In a primetime address on July 16, President Trump presented a federal review as having “identified approximately 278,000 non-citizens who are registered to vote in federal elections.” Because Democratic states had refused to share their files, he claimed, “the real number is actually much higher.”

The next day, his Homeland Security secretary, Markwayne Mullin, told the country that DHS had found “over 250,000 potential non-citizens illegally registered to vote in just 4 U.S. states,” and warned that election officials who received the administration’s information and declined to act could face “fines,” “penalties” and “prison time.”

The 278,000 figure does not appear in any of the 58 supporting documents the White House released alongside the address. RDP reviewed all of them. Exactly one addresses noncitizen registration: an undated, one-page DHS sheet titled “PREVENTING ALIEN VOTING.” It doesn't list the 278,000 figure Trump claimed — only two other numbers, describing two populations found two different ways, and it explains the method behind neither.

That is the rhetoric. Here is the record.

Two Searches, One Headline Number

SAVE, the Systematic Alien Verification for Entitlements program, was not built as an elections tool. It started as an immigration and public‑benefits database, designed to let agencies verify status for things like Medicaid and driver’s licenses. In 2025, the administration wired it into a broader identity stack and began using it to screen voter rolls at scale. RDP has been following that shift since late 2025, documenting DOJ’s “confidential” SAVE memorandum with states and the 26‑state pattern of federal data‑sharing it created.

The sheet’s first figure is “over 250,000” noncitizens supposedly registered in California, Pennsylvania, New Jersey and Nevada, four states the document itself says had “not utilized the SAVE system.” That population came from a review of “public voter files.”

The sheet does not say what those files were matched against, what established noncitizenship, whether any match was confirmed or reviewed by a person, or how a wrongly flagged citizen could contest it.

Mullin acknowledged that DHS still needed additional records from those states to determine whether the people it had identified actually voted and where. The department might have to obtain that information through public-records requests, he said. That does not explain how DHS generated the 250,000 figure. It does show that the individualized review needed to move from a database flag to an enforceable finding was unfinished when the administration announced the number.

The sheet’s second figure is “over 28,000” noncitizens, drawn from the “enhanced SAVE system” — through which, it says, 25 states processed more than 68 million registration records as of June 22, 2026.

Here the document discloses a little more: a table headed “Proactive SAVE User States,” with deceased and noncitizen counts for ten states. The “noncitizen” column sums to 10,716, roughly 38 percent of the claimed 28,000. The document labels the table “sample data.” Fifteen of the 25 states go unnamed, and the balance is assigned to no state at all.

SAVE returns result codes that distinguish a confirmed match from a case needing further checking. The release discloses none of them, and never says how many of the 28,000 were tentative matches rather than settled findings.

Add 250,000 and 28,000 and you get 278,000. The DHS sheet doesn't tell the reader that the President’s headline number stitches together a database-screening program and a separate review of public files in states that, by the document’s own account, never used the SAVE program.

The government’s own language is inconsistent. The one-pager’s headline says the registrants “ARE ILLEGALLY REGISTERED.” Mullin, a day later, called them “potential.” Trump’s number carried no qualifier at all. These are official statements. They are not independently validated findings. The distance between those two things is the whole story.

A Flag Is Not a Finding

A registration is not a vote. Nothing in the release shows that any of these registrants cast a ballot. A database match is not a legal determination of ineligibility; it means two records resemble each other, subject to a review the release does not describe.

The government knows the difference, because by its own account the confirming work is not finished. DHS was “going through these files one by one,” Mullin said, to determine for each person “did they vote? And… where do they vote at?” That is the description of a review still under way, offered as the basis for a number already presented to the nation as fact.

The distance between an initial flag and a confirmed finding can be large. As RDP previously documented from Iowa records and related litigation, Iowa’s own 2024 review initially flagged 2,176 registered voters as potential noncitizens; at least 88 percent turned out to be citizens.

That was a state review conducted outside SAVE, not a SAVE error rate, but it is a concrete measure of how far a flag can sit from a finding, and it is exactly the kind of secondary-review data the July release omits.

From Benefits Checks to Voter-Roll Screening

The distinction matters because SAVE was not designed to screen entire voter rolls.

The Systematic Alien Verification for Entitlements system is decades old. For most of its existence, agencies used it for case-by-case status checks in benefits and licensing decisions. An agency could ask whether a particular noncitizen held an immigration status that made the person eligible. Its transaction engine—the Verification Information System, or VIS, which also supports E-Verify—was built around that narrower function.

The 2025 changes altered both the scale and the population being searched. Bulk upload allowed states to submit entire lists at once. Searches using partial Social Security numbers allowed the system to reach beyond immigration-specific identifiers and query citizens as well as noncitizens.

The scale is documented. In a sworn declaration now in the appellate record, a senior USCIS official stated that 27 states had registered for SAVE voter verification by April 1, 2026, and that the system logged 59.7 million voter-verification queries during the preceding 15 months.

A case-by-case eligibility system was now processing voter records by the tens of millions. But scale alone does not show how state voter files reached the system. On that question, DOJ has now spoken in court.

The Pipeline is Now on the Record

The question is no longer whether DOJ intended to connect the voter files it collected from states to SAVE. DOJ said so in court.

In a March 26 hearing, DOJ’s acting Voting Section chief, Eric Neff, told a Rhode Island court, “we are certainly going to be proceeding with running this, our intention is to run this against DHS’s SAVE database.” He cautioned that steps remained before the government could claim full Privacy Act compliance. That's intent, not a completed handoff. But the intent did not stay a stray courtroom line.

In April, as Democracy Docket reported, Minnesota told a federal court that DOJ’s counsel had “confirmed that DOJ will in fact provide the list to DHS.” On May 12, DOJ’s Office of Legal Counsel issued an opinion titled “Authority to Obtain and Share Statewide Voter Roll Data,” supplying the administration’s legal theory for exactly that.

The new DHS sheet adds an official line of its own: DHS “will support the Department of Justice’s review of voter files obtained pursuant to their enforcement authority.” Those records establish the plan, the administration’s claimed legal authority and DHS’s promised participation. They do not establish that every state file completed that route. Iowa shows why that distinction matters.

Iowa appears in the record through two separate data channels. In the first, Iowa handed its statewide voter file to the Justice Department.

As RDP reported in May, Secretary of State Paul Pate said the state was “legally obligated to comply with the request,” and Iowa’s own public records show the transfer was completed through DOJ’s secure JEFS portal in March 2026, a staffer’s email confirming “the data transfer is complete.”

In the second channel, Iowa’s Department of Inspections, Appeals, and Licensing has been a direct SAVE user for professional licensing. Its interim director, Aaron Baack, swore on July 1 that Iowa began submitting cases in December 2025 and had submitted “more than 8,150,” with more than 350 licenses stalled when DHS disabled Social Security number verification the day after the D.C. court ruling.

Those licensing cases are not the voter file. And Iowa is no bystander in the litigation: its attorney general, Brenna Bird, is lead counsel on a four-state amicus brief filed in the D.C. Circuit on July 9, arguing to keep the screening system running.

The remaining Iowa question is specific: what happened after the voter file reached DOJ? The public record does not show whether DOJ sent it to DHS, whether any Iowa voter record entered SAVE, what matching rules or result codes were used, or whether anyone was flagged. The Iowa-to-DOJ transfer is documented. The downstream transaction record is not.

RDP has asked DIAL, the Attorney General’s Office, the Secretary of State’s Office and Iowa HHS which personal identifiers belonging to Iowans were sent to DHS. We have been asking for months. No state agency has provided a substantive answer.

The documented trail stops there. The state-by-state transaction ledger—and the validation data needed to measure false positives—has not been produced.

The same system was already under conflicting federal court orders when Trump delivered the speech. On June 22, Judge Sparkle Sooknanan of the federal district court in Washington vacated the 2025 SAVE changes. On July 7, a federal judge in Florida ordered DHS to restore two features for Florida, Ohio, Iowa and Indiana, and DHS created a workaround days later. The D.C. plaintiffs are seeking enforcement of the vacatur, while the four states are supporting continued operation of the system. The conflict remains unresolved.

The Law Congress Has Not Passed

Against that unresolved legal conflict, Trump asked Congress to give the disputed system an express statutory foundation. The vehicle he endorsed was the SAVE America Act—H.R. 7296, with a Senate companion, S. 3752.

Introduced on January 30, 2026, it has not passed the House and has not been marked up, contrary to claims after the speech that the House had already passed it. The bill that did pass the House, 220–208 in April 2025, is a different and narrower measure, H.R. 22, which has sat in the Senate since with no further action.

H.R. 7296 would convert the disputed machinery into law. It requires documentary proof of citizenship to register and photo identification to vote, in person and absentee, and writes SAVE into statute.

It orders federal agencies holding relevant information to hand it to a state election official within 24 hours of a request, batches included, and directs federal departments to share that information with one another to answer such requests.

The administrative changes enabling bulk screening and interagency data sharing were vacated as unlawfully implemented. H.R. 7296 would give much of that architecture an express statutory basis.

The bill contains no general restriction limiting mail voting to illness, disability, military service or travel, despite that promise appearing on the White House’s SAVE America page and in the address.

The SAVE America Act was not written in response to the June ruling; it was introduced nearly five months before the vacatur. The speech did not create the bill. It repurposed it.

The Expansion Did Not Begin With This Speech

Restoring Democracy’s Promise has treated SAVE as infrastructure for more than a year—following it from a benefits database into licensing, voter‑roll screening, inter‑agency data‑sharing and litigation.

We were on this beat before Trump made “SAVE America” the centerpiece of his speeches, reporting on DOJ’s SAVE MOU, Iowa’s voter‑file hand‑off, the federal court that vacated Trump’s revamped voter‑screening system, and the four‑state workaround DHS built in response.

The July 16 release adds another stage. The administration is asking Congress to make population-scale voter screening permanent while withholding the methodology, result codes and state-level records needed to test its central claim.

Trump gave the public a number. His administration did not provide the work behind it.

RDP will continue following the litigation, records requests and federal-state data exchanges as one connected investigation.

Further Reporting

SAVE: The Benefits Database Now Monitoring Every Licensed Iowan — and Every Driver, December 10, 2025

The 26-State Pattern: DOJ's "Confidential" SAVE MOU to Federalize Voter Rolls, December 31, 2025

The Department of Governance by Algorithm: How DOGE Built Cleta Mitchell’s Dream Machine, January 20, 2026

The SAVE America Act: From Voter Verification to Identity Infrastructure, February 18, 2026

Iowa Handed Over the Voter Data — The Legal Blueprint Was Already There, May 7, 2026

A Court Struck Down Trump's Voter-Screening System. Iowa Had Already Signed On Twice., June 25, 2026

DHS Built a Four-State SAVE Workaround After a Judge Struck Down the 2025 System, July 11, 2026

The federal government has told a judge in Washington how it plans to respond to two courts pulling the same citizenship-verification system in opposite directions. It will not restore ordinary SAVE access nationwide. Instead, Florida, Ohio, Iowa, and Indiana send spreadsheets through a secure federal file-sharing tool; USCIS administrators run the bulk and Social Security number searches internally; and Social Security has reactivated its data connection for those four states alone.

The arrangement appears in a July 10 Joint Status Report and three accompanying records, including sworn declarations from USCIS and the Social Security Administration. Together, they reveal not a nationwide restoration, but a geographically limited federal workaround.

The Exception was Already in the Paperwork

The four-state idea itself is not new. As RDP reported after the June ruling — building on our investigation dating to December 2025 — the court decisions did not begin this story. They exposed an architecture Iowa and the other settlement states had already spent months putting into place.

The settlement also contains a federal-law escape clause. Paragraph 17 says it imposes no duty on the government that is “inconsistent with” federal law — a reading the D.C. plaintiffs pressed and DHS itself acknowledged in an earlier briefing. Judge Sooknanan nevertheless rejected the settlement as a shield against relief and vacated SAVE’s 2025 overhaul. Just over two weeks later, the Florida court ordered restoration anyway.

The July workaround is the operational endpoint of a collision RDP has been documenting — and that has been visible in the federal paperwork — for more than seven months.

Inside the Four-State Workaround

Pezzi’s July 9 email provides the clearest blueprint. “Bulk-upload capability for Florida, Ohio, Iowa, and Indiana — but nobody else — has now been restored,” he wrote, through a “different procedure” created for the circumstances.

Instead of running bulk or Social Security number searches themselves, the four states send spreadsheets through a secure federal file-sharing tool. USCIS employees run the queries against data available to DHS and USCIS, then return the results through the same channel.

The same arrangement applies to Social Security number searches. States can include full or last-four SSNs on the spreadsheet, and USCIS performs the lookup. The exclusivity was explicit: DOJ told the states not to share the address or instructions because the capability was not being offered to anyone else.

Broderick’s sworn declaration confirms who holds the keys: “Only internal USCIS administrators will have the ability to initiate SAVE queries in bulk and using an SSN.” This is not ordinary state access to a federal database. It is a closed, federally operated channel built for four states.

What Was Shut Down — and What Came Back

The declarations establish the sequence. On June 23, the day after the D.C. court vacated SAVE’s 2025 overhaul, USCIS disabled four capabilities nationwide: the bulk-upload tool, the API used for automated queries of SSA data, the SSN field for full and last-four searches, and related passport-query functionality. SSA disabled its API connection with DHS the same day and removed the vacated records notice from its website on June 24. Three automated test transactions slipped through on July 6. The government says they produced no response for any public SAVE user and were stopped the next day.

Then the machinery selectively reversed. On July 9, Broderick declares, USCIS began reenabling bulk and SSN-query capability for the four plaintiff states in the Florida case. That afternoon, per Steffensen, SSA reactivated the connection for use by DHS USCIS solely for the four plaintiff states. The Joint Status Report puts it flatly: SSA is making NUMIDENT records — the master file behind Social Security number verification — available for SAVE requests solely from Florida, Ohio, Iowa, and Indiana.

One timing seam remains. In the same July 9 email, Pezzi told the states their searches would run on DHS-held data that "will not (yet) include SSA data," with the SSA component expected "by the end of this week." The record does not yet establish precisely when SSA-backed responses began reaching state users end to end. The larger finding stands either way: the pipe was rebuilt, and it was rebuilt for four states.

“The ‘Partial Stay’ That This Court Denied”

The plaintiffs who won the Washington judgment do not treat any of this as compliance. In their half of the Joint Status Report, the League of Women Voters, the Electronic Privacy Information Center, and their co-plaintiffs argue that running the vacated system's features for four states — with no valid System of Records Notice in effect at DHS or SSA — violates the court's final judgment. They argue SSA was never a party to the Florida case and therefore faces no conflicting order at all.

On July 11, Judge Sooknanan put that question directly to Social Security. She ordered SSA to explain by 5 p.m. July 13 whether it is bound by the Florida consent decree or Judge Wetherell’s restoration order at all. In doing so, she pointed to Wetherell’s own acknowledgment that there is “merit” to the argument that SSA is not bound by his order.

The chronology gives their sharpest argument its teeth. The government asked the D.C. court for a partial stay covering exactly these four states. The D.C. Circuit did not grant an administrative stay and instead set a briefing schedule. The SAVE screening features came back on for those four states anyway — in the plaintiffs' words, the defendants are "effectively granting themselves the 'partial stay' that this Court denied."

If the dispute is not promptly resolved, the plaintiffs said they anticipate seeking an order requiring the defendants to show why they should not be held in contempt. No contempt motion has been filed to date. The government says it is complying with all outstanding orders "to the greatest extent possible" and proposes that the parties file a schedule for resolving the fight by 3 PM Monday, July 13.

For Iowa, the consequences of that legal collision were not abstract.

Why Iowa Matters

Iowa is one of the four states inside the special channel, and Iowa is where the workaround's stakes are most concrete, at least about voting.

The sworn declaration of Aaron Baack of the state's Department of Inspections, Appeals, and Licensing said Iowa had submitted more than 8,150 SAVE cases since December 2025, and that after the SSN pathway went dark, more than 350 professional licenses could not be verified and therefore could not be issued.

The immediate Iowa injury used to obtain emergency relief was not a challenged voter registration. It was a licensing system Iowa had wired into SAVE — with hundreds of licensure applicants waiting to work.

Iowa’s entanglement with SAVE runs through at least three doors: a voter-verification agreement at the Secretary of State’s Office, a licensing clearinghouse at the Department of Inspections, Appeals, and Licensing, and the state’s role as a plaintiff in the Florida settlement.

A memorandum of agreement between USCIS and the Iowa Secretary of State, dated January 22, 2025, sits in the federal administrative record in the Washington case, and a sworn USCIS declaration filed there last April lists Iowa among the states holding voter-verification SAVE agreements. But Iowa has not told the public what moved through those lanes.

Restoring Democracy's Promise sent questions to both the state Attorney General's Office and the Secretary of State's Office about Iowa's use of SAVE and received no response. A related public-records request was met with a blanket privilege response rather than operational records. Iowans still do not know whether Iowa voter or driver’s-license records were submitted to or processed through SAVE: not because the question cannot be answered, but because the state has not answered it.

Iowa’s own statute complicates the picture. Division VI, Section 35 of SF 2218 says the law’s verification requirements are suspended whenever the federal government does not provide Iowa access to SAVE. They resume automatically when access returns, and state and local officials face no liability for noncompliance during the interruption.

Iowa's own law, in other words, may contain a failsafe for the very federal disruption the state cited as emergency harm.

Whether Section 35 applies remains unresolved because Iowa never defined what counts as SAVE "access." Did Iowa lose access when the SSN search disappeared, or did the remaining query methods keep the law in force? Does the new federal spreadsheet workaround count as restored access? No Iowa official has answered, and the issue does not appear in the Florida filings. That matters because it could determine whether Iowa's verification mandates were suspended during the outage, and whether they are in force now.

The Florida Fight Widens

The Florida fight widened the same day. On July 10, the four states opposed LWV and EPIC's emergency request to enter the case and appeal Judge Wetherell's restoration order. They argue the groups waited too long after learning of the settlement in December and may not have standing to appeal if the federal government does not appeal. That filing is signed by counsel for Florida, Ohio, Indiana, the Iowa AG, and Iowa Secretary of State.

Hours later, the federal government filed its own opposition, also arguing that the request came too late. The sequence is striking. The federal government opposed the states' emergency motion to enforce the settlement, then began carrying out the order after the court ruled against it. It initially took no position on intervention — and now joins the states in trying to keep LWV and EPIC out of the Florida case. For now, the federal government and the four states are aligned against intervention.

The states' brief frames the litigation broadly, opening with their "obligations to maintain accurate and current voter registration records to prevent voter fraud, including non-citizen voting." Iowa's specific emergency harm declaration in this enforcement round remained licensing-focused. The intervention motion is pending and no ruling has been issued.

Subscribe now

Learning the System from the Docket

The mechanics became public because a judge demanded an accounting. Neither DHS nor SSA has published an explanation of the four-state channel; no Iowa official has publicly addressed what the outage or the workaround means for the state's licensing backlog or its suspension clause. DOJ's email asked recipients not to share the address or instructions because the capability was not being offered outside the four plaintiff states. The dockets are, right now, the clearest public record of who can use the workaround, how searches are submitted, and who runs them.

Step back, and the litigation has exposed something larger than a fight between two judges. States have built everyday government functions around a shared federal identity system: SSA's NUMIDENT records, USCIS's SAVE service, state licensing programs, and voter-verification agreements. The legality of SAVE's 2025 overhaul is now before the D.C. Circuit on appeal. But the machinery itself is no longer hidden. The filings show who operates it, how the four-state workaround works, and which states received the special channel.

That workaround also emerged alongside a separate DOJ campaign to obtain statewide voter files and a May 2026 legal opinion asserting authority to share them with DHS — a parallel track RDP is investigating separately. The story is power moving through paperwork.

What Happens Next

Judge Sooknanan moved quickly after the workaround became public. On July 11, she ordered the Social Security Administration to file a notice by 5 p.m. July 13 explaining whether it is bound by the Florida consent decree and Judge Wetherell’s July 7 enforcement order.

She also directed the parties to meet by July 13 and try to resolve the dispute. If they cannot, the Washington plaintiffs have until July 14 to move to enforce or clarify the judgment. The federal government must respond by July 16, with a reply due July 17. The court told the parties to be ready for a hearing at 10 a.m. July 20 if one is needed.

The order places the narrowest and most consequential question squarely before SSA: what legal obligation, if any, required an agency that was not a party to the Florida case to reconnect its data for four states alone?

Until then, the basic sequence is clear. Judge Sooknanan vacated SAVE’s 2025 overhaul. Judge Wetherell ordered two of its features restored for four states. The federal government created a separate channel through which USCIS administrators can run those searches internally, while Social Security reactivated its data connection only for Florida, Ohio, Iowa, and Indiana. The Washington plaintiffs call it the four-state stay Judge Sooknanan refused to grant. The court is now demanding answers directly from SSA.

Share

On June 22, 2026, a federal judge in Washington threw out the machine. In League of Women Voters v. U.S. Department of Homeland Security, Judge Sparkle L. Sooknanan vacated the 2025 "modified" Systematic Alien Verification for Entitlements system (SAVE) along with two related System-of-Records Notices, one from the Department of Homeland Security and one from the Social Security Administration. She did not mince words. The federal agencies, the court found, "haphazardly combined and repurposed the private information of millions of Americans, including citizenship data that they knew to be unreliable," and in doing so "knowingly trampled on the privacy rights of American citizens in a manner that threatens the sacred right to vote." The overhaul was unlawful three times over: it violated the Social Security Act's bar on disclosing Social Security numbers, breached the Privacy Act, and exceeded the agencies' authority under the Administrative Procedure Act.

Iowa matters because its own records place the state at the front end of this machine, not once but twice. Two of its highest officials opened the doors. The record of what happened to Iowa’s data at the back end has never been produced.

The national scoreboard: when states fight, they win

The SAVE ruling landed on top of a pattern that has only grown since we first wrote about this architecture in December 2025. The Trump–Vance Justice Department has sued more than 30 states and the District of Columbia, demanding unredacted statewide voter‑registration lists. As of June 24, nine federal district courts have already rejected those demands, and the campaign is winless where judges have reached the merits.

On June 18, a Maryland court denied DOJ’s motion to compel and dismissed its suit, noting that the case was “one of thirty similar lawsuits” and that eight had already been dismissed. Maryland made nine.

Six days later, the first appellate merits decision arrived. In United States v. Benson, a published Sixth Circuit opinion affirmed dismissal of DOJ’s Michigan case and held, 2–1, that Title III of the Civil Rights Act does not entitle the government to a state’s unredacted voter file. Because Kentucky sits in the Sixth Circuit, where DOJ is pursuing a nearly identical demand in United States v. Adams, the Michigan ruling is now binding precedent there as well.

Parallel to that litigation, Sooknanan’s ruling against DHS and SSA did something different: it shut down the modified SAVE system itself. The same database DOJ had acknowledged planning to use to “scrub aliens from voter rolls.”

Within forty‑eight hours of those defeats, Trump escalated. On June 24, he cancelled a planned Capitol Hill signing for a bipartisan housing bill that had cleared both chambers with support from both parties, and announced on Truth Social:

The SAVE America Act, the modified DHS SAVE database, and DOJ’s voter‑file lawsuits are not the same legal instrument; they are parts of the same political project: federal proof‑of‑citizenship and voter‑data control.

That sequence is not subtle: a string of court losses, then a presidential demand that Congress pass his voter‑data bill before an unrelated housing measure can move.

We Traced This Wiring Before It Blew Up

This didn’t start here. In December 2025, in Part 3 of our warrantless‑surveillance series, “SAVE: The Benefits Database Now Monitoring Every Licensed Iowan,” we documented how a September data scandal, an October state executive order, and a November federal settlement assembled Iowa’s access to the federal verification system, including a path from the state’s driver records toward the federal engine.

We showed that the SAVE America Act did not create a new verification system; it would codify an architecture that was already active. We traced DOJ’s “confidential” memorandum of understanding that turns SAVE into a de facto national eligibility gate, and we pulled Iowa’s own correspondence that plugged our state into that architecture.

