sent in January.

“Overall, it seems like this process has done more to worry people who can vote than to identify actual registered voters who don’t qualify,” she said. “It’s just a waste of resources. I don’t think it makes the elections any more safe.”

In Boone County, where Lennon is the clerk, the count of flagged voters fell from 74 to 33 and the naturalized citizen who Lennon’s staff helped register was no longer on the list.

Lennon said she and other county clerks would happily accept data that helps them correctly identify noncitizens on their voter rolls. But so far, SAVE hasn’t done that. And until it does, she said, she won’t purge voters purely because SAVE has flagged them.

“This is not ready for prime time,” Lennon said. “And I’m not going to risk the security and the constitutional rights of my voters for bad data.”