This installment builds on that record with primary documents that have since entered the case: a federal ruling; a signed settlement; Iowa’s own correspondence; and sworn admissions from the Justice Department. The picture now is sharper. Iowa is not just in the wiring diagram. It is in the litigation record — twice.

Read the graphic as a map of the record, not a claim that every transfer has been proven. The documented doors are on the edges. The unanswered questions sit in the middle.

Two Doors, Not One

The two Iowa channels were legally distinct but politically connected. One ran through the Attorney General’s lane: a DHS/SAVE settlement that promised access, modernization, and long-term federal use. The other ran through the Secretary of State’s lane: the Justice Department’s demand for Iowa’s voter-registration list. Different documents. Different agencies. Different legal authorities. Same state. Same officials. Same missing audit trail.

Door One: The DHS/SAVE Settlement

The bridge from Iowa politics to federal plumbing has Iowa's signatures on it. On November 28, 2025, Attorney General Brenna Bird and Secretary of State Paul Pate were named plaintiffs—alongside Florida, Ohio, and Indiana—in a settlement with the Department of Homeland Security, filed in State of Florida, et al. v. U.S. Department of Homeland Security in the Northern District of Florida. Bird did not merely sign it; she celebrated it. Her office's press release announced an "Election Integrity Win"; said the deal "requires the Department of Homeland Security to provide Iowa officials with access to the federal immigration database"; and promised Iowa "free access" to the technology for 20 years.

The settlement itself is more specific than the victory lap. It commits the states and DHS to execute a new information-sharing agreement and a "new or updated" SAVE memorandum of agreement. It says each state plaintiff "may provide" DHS with 1,000 randomly selected driver's-license records—name, date of birth, license or state ID number, and state of issuance—to help develop and modernize SAVE. It gives DHS "full use" of state driver's license records through the Nlets network and the state licensing agencies. And then comes the part that should stop a reader cold: the agreement orders DHS to build into SAVE the exact capabilities a federal court would declare unlawful seven months later—bulk-upload verification, full- and last-four-digit Social Security number searches, and downloadable, "paper-verifiable" output—and asks the court to keep the whole arrangement under its jurisdiction for twenty years. Iowa's attorney general signed onto a 20-year deal to build the machine the D.C. court has now torn down.

Iowa is no bystander in the federal record that case produced. A government declaration filed in League of Women Voters v. DHS lists Iowa among the 27 states registered with DHS to use SAVE for voter verification—part of a system that, by the government's own count, processed 59.7 million voter-verification queries nationwide between January 2025 and April 2026. The administrative record in the same case also contains the Iowa Secretary of State's SAVE memorandum of agreement with DHS's immigration-services arm.

The settlement treats the 1,000-record driver sample as optional — each state “may provide” it — but the broader access architecture is not optional in the same way. The agreement gives DHS “full use” of state driver’s-license records through Nlets and state licensing agencies, and it asks the court to keep the arrangement under its jurisdiction for twenty years.

Door Two: The Transfer

The second channel is the Justice Department’s, and Iowa’s own records define it. Beginning in August 2025, DOJ’s Civil Rights Division asked Iowa for its statewide voter‑registration list. On Aug. 21, the Secretary’s office sent a link to its standard list — name, address, date of birth, and voter ID — and stated plainly that the file “does not include social security numbers or driver’s license numbers.”

By spring, the demand had grown to the unredacted list. In a March 5, 2026 letter, the Secretary of State’s office wrote that “after consulting with and receiving advice from the Iowa Attorney General’s office,” it would comply and hand over the unredacted data. On May 5, 2026, the office confirmed that Iowa “has complied” and that the list “was securely transferred” to the Department of Justice. That is the documented fact: Iowa took a compliance route while other states were litigating.

For a year, whether DOJ was funneling state voter data into DHS’s citizenship database was treated as an open question. It isn’t anymore. On September 11, 2025, a DHS spokesperson confirmed — on the record, to Democracy Docket — that voter‑registration data “being collected by the Department of Justice is being shared with” DHS to “scrub aliens from voter rolls.” Six months later, in a Rhode Island courtroom, DOJ’s acting Voting Section chief, Eric Neff, told a federal judge in plain language: “Our intention is to run this against DHS’s SAVE database.” The architecture is acknowledged at the top and admitted under oath in open court.

After Neff’s admission, the Justice Department filed a clarification stating that it had begun its own analysis but had “not shared the information with any other agency.” The intent is on the record; the completed, dated hand‑off of any single state’s file is the piece the government has not confirmed. That is precisely where Iowa’s missing record would speak.

What This Means for Iowa Voters

Here’s what this ruling and Iowa’s two federal “doors” actually mean for someone walking into a polling place in Iowa.

• Iowa’s attorney general and secretary of state opened both doors: a 20‑year settlement to modernize SAVE’s verification capabilities, and a voluntary hand‑over of the state’s unredacted voter‑registration list after consulting the AG. No court order forced Iowa’s hand.

• The modified SAVE system those decisions were built to feed has now been vacated as unlawful under the Social Security Act, the Privacy Act, and the APA. Judge Sooknanan found that the agencies “knew” some of the citizenship data they were relying on was unreliable, and that their overhaul “threatens the sacred right to vote.

• DOJ’s own architecture routes each state’s roll through a secure federal file‑sharing portal that logs every transfer, and SAVE returns a verification case number and result for every query it runs. Those systems are designed to leave audit-trail records. Iowa has produced none of them.

In practical terms, that leaves Iowa voters with three risks and one opportunity:

1. Mis‑flagging. SAVE has already been found to flag U.S. citizen voters as “non‑citizens” when it relies on stale or mismatched data, a risk documented in NPR’s reporting and in litigation over voter‑purge efforts. An erroneous “tentative nonconfirmation” can translate into a letter demanding proof of citizenship or a quiet challenge to a voter’s right to cast a ballot.

2. Lack of notice. If Iowa has run its roll through SAVE or any DHS tool and received flags back, voters have not been told that their registration status might have been scored against a federal database a judge has now declared unlawful.

3. Accountability gap. In state after state, officials fought to keep that data out of federal hands, and judges agreed with them. Iowa went the other way. The proven story is one of participation and missing records: our officials opened both doors, and the trail of what moved through them has not been produced.

The opportunity is this: because the courts have now ruled, and because the architecture is documented, Iowa voters can demand to see what happened to their data.

What We Asked — And What You Can Do

We put these questions to the offices involved. We sent questions to the Iowa Attorney General’s office — about its role in the four‑state settlement and its advice to the Secretary of State on the separate DOJ request — and the same day filed an Iowa Code Chapter 22 request seeking any records that would show what became of Iowa’s data downstream. As of publication, the Attorney General’s office had not responded. We have also sent questions to the Iowa Secretary of State, DOJ’s Civil Rights Division, and DHS. This story will be updated if any office responds or produces responsive records.

In the meantime, here is what Iowa readers can do:

• Check your registration. Use the Iowa Secretary of State’s voter‑lookup tool to confirm you are registered at your current address and that your status is “active.”

• Tell us if you’ve been flagged. If you have received a letter from a county auditor, the Secretary of State, or any election office saying you must “cure” your registration, prove citizenship, or respond to questions about your eligibility, we want to hear from you. Send us a tip and, if you are comfortable, a redacted copy of the notice.

• Demand the audit trail. Ask Bird and Pate — in writing — whether Iowa executed the settlement’s “new or updated” SAVE agreements, whether the “may provide” driver-record sample was sent, whether Iowa’s voter file was run through SAVE or any DHS tool, and whether any result, flag, or “tentative nonconfirmation” came back. If those transfers or queries happened, the systems are designed to leave records behind. Voters are entitled to know whether their registrations were scored against a system a federal court has now vacated.

Strip it to the question that matters. Two federal doors opened in Iowa within months of each other, both signed by officials who answer to Iowa voters. Voter data — and, through the settlement, potentially driver data — were positioned to move through them toward a system a court has now declared unlawful. Across the rest of the country, officials fought to keep that data out of federal hands, and judges agreed with them. Iowa went the other way. The proven story is one of participation and missing records: Iowa entered both doors, and the trail of what moved through them has not been produced. So the question is documentary, not rhetorical — who opened which door, what data moved through it, and where is the audit trail?

References

Primary legal & government records

League of Women Voters v. U.S. Department of Homeland Security, No. 1:25‑cv‑03501‑SLS (D.D.C. June 22, 2026) (memorandum opinion and order vacating modified SAVE system).

Settlement Agreement, State of Florida v. U.S. Department of Homeland Security, No. 3:24‑cv‑509‑TKW‑HTC (N.D. Fla. Nov. 28, 2025), ECF No. 30‑1.

United States v. Amore, No. 1:25‑cv‑00639‑MSM (D.R.I.): Transcript of Proceedings (Mar. 26, 2026); Notice of Clarification, ECF No. 46 (Mar. 27, 2026).

United States v. DeMarinis, No. 1:25‑cv‑03934‑SAG (D. Md. June 18, 2026) (memorandum opinion denying motion to compel and dismissing suit).

United States v. Benson, No. 1:25‑cv‑01148‑HYJ‑PJG (W.D. Mich. Feb. 10, 2026) (opinion dismissing DOJ’s Civil Rights Act Title III voter‑roll claim for failure to state a claim), aff’d, No. 26‑1225 (6th Cir. June 24, 2026) (published opinion affirming that Title III does not entitle the government to a state’s unredacted voter file).

Executive Order No. 14248, Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14,005 (Mar. 25, 2025).

Iowa Attorney General’s Office. (2025, December 1). Attorney General Brenna Bird secures election integrity win for Iowa [Press release].

Iowa Secretary of State. (2026, May 5). Secretary Pate releases statement on Department of Justice request [Press release].

Pate, P. (2026, March 5). Letter to Eric Neff, Acting Chief, Voting Section, U.S. Department of Justice, Civil Rights Division [Iowa Secretary of State open‑records production].

U.S. Department of Justice, Civil Rights Division. (n.d.). VRL/Data Sharing confidential memorandum of understanding [template; Iowa Secretary of State open‑records production].

Pending related litigation (reported)

American Civil Liberties Union. (2026). United States v. Adams [Case page].

Reporting (context)

Saksa, J. (2025, September 11). Trump administration sharing voter data across agencies, DHS confirms. Democracy Docket.

Brennan Center for Justice. (2025–2026). Tracker of Justice Department requests for voter information.

NPR. (2025, December 10). Trump’s SAVE citizenship tool is flagging U.S. citizen voters.

NPR. (2026, March 27). DOJ plans to share states’ sensitive voter data with DHS.

Rivas, Y. (2026, June 24). Trump DOJ suffers first appeals court loss in floundering voter roll crusade. Democracy Docket.

Prior Reporting

Tucker, T. (2025, December 10). SAVE: The benefits database now monitoring every licensed Iowan. Restoring Democracy’s Promise.

Tucker, T. (2026, February 18). The SAVE America Act: From Voter Verification to Identity Infrastructure. Restoring Democracy’s Promise.

Tucker, T. (2026, May 7). Iowa Handed Over the Voter Data — The Legal Blueprint Was Already There. Restoring Democracy’s Promise

The difference between a good year and a bad one at Iowa’s largest public pension fund can come down to the width of a pencil lead.

In the fiscal year that ended June 30, 2025, the Iowa Public Employees’ Retirement System (IPERS) earned 9.87 percent on its investments. Its “policy benchmark” — the yardstick the board uses to judge success — was 9.85 percent. IPERS beat it by two‑hundredths of a percentage point. On a $46 billion fund, that tiny edge translates into roughly $9 million in what the industry calls “value added.”

It was not a one‑off. IPERS has beaten its benchmark every year since fiscal 2020, five years running, never by as much as a full percentage point. When the margin between beating the market and trailing it is that thin, the interesting question stops being “what’s the score?” It becomes “who’s holding the ruler?”

At IPERS, that question leads quickly to a line in the state payroll system.

For the calendar years 2023, 2024 and 2025, a single entry appears next to the name of Chief Investment Officer Sriram Lakshminarayanan:

Among the executives whose records the state produced, no one else received money under that label. The amount is not arbitrary. It matches, to the dollar, a cap IPERS wrote into its own budget documents as the maximum incentive payment allowed per investment employee.

IPERS’ stated purpose for the incentive program is to reward “investment staff decisions that add value over and above stated benchmarks” — the definition, in investment slang, of alpha, or return beyond what the market would have provided anyway. In plain English, it is a bonus for beating the ruler. But in thousands of pages of board minutes and budget records released so far, there is no public explanation of who decided the CIO’s work was “exceptional,” what benchmark they used, or whether anyone independent checked the math.

The Payroll Receipt

The state’s own records settle at least part of the story.

In response to an open‑records request, Iowa’s payroll custodian produced five pages of compensation tables for IPERS executives, one page per year from 2022 through early 2026. Most columns are routine: regular salary, holiday, sick pay, vacation. On the pages for 2023, 2024 and 2025, an extra column appears: “Exceptional Job Performance Pay.”

In each of those years, Lakshminarayanan’s entry reads $25,000.00. The entry for CEO Gregory Samorajski reads zero. So do the entries for every other listed official. Over the same period, the CIO’s total gross pay rose from about $291,000 to roughly $368,000 — about 27 percent — while the CEO’s rose about 14 percent before his departure on May 1st.

The payroll tables answer the first questions cleanly: the money was real, it was labeled as “exceptional” performance pay, and it went to one person. They answer nothing else about how that label was earned.

The Program Behind the Number

Other records show where the $25,000 figure comes from.

Minutes from a December 2024 board meeting note that IPERS’ next budget request would “remove the current cap that limits incentive compensation payments to investment staff at $25,000 per year/employee.” Three payments, three years, one number — the maximum the program allows.

That structure creates an odd result for a system built on very small margins. Whether the fund beats its benchmark by two basis points or by two percentage points, the award at the cap is the same. The plan’s own materials told board members that new strategies “could add hundreds of millions of dollars of extra return,” but the maximum reward for the CIO is a flat $25,000 either way.

What must be done, specifically, to earn the “exceptional performance” label has never been made public.

The subject of bonuses surfaces directly in public only once in the records reviewed — in a finance podcast. When host Angelo Calvello pressed Lakshminarayanan about public‑fund compensation, the CIO said IPERS was within “striking distance” of hedge‑fund pay. When Calvello suggested “maybe there’s a discretionary bonus popping up or something,” Lakshminarayanan laughed and replied, “No, no, no. Let’s not open that door.” The exchange is light. In the written record, the door stays shut.

Two officers, Two Systems

The way IPERS handles executive pay in public differs sharply depending on the job.

For the chief executive, every raise appears in open session. Board minutes from 2021 through 2025 record votes to move Samorajski to a higher pay grade and to award cost‑of‑living increases — 5 percent one year, then 2 percent, then another 2 percent — each approved by recorded roll call, sometimes over a dissenting “no” from the state treasurer.

For the chief investment officer, there is no such trail. In six years of minutes reviewed for this article, there is not a single open‑session vote, dollar amount, or explanation of the CIO’s pay. Instead, the minutes show a recurring pattern each spring: a motion that the board “go into a closed session… to discuss the CIO’s annual performance evaluation and the CEO’s compensation as authorized by Iowa Code section 21.5(1)(i),” followed each time by the sentence, “The Board took no action during its closed session.”

The statute the board cites allows closed‑door evaluations only when they are necessary to prevent “needless and irreparable injury” to an individual’s reputation and when that individual requests a closed session. The minutes record that the board met behind closed doors. They do not record the CIO requesting it, as the law requires. That omission may reflect paperwork the public has not seen, but on the face of the record, even the legal basis for closing the door rests on a condition no one has documented.

In 2022, Lakshminarayanan’s first full year as CIO, the minutes record no evaluation session at all. The first agenda to list “CIO Compensation” alongside a closed session is dated March 27, 2026; IPERS has not released minutes from that meeting.

What the public documents do not show, after three years of maximum “exceptional” payments, is who made that judgment or what they measured.

The Structure Behind the Silence

That blank is not sloppy filing. It is what IPERS' design produces.

Iowa's pension system is not built like most. At large public funds, a governing board hires, oversees, and can fire the chief executive. IPERS’ Investment Board is the trustee of the fund — it governs the portfolio, the policy, the actuary — but the agency itself “is administered by its chief executive officer,” who is appointed through the executive branch rather than hired by the board.

The board’s documented powers over its CEO amount to two: setting his salary and recommending his reappointment to the governor. It does not employ him. A former IPERS chief operating officer, Leon Schwartz, put it bluntly to the Financial Times this spring: "Compared to most public pension systems, IPERS has a quite weak governance structure."

That matters because the board appears to evaluate performance without holding the ordinary employment power a governing board would usually carry.

And the function meant to check the numbers sits inside the very operation it checks. IPERS' policy assigns risk oversight to two officers — the CIO, and a chief risk officer responsible for the systems that measure investment risk, with a duty to report any breach of limits to the board.

So the issue is not simply one person grading his own homework. It is a structure in which the public cannot see who wrote the test, who graded it, or who checked the grade.

The Benchmark That Grades Itself

The “exceptional” label matters because of how IPERS defines success.

In its Investment Policy and Goal Statement, a footnote to the asset‑allocation policy says:

In practice, that means private equity, private credit and private real assets — roughly a quarter to a third of the portfolio — are graded, inside the fund’s main benchmark, against their own returns. That slice of the book can never beat its benchmark and never trail it; it is the benchmark.

IPERS points out that private portfolios lack simple, investable indexes and that the rule is disclosed in both its policy and audited financial report. The fund also applies a separate, longer‑term test to private markets: beating the Russell 3000 stock index by three percentage points over rolling ten‑year periods. All of that is true.

But the ten‑year test does not appear in the annual number the board and public hear, and the one‑page summaries IPERS distributes to members describe the policy benchmark only as “a passively managed set of market indexes, with appropriate weightings” — with no mention that a large segment is benchmarked to itself.

The headline margins are thin. Since fiscal 2020, IPERS has outperformed its benchmark each year by between 0.02 and 0.80 percentage points. Within those narrow gaps, any portion of the portfolio that is impossible to fail matters.

The same reports that help IPERS tout its results raise questions about how much “value added” there is to reward. Each fall, the board hears from CEM Benchmarking, a Toronto‑based firm that compares plans’ costs and performance. Minutes from September 2023 say that IPERS “once again ranked as a low‑cost fund” and that its five‑year net value added was 1.7 percent, beating the peer median of 0.8 percent.

Inside CEM’s own report, however, a table discloses that before CEM adjusts every fund’s private‑equity benchmark to a standardized public‑market index, IPERS’ five‑year net value added was 0.1 percent. The higher 1.7 percent figure — the one quoted in minutes — depends on a modeling choice the board never discusses in public.

None of this proves IPERS designed its benchmark to flatter results or that any award criteria used those numbers. It does show that a fund promising to pay for “value over and above stated benchmarks” is operating with a benchmark that, for a significant portion of the portfolio, cannot be beaten or missed.

Who Builds the Scoreboard

The public record is clearer on who assembles and presents the scoreboard the board sees.

IPERS has relied on the consulting firm Wilshire for more than 35 years. In 2021 the board renewed them on a six‑year contract and expanded its mandate to include “private markets advisory services,” along with access to new risk‑analytics dashboards. Minutes and agendas show its consultants presenting the fund’s annual performance review, leading a “benchmark education” session, walking through asset‑allocation changes, and briefing the board on “active risk” at every regular meeting in the past year — including immediately before the March 27, 2026 closed session on CEO and CIO compensation.

On the private‑equity side, the dominant manager is Pathway Capital Management, which runs a dedicated fund‑of‑funds valued at about $7.3 billion — roughly 90 percent of IPERS’ private‑equity portfolio. Board packets credit Pathway as the source of IPERS’ private‑equity program summaries. Because private markets are benchmarked to their own returns inside the policy benchmark, Pathway’s performance is both the grade and the grader for that slice of the fund.

Pathway’s own biography of senior managing director and co‑founder James Reinhardt adds another layer: before starting Pathway, it says, he “cofounded the Special Investments Division of Wilshire Associates Inc., which focused exclusively on assisting institutions with investment in the private equity asset class.” Wilshire does not own Pathway, and nothing in the records reviewed suggests it does; each firm has private‑equity owners of its own.

The point is narrower than ownership. The consultant that helps design and explain IPERS’ private‑markets program, and the manager that runs most of it and supplies the numbers that feed the benchmark, grew out of the same firm — and there is no public record of any relationship map, conflict‑of‑interest disclosure, or independent validation of the Pathway‑sourced data the board receives.

IPERS has not responded to detailed questions seeking comment on these issues or on how, if at all, their reports and benchmarks are tied to the CIO’s “exceptional job performance” pay.

What the documents show, after three years of maximum performance bonuses, is a closed loop: the fund sets the benchmark that grades its own results, outside firms paid by the fund help construct and present it, and the only people who know how that loop translates into “exceptional” are the ones inside the room the public never sees.

The Missing Risk Officer

One of the safeguards meant to stand between the portfolio and the bonus is missing from the public record.

IPERS’ own policies assign risk oversight to two people: the chief investment officer, and a separate chief risk officer responsible for developing “systems, models, tools and reporting processes” to measure investment risk and for reporting any breach of limits to the board. Lakshminarayanan held that risk job himself for eight years before becoming CIO in 2022.

Minutes show the board meeting his successor, Rich Wiggins, in September 2022 and hearing risk reports from him that fall. After December 2022, Wiggins disappears from the minutes. There is no recorded discussion of his departure or of a search for a replacement. State payroll records show a termination vacation payout and a negative relocation entry by his name in 2023.

At all eleven regular meetings in that span, the man who runs the portfolio is the man who tells the board how risky it is.

Wiggins is now suing the state, claiming he was fired after raising concerns about IPERS’ risk reporting, benchmarks, and fee disclosures, and alleging that after his termination, executives “requested money in the form of bonuses” based on misleading information. The state denies every substantive allegation, and no court has found his claims true. The payroll records independently confirm only one narrow overlap: performance‑labeled payments to the CIO exist, begin the year he was terminated, and do not include the CEO also named in his suit.

What IPERS Still Owes the Public

IPERS is not in crisis. By national standards, the fund is large and comparatively healthy, and benefits are being paid. The issue this story surfaces is smaller and harder to see: a structure in which the benchmark that helps define “exceptional” is partly self-referential, the data that feed it come from firms whose relationship map does not appear in the public record, no replacement for the former risk officer appears in the minutes reviewed, and the criteria for the only documented performance bonuses remain behind a closed door.

Those are questions lawmakers, auditors and 424,000 members can answer without a subpoena. The documents that would settle them are specific and short: the incentive‑pay plan, the award scorecards and approvals, the closed‑session requests required by law, the current risk‑oversight chart, and any conflict‑of‑interest and validation records for the private‑markets program.

Until those are made public, “exceptional job performance” at Iowa’s $46 billion pension fund is a judgment taxpayers and workers are being asked to take on trust — from the only people who know what it means.

References

Court filings — Wiggins v. State of Iowa

Wiggins v. State of Iowa, No. LACL163118 (Iowa Dist. Ct., Polk County, petition filed July 14, 2025).

Wiggins v. State of Iowa, No. LACL163118 (Iowa Dist. Ct., Polk County, amended petition filed Jan. 30, 2026).

Wiggins v. State of Iowa, No. LACL163118 (Iowa Dist. Ct., Polk County, answer filed May 21, 2026).

Board minutes and agendas — IPERS Investment Board

Iowa Public Employees’ Retirement System. (2021, December 2). Investment Board meeting minutes.

Iowa Public Employees’ Retirement System. (2022). Investment Board meeting minutes, calendar year 2022

Iowa Public Employees’ Retirement System. (2022, September 22). Investment Board meeting minutes.

Iowa Public Employees’ Retirement System. (2022, September 22). Investment Board meeting materials [Board packet, p. 8].

Iowa Public Employees’ Retirement System. (2022, December 1). Investment Board meeting minutes.

Iowa Public Employees’ Retirement System. (2023, March 24). Investment Board meeting minutes.

Iowa Public Employees’ Retirement System. (2023, September 28). Investment Board meeting minutes [Board minutes, p. 2].

Iowa Public Employees’ Retirement System. (2023, December 7). Investment Board meeting minutes [Board minutes].

Iowa Public Employees’ Retirement System. (2024, March 22). Investment Board meeting minutes [Board minutes].

Iowa Public Employees’ Retirement System. (2024, December 6). Investment Board meeting minutes [Board minutes].

Iowa Public Employees’ Retirement System. (2025, March 28). Investment Board meeting minutes [Board minutes].

Iowa Public Employees’ Retirement System. (2025, September 25). Investment Board meeting minutes [Board minutes, p. 2].

Iowa Public Employees’ Retirement System. (2026, March 27). Investment Board meeting agenda [Board agenda].

Iowa Public Employees’ Retirement System. (2023–2025). Investment Board meeting minutes [Board minutes for the risk-report presenter series: 3/24/2023, 6/15/2023, 9/28/2023, 12/7/2023, 3/22/2024, 6/20/2024, 9/26/2024, 12/6/2024, 3/28/2025, 9/25/2025, 12/5/2025].

Benefits Advisory Committee / governance description

Iowa Public Employees’ Retirement System. (2022, January 24). Benefits Advisory Committee meeting minutes [BAC minutes, p. 2].

Iowa Public Employees’ Retirement System. (n.d.). Benefits Advisory Committee responsibilities [Governance description].

Annual financial report

Iowa Public Employees' Retirement System. (2025). Annual comprehensive financial report, fiscal year 2025 [PDF].

Policy documents

Iowa Public Employees’ Retirement System. (2022). Investment policy and goal statement (effective July 1, 2022) [Policy document].

Iowa Public Employees’ Retirement System. (2022). Private markets investment policy (effective Oct. 1, 2022) [Policy document, § I.C].

Iowa Public Employees’ Retirement System. (2024). Portfolio market value & investment returns.

Payroll and public-records materials

Iowa Department of Administrative Services. (2026). Executive compensation tables, Iowa Public Employees’ Retirement System, calendar years 2022–2026.

Restoring Democracy’s Promise. (2026). Iowa open records request: IPERS executive compensation, bonuses, and related payroll records.

Benchmarking report

CEM Benchmarking Inc. (2025, December 5). Iowa PERS: CEM investment benchmarking report DB – 2024 [Benchmarking report].

Statutes

Iowa Code § 21.5(1)(i) (2025). https://www.legis.iowa.gov/docs/code/21.5.pdf

Iowa Code ch. 97B (2025) [pdf].

Podcast

Calvello, A. (Host). (n.d.). Beyond fee savings: How IPERS uses co-investments to build investment talent (No. 13) [Audio podcast episode]. Angelo Calvello’s podcast.

News article

Yu, S. (2026, May 9). Iowa pension chief resigns amid concerns about performance figures. Financial Times.

Corporate / firm sources

Wilshire Advisors LLC. (2021, January 13). Wilshire announces new leadership team members and growth vision at the acquisition close.

Wilshire Advisors LLC. (2021, August 9). Wilshire retained as investment consultant for Iowa Public Employees’ Retirement System.

Pathway Capital Management. (n.d.). James H. Reinhardt [Firm biography]. Retrieved June 11, 2026.

Prior reporting (cited as in-text links)

Restoring Democracy’s Promise. (May 19, 2026). A resignation is not an audit: Why Iowa still owes IPERS members answers [Investigative report].

Restoring Democracy’s Promise. (April 6, 2026). Newly Obtained Amended IPERS Lawsuit Expands Allegations on Risk, Fees, and Benchmarking [Investigative report].

"I have news for Joe Biden when I'm attorney general I'll see you in court right our current attorney general he's Biden's attorney general. When I'm attorney general, I'm gonna be Iowa's attorney general.”

Brenna Bird, Des Moines Register Political Soapbox, August 13, 2022

“Iowa’s Attorney General”

On May 19, 2026, the Bird for Iowa campaign posted a message to its official Facebook account. “Because of generous support across Iowa,” it read, “our campaign is in strong position to get our positive message out and WIN on Election Day!” Attached to the post was a campaign press release in which Brenna Bird was quoted directly: “Iowans have invested in this campaign because they’ve seen that we can cut through politics, deliver results, and stand by the rule of law.”

That same week, the campaign filed its pre-primary disclosure with the Iowa Ethics and Campaign Disclosure Board. The Iowa records show that on May 13, 2026, a single organization — the RAGA Action Fund, a federally registered Super PAC with a Washington, D.C. address — contributed $1,425,000 to the Bird for Iowa campaign account. The campaign’s total reported cash contributions for the period ending May 14, 2026, were $1,775,913.99. The RAGA Action Fund contribution alone represented 80.24 percent of that total.

All other donors — every individual check, PAC contribution and small-dollar gift — together raised roughly $350,913, or about twenty cents on the dollar.

The campaign’s press release described raising “over $1.7 million” and characterized the result as evidence that “Iowans have invested in this campaign.” It did not mention the RAGA Action Fund.

With those numbers in mind, let’s look more closely at the pre‑primary filing itself — the document that makes these figures official.

The Ledger

The DR-2 is a routine campaign finance disclosure, filed with Iowa’s ethics board on May 19, 2026, and amended May 29, 2026. Under Iowa law, it covers a defined reporting window and lists every cash contribution above certain thresholds, every expenditure, and a statement of cash on hand.

Page one lists the period summary: $1,775,913.99 in Schedule A cash contributions. The contributor pages run for several pages — dozens of individual donors from communities around Iowa, state political action committees, industry interests. Among them, a single line entry:

No other single contribution in the filing comes close. The campaign’s public framing during this period emphasized Iowa support; the filing shows its financial position depended overwhelmingly on a single Washington-based Super PAC contribution.

The non-RAGA remainder — $350,913.99 — included a $50,000 check from Miriam Adelson of Las Vegas, a $25,000 payment from The Hurst Group LLC of Jackson, Mississippi, and $10,000 from KochPac in Wichita. The individual Iowa contributions — $25 here, $100 there — were real. They were also a fraction of the total.

In fact, the 19.8 percent that did not come from RAGA was itself top-heavy. Of that $350,913.99, twenty-eight donors who gave $5,000 or more accounted for 74.4 percent of the remainder. At the other end, sixty donors who gave under $500 supplied less than two percent of it. Whatever “generous support across Iowa” describes, the dollar figures point to a small number of large checks rather than a broad base of small ones.

The DR-2 doesn’t tell the whole story. Once the May 14 reporting window closed, new money started flowing in — and those later transfers pushed the known RAGA Action Fund total even higher.

Beyond the Pre‑Primary Report

Iowa campaign finance law requires disclosure of contributions within a defined reporting window. The May DR-2 covered through May 14, 2026. Contributions arriving after that date would appear in a later filing, not this one.

On May 26, 2026, twelve days after the DR-2 cutoff, the RAGA Action Fund contributed another $1,100,000 to Bird for Iowa. That transfer appears in a later state filing, at the same Washington, D.C. address as the May 13 contribution. It would not have appeared in the May DR-2 that Iowa voters saw at the time the campaign published its “generous support across Iowa” announcement.

There is a further wrinkle in the federal record. The RAGA Action Fund’s first-quarter 2026 federal report shows total receipts of just $2,935 for the quarter. The Super PAC’s two May 2026 contributions to Bird, totaling $2,525,000, were therefore drawn on balances the committee already held rather than on new first-quarter fundraising.

Those post‑May 14 contributions, added to an earlier December gift, reveal just how concentrated Bird’s support is.

Tracking the RAGA Action Fund Transfers

"And DAGA has put a target on Brenna Bird and Kris Kobach. Both of those seats we won by about one and a half points four years ago. We'll defend those."

Adam Piper, Executive Director of Republican Attorneys General Association

Three known RAGA Action Fund contributions to Bird for Iowa, confirmed in state records.

That is a $3.525 million running total from one Super PAC, in a race that does not end until November 2026.

Piper explicitly confirms that protecting Bird is a top-down national priority. He dismissed governors and senators as "show horses with a big bully pulpit," and boasted that, "when you look at [the] AG's office you have the ability to move the needle on 8,000 different issues every single day of the week."

Understanding these numbers requires understanding the entity behind them.

What is the RAGA Action Fund?

The RAGA Action Fund is not a mystery. It is a federally registered Super PAC — formally an independent-expenditure-only committee — registered with the Federal Election Commission under committee ID C00560904. Its contributions to Bird for Iowa appear on publicly available Iowa and federal records. This is the disclosed layer of the operation.

The organization is the Super PAC arm of the national network of Republican attorneys general. Its purpose is to elect Republican AGs. What the financial record makes visible is the scale at which that mission is being executed in Iowa’s 2026 race — and the structural relationship between the contributor and the candidate it is financing.

Money is only half the equation. Bird also has an inside role in the organization sending her the funds.

The Board Seat

Here the financial record meets the governance record. Bird is involved at the top level of leadership in RAGA.

According to an amended IRS Form 8871 filed by RAGA on July 29, 2025, Brenna Bird serves as an executive committee member of the Republican Attorneys General Association (RAGA) — the parent organization of the Super PAC that is her campaign’s dominant financial backer.

Federal tax filings for the 2023 and 2024 tax years, the most recent available, also list Bird as a director of the Rule of Law Defense Fund, or RLDF — the 501(c)(4) social welfare organization that functions as RAGA’s policy arm. Unlike a Super PAC, a 501(c)(4) is not required to disclose its donors, and RLDF’s funding sources are not visible on its public filings. Bird is also listed as a director of this organization as of the last available tax filings.

During the 2024 tax year, while Bird was listed as a director, RLDF transferred $1,200,000 to RAGA as a political campaign activity expenditure, disclosed on Schedule C of RLDF’s 2024 Form 990. The same filing shows $697,000 in shared expenses between RLDF and RAGA.

The records do not show whether Bird voted on those transfers or was present for the decision; what they show is that during the year RLDF made them. But they do show that she was listed as both a director of the RLDF and executive committee member of RAGA during the most recent reporting available.

Together, those roles show how Bird’s campaign and national networks overlap.

Tracing the Money and the Board

Step back from the individual transactions, and the structure is visible in the filings.

It runs across three agencies’ records — the IRS, the FEC, and the Iowa Ethics and Campaign Disclosure Board — and it moves in one direction. A donor-nondisclosing 501(c)(4) feeds a 527 political hub. The hub feeds a Super PAC. The Super PAC funds an Iowa campaign. And the candidate at the end of that chain is listed, in the organizational filings, as a governance member at two points along it.

The middle of the chain is the part most people never see. During 2025, the RAGA 527 transferred more than $12.6 million into its affiliated Super PAC layer — the RAGA Action Fund and RAGA Action Fund PAC, both at the same Washington address — before and during the period the Super PAC began making major contributions to Bird for Iowa. That is the operating pool the December 2025 and May 2026 Bird contributions were drawn from.

The Rule of Law Defense Fund kept feeding that pool through the current cycle. Beyond the $1.2 million political expenditure disclosed on its 2024 Form 990, RLDF provided $557,116 in cash and $273,251 in-kind to the RAGA 527 during the 2025–2026 reporting period — $830,367 in additional support, separate from the earlier transfer.

Bird’s connection to the network is not only financial. The RAGA 527’s own expenditure records list $568 in travel reimbursements paid to Brenna Bird across three transactions in January and February 2025 — the routine bookkeeping of an organization reimbursing a participating member’s travel. It is a small number. It is also documentary confirmation that her role in RAGA is an active one, contemporaneous with the campaign.

The records place Bird in governance roles at two nodes of the same attorney-general network. The money flow runs through interconnected entities: RLDF, the RAGA 527, the RAGA Action Fund, and Bird for Iowa. The filings show a national attorney-general infrastructure financing an Iowa reelection campaign — and they show the candidate inside the infrastructure.

One fundraising event, however, offers a window into how the campaign and national donors came together.

Inside the Mar‑a‑Lago Fundraiser

The campaign’s spending records and a public invitation point to the same event — and the contribution ledger shows what came in around it.

On November 12, 2025, Bird for Iowa held a fundraiser at the Mar-a-Lago Club in Florida. The invitation, circulated on Instagram, requested “the honor of your presence … for an evening in support of Attorney General Brenna Bird,” with a reception and dinner. The suggested support levels were steep: $5,000 per couple for the reception, $10,000 for reception and dinner, and $25,000 per couple to be an “Event Host.” Checks were payable to Bird for Iowa; questions were routed to two consultants — one for Iowa donors and one for “National” donors — the same firms that appear as the campaign’s paid consultants in its own state disclosures.

The campaign’s own ledger corroborates the event: Bird for Iowa paid the Mar A Lago Club LLC $19,260 in April 2025 and $38,520 in August 2025 — $57,780 in venue costs, with the memo fields left blank.

Public social media confirms the event and identifies its host. In a post dated November 13, 2025, a verified X account wrote that its owner was “honored to have hosted an incredible event at Mar-a-Lago last night” in support of Bird, tagging her campaign account and posting photos from the club. The Public business, professional, biographical, and interview sources identify the host as Ranko Ristic, founder and CEO of Zastava Arms USA. According to the Halyard Mission Foundation’s public biography, Ristic formed Zastava Arms USA in 2020, and the company became the exclusive importer of firearms for Serbian company Zastava Oruzje.

Instagram user @iowawecandobetter, who posted the invitation, perfectly captured the absurdity of the event by tagging Bird and writing, "@brennabirdia - we're confused. Are you running for AG in Florida?"

A Bird for Iowa contribution record lists a $25,000 contribution from “Rada Ristic” of Park Ridge, Illinois in the same event window; RDP treats the campaign-finance spelling as a record rendering or name variant and uses Ranko Ristic as the public business name. Ristic’s X post also stated that General Michael Flynn was among those present. The post does not establish who paid to attend, what was discussed, or whether any contribution was tied to the event; it corroborates that the fundraiser occurred and was publicly presented as a Mar-a-Lago event in support of Bird.

And the contribution records show a cluster of high-dollar donations around the event window matching the invitation’s support tiers. In November and December 2025, the campaign reported four contributions of exactly $25,000, one of $20,000, five of exactly $10,000, and fifteen of exactly $5,000 — the invitation’s three price points, repeated. Eight tier-matching donors clustered around the event date — from Park Ridge, Illinois; Alpha, Minnesota; Brownsville and Austin, Texas; and several Iowa towns — gave $90,000 between them, more than the campaign’s venue cost. One donor at a North Bay Village, Florida address gave $25,000 at the Host tier on November 17. Across the window, contributions of $5,000 or more totaled roughly $280,000 — with more arriving from out of state than from Iowa.

The records do not identify who attended, and they do not label any contribution as event proceeds; the pattern is one of timing and tier-matching visible in the ledger. What they do show is the financing model: high-dollar checks at fixed national-event price points, not low-dollar grassroots giving. It fits the larger pattern — the rhetoric was local; the money was national and high-dollar.

To see how unprecedented this flow of money is, it’s worth tracing the donors behind RAGA — and how they differ from its Democratic counterpart.

The Upstream Funders

The Super PAC’s operating pool has its own sources, and one of them has a long history with RAGA.

Federal tax filings show that the Concord Fund — a Virginia-based 501(c)(4) that also operates under the name Judicial Crisis Network — contributed $7 million to the Republican Attorneys General Association’s 527 organization across three tax years, from 2021 through 2023. Those payments went to the RAGA 527, not directly to the RAGA Action Fund and not directly to Bird for Iowa.

That distinction matters. The records reviewed here do not show Concord writing a check to Bird’s campaign. They show something broader: upstream financing into the national attorney-general network whose Super PAC later became Bird’s dominant funder.

Between Concord’s donor-nondisclosing contributions and the Super PAC’s disclosed transfers to Bird sits RAGA itself — the 527 hub that received $7 million from Concord, took in additional support from the Rule of Law Defense Fund, and routed more than $12.6 million into its Super PAC layer during 2025. The checks to Bird for Iowa were disclosed. The layers above them are where the disclosure thins out.

As RDP reported in The Pincer Movement - An Architecture of Autocracy , the Concord Fund sits inside a larger architecture of organizations linked to conservative legal organizer Leonard Leo that move money between dark money nonprofits and the political and legal infrastructure they fund.

That reporting establishes the dark money upstream for what the Iowa filings show downstream: the same network that finances national legal-policy fights is, through the RAGA Action Fund, the dominant funder of Iowa’s attorney general race.

A fair question is whether this is simply how both parties operate. National attorney-general associations exist on both sides, and both spend heavily to elect their party’s top law-enforcement officers. The Democratic Attorneys General Association raised roughly $32 million in 2025 — more than its Republican counterpart at the committee level — drawing on disclosed contributions from unions, corporations, and plaintiffs’ law firms.

The distinction visible in the records reviewed is not one of scale. It is architectural: the Republican Attorneys General Association and the Rule of Law Defense Fund — a donor-nondisclosing policy arm — share an address, share staff, and, according to IRS filings, have moved millions of dollars between them through payroll reimbursements and shared expenses. No comparable arrangement — a co-located, donor-nondisclosing policy arm sharing staff and finances with the Democratic association — appears in the records reviewed.

All of this raises a deeper question: why pour so much money into a statewide legal office?

Why the Attorney General Matters

Iowa’s attorney general is not a ceremonial office. The position controls the state’s law-enforcement posture across a wide portfolio: consumer-fraud prosecutions, antitrust actions, Medicaid oversight, public-records litigation, and the legal defense of state agency decisions in federal court.

The attorney general also controls Iowa’s participation in multistate legal coalitions — the networks of state attorneys general who file joint amicus briefs, multistate lawsuits, and coordinated letters to federal agencies. Those coalitions have been among the most effective mechanisms for challenging or defending federal policy across administrations. Who leads Iowa’s legal office shapes whether the state’s legal power is deployed to challenge Washington or to align with it.

That is one reason the national party committees now contest these once-lower-profile races so aggressively. Adam Piper, RAGA’s executive director, has compared their stakes to the top of the ticket, telling one interviewer that who holds the attorney general’s office “matters as much to a state” as who serves as governor. The money flowing into Iowa’s 2026 race is the local expression of that national calculation.

Under Bird, Iowa has participated in immigration-enforcement cooperation, expanded citizenship-verification database access, joined multistate letters on DEI and federal education policy, and pursued enforcement actions touching higher education. Bird has also used her position to announce high profile anti-DEI and immigration investigations that were not followed up on, or quietly dropped months later.

The scale of the outside investment is also notable against the shape of the race. Public polling available through April 2026 has shown the contest between Bird and her Democratic challenger Nate Willems within the margin of error in each survey conducted.

Finally, the stakes of this race go beyond Bird versus her opponent — they speak to how democracy works when national money floods local offices.

The Democratic Accountability Question

Iowa’s Attorney General is elected every four years, creating a direct line of accountability between the state’s top law enforcement officer and its voters. Speaking to a national audience on Night 2 of the 2024 Republican National Convention, Attorney General Brenna Bird proudly attributed her initial election victory to this local mandate, telling the crowd,

"We won because Iowans were ready for an attorney general who would protect them, not the criminals." - Brenna Bird, July 16, 2024.

Yet as her 2026 reelection campaign accelerates, the financial reality documented in state and federal ledgers tells a vastly different story. The campaign's own filings show that the overwhelming majority of its pre-primary war chest did not come from everyday Iowans, but rather from a single Washington, D.C.-based Super PAC operated by the Republican Attorneys General Association

While the campaign’s public rhetoric continues to celebrate local momentum and “generous support across Iowa,” the reality of a $3.5 million national rescue package raises a fundamental democratic question. When a state campaign is fundamentally sustained by a national political machine rather than the voters it claims to represent, who is the “People’s Lawyer” truly accountable to?

References

Primary records and official data

Bird for Iowa. (2026, May 19). DR‑2 pre‑primary disclosure, Schedule A (amended May 29, 2026; re‑amended June 5, 2026). Iowa Ethics & Campaign Disclosure Board. iecdb.iowa.gov.

Bird for Iowa. (2025). Contribution and expenditure records, 2025 (including November–December 2025 contribution export and Mar‑a‑Lago venue payments). Iowa Ethics & Campaign Disclosure Board. iecdb.iowa.gov.

Concord Fund. (2022–2024). Form 990, Return of organization exempt from income tax (TY 2021–2023). Internal Revenue Service.

Federal Election Commission. (2025–2026). RAGA Action Fund, committee ID C00560904: Campaign finance reports and data. Federal Election Commission. https://www.fec.gov

DMRegister. (2022, August 13). Iowa Attorney General candidate Brenna Bird at the Des Moines Register Political Soapbox, Youtube

Halyard Mission Foundation. (2021). Ranko Ristić biography. Halyard Mission Foundation.

Iowa Ethics & Campaign Disclosure Board. (2025–2026). Bird for Iowa (Committee #5206): DR‑2 filings, contribution exports, and expenditure schedules. iecdb.iowa.gov

RAGA Action Fund. (2025–2026). Form 8872, Political organization report of contributions and expenditures. Internal Revenue Service.

Republican Attorneys General Association. (2025, July 29). Form 8871, Political organization notice of section 527 status (amended). Internal Revenue Service.

Rule of Law Defense Fund. (2024–2025). Form 990, Return of organization exempt from income tax (TY 2023–2024). Internal Revenue Service.

Zastava Arms USA LLC. (n.d.). Federal firearms license listing, 55 Bradrock Dr., Suite B, Des Plaines, IL 60018; mailing address 1515 Laverne Ave, Park Ridge, IL 60068. Bureau of Alcohol, Tobacco, Firearms and Explosives / FFL directories.

Zastava Arms USA LLC. (n.d.). Business profile. Better Business Bureau.

Zastava Arms USA LLC. (n.d.). Zastava warranty policy. Zastava Arms USA.

Zastava Arms USA LLC. (n.d.). Zastava Arms USA LLC. Park Ridge Chamber of Commerce.

News, analysis, and secondary sources

Associated Press. (2026, March 21). Big money flows into state attorney general races as legal battles shape American politics. San Francisco Chronicle.

The Lobbying Show. (2025, December 13). 2026 midterms: Attorneys general preview with Adam Piper, RAGA [Audio podcast episode]. In The Lobbying Show. Podtail.

Center for Media and Democracy. (2024, October 15). Leonard Leo’s Concord Fund again tops funders of Republican AG group in third quarter. Exposed by CMD.

Democratic Attorneys General Association. (2026, June 3). ICYMI: The Kansas AG race is heating up.

InfluenceWatch. (2022, February 24). Rule of Law Defense Fund. Capital Research Center.

Kansas City Star / Topeka Capital‑Journal. (2024, December 16). Kris Kobach’s popularity plummets among Kansas voters. The Kansas City Star.

Multistate Associates. (2026, February 3). State AG races to watch in 2026 and why you should care. Multistate Associates.

ProPublica. (2026, February 3). Republican Attorneys General Association — 527 Explorer. ProPublica.

Rule of Law Defense Fund. (n.d.). About us. Rule of Law Defense Fund.

Washington Examiner. (2026, March 4). Donors turn their attention to “top cop” races in midterms. Washington Examiner.

Zastava Arms. (n.d.). Zastava Arms. Wikipedia.

Zastava Arms USA. (2019, February 8). PAPs, Toks and Mausers for the masses: Zastava launches U.S.‑based operation. Zastava Arms USA.

Zastava Arms USA. (2025, April 28). History. Zastava Arms USA.

Zastava Arms USA. (2025, July 21). Zastava in Des Plaines: How the U.S. facility upgrades AK production. Zastava Arms USA.

Zastava Arms USA. (n.d.). Zastava Arms USA. ZoomInfo.

Social‑media and campaign materials

Bird for Iowa. (2025, November 12). Mar‑a‑Lago Club fundraiser invitation for Attorney General Brenna Bird. Instagram reposts (e.g., @iowawecandobetter). Screenshots on file with Restoring Democracy’s Promise.

Bird for Iowa. (2026, May 19). “Because of generous support across Iowa” pre‑primary fundraising announcement and press release. Facebook. Screenshot on file with Restoring Democracy’s Promise.

Ristic, R. (2025, November 13). “Honored to have hosted an incredible event at Mar‑a‑Lago last night in support of Iowa Attorney General Brenna Bird!” [Post]. X (formerly Twitter).

Zastava Arms USA. (n.d.). ZASTAVA ARMS USA (@zastavaarmsusa) profile. X (formerly Twitter). Screenshot on file with Restoring Democracy’s Promise.

RDP prior reporting

Tucker, T. C. (2025, July 4). The pincer movement: An architecture of autocracy. Restoring Democracy’s Promise.

Tucker, T. C. (2025, May 30). AG Bird’s silence on 27A database revealed amidst sheriff pursuit. Restoring Democracy’s Promise.

Tucker, T. C. (2025 November 7). The DEI hoax: Iowa’s attorney general announced an investigation in six hours — and then nothing. Restoring Democracy’s Promise.

Tucker, T. C. (2025, November 24). The Performance of Protection: Why Iowa’s crypto crackdown doesn’t stop fraud — but supercharges surveillance. Restoring Democracy’s Promise.

Tucker, T. C. (2025, December 10). SAVE: The benefits database now monitoring every licensed Iowan — and every driver. Restoring Democracy’s Promise.

Iowa’s largest public pension system spent the spring of 2026 answering one question — who would lead it next.

They have not answered the governance question: whether Iowa reviewed the investment-risk, benchmarking, fee, and bonus-related allegations already pending in court.

On April 7, Governor Kim Reynolds said the public process was still underway and that “once that is completed, there will be a review of what next steps look like.”

By May 18, after former IPERS CEO Greg Samorajski had resigned and Chief Benefits Officer Steve Herbert had been removed, that promise had narrowed.

Asked by The Gazette whether Iowans would eventually receive more information about the investigation, Reynolds replied: “No, no.” She again framed the matter as personnel, saying she was “not going to share a lot,” while adding that the investigation had “no impact whatsoever on the IPERS fund” and involved no criminal charges.

That answer does not close the governance question. It sharpens it.

The public is now being asked to accept three things at once: that personnel concerns serious enough to produce departures at the top of IPERS existed; that the matter did not threaten the fund or involve criminal conduct; and that no additional details will be released that would let public employees, retirees, lawmakers, or the Investment Board determine whether the inquiry touched the separate investment-governance allegations already pending in court.

From “Next Steps” to “No, No”

On April 7, 2026, asked whether the public would eventually learn details of the state investigation, Reynolds said (lightly condensed for clarity):

“Everybody deserves the right to go through the process … once that is completed, there will be a review of what next steps look like. It has no impact on the solvency of the trust fund and all the beneficiaries will continue to receive their payment. This is a personnel issue, so I’m not going to be able to comment on that … but it has absolutely no impact on solvency or the ability to allocate payments.”

Two things matter about that statement. The solvency reassurance was accurate as stated. Benefits are not at risk. The fund is not in crisis. And — separately — the review of next steps that Reynolds promised once the process completed has, in the public record reviewed for this article, produced personnel actions and a CEO search, but no announced independent review of the investment-governance allegations already on the public record.

That distinction matters because the Governor’s own public language shifted as the process moved from investigation to closure.

But the reason the personnel explanation is incomplete is already sitting in the public court record.

What the Court Filing Already Says

A month before the administrative leaves, a court filing in Polk County had already put detailed allegations into the public record.

On January 30, 2026, former IPERS Investment Risk and Operations Officer Rich Wiggins filed an amended petition in Wiggins v. State of Iowa, LACL163118, Polk County District Court.

The petition alleges flawed risk reporting; a benchmarking structure that, if accurate, made underperformance essentially impossible across large portions of the portfolio; management fees structured so they could not be itemized; and false bonus‑related information submitted to a state board after Wiggins was terminated in February 2023.

RDP’s April 6, 2026 article, Newly Obtained Amended IPERS Lawsuit Expands Allegations on Risk, Fees, and Benchmarking, lays out the petition in detail and remains the technical source.

These are allegations in a court filing, not findings. The State of Iowa contested them through a motion to dismiss. On April 19, 2026 — twelve days after Reynolds characterized the matter as a personnel issue — Judge Jason Walke denied that motion.

A denial of a motion to dismiss is a procedural ruling. It means the case survives and proceeds unless resolved. It does not prove the allegations, but it means the case survived the State’s attempt to end it at the pleading stage.

That distinction matters because Iowa already has audit reports in the public record. Those reports answer financial-statement and compliance questions within their stated scope. They do not, by that same stated scope, answer whether anyone reviewed the investment-governance allegations raised in the Wiggins petition.

Whether the two are related is precisely what officials have not publicly said.

The petition’s allegations remain allegations. But they are the specific allegations Iowa officials have not publicly said were reviewed, audited, or resolved.

What the State Audits Did — and Did Not — Cover

The Iowa State Auditor issued a Government Auditing Standards companion report on IPERS dated December 18, 2025, as part of the FY2025 financial-statement audit. Within its scope — the financial statements as of June 30, 2025, internal control over financial reporting, and limited compliance testing — the report found no material weaknesses and no instances of noncompliance required to be reported. A separate GASB 68 accounting audit released on March 24, 2026 also reported no findings, but addressed only employer-allocation schedules.

The December 18 report itself states that its purpose “is solely to describe the scope of our testing of internal control and compliance and the results of that testing, and not to provide an opinion on the effectiveness of IPERS’ internal control or on compliance.”

Those findings are meaningful within their scope. They are not the same thing as an investment-governance review, and they should not be read as evidence that the Auditor’s Office could simply expand the assignment at will. Since 2023, Iowa law has narrowed the State Auditor’s access to some categories of information and moved certain records disputes involving state agencies and the Auditor out of ordinary court enforcement and into an arbitration process instead.

Neither report, by its stated scope, appears designed to examine the questions raised in the Wiggins petition: investment-governance methodology, benchmarking structure, management-fee disclosure practices, fiduciary conduct, ethics compliance, or conflicts of interest. The point is not that the audits failed. The point is that they were never designed to answer the questions the petition raises.

An outside voice with experience in public-pension governance reached the same structural reading.

Public pension expert Chris Tobe, a former trustee of the Kentucky Retirement Systems and author of several books on pension governance, said the personnel explanation does not answer the governance question.

“When a public pension system removes senior officials after an internal investigation with no transparency, it tells you nothing except that IPERS is secretive,” Tobe said. “As far as we know, it is totally unrelated to investment governance issues.”

In a sharper assessment, Tobe added, “Everything I have seen indicates that IPERS is committed to covering up the investment governance issues in the Wiggins litigation.”

Tobe’s warning goes to the heart of the issue: a personnel explanation is not an investment-governance review.

That is why provenance matters. RDP was not reverse-engineering a governance question after the resignations. It was already asking one.

RDP Was Already Asking

Restoring Democracy’s Promise did not arrive at the governance question after the headlines.

In August 2025, RDP published a conflict-of-interest investigation related to IPERS and an executive appointed by Governor Reynolds to the Iowa DOGE Task Force. In November 2025, RDP submitted a Memorandum of Concern to the Iowa Ethics and Campaign Disclosure Board, citing fiduciary concerns and requesting an independent review under Iowa Code §§ 68B.2A and 68B.25.

One specific governance question RDP already had on the record involved IPERS private-equity oversight. The relationship between IPERS’ general investment consultant, Wilshire Associates, and Pathway Capital Management — a private-equity fund-of-funds manager founded by former Wilshire partners and used in IPERS’ private-equity program — raises a basic independence question. The concern was not that the relationship, by itself, proved misconduct. The concern was that the public record left unanswered whether the consultant charged with providing independent advice was sufficiently independent from the private-equity structure it was helping oversee. Nine months later, that question still has not been publicly answered.

That is exactly why a personnel resolution is not a governance audit.

In May 2026, RDP notified IPERS leadership of the governance questions already on file and sent written questions to Rep. Elizabeth Wilson, who had been quoted in press coverage of the investigation. No response was received before publication.

That sequence does not prove the Wiggins allegations. It establishes only that governance questions about IPERS were on the public record — in court filings, in a formal ethics submission, and in newsroom inquiries — before officials framed the outcome as a personnel matter.

What Iowa Has Not Publicly Answered

These are not technical quibbles. They are the minimum questions needed to know what the public process actually examined.

The reviewed public record identifies no official response to any of the following:

• Who conducted the investigation of Samorajski and Herbert?

• What was its written scope?

• Did it examine risk-reporting methodology?

• Did it examine benchmarking structure?

• Did it examine management-fee and transaction-cost disclosure?

• Did it examine the bonus-related information alleged to have been submitted to the IPERS Investment Board?

• Were findings provided to the IPERS Investment Board?

• Will any findings be released publicly?

Until those questions are answered by someone with clear authority and independence, Iowans are being asked to treat “trust us” as a substitute for an audit.

No statement by the Governor’s Office, the IPERS Investment Board, or any other public official identified in the materials reviewed for this article directly answers those questions.

What Iowans Were Told, and What They Were Not

IPERS, Iowa’s largest public pension system, had 423,989 members in FY2025 — teachers, corrections officers, state workers, firefighters, and retirees. One in ten Iowans is an IPERS member. In FY2025, the fund paid $2.759B in benefits, including $2.442B to members living in Iowa. The net investment portfolio at FY2025 close stood at $46.682B. The funded ratio was 92.2 percent.

Those figures are why accountability matters. They are also why solvency was never the question.

Benefits being safe is not the same as governance having been reviewed. Clean financial reporting is not the same as an audit of investment methodology. A personnel action is not fiduciary accountability.

Those questions were raised in a court filing that survived a motion to dismiss. They were raised in a formal memorandum to state ethics officials. They were raised in newsroom inquiries that went unanswered. No reviewed public document shows that any independent body examined those investment-governance questions or released findings about them.

Iowa officials resolved the personnel question in public. They have not resolved the governance question in public. Until they do, the most important issue raised by the Wiggins record remains unanswered.

In a forthcoming article, RDP will examine how IPERS’ private-equity structure — including its consultant and fund-of-funds relationships — fits into those unanswered governance questions.

Share

About this article: The allegations described above are drawn from the amended petition in Wiggins v. State of Iowa, LACL163118, Polk County District Court, and are allegations in a court filing — not adjudicated findings of fact. Governor Reynolds’ quote is from her April 7, 2026 press availability and has been lightly condensed for clarity; the unedited statement is preserved in the source record.

Reference List

Barton, T. (2026, May 18). Reynolds: No details will be released on IPERS misconduct investigation. The Gazette.

Iowa Judicial Branch. (2026). Iowa Courts Online — Case docket, Case 05771 LACL163118 (Wiggins v. State of Iowa) [Docket record].

Iowa Public Employees’ Retirement System. (2025). Annual comprehensive financial report, fiscal year 2025. Iowa Public Employees’ Retirement System.

Iowa Public Employees’ Retirement System. (2025). Performance report, fiscal year 2025. Iowa Public Employees’ Retirement System.

Iowa State Auditor’s Office. (2025, December 18). Iowa Public Employees’ Retirement System — Independent auditor’s report on internal control over financial reporting and on compliance and other matters (Government Auditing Standards companion report) [Audit report]. Office of the Auditor of State.

Iowa State Auditor’s Office. (2026, March 24). Iowa Public Employees’ Retirement System — Schedule of employer allocations and pension amounts by employer (GASB Statement No. 68) [Audit report]. Office of the Auditor of State.

Office of the Governor of Iowa. (2026, May 7). Gov. Reynolds announces resignation of IPERS CEO [Press release].

Restoring Democracy’s Promise. (2025, November 8). Memorandum of concern regarding IPERS governance and possible violations of Iowa Code §§ 68B.2A and 68B.25 [Formal memorandum submitted to the Iowa Ethics and Campaign Disclosure Board and copied to State Auditor Rob Sand].

Reynolds, K. (2026, April 7). Press availability [Audio recording and transcript]. Office of the Governor of Iowa.

Tucker, T. C. (2025, August 10). EXCLUSIVE: Hidden conflict could hand $42.9M to Iowa Task Force member’s firm. Restoring Democracy’s Promise.

Tucker, T. C. (2026, April 6). Newly obtained amended IPERS lawsuit expands allegations on risk, fees, and benchmarking. Restoring Democracy’s Promise.

Wiggins v. State of Iowa, No. LACL163118 (Polk Cnty. Dist. Ct. Iowa) (amended petition filed January 30, 2026; State’s motion to dismiss denied April 19, 2026, Walke, J.).

The political attack on State Auditor Rob Sand over the Dexter Public Library investigation collapses under one sentence from the official report.

According to the Iowa Auditor of State’s special investigation, Dexter was not targeted. Dexter asked for help.

“The special investigation was requested by City officials as a result of concerns regarding certain financial transactions processed by the former Library Director, Mary McColloch.”

That is the fact missing from the partisan version of the story.

The “blindsided” claim also falls apart under McColloch’s own words. In her KCCI interview, she acknowledged that the auditor’s office tried to reach her before the report was released:

“He did try to call me a couple times…”

She then explained why she did not engage:

“I really didn’t know if I would have any information that could help them, and I really didn’t want to get pulled back into it. I had moved on.”

Being blindsided is one thing. Knowing investigators were calling, choosing not to engage, and later claiming surprise is something else entirely.

Before anyone argues about the politics of Rob Sand, start with the record: Dexter asked for the audit, the Auditor followed the money, and the report documented serious financial irregularities.

What the Auditor Actually Found

This article does not accuse anyone of theft. That decision belongs to prosecutors, not journalists and not auditors.

But the Auditor’s job is not to prove criminal intent beyond a reasonable doubt. The Auditor’s job is to trace public money, identify unsupported or improper transactions, and report what the records show.

In Dexter, the report identified:

• $13,589.50 in undeposited collections

• $4,179.59 in improper disbursements

• $2,404.57 in unsupported disbursements

That is not “nothing.” That is a public ledger that did not add up.

The undeposited collections included checks issued to the library that were deposited into the Dexter Community Foundation account, checks issued to the library that were not properly deposited into the city’s bank account, library donations and fundraiser collections that were not properly deposited into the city’s bank account, and Bayer Ag grant proceeds issued to the library but deposited into the Foundation account.

That does not prove criminal theft. But it absolutely justifies the city asking questions.

And once the city asked those questions, the Auditor had every reason to follow the money.

The Foundation Account They Leave Out

The most important part of the official report is not the political drama. It is the separate Dexter Community Foundation account.

The report says McColloch created the Foundation as a nonprofit organization years earlier. City officials told auditors the City Council did not approve the establishment of the Foundation or its separate bank account. The report also says the Foundation’s articles of incorporation contained no specific language tying it to the Dexter Public Library.

Yet library-related money was deposited there.

Auditors reviewed Foundation bank records and found 167 disbursements totaling $38,722.29. Of those, 59 disbursements totaling $18,247.85 went to McColloch’s husband. Another 31 disbursements totaling $11,197.24 went to Audubon State Bank, where auditors determined McColloch held personal bank accounts. City officials told auditors the city had no accounts at that bank.

That means 90 disbursements totaling $29,445.09 — 76 percent of the Foundation disbursements reviewed — went either to McColloch’s husband or to a bank where she held personal accounts.

The Auditor did not roll that $29,445.09 into the official total of questioned city funds because the Foundation was not a city bank account. That is not overreach. That is restraint.

But it is also exactly why the investigation mattered.

When public donations, grants, library funds, foundation accounts, family reimbursements, and city oversight all blur together, the public deserves a clear accounting.

That accounting does not end just because a prosecutor declines to file charges.

“No Charges” Is Not the Same as “No Problem”

The political attack leans heavily on the fact that Dallas County Attorney Matt Schultz chose not to file criminal charges.

That is relevant. It should be reported.

But it is not the same thing as saying the audit was wrong.

A prosecutor has to decide whether criminal charges can be proven beyond a reasonable doubt. That is a very high legal standard, especially when records are incomplete, accounts are tangled, and intent is difficult to prove.

An auditor is doing something different. An auditor asks: Were public funds properly deposited? Were payments properly approved? Were reimbursements supported by receipts? Were internal controls working?

In Dexter, the Auditor answered: not consistently.

That is the part the partisan narrative tries to flatten. It wants readers to believe that if no one was charged, then nothing was found.

That is not how oversight works.

A fire inspector can find smoke even if the county attorney never charges anyone with arson.

McColloch Wasn’t Targeted. The Records Were.

The official report also undercuts the idea that the investigation came out of nowhere.

After McColloch resigned, the report says library officials were contacted by a concerned citizen who reported seeing her loading filing cabinets and boxes from the library into her personal vehicle. A library official contacted the mayor, the Dallas County Sheriff’s Office became involved, and city and library officials began reviewing records.

During that review, officials identified receipts and revenue listed as collected by the library that could not be traced to the city’s bank account. They also raised concerns about the handling of the Clell F. Hoy Trust.

So on August 19, 2022, city officials contacted the Office of Auditor of State.

That is the story.

Not “Rob Sand targeted Dexter.”

Dexter called the Auditor.

That fact matters because once Dexter asked for a special investigation, the question was no longer whether the Auditor had a right to look. The question was how much work it would take to reconstruct years of transactions after the ordinary paper trail had broken down.

The $35,000 bill did not create the scandal. It revealed the cost of untangling it.

The $35,000 Bill Was the Cost of Untangling the Mess

The politicized version of this story tries to make the audit bill the scandal.

But forensic work costs money because disorder costs money.

If records are missing, if deposits have to be reconstructed, if a separate nonprofit account has to be subpoenaed and reviewed, if years of transactions have to be traced after the fact, that is not a quick bookkeeping check. That is financial archaeology.

The question is not whether $35,000 is a lot of money for a small town. Of course it is.

The question is why the city had to spend that money to reconstruct what should have been clean, traceable public records in the first place.

Blaming the Auditor for the cost of untangling the mess is like blaming the mechanic for the price of diagnosing an engine someone else drove without oil.

The Bigger Attack on Oversight

Dexter is a small town. But the fight over this investigation is not small.

It fits into a broader political campaign to weaken Iowa’s elected Auditor and discredit independent oversight whenever it becomes inconvenient. That campaign depends on turning every audit into a personality fight and every finding into a partisan grievance.

But public money does not become less public because the records are messy. Public oversight does not become a witch hunt because the findings are uncomfortable. And a prosecutor’s decision not to charge does not erase the Auditor’s documented findings.

The Dexter investigation should not be treated as proof that Iowa’s Auditor has too much power.

It is proof that local governments need strong controls, clean records, and an independent office capable of stepping in when something does not add up.

The real lesson from Dexter is simple:

When a city asks for help tracing public money, the Auditor should answer.

That is not a scandal. That is oversight.

Public money does not become less public because the records are messy. Share this with someone who still thinks “no charges” means “nothing happened.”

The disputed claims addressed in this article were advanced by Iowa Field Report and later amplified by Republican officials. This article tests those claims against the State Auditor’s report, KCCI’s interview, and public records.

Source Notes

Iowa Office of Auditor of State, Report on Special Investigation of the Dexter Public Library⁠, June 20, 2024.

KCCI / YouTube, Iowa woman seeks to clear name 2 years after audit of Dexter library⁠, May 12, 2026.

Luke Martz, State Auditor’s Office led by Sand bungles Dexter investigation while taxpayers foot $35,000 bill⁠, Iowa Field Report, May 13, 2026.

Iowa Field Report, IFR publisher expelled from Iowa Press Association⁠, Jan. 2, 2023.

Iowa Starting Line, Rob Sand says GOP bill to let state agencies bypass auditor’s office could lead to corruption⁠, Feb. 14, 2024.

Raccoon Valley Radio, Iowa State Auditor Rob Sand opens investigation for former Dexter library director⁠, June 24, 2025.

Iowa media is now reporting that Iowa turned over voter-registration information to the federal government. That matters. But the data transfer is not where the story begins.

The latest reporting confirms the public-facing event. What it does not yet explain is the system behind it.

Months ago, Restoring Democracy’s Promise documented the deeper architecture taking shape beneath Iowa’s election and identity systems: voter records, DMV data, immigration verification systems, Nlets-linked data pathways, and agency-level agreements that can transform ordinary administrative records into a voter-screening infrastructure.

This week’s headlines focus on Secretary of State Paul Pate’s announced transfer of Iowa voter-registration data to the Department of Justice. That is the visible event. But the deeper architecture was already in motion.

To understand why this week’s announcement was predictable, start with December.

The Handoff Was the Output, Not the Origin

In December, Iowa officials announced a settlement giving the state access to DHS’s SAVE system (Systematic Alien Verification for Entitlements). SAVE is the federal verification system officials use to check immigration or citizenship-related status against federal records.

Iowa also shared driver’s license data with the federal government as part of that arrangement. That agreement was announced by Attorney General Brenna Bird and Secretary Pate.

The contradiction became sharper when Pate publicly acknowledged Iowa’s compliance with the federal demand while also distancing his office from the legal authority behind it.

According to the Des Moines Register, Pate said Iowa had “serious concerns” about the federal request, but ultimately complied after legal review and consultation with the Iowa Attorney General’s Office.

Less than three weeks later, Pate announced that Iowa had complied with DOJ’s voter-data demand. But even then, he again emphasized that “states are responsible for elections and voter list maintenance,” while saying Iowa complied only after legal review and consultation with the Iowa Attorney General’s Office.

That does not absolve Pate. His office transmitted the data. But it does sharpen the central question: if Iowa’s chief election official was publicly emphasizing state control, who supplied the legal theory that made federal access operational?

Pate Transmitted the Data, Bird Supplied the Legal Theory

Secretary of State Paul Pate is accountable for the transfer. But Attorney General Brenna Bird’s office was not a bystander. According to Pate’s own statement, his office consulted with the Attorney General’s Office before Iowa concluded it was legally obligated to surrender the data.

“We are legally obligated to comply with the request, but we do not take the obligation to turn this information over lightly,” Pate stated on May 5th, 2026.

That matters because “legal obligation” is not a neutral phrase. It is a theory — and in this case, Bird’s office helped supply it.

Pate was still speaking the language of state election control. Bird’s office quietly supplied the legal theory that made federal access operational.

That role becomes even clearer when you compare how each office responded to our open-records requests.

The Records Request Discrepancy

RDP submitted an open-records request to the Iowa Attorney General’s Office on Jan. 13 seeking records related to the SAVE settlement, implementation, and data-sharing architecture. After receiving no substantive production, RDP followed up on Mar. 5 with narrowed language.

The Attorney General’s Office responded by stating that responsive communications were protected as attorney-client privileged or attorney work product, that no such documents existed, and that no documents existed within the Attorney General’s Office related to the request.

But records produced by the Secretary of State’s Office tell a different institutional story. Those records show that Secretary of State staff told DOJ in December that they had sent a legal question to the Attorney General’s Office and were awaiting a response. Pate later told DOJ that, after consulting with and receiving advice from the Attorney General’s Office, Iowa concluded DOJ likely had authority to demand voter-registration data.

That does not prove the Attorney General’s Office lied. But it does raise a basic public-records question: if the AG’s office was asked for legal guidance and later supplied advice central to Iowa’s compliance decision, why did its records response not produce or clearly account for that role?

The answer points back to the Attorney General’s Office. Brenna Bird campaigns as a fighter against federal overreach. But on Iowa voter data, her office appears to have helped convert federal overreach into state compliance. That is the contradiction at the center of this story.

That discrepancy matters because Iowa’s compliance did not occur in a vacuum — it slotted neatly into an architecture already documented months earlier.

From Iowa Model to Federal Pipeline

This was never just an Iowa story. Nationally, the Brennan Center has tracked DOJ lawsuits against Washington, D.C. and 30 states that refused to provide complete voter-registration lists with driver’s-license and Social Security-number information.

Iowa’s decision to comply should therefore not be treated as automatic or inevitable. It was a choice made through a legal theory — and Pate’s own statement points back to the Attorney General’s Office.

In Part IV of this series, RDP documented the national expansion: DOJ demands for full, unredacted statewide voter rolls, driver’s license numbers, SSN4s, confidential MOUs, 45-day “clean” clocks, and SAVE as a de facto national eligibility gate. Iowa was not an outlier. Iowa looks increasingly like the proof of concept.

The danger is not simply that Iowa shared voter-registration data. The danger is that Iowa appears to be participating in a broader identity-verification pipeline where voter rolls, driver records, citizenship-status checks, and federal databases can be cross-referenced without ordinary voters understanding the rules, the retention policy, or the correction process.

The issue is not just data sharing. It is what the data can be connected to.

That is why this week’s disclosure matters: it connects the public headline to the infrastructure RDP had already documented.

This week’s reporting did not reveal a new architecture. It revealed the next stage of the architecture already documented here. Which brings us to the blueprint: the architecture that predated this week’s data transfer.

The Transfer Was New—The Blueprint Was Not

The headline this week is that Iowa handed over the data.

What Iowa entered was not just a data-sharing agreement. It was a legal pathway for moving routine state records into a federal identity-screening system most Iowans have never seen, debated, or consented to.

Secretary Pate may want voters to hear that elections belong to the states. Attorney General Bird’s office appears to have helped build the argument that placed Iowa’s voter data within federal reach.

Independent journalism matters because the architecture is usually visible before the headline.

Subscribe to support the kind of reporting that follows the system before the press release catches up.

Join the Mission

That is a positive outcome for privacy and public-records accountability — for now.

The issue is not over. It will likely return next session. The standard should be clear: real ALPR reform means public audit results, narrow sharing rules, enforceable limits, and access to the logs when government power is misused.

The bill would require ALPR search logs and audits. But H-8452 would make those logs confidential and remove public audit reporting — leaving Iowans with rules they cannot verify.

For weeks, Iowa lawmakers have promised to “rein in” automatic license‑plate readers (ALPRs), the networks of cameras that can photograph thousands of vehicles an hour, send alerts about “hot list” plates and, in practice, track people’s movements for weeks or months at a time. Their vehicle for reform is SF 2284, a Senate bill that began life as an overhaul of traffic‑camera enforcement and has since been repeatedly rewritten.

On March 10 the Senate passed a reprinted version of the bill that dealt mostly with automated noise cameras and plate‑sharing prohibitions. The House then bolted on a comprehensive ALPR framework (Amendment S‑5192): cities would need an ordinance to use ALPRs; the Department of Public Safety (DPS) would maintain a list of approved vendors; law‑enforcement agencies would have to delete raw plate images after thirty days; and officers would have to record the name, call number and reason for every ALPR search. A later Senate amendment (H‑8452) modified S‑5192 again and is now sitting in front of the House for concurrence. Lawmakers were still debating legislation past midnight this weekend, clearing appropriations and tax bills while leaving the most controversial items—like ALPR and Save‑Act voter verification—until the last possible moments.

As of Sunday morning, SF 2284 had not appeared on the House floor agenda. But the version that could pass—SF 2284 plus S‑5192 plus H‑8452—wouldn’t be the privacy victory advocates might expect. It would build a statewide ALPR system, lock in broad sharing with police and insurance companies, and make the logs that could prove misuse confidential under Iowa’s open‑records law. In plain English: Iowa would be telling police to keep receipts—and then making sure ordinary residents will never see them.

That is why the bill has to be read in two layers. The first layer is the public-facing reform package: local ordinances, a facial-recognition ban, a 30-day deletion rule and required audit trails. The second layer is the infrastructure package: state-approved vendors, authorized data sharing with law enforcement and insurers, and a new confidentiality rule for the logs that would show how the system is used. The first layer reassures the public. The second layer protects the system.

The Bill’s Supposed Guardrails

The House‑amended bill does contain several provisions that sound good on paper:

• Local control and state approval: Under S‑5192, cities and counties would need to pass an ordinance authorizing ALPR use. They would have to specify which vendors and which job classifications can run searches. State agencies would need approval from the DPS commissioner, and devices must come from a DPS-approved vendor list, with approvals running on two-year cycles under H-8452.

• No facial recognition: All ALPR systems would have to operate without facial‑recognition capability. That sounds meaningful, but it is also a limited safeguard: ALPR cameras are not facial-recognition systems in the first place. They are plate-recognition systems. The real privacy fight is over the location data, the sharing networks, and the logs.

• Short retention for raw data: Plate images and associated data in the ALPR system would have to be purged after 30 days unless copied into a separate case file.

• Audit trails: Each ALPR search must be logged with the searcher’s name, the reason for the search and an associated case or call number. Agencies must audit these logs at least every four months.

Those rules would be an improvement over Iowa’s current patchwork, where local police can deploy Flock Safety or similar systems with minimal public input and hold data for as long as they like. Supporters have framed the package as a measured attempt to “balance law enforcement, allowing them to do their job, with the fear of a surveillance state,” as Rep. J.D. Scholten (D‑Sioux City) put it. Rep. David Young (R‑Van Meter) argued that it gives police the tools they need “to keep our communities and families safe” while adding “some guardrails to protect our privacy.”

The Holes in the Privacy Story

The problem is not that every provision is bad. Some are plainly better than the status quo. The problem is that the bill’s most enforceable privacy-sounding provisions are paired with exceptions and secrecy rules that leave the surveillance architecture intact.

A Statewide Framework to Normalize ALPRs

Requiring local ordinances and a DPS vendor list doesn’t limit ALPRs; it standardizes them. Once a city approves its ordinance, cameras can be deployed with official blessing. The DPS list turns what is now a patchwork of private contracts into a state‑sanctioned network of “approved” systems. That structure will make it easier—politically and practically—for police departments and state agencies to adopt ALPRs on a wide scale.

Expanded Data‑sharing Channels

The House amendment authorizes copying plate data into case files and sharing it with:

• Any “peace officer or law‑enforcement agency”—a term broad enough to include federal agencies, fusion centers and out‑of‑state police.

• Contractors working “solely” on public‑safety, criminal‑investigation or law‑compliance tasks, which can include private analytics firms and vendors.

• Insurance carriers, the National Insurance Crime Bureau and “insurance support organizations,” for fraud investigations, vehicle recovery or claims adjudication. In other words, the bill explicitly allows commercial industries to receive plate data without clear deletion or minimization requirements.

The bill bars agencies from conveying “historical location information” to a plate‑reader vendor except in three broad circumstances: when the data have been anonymized or “redacted”; when the vendor needs historical data for operation, security, testing or improvement; and when the vendor provides technical support. Those exceptions swallow the rule—vendors still get access to large amounts of location data as long as they promise to scrub personal identifiers.

A Secrecy Clause that Locks the Only Accountability Tool

The most consequential amendment comes from H‑8452: a single sentence inserted into the logging section stating that “A search log maintained pursuant to this subsection is a confidential record under section 22.7.” Iowa Code 22.7 is the section of state law that lists categories of records that agencies “shall keep confidential.” It already covers medical records and certain investigative materials; once a record is placed there, public‑records requests can be denied by default.

Before SF 2284, agencies could and did fight over ALPR logs, often invoking existing confidentiality claims. H-8452 would change the posture by giving agencies a direct statutory sentence to point to. By labeling ALPR search logs as confidential under 22.7, the bill gives agencies a statutory shield to refuse disclosure altogether. The bill retains the auditing requirement but strips out S‑5192’s mandate that agencies publish audit results online. Audits will still happen—internally. The public will never see them.

Rep. Ryan Weldon (R‑Ankeny) highlighted one of the core problems: “A privacy bill that, in my opinion, doesn’t address private vendors isn’t a privacy bill. It is a half measure,” he told Iowa Public Radio.

Becca Eastwood, the ACLU of Iowa’s policy director, agreed that Iowans need more protection: “Municipalities are licensing Iowans’ data to private, third‑party vendors that are sharing it around the world. Iowans are losing control over their data in ways that are unnecessary to advancing public safety goals.” Yet the final package retains the vendor and insurance exceptions and goes further, insulating the logs themselves from view.

That is the central contradiction of SF 2284. It requires the government to create the accountability record, then prevents the public from seeing it.

Why it Matters: When the Logs Go Dark

Imagine a driver heading home on a Saturday evening with children in the car. The driver passes through a corridor lined with automated license-plate readers. Somewhere behind the scenes, a camera reads the plate. Maybe it matches a warrant entry. Maybe it triggers an alert. Maybe it does nothing at all.

A few minutes later, a patrol car appears behind the vehicle.

The officer cites a traffic issue or warrant entry, removes the driver from the car, and takes the driver into custody while the children watch from the shoulder. The driver is left with a basic question: did a human decision lead to that stop, or did an ALPR alert put the vehicle on the officer’s screen?

SF 2284 moves in the opposite direction. The bill requires agencies to keep those records — and then H-8452 classifies the search log as confidential under Iowa Code 22.7. The search would be recorded. It would be audited. But the person most affected by it may have no practical way to see it without litigation, subpoena power, or voluntary disclosure.

That is not transparency. It is an accountability system built for everyone except the public.

Late‑night Sausage and Last‑minute Changes

The secrecy amendment emerged during the final days of Iowa’s 2026 legislative session, as lawmakers were debating bills late into the night. On Saturday morning, the House and Senate were still moving appropriation bills and tax measures after midnight. Both chambers stood at ease, recessed and reconvened multiple times in the early hours. It was in this atmosphere that the Senate filed H‑8452—a 16‑item amendment that, among other things, capped the number of mobile ALPR units a city can operate, tweaked signage rules and, crucially, classified search logs as confidential. The House now must decide whether to concur or negotiate further.

Iowa’s lawmaking process always involves give‑and‑take. But making major surveillance decisions when public attention is low invites cynicism. When a bill that expands surveillance architecture also hides its accountability mechanisms, legislators should expect questions about whose interests are being served.

The Real Choice Ahead

SF 2284 has become a Rorschach test. Some see real reforms: a facial‑recognition ban, a deletion schedule, a statewide approval process. Others see a blueprint for normalizing ALPRs while institutionalizing secrecy and vendor access. Both readings contain some truth — but only one explains where the bill’s real power sits.

If lawmakers are serious about curbing mass surveillance, they still have tools. They could remove the sentence classifying search logs as confidential and restore public audit reporting. They could narrow the definitions of “law‑enforcement agency” and “insurance support organization,” or bar sharing with out‑of‑state and federal agencies unless there is a warrant or specific court order. They could require that any data copied out of the 30‑day window be logged and subject to the same deletion deadlines.

Right now, none of those things are in the bill. What remains is a package that reins in one kind of abuse (local camera free‑for‑all) while reinforcing others (vendor networks, sealed logs).

When lawmakers return to SF 2284, they will not just be deciding whether to regulate license-plate readers. They will be deciding whether Iowa’s ALPR system will be accountable to the people it tracks — or only to the agencies, vendors and insurers allowed to look behind the curtain.

Subscribe now

References

Iowa Legislature. (2026). Senate File 2284.

Iowa Legislature. (2026). House amendment S-5192 to Senate File 2284.

Iowa Legislature. (2026). Senate amendment H-8452 to House amendment S-5192.

Iowa Legislature. (2026). House File 2161 and amendment H-8006.

Iowa Legislature. (2026). House File 2701.

Sostaric, K. (2026, April 17). Iowa House adds regulations for automatic license plate readers to a traffic camera bill. Iowa Public Radio.

ACLU of Iowa & University of Iowa Technology Law Clinic. (2025). ALPRs are tracking you with little oversight.

Tucker, T. C. (2025). The ALPR Trap: How America’s Plate Readers Turn Your Movements Into a Permanent Financial Surveillance Record. Restoring Democracy’s Promise.

A newly obtained amended petition in Polk County District Court sharply expands the allegations in former IPERS risk officer Rich Wiggins’ lawsuit against the State of Iowa.

The amended filing, e-filed Jan. 30, 2026 under LAW NO. LACL 163118, alleges flawed risk reporting, a benchmarking structure that made underperformance effectively impossible, understated management fees and expenses, and false bonus-related information submitted to a state board after Wiggins was fired.

That matters because recent public coverage of IPERS focused on the administrative leave of senior officials and vague references to “misconduct,” while giving the public little sense of what had already been laid — in detail — in the court record.

What Was Already on the Record

The earlier petition, filed in July 2025, alleged that Wiggins was hired in June 2022 as IPERS’ Investment Risk and Operations Officer and fired on Feb. 2, 2023 as a “bad fit” after raising concerns about risk reporting, a benchmarking process that allegedly “artificially creates alpha,” and the understatement of fees and expenses.

Wiggins was not a junior analyst questioning his superiors. Before joining IPERS, he served as head of risk and strategy for Saudi Aramco — the second-largest company in the world. He was hired specifically to ensure IPERS did not become, in his supervisors' own words, "the next Pennsylvania State Employees Retirement System" — a reference to the 2021 scandal involving overstated investment returns and an FBI investigation.

The original petition made clear that Wiggins was alleging more than an ordinary employment dispute. But the amended filing goes much further — and much more specifically.

What the Amended Petition Adds

In the amended petition, the allegations move from broad warning signs to a detailed description of how Wiggins says the system was being presented to decision-makers.

According to this filing, Wiggins alleges IPERS’ reporting was “riddled with errors” in three main areas: risk reporting, a benchmarking rubric that artificially created alpha, and the understatement of management fees and expenses.

On risk reporting: Wiggins alleges IPERS did not use any of the large risk software packages commonly employed by major state pension systems. Instead, the system relied on a small Illinois firm with no other clients of comparable size, using formulas developed by then-Chief Investment Officer Sriram Lakshminarayanan.

IPERS staff then graphed the output by hand in Microsoft Excel. When Wiggins requested the underlying algorithms and formulas, he was told they were unavailable. The Illinois vendor refused to provide them.

In the fall of 2022, Wiggins authored a memorandum recommending that IPERS bring in an outside consultant to verify the risk calculations. No response was received. He wrote a second memorandum. It was ignored.

Colleagues whom Wiggins shared some of the raw numbers with — experts in investment risk — agreed the output appeared visibly flawed and did not represent a robust measure of actual risk.

On benchmarking: The amended petition alleges that a large swath of the portfolio was benchmarked directly to itself — making it mathematically impossible to underperform. As the filing states: if IPERS' private equity, real estate, direct lending, opportunistic credit, and real assets all went to zero, the fund would still not underperform its benchmark, because the benchmark return was set to equal whatever those asset classes actually returned.

The filing characterizes this as, at best, "engineered outperformance" and, at worst, intentional misrepresentation.

Some strategies also allegedly introduced synthetic exposure to stocks and bonds benchmarked to cash — a mechanism that makes outperformance easy to show while introducing undisclosed leverage and obscuring real risk.

On fees: The petition alleges IPERS leadership frequently presented the plan as among the lowest-cost in the country. But the figures shown to the Investment Board excluded underlying private equity manager fees and incentives, and certain fees were structured so they were buried in transactional costs — preventing them from being itemized.

On post-termination conduct: The amended filing goes one step further. It alleges that after Wiggins was terminated, false information was submitted to a state board and money was subsequently requested in the form of bonuses. Under Iowa's False Claims Act (Iowa Code Chapter 685), Wiggins alleges that the use of inaccurate risk metrics and manipulated benchmarking to justify bonus requests constitutes the submission of false claims for compensation.

Those are allegations in a court pleading, not findings by a judge. But they are materially more specific than the version of the story most Iowans have seen so far.

A Filing the Public Never Really Saw

The filing also helps clear up some of the confusion surrounding the case itself. The amended petition identifies the matter as Rich Wiggins v. State of Iowa, filed in Polk County under LAW NO. LACL 163118. Wiggins is represented by Thomas J. Duff and Jim T. Duff of Duff Law Firm, P.L.C. The filing also shows copies to Jeffrey Peterzalek and Steven E. Blankinship for the State.

That level of detail matters on its own. It matters even more because most public coverage to date has focused on vague references to “misconduct” while leaving the substance of the court record largely unexplored.

This amended petition was e-filed on January 30, 2026 — two full months before IPERS CEO Gregory Samorajski and Chief Benefits Officer Steven Herbert were placed on administrative leave in the first week of April.

The timeline raises a question that no outlet has addressed: did the State's investigation begin before or after the amended filing landed? The public has not been told.

What the Public Was Told Instead

When the administrative leaves were announced, the governor's office issued a statement: “This situation does not pose any risk to the IPERS Trust Fund and does not impact the payment of benefits to members.”

That statement is narrowly true. IPERS is 92.7 percent funded. Benefits will continue to be paid.

But the statement does not address what is actually being alleged: that the numbers used to calculate that funding ratio may themselves be unreliable. If risk is understated, fees are concealed, and benchmarks are structured to guarantee the appearance of outperformance, then the system's reported financial health is an output of the very practices now under scrutiny — not an independent measure of it.

Nobody is saying retirees won't get their checks. The question is whether the people responsible for the $45 billion behind those checks were telling the truth about how it was being managed.

What Remains Unanswered

State officials have said senior IPERS officials were placed on leave pending an investigation. What remains unclear is who is conducting that investigation, what its scope is, and whether it overlaps with the allegations in the amended Wiggins filing.

This outlet has been tracking the IPERS story since August 2025, including reporting on pension privatization pressure from the Governor’s DOGE Task Force and a November memorandum of concern regarding potential conflicts of interest on the IPERS Investment Board. Those broader concerns remain separate questions. The amended Wiggins filing does not prove them. But it does establish that the public court record is more developed, and more serious, than recent coverage has suggested.

That is the significance of this filing. It does not prove the case overnight. It does strip away the fiction that the public had no way of knowing what the underlying allegations were. The amended petition exists. It is detailed. It is public. And it shows that the story surrounding IPERS is more serious than the state’s vague language — and much of the press coverage that followed it — has allowed the public to see.

The IPERS trust fund belongs to 424,000 Iowans — teachers, firefighters, corrections officers, state workers, and retirees who built careers on the promise of a secure retirement. They deserve more than reassurance. They deserve the actual record.

Share Restoring Democracy's Promise

Today I’m introducing RDP Analytics, a new research and methods arm within Restoring Democracy’s Promise.

The goal is simple: build a more structured way to document institutional failures, accountability gaps, and hidden system behavior using evidence, timelines, and analytical modeling — while keeping the work grounded in public records and readable journalism.

This is where quantitative structure meets investigative reporting.

The first public case study is now live:

The Federal Oversight Vacuum Cascade

A 164-hour core oversight blackout during the shutdown, reconstructed through contemporaneous records and analytical validation.

Click or tap the graphic below to open the full exhibit.

This is the first of several exhibits and case studies that will sit under the RDP Analytics umbrella. More to come soon.

Subscribe to stay updated.

Subscribe now

We are not war correspondents, and we are not going to pretend otherwise. But silence is also a choice.

Since February 28, a joint U.S.-Israeli military campaign against Iran has escalated into a wider regional war. Evacuations, missile strikes, and mounting civilian displacement have deepened the humanitarian toll while also accelerating the democratic dangers that follow war wherever it spreads: fear, propaganda, weakened oversight, and public pressure to treat dissent as betrayal.

As of March 12, 2026, UNHCR confirmed that up to 3.2 million people have been displaced inside Iran. The International Organization for Migration reports more than 822,000 displaced in Lebanon. UNICEF reports that over 190 children have been killed across the region in less than two weeks.

These are not abstractions. They are people — families carrying children down roads they did not choose, in a war they did not start.

At Restoring Democracy's Promise, we are not here to narrate the battlefield. We are here to follow democratic accountability: how power is authorized, how public money is used, how truth is pressured when governments need fear more than public trust, and whether human beings are treated as disposable when fear becomes politically useful.

We will not stay silent when oversight is pushed aside.

These risks are not theoretical. They are documented patterns, and they are already in motion. The treatment of dissent as disloyalty, the erosion of civil liberties, and the dehumanization of entire populations are not side effects of war. They are warning signs.

Wars do not only destroy bodies and buildings. They corrode democratic standards in the institutions back home. War abroad does not stay abroad; it returns through fear politics, weakened oversight, manipulated information, and the normalization of cruelty as public culture.

And as always, the first people treated as expendable are the people with the least power to resist: civilians, displaced families, minorities, migrants, and communities already living at the edge of protection.

​Our position is clear: de-escalation, civilian protection, transparent authorization, and democratic accountability.

We call for:

• Transparent congressional accounting of the legal authorization, operational scope, and cost of U.S. military operations — because democratic wars require democratic consent.

• Protection of civilians and full compliance with international humanitarian law by all parties — because human life is not a variable to be optimized away.

• Defense of the domestic information environment against propaganda, manufactured consent, and the suppression of dissent under the cover of wartime loyalty—because democratic oversight does not pause for war.

We must ensure that our commitment to holding power accountable remains as unwavering during times of war as it is during times of peace.

But let us be absolutely clear: our goal is not a better-managed war. The first duty of a democracy is the preservation of human life, not the refinement of its destruction.

Our ultimate demand remains an immediate and lasting peace.

If this statement resonates, subscribe to Restoring Democracy’s Promise for reporting on democracy, power, public truth, and the human consequences of state action—at home and, when necessary, beyond it.

Join the Mission

From Rhetoric to Infrastructure—Codifying the System Already Running

During the recent State of the Union address, President Trump repeatedly invoked the “SAVE America Act” — framing it as a necessary safeguard for election integrity through expanded citizenship verification.

The messaging was clear: verification must become routine, centralized, and federally integrated. Less than twenty-four hours later, Iowa lawmakers advanced legislation that mirrors that national push — embedding recurring federal SAVE verification system checks directly into state election administration.

This is not coincidence. It is architectural alignment.

In the only statewide test of this model, nearly nine in ten Iowans flagged as “potential non‑citizens” turned out to be U.S. citizens. Iowa is not simply debating voter policy. It is wiring federal verification infrastructure into state law.

In December, we documented how the DHS’s existing Systematic Alien Verification for Entitlements (SAVE) came to Iowa through executive action.

Through a combination of administrative procedures the system architecture is already running in Iowa.

On February 25th, Iowa lawmakers advanced SF 2203 in the Senate (34–13) and HF 2501 in the House, bills that would formalize those connections and make recurring SAVE checks a requirement rather than an option.

The bills are not companions nor have they been reconciled. They are on parallel tracks. In Iowa, a bill passed by one chamber must pass the other chamber in the same form (or be reconciled) before it can go to the governor.

That limbo makes the current moment critical for public input: the core system is already wired, and the legislation would make it permanent.

Though texts differ, both bills would move Iowa from executive order and court settlement use to statutory mandate.

Under SF 2203, county auditors would verify registrations against SAVE, mark voters as “unconfirmed” if the database fails to confirm citizenship, mail notices, and—if the voter fails to return proof within 90 days—cancel the registration.

HF 2501 establishes similar verification mechanisms and narrows same‑day registration options.

On its face, this is framed as a procedural safeguard. But structurally, it embeds a recurring federal query mechanism into Iowa’s voter maintenance system. Verification shifts from an event-based safeguard to an ongoing data relationship between Iowa election officials and federal databases.

The implication is subtle but significant: The state becomes dependent on federal status codes to maintain its voter rolls. In plain terms: instead of checking citizenship once, the state would check repeatedly. And when databases don’t match, the voter—not the state—must fix the error.

State Sen. Sarah Trone Garriott warned during floor debate that the legislation piles “more brokenness on our already broken immigration system” and risks punishing eligible voters: “We are not only punishing the people we’re trying to weed out — if they exist — we’re punishing people who are eligible to vote”.

Together these proposals would legislate an identity‑matching architecture rather than a one‑time purge. If SF 2203 builds the verification pipeline, HF 2501 adjusts how flagged records are processed.

This is not a single reform. It is a layered system. To understand the architecture, follow the data flow.

The Data Pipeline: From the DMV to SAVE to County Election Officials

Under expanded SAVE integration, state DMV identity data for all residents may be aggregated into the DHS’s SAVE system to cross-reference citizenship indicators through federal systems. Under SF 2203 county auditors would start a 90‑day removal clock as soon as SAVE fails to confirm a voter.

That coupling of automatic flags and short correction windows effectively shifts the burden of proof from the state onto each voter. In a system that relies on federal match codes the state does not control, friction is inevitable; the SAVE algorithm does not eliminate human error—it encodes it.

The debate often centers on fraud prevention. But the structural change is the creation of a recurring federal-state verification loop. And Iowa already knows what that loop produces. In the only statewide test of this architecture, the results were definitive — and damning.

SAVE System Errors and Voter Verification Flaws

The danger is not theoretical: it is visible in Iowa’s own pilot. In 2024, state officials compared voter lists against legacy DMV immigration codes and flagged 2,176 registrants as potential non‑citizens. Court filings later revealed that only 277 were actually non‑citizens; at least 88 percent of those flagged were U.S. citizens, many of them naturalized Americans whose lawful permanent‑resident records were never updated in older DMV databases.

Getting flagged does not equal removal. However, the volume of flags determines administrative burden — and the burden shifts to the voter to resolve discrepancies within the cure period.

When verification systems expand in scope and speed, error tolerance matters.

And documented federal database inaccuracies — including naturalization lag and missing citizenship indicators — remain part of the equation.

The ACLU of Iowa called the program an “unjustified, intimidating effort” to police naturalized citizens, and voting‑rights attorney Jonathan Topaz warned that it invites discrimination against people who sound or look “foreign”. National voting‑rights advocates have echoed those warnings: ACLU policy counsel Molly McGrath criticised federal SAVE legislation as “an expensive solution in search of a problem” that will “kick eligible voters off the rolls”. Those observations are borne out in the results: naturalized citizens received provisional ballots and had to prove their citizenship, while county auditors later learned that the list itself was “fatally flawed.”

South Carolina election officials, in a letter to the U.S. Attorney General, said the system would require “large‑scale manual override” to avoid wrongly removing naturalized citizens.

A federal judge presiding over current litigation of the SAVE overhaul wrote that she was “troubled by the recent changes to SAVE” and “doubts the lawfulness of the Government’s actions.”

These are engineering warnings, not ideological critiques: when a bulk‑matching system hinges on incomplete DMV or SSA records, false positives multiply.

When you scale a one to one lookup database to a nationwide bulk ingestion model, prior error rates matter.

DHS’s SAVE user guide explains that when the system returns a “no match” or “incomplete” response—situations that commonly occur for citizens whose records lack a citizenship indicator—the local agency cannot correct the underlying federal record.

Only USCIS or the Social Security Administration can update the data, and individuals must navigate federal bureaucracy to clear their names.

These are not hypothetical risks. They are the documented performance of the system Iowa's legislature now proposes to make permanent.

The Convergence: When Federal Rhetoric Becomes State Code

The SAVE America Act would expand federal verification authority nationwide; Iowa’s bills operationalize that framework at the state level. What is pitched as a federal safeguard becomes, in Iowa, an everyday administrative workflow. The rhetoric of “election integrity” becomes recurring code.

Iowa has always maintained voter rolls. What changes now is the frequency of federal verification and reliance on federal databases—essentially federalizing voter lists that have historically been state‑maintained and decentralized.

If passed, the state bills would also put timeline pressure on flagged voters to prove their citizenship. It normalizes bulk federal verification queries of citizens’ private data. This is not about a single flagged record.

It is about converting voter maintenance into a data synchronization exercise with federal systems. Once embedded in code, such systems rarely contract.

They scale.

The legislative proposals therefore raise practical questions that remain unanswered. Before these bills are signed, these critical issues are still unknown and as of yet undefined in the bill language:

1. What notice is guaranteed before cancellation?

2. What is the current accuracy rate of the verification system?

3. Will the verification system be audited, and by whom?

4. What documentation will satisfy county auditors?

5. How quickly can DHS or SSA correct underlying records?

6. How often will recurring checks run?

7. What audit thresholds will be applied?

8. What error safeguards will be published?

9. How will cure notifications be delivered and tracked?

10. Will the state publish transparency reports showing how many voters are flagged, how many are ultimately removed, and why?

Voters deserve clarity not just about intent — but about implementation. Because once verification becomes routine, it stops being exceptional. And routine systems define the landscape far more than speeches ever do.

Without guardrails, instituting recurring SAVE verification checks risks normalising federal system that disenfranchises eligible voters and treats citizenship as a database field rather than a constitutional status.

What is pitched federally becomes routine administratively in Iowa.

The SAVE America Act may be debated in Washington. But in Iowa, the wiring is already being installed.

The proposed state statute now reflects the existing state and national architecture:

• A federal database.

• A recurring query.

• A defined purge window.

• A state compliance clock.

The policy language sounds procedural. The design is infrastructural.

Voters should respond with proactive steps rather than panic. To stop the transfer of your personal DMV data to DHS federal systems, contact your state legislators and urge them to oppose these bills.

Periodically verify your registration— especially if you have recently naturalized or changed your name. Confirm that your federal records reflect your current status. If you receive a notice from your county auditor, respond promptly—these letters will arrive under the authority of a law that presumes non‑citizenship unless proven otherwise. The machinery is in motion; civic vigilance is the only defense.

If you are a naturalized citizen, or your name has changed, consider bringing a passport, birth certificate, or naturalization papers when you vote.

But individual vigilance cannot substitute for structural accountability.

Citizenship Is Not a Database Field

The bottom line is that election law debates often focus on ballots, but this debate is about databases. Iowa’s bills would transform voter eligibility into a question of cross‑agency identity matching. Infrastructure persists; error rates compound.

Before the Legislature codifies this new identity layer, it should confront the operational evidence: in the only statewide test, nearly nine in ten flagged voters were U.S. citizens. When automation scales, past error rates aren’t footnotes — they are forecasts.

The machine is built, but it is not yet fully legalized. The window to unplug it is closing.

Share

Subscribe now

References

Iowa General Assembly. (2026). Senate File 2203: A bill for an act relating to the verification of United States citizenship of voters [Bill text and legislative history]. Iowa Legislature.

Iowa General Assembly. (2026). House File 2501: A bill for an act relating to the conduct of elections and including effective date provisions [Bill text and legislative history]. Iowa Legislature.

U.S. Citizenship and Immigration Services. (2023). Systematic Alien Verification for Entitlements (SAVE) user guide [PDF]. U.S. Department of Homeland Security.

U.S. Department of Homeland Security. (n.d.). Systematic Alien Verification for Entitlements (SAVE): Program overview [Web page]. U.S. Department of Homeland Security.

American Civil Liberties Union of Iowa. (2026, February 11). Iowa Secretary of State agrees to settle lawsuit after wrongly targeting naturalized citizens as “potential non‑citizens” [Press release].

Texas Secretary of State. (2019). Memoranda regarding SAVE pilot processing failure rates [Internal memoranda]. Office of the Texas Secretary of State.

South Carolina Election Commission. (2020). Letter to the U.S. Attorney General regarding SAVE verification burdens [Letter].

State of Florida, State of Indiana, State of Iowa, & State of Ohio v. Department of Homeland Security, Case No. 3:24-cv-00509-TKW-HTC (N.D. Fla. Nov. 28, 2025) (Settlement Agreement).

U.S. Citizenship and Immigration Services & Iowa Secretary of State. (2025). Memorandum of agreement between the Department of Homeland Security, U.S. Citizenship and Immigration Services and the Iowa Secretary of State regarding participation in the SAVE program.

Office of the Iowa Attorney General. (2025, December 1). Attorney General Brenna Bird secures election integrity win for Iowa [Press release].

Reynolds, K. (2025, October 8). Executive Order 15. State of Iowa Executive Department [Press release].

4 Republican states will help Homeland Security obtain driver’s records to check voters’ citizenship. (2024/2025). Associated Press / News Reporting.

Social Security Administration, Office of the Inspector General. (2006, December 18). Congressional response report: Accuracy of the Social Security Administration’s Numident file (Report No. A-08-06-26100).

U.S. Department of Homeland Security. (2025, October 31). Privacy Act of 1974; System of Records (DHS/USCIS-004 Systematic Alien Verification for Entitlements). Federal Register, 90(209), 48948–48953.

U.S. Department of Homeland Security. (2025, October 31). Privacy impact assessment for the Systematic Alien Verification for Entitlements (SAVE) program (DHS/USCIS/PIA-006(d)).

Fair Elections Center. (2025, December 12). Comment of Fair Elections Center to the Social Security Administration on the System of Records Notice for SSA Master Files (Docket Number: SSA-2025-0225).

U.S. Citizenship and Immigration Services. (2025, May 22). Optimizing SAVE: New options to create cases with a Social Security Number and by bulk upload.

U.S. Citizenship and Immigration Services. (2025, July 16). SAVE user reference guide, 10.1 bulk upload file management.

Plaintiffs' Amended Complaint (April 2025)—Selcuk v. Pate, Case No. 4:24-cv-00390, Amended Complaint for Declaratory and Injunctive Relief (S.D. Iowa Apr. 4, 2025).

State Defendant's Supplemental Declaration (November 2024) Selcuk v. Pate, Case No. 4:24-cv-00390, Supplemental Declaration of Michael Ross (S.D. Iowa Nov. 1, 2024).

Final Settlement Agreement (February 2026) Settlement Agreement, Selcuk v. Pate, Case No. 4:24-cv-00390, Exhibit A (S.D. Iowa Feb. 9, 2026).

Iowa Secretary of State. (2025, March 20). Iowa Secretary of State’s audit of voter registration lists finds 277 confirmed noncitizens registered to vote [Press release].

Primary documents & prior SAVE evidence lockers (paid archive): Restoring Democracy’s Promise — Subscriber Vault.

On its face, the SAVE America Act (H.R. 1238) appears to be a straightforward effort to prevent noncitizens from voting: run names through a federal database and remove anyone who isn’t a U.S. citizen.

But beyond politics, this is a systems-architecture decision. Once you follow the data flows, you realize the capabilities extend far beyond elections. The SAVE America Act does not create a new verification system. It codifies one already active.

Using legislative backfill, the SAVE Act provides regulatory cover while formalizing and nationalizing a verification system already partially operational through executive agreements and federal–state data exchanges.

The bill doesn’t just check IDs. It mandates that states route entire voter rolls through federal immigration databases, extends photo‑ID mandates that push millions more voters into DMV systems, and deepens data pipelines between election officials, motor‑vehicle agencies and the Department of Homeland Security (DHS).

In other words, it tries to turn DHS’s Systematic Alien Verification for Entitlements (SAVE) database into a national citizenship-eligibility verification tool that elections are then forced to rely on.

Supporters frame it as fraud prevention; critics see something larger: the construction of a unified identity framework.

Once state election databases, DMV records and federal immigration data are stitched together, those pipes can be used for more than checking citizenship. The legislation encourages the creation of cross‑system identifiers—sometimes join keys, linkage keys or unique linking IDs—that allow disparate systems to match a person across agencies and states.

When Verification Meets Reality

Three states have tried to use SAVE or similar systems to purge rolls. Their experiences reveal technical and civil‑rights problems that the federal bill doesn’t solve.

Texas: When the System Broke

During a pilot program, Texas ran 1,657 voter‑file records through the updated SAVE system. Because SAVE was built to verify benefits eligibility for specific individuals, it was never designed for bulk election screenings. Roughly 300 queries failed outright, an 18 % processing failure rate blamed on duplicate entries, formatting differences and other data problems. In other words, nearly one in five records couldn’t be resolved.

In engineering terms, that isn’t statistical noise. It’s structural instability. The SAVE verification system wasn’t designed for this caseload.

Iowa: When Citizens Were Flagged as Suspects

In 2024 the Iowa secretary of state used old DMV records to mark 2,176 registered voters as potential noncitizens. The list was kept secret, and the targeted voters received no notice. Civil‑rights groups sued and discovered that only 277 of the 2,176 were not U.S. citizens. At least 88% of those flagged were U.S. citizens, many of them naturalized citizens whose earlier lawful permanent resident records had never been updated in legacy DMV files. The American Civil Liberties Union (ACLU) of Iowa argued that the program was a “discriminatory and unreliable” attempt to undermine voters of minority race and naturalized citizens.

The system is most confident where it is most wrong. Naturalized citizens.

South Carolina: The Data Demands Expand

South Carolina’s experiment, outlined in 2023 planning documents, highlighted the same structural weaknesses.

Officials warned that SAVE data would miss naturalisation updates, mis‑match names and require manual follow‑up in a large number of cases. In effect, the state would have to build a parallel review process to account for stale or ambiguous matches.

These are not passive verification fields. They are structural linking mechanisms — persistent identifiers that allow records to match and migrate across agencies.

Figure 1 summarizes the real world results.

The technical failures are only part of the story.

How Identity Keys Become Infrastructure

To match voter rolls to immigration data, states need more than names and birth dates. They need persistent identifiers that can link records across systems. The SAVE America Act encourages states to work with DHS and DMVs to create or access “golden records” and cross‑agency linking identifiers.

As we outlined in Part  4 of our series, DHS and states have already signed memoranda of understanding (MOUs) that let election officials query SAVE and DMV data in bulk. The technical paperwork describes linkage keys built from Social Security numbers, driver‑license numbers or other unique codes. Such keys make it easy to join disparate databases, but once they exist they can be used far beyond voter registration. The Department of Homeland Security has already proposed linking these records to facial images at DMVs and state agencies.

These cross‑system keys or persistent identifiers are quietly building a national identity layer. Voting systems do not need to see your face to confirm your citizenship. Yet the architecture increasingly allows them to. Those links can be reused for other purposes—from tracking immigration enforcement to matching protest footage to driver‑license photos. Once facial images and DMV records are linked to voter files, we leave election administration and enter the world of persistent person-tracking.

Our earlier report showed that this architecture already exists thanks to MOUs signed between DHS, the Social Security Administration and several states. The SAVE America Act would codify that infrastructure rather than building it from scratch.

Experts Warn the Infrastructure Is Unstable

Civil‑rights attorneys warn that the bill’s underlying technology threatens more than voting rights. After the Iowa purge, Rita Bettis Austen, legal director of the ACLU of Iowa, said that the program was an “unjustified, intimidating effort” that risked disenfranchising eligible voters.

National ACLU attorney Jonathan Topaz said the Iowa list targeted citizens and “created a real risk that those voters would be wrongfully denied their right to vote”. Election officials involved in pilot programs also noted that using SAVE at scale would produce many false matches and require manual adjudication, undermining the supposed efficiency of automated checks.

Even immigration analysts have raised alarms. They note that linkage fields designed for benefits management can be repurposed for surveillance. Once a person has a universal linking ID shared across agencies, it becomes trivial to aggregate travel records, DMV photos, health data and voting history. Such a system is ripe for abuse unless strict limits are imposed on data use and retention.

From a systems perspective, they’re describing the same failure mode Texas and South Carolina flagged in technical memos: a tool built for case‑by‑case checks behaves unpredictably when repurposed for bulk screenings inside election timelines.

From Election Law to Identity Records

For two decades, debates about voting have centered on ballots, access, and fraud prevention.

The SAVE America Act reframes the debate.

It does not simply adjust voting rules. It embeds voter eligibility into a broader identity verification architecture — one that links election systems to DMV databases, federal immigration records, and persistent identity keys that can outlive any single election cycle.

The question is no longer just:

Who is eligible to vote?

It becomes:

What permanent identity record is being built in the process of answering that question?

When voter verification requires interoperable identifiers, cross-agency matching, and photo-linked credentials, the scope expands beyond election law. It becomes a matter of how the state constructs, links, and retains identity records.

Infrastructure matters because infrastructure persists.
Election laws change.
Data systems endure.

That is the shift this bill represents.

References

American Civil Liberties Union of Iowa. (2026). Settlement agreement reached in ACLU, LULAC lawsuit over “potential noncitizens” voter list.

Texas Secretary of State filings (2025). SAVE system pilot testing documentation.

South Carolina election planning documents (2023). SAVE integration memoranda.

U.S. Department of Homeland Security. (n.d.). Systematic Alien Verification for Entitlements (SAVE) program.

U.S. House of Representatives. (2026). H.R. 1238 — SAVE America Act.

Analysis by Restoring Democracy’s Promise

Iowa lawmakers are considering HF2161, a bill intended to rein in Automated License Plate Readers (ALPRs). On its face, the bill is a step forward — and in a state that’s been moving fast on surveillance infrastructure, “a step forward” matters.

Iowa’s own ALPR transparency portals show at least 4,386,514 vehicle detections in a single month, averaging 10,177 detections per camera.

But here’s the core reality:

HF2161 mostly regulates local use. It does not fully regulate the system those cameras feed.

This analysis builds on our prior reporting on ALPR networks and upstream data flows in Iowa.

What HF2161 Gets Right

HF2161 does a few important things that should not be minimized:

• Local authorization: A local authority must approve ALPR use through an ordinance — not a wink-and-nod purchase order.

• Tighter access to stored data: Access beyond a short window requires a warrant or subpoena, with narrow exceptions.

• Audit trail: It requires logging of access/queries — basic accountability Iowa has needed for a long time.

• Some bright-line protections: It bars ALPR use for facial recognition and restricts placement in certain sensitive contexts.

These provisions reduce local misuse. That’s real progress.

Where the Gaps Remain

The biggest weaknesses aren’t philosophical — they’re structural.

1. Scope is still too narrow.

   If the bill doesn’t clearly cover state-level actors and upstream routing layers, you can end up regulating the street-level “camera operator” while leaving the true power nodes untouched.

2. “Don’t share” isn’t the same as “can’t replicate.”

   HF2161 includes language that restricts sharing, but the real problem is architectural:

   The proposed bill bans providing copies of plate images/data to third parties (including out of state), but it doesn’t explicitly prevent vendor-network replication or remote cross-jurisdiction querying that can recreate the same outcome through a different pathway.

   This is the difference between policy and system design.

3. Derivative use and parallel construction are still the elephant in the room.

   Even if a local agency “follows the rules,” ALPR-driven intelligence can still generate leads that get laundered through other channels — and later show up as “normal policing,” with the original surveillance trigger never disclosed.

   That’s not just a privacy issue. It’s a due-process issue.

4. The commercial/broker loophole remains wide open

   If government can obtain equivalent location intelligence through vendors and commercial pathways, state restrictions can be bypassed without technically “breaking” state law — while producing functionally identical surveillance outcomes.

Policy Recommendations

If lawmakers want this bill to actually protect Iowans in practice, amendments should:

• Expand scope to cover state-level agencies and upstream routing layers

• Explicitly address vendor-network replication and remote cross-jurisdiction querying (not just “providing copies”)

• Add enforceable data-sharing limits with meaningful audits and penalties

• Close the commercial data loophole

• Add due process protections around disclosure when ALPR-derived intelligence influences investigations

Lock the Door, Leave the Windows Open

HF2161's effort is a starting point. It signals that lawmakers recognize the privacy harms of indiscriminate plate scanning—and it adds guardrails that would meaningfully reduce local misuse.

But the bill, as written, still leaves key pathways unaddressed: upstream sharing, vendor-network federation, fusion-center laundering, derivative re-circulation, and commercial/broker bypasses.

In other words: it tightens the rules at the camera and the local database—while leaving too much of the broader data ecosystem structurally untouched.

That’s the conversation worth having now — before the architecture hardens and the gaps become permanent.

Share

Sources / Key texts

HF2161 (bill text)

Iowa Code §321P.4 (current ALPR retention law)

ACLU of Iowa / UI Tech Law Clinic ALPR report (Dec 2025)

On June 12, 2025, a senior federal immigration official quietly demonstrated a voter-verification system to a private political network.

The public was not invited. Voting-rights organizations were turned away. Congress would not be informed for weeks.

The system already existed. The law authorizing it did not.

The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.

What follows is not a theory. It is a documented sequence — drawn from court filings, whistleblower disclosures, internal agreements, and federal admissions — showing how a private political agenda crossed into public infrastructure, and how a system once designed to verify benefits was transformed into a national gatekeeper for citizenship itself.

Two SAVEs, One Cover Story

Why the SAVE Act debate hides the SAVE system already in use

Much of the public debate now unfolding in Congress treats the SAVE Act as the origin point of federal voter verification. It is not.

While Republicans push the stalled bill in Congress—a priority the House GOP that passed earlier this year and now sits contested in the Senate—a system with the same name is already running.

Since the spring of 2025, federal agencies have been expanding the Systematic Alien Verification for Entitlements (SAVE) program from a case-by-case immigration tool into a bulk screening pipeline—one capable of ingesting entire voter rolls, matching them against Social Security records, and flagging U.S.-born citizens for review for the first time.

That name collision matters. It creates a kind of institutional fog: search for “SAVE” and the public encounters a legislative fight in Congress, not a working database quietly processing state records. Whatever the intent, the effect is the same—the debate over the bill can obscure the system already in use.

Are you allowed to exist in the system today and without having to prove yourself again, in the databases that govern eligibility and participation?

This installment is the story of how that machine was accelerated into place: who got briefed early, who rewired the stack, and why the “verification” rationale doesn’t match the appetite of the agreements—bulk ingestion, unique identifiers, and the kind of identity data no election system needs to “check citizenship.”

Over the last year, that system has been retooled to do something unprecedented: ingest state records at scale and output a citizenship verdict for voting list data trimming. The name collision isn’t a coincidence—it’s camouflage. It turns every search into noise, while the machine keeps running.

The public didn’t learn any of this from a press conference. But one network got a walkthrough.

The Private Briefing

On June 12, 2025, U.S. Citizenship and Immigration Services (USCIS) officials held a briefing with the Election Integrity Network, a private voter-challenge organization run by activist Cleta Mitchell. The meeting, led by USCIS official David Jennings, is referenced in multiple federal court filings and was later the subject of a joint FOIA request seeking records of the briefing.

That session shows up in court filings and FOIA demands not because it was ceremonial, but because it functioned like a working handoff: here’s the machine; here’s how to use it; here’s what it will produce.

While DHS declined to provide comparable briefings to voting-rights organizations, the EIN session became a factual predicate in subsequent litigation challenging the expansion of the SAVE database.

The same network that spent years promoting mass voter challenges and disputing certified results is now positioned to influence—directly or indirectly—the federal systems used to “verify” citizenship at scale.

Jennings explained what the SAVE database could now do: bulk uploads, SSN matching, free access for states. The activists on the call had spent years trying to build exactly this capability outside the government. Now it was being handed to them from the inside.

No comparable briefing was offered to voting-rights organizations. No notice was sent to state election administrators, other than for Texas and Louisiana pilot programs. Congress would not be informed for another month.

The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.

Mitchell was not a neutral election lawyer who happened to be interested in list maintenance. She was on the January 2, 2021 call where Trump pressed Georgia’s Secretary of State to “find” enough votes to overturn the result — a role that forced her resignation from her law firm.

In the years that followed, she helped build a national “election integrity” network that trained Trump supporters to challenge voters and worked to dismantle existing safeguards like the ERIC interstate data‑sharing compact.

By June 2025, the same ecosystem that had tried to overturn the 2020 election from the outside was being invited inside the federal government’s new citizenship‑verification machine and given a private briefing on how to use it at scale.

The Rewrite (When SAVE Quietly Changed Scope)

In early 2025, USCIS did not announce a new voter-screening system. It updated a fact sheet.

That sounds small—until you compare what the agency said before the upgrade to what it said after.

For most of its existence, SAVE was not designed to verify the citizenship of U.S.-born citizens. It was a case-by-case immigration verification tool—built to confirm eligibility for benefits using identifiers that already existed inside DHS systems.

Then, in the spring of 2025, that constraint vanished. And you can see the shift in USCIS’s own language.

Between March and May, DHS quietly re-engineered SAVE from a pull-based verification service into a push-based ingestion system. Instead of asking questions one person at a time, states were enabled to upload entire voter rolls at once—millions of records in a single batch—allowing the federal system to run automated citizenship checks across whole populations.

This was not a policy change. It was an architectural one.

From Lookup Tool to Intake Pipeline

Under the original SAVE model, verification required identifiers that already existed inside DHS systems—such as an Alien Registration Number or a naturalization certificate number. That design ensured SAVE only touched people who had already interacted with the immigration system.

The overhaul removed the boundary.

Under the new configuration, SAVE accepts Social Security numbers (including partial SSNs), names, and dates of birth. That shift brought a new population into scope for the first time: U.S.-born citizens who have never had an immigration file at all.

Once voter rolls are uploaded, SAVE does not simply answer yes or no. It performs matching across federal datasets and returns flags and status indicators that states are expected to act on—often within strict time windows.

For immigrants, the system includes a safety valve: the "Institute Additional Verification" process that triggers human review when automated checks fail. For U.S. citizens queried through the SSN pathway, that valve was removed. If the automated check fails, the case closes with no escalation. A clerical error at SSA becomes an automatic non-confirmation — with no human ever seeing it.

This is how a verification tool becomes a screening engine.

The system didn’t need Congress to exist. It needed an access channel—and someone willing to implement it.

The paper trail is now public—if you know where to look. And once states refused the handoff, the federal government tried to take the data through the courts.

The Compliance Pretext

Publicly, the Department of Justice frames these demands as routine compliance: a standard request to enforce voter list maintenance and ensure states follow federal recordkeeping rules. In that story, the lawsuits are housekeeping—transparency, integrity, compliance.

But the record describes something else: a system rebuilt for scale, then defended as if scale has no constitutional consequences.

In United States v. Weber, Judge David O. Carter did not treat the federal demand for sensitive voter file fields as ordinary. In his dismissal order, he warned that democracy is not lost all at once, but “chipped away… piece-by-piece,” and described the case as one of those cuts that “imperils all Americans.” He also emphasized that privacy erosion and voting-rights restrictions belong in public legislative debate—not unilateral executive action.

He went further. The court criticized the DOJ for obscuring its real purpose, rejecting “pretextual” explanations that conflict with what the government has said outside the courtroom. The opinion describes a nationwide push to centralize sensitive voter data—an approach the court tied to chilling effects on registration and turnout.

In the hearing itself, California’s Deputy Attorney General Malcolm Brudigam put the stakes in plain language—warning that the action should “make the stomach of every American turn,” because the federal government was moving “state by state” and “vacuuming up” voter registration data at an unprecedented scale.

That split is the point of this chapter. What DOJ describes as compliance looks, in operation, like acquisition—built to scale, normalized through litigation, and defended as if privacy harms are collateral. Once the system exists and the data starts moving, everything downstream stops being hypothetical. It becomes workflow—who gets flagged, who gets reviewed, who gets removed, and who never learns why.

What they claim: law enforcement of voter list rules.

What the record shows: a nationwide acquisition project—normalized through litigation, and defended as if privacy harms are collateral.

That is the access channel.

The Access Channel

From Administrative Integration to Legislative Backfill

Once SAVE crossed the threshold from a case-by-case lookup tool to a system capable of intake at scale, the central question was no longer technical. It was administrative: who could access it, under what conditions, and with what assumptions of authority.

This is where the story shifts from architecture to governance.

SAVE’s expansion did not arrive through a single statute or public vote. It arrived through integration—via guidance, training materials, interagency coordination, and the quiet normalization of new workflows. Access did not require a declaration that the system had changed. It required only that agencies be told how to use it.

That process has a name in modern public administration: efficiency.

Across federal and state agencies, “efficiency” functions as a delivery language. It justifies consolidation, accelerates deployment, and reframes structural change as technical improvement. In this case, it provided the rationale for connecting systems, broadening identifiers, and onboarding new users without pausing for explicit legislative authorization.

This is where DOGE enters the picture—not as a policy originator, but as a mechanism. The newly created Department of Government Efficiency’s (DOGE) role is procedural: streamline, modernize, standardize. But when applied to a system that touches voting infrastructure and citizenship status, that procedural framing carries substantive consequences. It changes sequencing. Instead of authorize, build, then audit, the order becomes build, deploy, normalize and then backfill oversight.

Notably, this expansion did not follow new authorizing legislation. By the time Congress began debating the SAVE Act, the underlying verification infrastructure was already in use—and already being introduced to outside stakeholders. When systems go live before laws do, power migrates quietly—from legislatures to administrators.

It is against this backdrop that the SAVE Act enters the narrative. And while Congress argued over statutory cover, DOGE marketed the system as a finished product.

Here’s how the system was sold publicly — and why marketing doesn’t equal legal authority.

DOGE’s public messaging frames SAVE as settled infrastructure: free, scalable, and already delivering results. In that framing, readiness is treated as permission.

But public marketing does not resolve legal exposure. Once states transmit sensitive identifiers—driver’s license numbers, partial Social Security numbers, full voter-file join keys—the risk does not remain federal. It transfers.

Some states behaved as though that distinction mattered. Others treated availability as permission. That divergence is not ideological—it is procedural.

Kentucky shows what that divergence looks like when a state pauses at the access boundary.

Kentucky: Waiting for Legal Cover

Kentucky’s posture is revealing not because it is resistant, but because it stops at the access channel. Officials did not reject cooperation outright. They limited it—providing non-sensitive fields while withholding the identifiers that make bulk matching workable.

That distinction matters. It shows that some states do not treat the existence of the SAVE system as sufficient authorization to feed it.

In Kentucky, the naming collision becomes useful. SAVE the database is already live. SAVE the Act is still being debated. And until that ambiguity is resolved, state officials are forced to decide whether “system ready” equals “authority.”

That gap—between what exists and what is authorized—is the fog.

Kentucky’s hesitation highlights a deeper sequencing problem that appears throughout this investigation. Infrastructure was built. Access pathways were established. Training and coordination followed.

Only afterward did Congress begin debating whether—and how—to authorize what was already implemented.

This is the same sequencing pattern described earlier: implementation first, authorization later. When that order is reversed, discretion fills the gap—and discretion doesn’t live in law. It lives in people.

The Personnel Pipeline: The Human API

Administrative systems don’t run on statutes. They run on people—and the fastest way to change a system’s real-world behavior is to place the right people at the routing points where policy becomes workflow.

This is where the story narrows from infrastructure to staffing.

If the architecture shift made SAVE scalable, the personnel pipeline determines how that capacity is framed, operationalized, and justified inside government. The key transition is not “outsiders influencing government.” It is a movement learning to staff government.

This is why appointments matter even when they’re procedurally normal. A title is not a headline. A title is a permission structure: it defines who sits in which meetings, who sees which briefs, who signs which memos, who controls which implementation timelines.

One of Mitchell’s closest collaborators in that post‑2020 ecosystem, Pennsylvania activist Heather Honey—whose public claims about the 2020 election and ERIC were amplified across right-wing media and used to justify “Stop the Steal” narratives—would soon be listed on an internal DHS org chart as the department’s Deputy Assistant Secretary for Election Integrity.

Because this function sits where “data outputs” become “administrative action,” it’s less a messaging desk than a conversion layer—turning flags, lists, and guidance into enforceable routines. This isn’t a claim that any single appointee controls the system. It’s a description of how staffing decisions change what gets prioritized, measured, and implemented.

In DHS materials dated August 18, 2025, Honey is listed as Deputy Assistant Secretary of Election Integrity under Office of Strategy, Policy and Plans, placing “Election Integrity” inside the department’s formal administrative chain.

On paper, that chart is just a diagram. In practice, it shows something more consequential: “Election Integrity” is not merely a political slogan or an outside pressure campaign. It is a named administrative lane inside DHS.

This is the institutional hinge. Not character assassination. Governance mechanics.

The significance is not that any one person is uniquely powerful. It is that the pathway exists—and once a pathway exists, it attracts coordination, deference, and momentum. The meeting described in the previous section becomes legible only in this light: the system’s builders created scale; the access channel created availability; and the personnel pipeline created the conditions for normalized use.

Staffing is the accelerant — but it is not the system itself.

Once access is granted and pathways are normalized, the real work begins elsewhere: in the data layer, where records move faster than statutes and oversight arrives last. That infrastructure has a name, even if it rarely appears in public.

The Shadow Database

How the Data Actually Got There

At this point, the question is no longer whether SAVE expanded—but whether the data it relies on was ever lawfully obtained.

In Part IV of this series, we documented what the system does: bulk uploads, 45-day purge clocks, the confidential MOU that turns federal flags into state-level removals. But it left a question unanswered.

Where did the data come from?

The official story is straightforward: DHS signed a data-sharing agreement with the Social Security Administration. States upload voter rolls. SAVE queries SSA records. Citizenship status comes back.

That story is incomplete.

Whistleblower disclosures to the Senate Homeland Security and Governmental Affairs Committee reveal that the data powering SAVE’s new capabilities did not travel through normal interagency channels. Before any formal agreement existed, DOGE personnel — including Edward Coristine and others identified in Senate testimony — created a “live copy” of the Numident file — the master database containing the Social Security numbers, birthplaces, and parents’ names of every American — and placed it in an unmonitored cloud environment.

The SSA’s Chief Information Security Officer explicitly warned that “standard policy prohibits the use of production data in development environments” due to “reduced control measures and oversight.”

The Warning That Was Ignored

The SSA's career cybersecurity officials did more than warn. They quantified the danger.

On June 12, 2025 — the same day USCIS briefed the Election Integrity Network on SAVE's new capabilities — SSA's Office of the Chief Information Officer generated a formal Risk Acceptance Request Form for the cloud environment DOGE was demanding.

The form used the agency's standard five-point risk matrix:

Impact: 5 out of 5 — "Catastrophic."

The assessment noted that unauthorized access would result in "catastrophic damage to or loss of agency facilities and infrastructure" and widespread compromise of personally identifiable information.

Likelihood: 3 out of 5.

In SSA's framework, that score corresponds to a statistical probability between 35 and 65 percent.

The total risk score: 15

The agency's designation for "Very High."

The whistleblower complaint specifies what "catastrophic" meant in practice. The environment contained live production data — names, Social Security numbers, birthdates, parents' names — for between 300 and 450 million Americans. If breached, the complaint states, "the government may be responsible for re-issuing every American a new Social Security Number at great cost.”

Put simply: the system now determining citizenship status for voting was built on a copy of America’s most sensitive population database, moved without proper authorization, and knowingly placed in an environment rated “very high risk” by its own custodians.

Because the environment lacked an Authority to Operate and was self-administered by DOGE appointees, the agency had no audit trail. They would not know if the data was stolen.

Four days later, on June 16, SSA Acting Chief Information Security Officer Joe Cunningham emailed DOGE appointee Aram Moghaddassi directly:

"Most security exposures and breaches occur within development environments due to reduced control measures... our standard policy prohibits the use of production data.”

One month later, on July 15, Moghaddassi signed the authorization anyway:

"I have determined the business need is higher than the security risk... and I accept all risks associated with this implementation.” He signed his name to a coin-flip chance of catastrophic breach — and the system went live.

This is not negligence discovered after the fact. It is negligence documented in advance, calculated to two significant figures, and formally accepted in writing.

The same database that now determines whether you can vote sits in an environment whose own risk assessment gave it a coin-flip chance of catastrophic breach — and someone signed their name to accept those odds.

One whistleblower reported that Numident data subsequently appeared at DHS in an “unusual format” — a detail suggesting the transfer bypassed the secure protocols that normally govern interagency data sharing. A 19-year-old staffer who had previously been terminated for leaking data was granted administrator access to the environment without SSA supervision.

The voter verification system running today queries data that its own custodians gave even odds of catastrophic compromise. That is the foundation the Golden Record rests on.

Documentation note:

All Pillar Investigations are free to read. If you want release alerts and access to the supporting document archive, subscribe here.

Full fact sheets, court filings, FOIA responses, and source PDFs cited in this section are preserved in the RDP Evidence Vault for subscribers who want to review primary materials directly.

The Cache, Not the Query

The technical architecture confirms what the whistleblowers described.

Under the old SAVE model, verification worked like a library lookup: a clerk submitted a query, SSA’s mainframe returned an answer, the transaction ended. The system touched records one at a time. It did not retain them.

The overhauled system operates differently. The Person Centric Entity Resolution (PCER) microservice — the engine behind SAVE’s new bulk capabilities — does not query SSA in real time. It queries a cached copy.

DHS technical documents describe PCER as a system that “caches and consolidates” data from source systems, then resolves identity fragments into a single persistent profile: the “Golden Record.” That record is stored in the DHS cloud infrastructure (AWS GovCloud), where it can be matched against incoming voter rolls at scale.

The infrastructure runs on a $279 million contract awarded to IBM, known internally as FALCON — the procurement vehicle that funded the Person Centric Entity Resolution engine now powering bulk verification.

This is the architectural shift that made bulk processing possible. SAVE is no longer asking SSA a question. It is querying a copy of SSA’s answers — a copy that was initially populated, according to whistleblower accounts, through the irregular data dump DOGE personnel created to bypass legacy constraints.

Retroactive Authorization

The government attempted to legitimize this arrangement months after the data began flowing.

The timeline is documented:

• April 2025: DHS and DOGE announce the SAVE overhaul. Fees are eliminated. Bulk upload is enabled.

• May 15, 2025: A secret “Letter Agreement” is signed between DHS, USCIS, and SSA — retroactively authorizing the matching of voter rolls against Numident records.

• October 31, 2025: The legally required System of Records Notice is finally published — five months after the system went live.

For five months, SAVE operated in a legal gray zone: processing U.S. citizens, ingesting SSA data, and building golden records without the public notice the Privacy Act requires.

Extraordinary Risk

The Senate Committee report does not mince words. It calls for the “immediate shutdown” of the new cloud environment at SSA that contains the Numident data, citing an “extraordinary risk” of data exfiltration by private actors or foreign adversaries.

That risk is not hypothetical. The same database that determines whether you can vote now sits in an environment that was built to circumvent oversight, staffed by personnel who lacked appropriate clearances, and authorized only after the fact.

This is not a procedural footnote. It is the foundation the system rests on.

Part IV showed the downstream machinery: the MOUs, the purge clocks, the states under pressure to “clean” their rolls. This section shows what sits upstream: a shadow database, an irregular transfer, and a retroactive paper trail designed to legitimize what had already been built.

If the data's provenance is irregular, every output derived from it inherits that irregularity. A voter flagged by a system built on an unauthorized data transfer has grounds to challenge not just the flag — but the foundation.

The question is no longer whether the system exists. It is whether anyone authorized it to exist — and whether the data it runs on was ever secure.

From Output to Outcome

How Scale Turns Errors into Consequences

The consequences of scale are not abstract. They’re procedural. They show up as letters, deadlines, and “cure windows” that convert database outputs into life disruptions.

Under a case-by-case model, errors are annoying but containable. A clerk notices a discrepancy, makes a phone call, resolves it before anything happens. Under a bulk model, errors become structural — produced at volume, processed on a clock, and routed into administrative action before anyone reviews them.

A bulk matching system doesn’t “discover truth.” It produces categories: match, mismatch, further review. Those outputs feed downstream workflows with fixed timelines. And because election administration runs on calendars, the burden shifts onto the individual to prove the machine is wrong — frequently on short notice.

This is where the mismatch becomes the event.

Name changes. Data entry variations. Naturalization delays that haven’t propagated to SSA. Partial SSN collisions. All of it becomes consequential — not because the system is uniquely malicious, but because the workflow is unforgiving. At scale, even a modest error rate becomes a pipeline of false flags. And those false flags do not remain in the database. They become notices, challenges, removals, or bureaucratic limbo.

Part IV documented the 45-day “clean” mandate. This is what that mandate looks like in practice: a mismatch flag, generated by an algorithm querying cached data of uncertain provenance, triggering a countdown that ends in removal unless the voter can prove the machine wrong.

The system doesn’t need to be malicious to cause harm. It only needs to be fast, opaque, and indifferent to its own error rate.

The rollout did not unfold as a cautious pilot. Adoption-window data shows states integrating in bursts — clustered around DOJ pressure campaigns, not around readiness assessments. The system scaled before the safeguards did.

But even this understates what was built.

The public debate has focused on voters — adults, registrations, rolls. That focus assumes a boundary: that the system activates when you turn eighteen and register. That the surveillance begins at civic adulthood.

The architecture tells a different story. Errors at scale are one failure mode. But the system's appetite extends beyond names and numbers.

When “Verification” Asks for Your Face

Citizenship is a legal status. You can verify it with biographical records — name, date of birth, Social Security data, naturalization documentation. You do not need a face.

That’s why the most revealing signal in this buildout isn’t a policy memo. It’s the data they demand. When a “voter verification” pipeline requests driver’s license numbers — and the infrastructure to resolve them — it stops looking like eligibility checking. It starts looking like identity ingestion.

From Iowa’s Settlement to a National Template

Part III of our series showed how Iowa and three other states signed a settlement committing to give DHS “full use” of their driver’s license records through Nlets, the law‑enforcement backbone that already moves photos during traffic stops and warrants. That language was not a drafting accident. It was the prototype: once “full use” exists in one settlement, it can be copied, pressured, and litigated into others.​

Part IV traced how DOJ’s confidential MOU overlaid that template onto the rest of the map — demanding unredacted voter files that include driver’s license numbers, and suing states that refused.

Your driver’s license number connects your voter registration to your full DMV file — photograph, signature, address history, and in many states, the biometric template used for facial‑recognition matching. The MOU’s insistence on driver’s license numbers is not about verifying that you exist. It is about acquiring the key that unlocks everything else.​

DHS’s revised SAVE notice completes the circuit. It explicitly authorizes using those identifiers to “validate information against NLETS” and to reach “other government enumerators” — bureaucratic shorthand for querying external systems, including DMV repositories, once the join‑key is in hand. At that point, the voter file is the intake. The DMV vault is the destination.​

What Changes When the System Can See Your Face

SAVE already supports photo‑based identity confirmation as a built‑in feature. The Person Centric Identity Services architecture behind it is designed to fuse biographic and biometric data into a single “Golden Record” that persists across checks. Once states provide driver’s license numbers — by settlement, MOU, or court order — the federal engine holds the key to attach a face to every name it ingests.

The “verification” frame collapses under that weight. Photos are not about citizenship. You cannot be more or less American based on your bone structure. Photographs are about building a biometric‑ready identity layer — one that can be queried, matched, and repurposed far beyond the narrow question of who is eligible to vote.

That is the quiet shift Parts III and IV were pointing toward. The same pipeline that now checks your name against SSA and SAVE can, with the same join‑key, see your DMV portrait, your signature image, your address trail — and fold them into a permanent identity model.

Once a system can ingest faces alongside names and Social Security numbers at nationwide scale, the question is no longer whether it works. It is who controls it, who gets to query it, and what the next administration does with it when the machinery is already humming and normalized.

The Golden Record: Surveillance Without a Birthday

For months, the public defense of this system has rested on a single, comforting premise: “It’s just about protecting the vote.”

That defense assumes the system only looks at adults. Because you have to be 18 to vote, we imagine the machinery of “election integrity” activates on your eighteenth birthday — not before.

That assumption is wrong.

The technical shift to SSN4 didn’t just make the system faster. It made it universal.

When DHS and DOGE rewired SAVE to query the Social Security Administration’s Numident file, they stopped checking a list of immigrants. They started querying the master registry of the American population.

The Numident is not a voter roll. It is not a list of drivers. It is a list of every human being who has ever been assigned a Social Security Number.

And you don’t get an SSN when you register to vote.

You get it when you are born.

By linking the verification engine to the Numident, the architects removed the floor from the surveillance architecture. The “Golden Record” — the persistent digital profile that follows you across federal systems — is no longer created when you enter civic life. It is created in the maternity ward.

DHS technical documentation confirms the design. The Person Centric Identity Services (PCIS) system builds profiles for “all persons” it encounters, regardless of age. Children applying for CHIP. Minors processed through naturalization. Seventeen-year-olds who pre-register to vote in states that allow it. All are ingested. All are resolved into the Identity Index.

The “continuous vetting” mandate is explicit: records created for children “can be related to their adult records later.”

This is not a voter-verification system with incidental data collection. It is a longitudinal surveillance architecture — one that begins writing your file before you can walk and never stops updating it.

The infrastructure doesn’t care about your age. It cares about status resolution.

The same system that flags a naturalized citizen for removal in Pennsylvania is capable of indexing a newborn in Iowa. The same “Golden Record” logic that decides whether you can vote at 30 was initialized when your parents filled out the paperwork in the hospital.

We are no longer discussing a system that verifies voters.

We are discussing a system that logs Americans — from birth.

Mismatches Become Life Events

This installment documented the architecture: who built it, how they wired it, where the data came from, and what it’s capable of reaching.

But architecture is abstraction. The system doesn’t flag “records.” It flags people.

The finale follows what happens when the pipeline meets a person: the naturalized citizen whose SSA file still says “legal alien” five years after the oath. The county clerk with 10,000 flags and a 45-day window. The seventeen-year-old whose citizenship was queried before she could vote.

At small volumes, mismatches are clerical errors — annoying, correctable, forgettable.

At scale, mismatches become governance. Under deadline pressure, mismatches become life events.

Once citizenship verification becomes a cached, biometric-capable intake system, rollback is no longer a policy choice. It’s an infrastructure problem.

This infrastructure will outlast the people who built it. The Golden Record doesn’t expire. The cache doesn’t reset. The join-keys linking your vote to your face don’t delete themselves when administrations change.

Whoever satisfies the next election will inherit a machine that can query the citizenship status of every American, cross-reference it with biometric data, and act on the results — without asking Congress, without notifying you, and without any structural limit on what it’s used for next.

The machine is running. Part VI shows who it finds.

Share

References

American Civil Liberties Union. (2025). Freedom of Information Act request regarding SAVE system modifications and interagency data sharing.

Bower v. Social Security Administration, Complaint, No. 1:25-cv-2713 (D.D.C. 2025).

Common Cause. (2025). Motion to intervene regarding DHS voter verification practices.

Department of Homeland Security. (2025). System of Records Notice: SAVE Verification System. Federal Register.

Department of Justice. (2025). Correspondence and filings regarding state voter-roll data requests.

League of Women Voters v. U.S. Department of Homeland Security, Complaint and Preliminary Injunction Memorandum, No. ___ (D.D.C. 2025).

Padilla, A., Peters, G., & Merkley, J. (2025). Letter to the Secretary of Homeland Security regarding SAVE system briefings and data access.

U.S. Citizenship and Immigration Services. (2025). SAVE voter registration and voter list maintenance fact sheet (archived versions).

U.S. Social Security Administration. (2025). Numident data governance and security policies.

Whistleblower disclosure to Senate Committee on Homeland Security and Governmental Affairs. (2025).

Introduction: The Shield Wall of Evidence

Welcome to the Evidence Locker for our Pillar Investigation, The Department of Governance by Algorithm. This is part 5 of 6 in our Warrantless Surveillance Series. In the spirit of full transparency, we are making …

Read more

Read more

If you care about voting rights, privacy, or due process—share this with one local election official.

Share

TL;DR

Full reference list and primary documents are in the paid subscriber Evidence Vault.

• DOJ is asking states for full, unredacted statewide voter rolls—including driver’s license numbers and SSN4s—under a “confidential” MOU.

• The agreement imposes a 45 day compliance clock: if DOJ flags “anomalies,” states are pressured to “clean the rolls” fast.

• This isn’t just “election integrity.” It’s building a national verification pipeline—a system that can link identity + eligibility at scale.

• False flags are predictable when databases lag (naturalization updates, NUMIDENT timing, name mismatches): deadlines turn errors into purges.

• Iowa wasn’t an outlier—it reads like a pilot run for a scalable national permission layer.

• If you are naturalized, have changed your name, or have ever had a mismatch in SSA records, verify your voter registration status now—and document any “unable to verify” notices.

Table of Contents

1. The Offer: A “Confidential” Deal With a Deadline

2. The Network: The States in the Verification Grid

3. The Contract Engine: What the MOU Actually Demands

4. The Scale: From Lookup Tool to Infrastructure. Update (Feb. 20, 2026): An interactive exhibit mapping the contract and funding architecture has been added below.

5. The Skeleton Key: Bulk Upload + SSN4

6. The Data Trap: NUMIDENT Lag and Manufactured “Anomalies”

7. The Switchboard: The Machine Behind the Screen

8. Permanence Without Consent: The Records Don’t Roll Back

9. What This Builds: A Permission Layer for Civic Life

On a damp February morning, Lorenzo Gutierrez Lugo steered his black Dodge pickup south toward Brownsville, Texas. A Mexican-American trucker hauling clothing and furniture for a small transport company, he expected a routine drive—until a local cruiser pulled him over for 50 in a 45.

The real reason wasn’t on the roadside. Records show federal systems had already flagged his route as “suspicious.” Agents searched his truck, found only cash payments from customers, and arrested him anyway—accusing him of money laundering. They found no contraband. Charges were later dropped. His employer spent $20,000 on legal fees to clear his name.

That is what happens when sensitive personal data fuels a federal machine: a “flag” becomes a fact. And it’s the same kind of data the Justice Department is now seeking from state voter registration lists.

The same federal agencies that monitored Lugo’s license plate are demanding unredacted voter rolls from dozens of states. A confidential memorandum of understanding (MOU) spells out how states must hand over full voter lists—including driver’s-license and partial Social Security numbers—and “clean” the lists within 45 days. Although the Justice Department labeled the MOU confidential, a federal judge ordered the hearing transcript discussing it released to the public; the agreement is now part of public court exhibits accessible on PACER. This contrast between claimed secrecy and public availability underscores the high stakes at the outset.

DOJ’s stated rationale:

• DOJ argues it has a statutory role enforcing NVRA/HAVA list-maintenance compliance and needs access to statewide records to test accuracy.

• They say the MOU is meant to protect data during transfer/use and to standardize security procedures.

• DOJ frames the timeline as operational urgency—time-bound compliance and responsiveness to anomalies.

• DOJ frames the effort as election‑integrity enforcement and warns non‑compliant states they will be taken to court.

The counterargument from states/critics:

• States argue the request goes beyond what’s necessary and risks exposing sensitive identifiers (DL numbers, SSN4).

• Critics warn “anomalies” can reflect database latency or matching errors—deadlines can turn false positives into removals.

• “Confidential” terms reduce transparency and public oversight for a system that touches voting rights.

• Critics warn that the demanded identifiers aren’t “just voter rolls.” They are join-keys that can be linked across systems—sometimes all the way back to state ID records, including the photo on your driver’s license.

Both claims can be true at once: list maintenance is real—and a system designed for auditing can still function as a scalable eligibility gate if the data is centralized, time-pressured, and automated.

The States’ Offer

The clock starts the moment a state signs DOJ’s confidential SAVE MOU: 45 days and counting. That is how long election officials have to “resolve” every anomaly a federal database flags—names that don’t match, codes it doesn’t like, voters the system doesn’t recognize.

Miss the deadline and the state is out of compliance; meet it, and someone is struck from the rolls.

The first test of the MOU’s ultimatum came on Dec. 1, 2025. At 11:34 a.m., DOJ trial attorney Eric Neff sent Colorado officials a “confidential” contract with a 24‑hour deadline.

Neff did not ask for a meeting; he attached the draft MOU and demanded a reply by end of business the next day. The email offered a binary choice to avoid a federal lawsuit: surrender the state's unredacted voter roll and agree to "clean" the list within "forty-five (45) days" of any federal notice.

Neff promised the agreement would “cure all potential concerns,” then warned he doubted it would satisfy the state’s “various concerns” and asked for a quick decision: accept the MOU or prepare for litigation.

But the attachment doesn’t cure concerns. It codifies them.

Section XII.F goes further: it labels the entire agreement—and even preliminary communications—“confidential.” This wasn’t written for public debate.

The cost of that secrecy is surrender.

Under the MOU, states must hand over their entire statewide voter database, including driver’s‑license numbers and the last four digits of Social Security numbers (SSN4).

The federal government runs that file through its own verification engine called SAVE. If DOJ flags “issues… anomalies… or concerns,” Section VIII gives states just 45 days to remove “ineligible” voters.

Attorney General Pam Bondi framed list maintenance as essential to “free and fair elections,” warning that states that fail to provide accurate statewide voter lists “will see this Department of Justice in court.”

Critics don’t dispute the goal of accurate rolls. The fight is over the mechanism: bulk identifiers, a compressed deadline, and a system states can’t fully audit.

Forty-five days is an administrative cycle; for a voter correcting federal records, it’s a trap. The MOU turns the presumption of eligibility into a countdown to erasure.

This isn’t election "integrity"—it’s a federal permission layer built by contract, enforced by litigation, and executed by systems states can’t audit.

The Colorado MOU shows the mechanism in plain text: secrecy, mass data transfer, and a timed “clean” mandate enforced on DOJ’s terms.

This is not just about who gets a ballot. The same identity spine that can mark you as an “anomaly” in the voter file is wired, through Routine Use 50, into Treasury’s Do Not Pay system. The same system that can stop you at the polling place can also freeze a tax refund, block a Social Security payment, or hold up disaster relief. In this design, election integrity, eligibility for work, and access to money all hang from the same kill switch.

Colorado said no. Iowa said yes.

Colorado balked at DOJ’s terms. Iowa embraced Executive Order 15, reclassifying professional licenses as “public benefits” so they could be conditioned on federal clearance. That compliance didn’t just solve an immigration scandal—it proved the model. Once Iowa showed it could wire E‑Verify and SAVE into licensing and hiring decisions, DOJ packaged the same approach into the “confidential” MOU now sitting on desks in 26 other states.

Iowa as Proof of Concept

Iowa is not an outlier. It is the prototype.

As Part III showed, what happened here wasn’t a freak event—or a uniquely reckless governor—or a state that “went too far.” It was something quieter and more dangerous: administrative alignment. Iowa moved early into a system that was already designed, funded, and waiting.

That’s why this story does not stay in Iowa. The same tools, the same data fields, the same vendor stack, and the same federal interfaces now showing up here are already being adopted—quietly, unevenly, and often without public debate—in other states. Not because voters demanded it or because illegal voting is widespread, but because it fits—legally and operationally—into an expanding federal permission system for civic life. That architecture is built on SAVE.

For decades, SAVE — the Systematic Alien Verification for Entitlements — was sold as a narrow eligibility checker. A bounded system for a specific purpose: verifying immigration or citizenship status only when an agency had to make a benefits decision.

As detailed in Part III, Congress authorized this system in 1986 strictly to gate welfare access for non-citizens—never envisioning it would evolve into a permission layer for the American electorate. Transactional. Targeted. Politically containable. That’s the public story.

What exists now is different in kind, not just degree. Today, SAVE functions as something far more consequential: a digital eligibility backbone—an API-based permission layer that other systems can call to decide who gets cleared, who gets flagged, and who gets denied. When a “verifier” becomes infrastructure, it stops being a tool. It becomes a gate.

Verifiers don’t govern. Permission layers do

A verifier is supposed to answer a narrow question at a single moment: Does this record match what we need right now? If it’s wrong, the error is localized.

When did a benefits verifier become something that can gate a license, a job, or a ballot—and who authorized that expansion?

This is not semantics. It’s the danger. A database is passive; it waits for a question. A permissions layer is active; it sits between you and everything that matters.

Once SAVE is wired in as a dependency, the question is no longer “is this record correct?” but “did the system clear you?” Everything else becomes an implementation detail.

What a permission layer can decide:

• Renew or suspend driver’s licenses.

• Provide or deny benefits and services.

• Grant or deny professional licenses (nursing, teaching, medicine — treated as benefits rather than earned credentials).

• Determine eligibility for voter registration and continued enrollment.

• Trigger downstream “integrity” checks that can delay or block routine transactions.

The public rarely sees why these decisions are made. There is no visible rationale — just a drop‑down menu, a status code, a “could not verify.”

In a democracy, eligibility is a policy choice; in an administrative state, it becomes a software dependency. Once policy is recoded as a dependency, the machine stops asking permission. That quiet, technical shift is what changes everything.

Iowa Matters Because it’s Compatible — Not Because it’s Extreme.

This is where Iowa becomes instructive. Not because it is uniquely anything, but because it proved the model can be operationalized quickly when a state is willing to align its systems, fields, and timelines to federal demands.

Iowa didn’t invent the machine. Iowa showed the machine can run. Once it runs in one state, the next steps are simple: replicate, scale, and enforce.

That is what the “Confidential MOU” represents—and why the lawsuits matter. They are not isolated fights. They are the mechanism for building a national system out of fifty separate election administrations. Put differently: Iowa is not the exception that proves the rule; it is the proof of concept that becomes the rule once Washington decides to stamp it onto every state.

From Iowa to National Standard

This isn’t how a democracy is openly rewritten. It’s how an administration is quietly re-architected.

What looked like a discrete state‑level decision in Iowa was actually the first visible node in a coordinated federal campaign to convert the SAVE database from a passive immigration tool into a proactive national voter‑clearance engine. The evidence for that coordination is no longer theoretical; it is written in court transcripts, federal press releases, and the text of confidential contracts state officials never expected the public to see.

The Network: Twenty-six States and the “Confidential” Pact

The scope of this network is now a matter of record because DOJ was forced to name names in federal court. On December 4, 2025, during a hearing in United States v. Weber, DOJ Trial Attorney Eric Neff identified the states that had accepted the federal terms.

• The Confidential Pact: South Carolina, Nebraska, Montana, Mississippi, Missouri, Alabama, Texas, Virginia, Utah, Tennessee, and South Dakota.

• The Voluntary Compliers: Wyoming, Kansas, Indiana, and Arkansas.

• The Settlement States: Iowa, Florida, Indiana and Ohio.

Add legacy SAVE‑heavy states such as Arizona and Georgia, and the total matches USCIS’s November figure: twenty‑six states now integrated into a federal verification grid.

Subscribe for Free:

Join the Mission

This is what federalization looks like in practice: integration by paperwork, expansion by litigation. More than half the country has effectively nationalized its voter‑verification process, bypassing state legislatures to link local rolls directly to a federal enforcement engine.

The Mechanism: A “Confidential” Contract

The instrument of this realignment is not a law passed by Congress; it is a private contract. The “Confidential Memorandum of Understanding” offered to states like Colorado lays out the terms.

Section XII.F declares the MOU and all related communications “confidential,” shielding the transfer of power from public scrutiny. Section VIII imposes a “clean” mandate: once DOJ reports “anomalies,” the state “will clean its VRL/Data by removing ineligible voters” within forty‑five (45) days.

This clause federalizes voter-list maintenance. When algorithms in Washington flag a voter in Iowa or Texas, local officials are contractually bound to act. The state is no longer the arbiter of eligibility; it is the executioner on a federal clock.

The Ultimatum: Compliance or Litigation

The Colorado ultimatum shows the contract’s posture: comply fast or litigate. What matters next is what the contract does once the file is ingested.

The message to the states was binary: voluntarily feed the federal machine, or be ordered to do so by a judge.

That escalation matters because systems at this scale do not get built to answer a few clerks’ questions. They get built to run constantly, at population scale. To understand what that means, you have to stop thinking in terms of “checks” and start thinking in terms of throughput. What happens when a benefits‑era tool is rebuilt to process entire voter rolls on deadline?​

The answer shows up in the only place systems cannot hide: volume.

The Result: Industrial Scale Verification

For years, SAVE was a low‑volume system for specific benefit applications. In all of 2024, it processed about 25 million queries. By October 2025, after “optimization” for bulk voter checks, that number had exploded to 205 million.

Update (February 20, 2026): Part IV documents the scale of the verification system.

What it did not examine in detail is the funding architecture that makes that scale possible.

The interactive exhibit below maps the contract stack and funding pathways behind the architecture described here.

Figure 2 shows the scale; now we need the mechanism that makes that scale possible. A system doesn’t jump from “case-by-case verification” to large-scale throughput because states suddenly got curious—it jumps when the inputs and matching rules are redesigned for volume.

That’s what bulk upload and the SSN4 quietly accomplish: they collapse the distance between a targeted benefits check and a population-wide identity sweep. Once you can feed whole lists into SAVE and anchor matches on partial SSNs (instead of only immigration-specific identifiers), the universe of “checkable” people explodes—citizens included—because you’ve effectively handed the engine a universal key.

The moment you do that, the system’s weakest link becomes the thing that matters most: the upstream identity record it treats as authoritative. That’s where the trap snaps shut—because at scale, the machine isn’t verifying you; it’s verifying the version of you stored in SSA’s NUMIDENT, a static snapshot that was never built to govern eligibility across voting, licensing, and benefits in real time.

Iowa showed that a state could reclassify driver’s licenses as “public benefits” to bypass privacy laws. The federal government then took that logic, codified it in a confidential MOU, and rolled it out across half the union. The result is a national permission layer that treats the franchise as something to be renewed, not a right to be exercised.

That raises the next question: what kind of system can jump by millions of checks, and what did it have to become to do that?

From Alien File to National Registry

For decades, SAVE sat in the background of the bureaucracy, a narrow tool to verify the status of non‑citizens applying for specific public benefits like Medicaid or housing. It was a lookup service, not a grid.

In 2020, only immigrants and some naturalized citizens were eligible for SAVE benefits verification. To be checked, the system required an immigration ID.

In 2025, that changed. Through a series of technical overhauls and legal maneuvers, DHS turned SAVE from a “pull” system—one person at a time—into a “push” system capable of ingesting entire state populations.

From Immigration A-Number to SSN4

The critical technical shift came on November 3, 2025, when USCIS rolled out two new capabilities: Bulk Upload and SSN4 matching. Previously, SAVE required an immigration identifier such as an Alien Registration Number (A‑Number), which naturally limited queries to non‑citizens with immigration files.

The new architecture removes that limiter. States can now verify individuals using only a name, date of birth, and the SSN4. By switching the key identifier from an “A-Number” (which only immigrants have) to a SSN (which nearly every resident has), the federal government quietly converted an immigration database into a National Registry capable of scanning the electorate.

This is the system Iowa and twenty‑five other states have plugged into: one that uses stale data to generate erroneous flags, then uses confidential contracts to mandate purges based on those errors. Once a system like that exists, everyone who connects to it inherits the same logic: deny fast, correct slowly.

Ingestion, Not Inspection

The clearest proof that this system is built for permanent mechanical control, not human oversight, is in DOJ’s own filings. When states offered the traditional remedy—letting federal lawyers inspect rolls in person—DOJ refused.

In California, Secretary of State Shirley Weber invited officials to review a redacted voter database in her Sacramento office. DOJ rejected the offer and, in its motion to compel, demanded that the state “submit electronically” an unredacted file via the Justice Enterprise File Sharing (JEFS) system, including each voter’s driver’s license number and SSN4.

The distinction is critical. Those are not investigative leads; they are join‑keys—the unique identifiers needed to plug state records into the Person Centric Entity Resolution (PCER) engine. DOJ was not trying to see the list. It was trying to possess it.

The clock does not allow time for complex, human-led adjudication of citizenship, which is notoriously difficult to prove on a deadline. It forces the state to rely on the federal “flag.”

When Verification Becomes a Gate

Voter verification is the accelerant because it introduces two features benefits programs don’t always require: bulk processing and institutional urgency.

When those two features meet a federal permission layer, the result is predictable: more queries, more false positives, and less accountability.

The system doesn’t know who you are. It only knows whether you clear.

This repurposing changes the nature of the system because it transforms SAVE from a transactional lookup service into a mass ingestion pipeline. There is a fundamental difference between a tool that is occasionally consulted by a human clerk and a system that is queried in bulk by a state server.

The Skeleton Key: The SSN4 Shift

The most critical architectural change was not the volume of the queries, but the keys used to run them.

Under the 2020 rules, a state official literally couldn’t run SAVE on a typical U.S.‑born voter. The system required an immigration identifier—an A‑Number, I‑94, or similar—just to open the case. In May 2025, USCIS rewired the tool to accept searches by Social Security number specifically so agencies without immigration IDs could query the database anyway.

Then on November 3, 2025, USCIS loosened the Social Security enhancement further. The agency announced that states could now verify voters using only a name, date of birth, and the last four digits of a Social Security number (SSN4).

This technical shift had a profound structural consequence. While only non-citizens possess A-Numbers, nearly every American resident possesses a Social Security number. By switching the input key to the SSN, DHS technically unlocked the database to the general population.

The Static Snapshot Failure

The danger of this new architecture lies in the specific data it consumes. To perform these SSN-based checks, the overhauled SAVE system bypasses live immigration files and queries the Social Security Administration’s NUMIDENT file—a database the SSA itself has warned is not a definitive record of citizenship.

NUMIDENT is a "static snapshot." It records a person’s status at the time they applied for a Social Security card. It does not automatically update. If a lawful permanent resident becomes a naturalized citizen years later but does not update their Social Security record—a step not legally required for voting—SAVE will still flag them as a non-citizen.

The SSA’s Office of the Inspector General has estimated that 3.3 million U.S. citizens are misclassified as non-citizens in this database due to this "naturalization lag".

The Purge Clock

Under the "Confidential Memorandum of Understanding" sent to states like Colorado, this known data latency is weaponized.

Section VIII of the MOU does not merely provide data; it imposes a deadline. The agreement mandates that upon receiving notice of "anomalies" from the DOJ (generated by these static SSA records), the state "will clean its VRL/Data by removing ineligible voters" within "forty-five (45) days."

In the world of database administration, 45 days is a blink of an eye. In the legal world, it is a suffocating window. By the time a voter receives a notice in the mail, the clock has already burned down. The MOU ensures that the system’s default setting is deletion.

The Financial Kill Switch

This fulfills the surveillance logic we first saw in Part I: the shift from punishing crimes to policing “patterns.”

Buried in SSA’s revised System of Records Notice is “Routine Use 50,” which authorizes sharing NUMIDENT data with Treasury’s Do Not Pay system. If the voter‑verification algorithm flags you as “unverified,” that anomaly does not stay in an elections database. It can propagate to Treasury, where the same flag can trigger Do Not Pay screening and additional review—delaying payments until the record is resolved.​

This creates a structural trap. The federal system uses outdated data to generate a flag (the "anomaly"). The MOU then legally binds the state to act on that flag within a strict window. The burden of proof shifts instantly to the voter, who must now prove they are a citizen to a system that has already decided they are not.

The Leviathan — Not a Program, but a Dependency Stack

Public attention often fixates on "ImmigrationOS," the controversial analytics platform built by Palantir. But focusing on the dashboard misses the engine — a multi-billion-dollar "dependency stack" built to outlast any single administration.

The Engine: IBM and Your Digital Twin

While Palantir’s ImmigrationOS grabs headlines, the system that actually moves identity decisions is older, larger, and quieter. In May 2024, USCIS awarded IBM a $279 million “FALCON” task order to modernize the verification backbone—building and operating the Verification Information System (VIS), the transaction engine behind E-Verify and SAVE.

This isn't a file about you. In the eyes of the state, this file is you. If the flesh-and-blood voter says one thing, and the Golden Record says another, the machine is programmed to believe the record.

This is where “verification” stops being a lookup and becomes an identity model. Later in this report, I’ll show how that modernization enables a person-centric profile—your digital twin—to persist across systems long after the original query is over.

The Memory: HART and Peraton

If IBM provides the logic, Peraton provides the memory. Following its acquisition of Northrop Grumman’s IT division, Peraton manages the Homeland Advanced Recognition Technology (HART) system—the massive biometric database replacing the legacy IDENT system.

This matters because once a “verification” system has memory, it stops being a lookup tool. It becomes a national gate for anyone it can measure.

What does “Everywhere” Actually Mean?

When federal officials say this system will be deployed “nationwide,” they do not just mean it will be in every state. They mean it will be in every transaction.

The architecture of the Leviathan is designed to collapse the distance between a “voter check,” a “traffic stop,” and a “financial penalty.”

The Physical Enclosure

“Everywhere” also means the physical observation of movement is no longer local.

• If you drive: Your movement is captured by ALPRs and fed into state fusion centers like the Texas FCIC, where it is legally reclassified as "intellectual property" to hide it from public records requests.

• If you park: Your location is logged by private data aggregators like Verisk/ISO, which markets a "multi-billion-scan vehicle-location database" to insurance carriers to track where vehicles are garaged.

• If you cross state lines: Your data is shared via Nlets, the same interstate law enforcement backbone we exposed in Part II. The same pipe that funnels your license plate scans to a fusion center is now being configured to route your driver’s license photo to the DHS.

The system doesn’t need to arrest you to control you. It simply needs to deny your transaction. In this architecture, eligibility is not a right you hold; it is a status code the system assigns.

SAVE isn’t where the data lives. SAVE is where the decision happens. And decisions are governance. Even when they’re disguised as “verification.”

The Transformation Is Measurable — In Volume, Ambition, and Intent

The shift from a passive benefits check to a proactive mass‑surveillance grid is not speculation; it is quantified in federal records.

In 2020, SAVE’s role in elections was buried as one of many “lawful purposes.” By 2025, “voter registration and voter list maintenance” appears in the opening justification: it is now a primary design target of the overhaul, not a hypothetical side case.

Under Section VIII of that confidential deal, the state does not just share data; it surrenders authority. The process is not a dialogue; it is a loop:

1. Ingest: The state uploads the voter roll to the federal system.

2. Match: The DOJ runs the data against federal databases (SSA Numident/DHS SAVE).

3. Purge: Upon receiving notice of “anomalies,” the state “will clean its VRL/Data by removing ineligible voters” within “forty-five (45) days”.

As earlier mentioned, this is ingestion, not inspection. The demanded fields are join-keys.

The MOU mandates that upon receiving notice of “anomalies” from the DOJ, the state “will clean its VRL/Data by removing ineligible voters” within “forty-five (45) days”.

This effectively federalizes the administration of state elections. Local discretion collapses into a federal clock.

Because 205 million queries is not a “benefits tool.” That is national in scale.

That is the scale of something designed to be called constantly by other systems—until “verification” becomes so routine it stops looking like politics and starts looking like administration.

The Demand for Full Ingestion

The Department of Justice is no longer asking states to participate; it is suing them for total submission — demanding the electronic transfer of entire unredacted voter files.

When USCIS officials state, "We encourage all federal, state, and local agencies to use the SAVE program," they are describing a default. They are describing a future where "verification" becomes the connective tissue between every agency—so normalized that it no longer looks like surveillance, but simply looks like modern governance.

This is not red vs. blue; it is administrative alignment—the quiet construction of a national permission layer.

In practice, SAVE is no longer “a database.” It functions more like a federal verification gateway — an eligibility switchboard other systems call, quietly, at scale. That matters because the system scales larger through interfaces, contracts, and “optimization” work that rarely comes with a press conference.

And when the verification engine itself is being modernized — from distributed lookups to cached identity profiles and probabilistic match scoring — the question stops being what SAVE was designed to do.

This isn’t oversight—DOJ wants the electronic file because license numbers and SSN4s are the join‑keys the PCER engine needs.

The question becomes: what does this system become once it’s built to verify everyone, everywhere, all the time?

The Statutory Shell Game

The transformation of the American voter from a citizen into a “record” required more than just new software; it required a new legal theory. To build a national verification grid without passing a National ID law, the executive branch had to repurpose existing statutes that were designed to do the exact opposite of what they are being used for today.

Weaponizing the Civil Rights Act

To build this system, the DOJ had to weaponize a law designed to stop Jim Crow. In its lawsuits against California and Colorado, the government cites Title III of the Civil Rights Act of 1960—a statute passed to preserve records so federal prosecutors could prove registrars were suppressing Black voters.

Congress passed this law for a specific, historical purpose: to preserve election records in the Deep South so federal prosecutors could prove that registrars were systematically discriminating against Black voters. It was a tool for enfranchisement—a way to catch officials who were throwing away the registration forms of minority citizens.

Today, the DOJ is inverting that purpose — using the same statute to demand unredacted voter rolls that feed a computerized purge engine. They are using a civil rights law to build a surveillance list.

In its lawsuits against California and Colorado, the government explicitly cites Title III not to investigate discrimination, but to enforce “list maintenance”—a bureaucratic euphemism for purging voters. By invoking a civil rights statute to demand “unredacted” voter files, the DOJ is using a law meant to protect voters from the state as a tool to expose voters to the federal government.

“List Maintenance” As Data Capture

The government’s legal filings reveal that “compliance” is the pretext for data acquisition.

In United States v. Weber, the DOJ argues that it cannot verify whether California is properly “removing ineligible voters” unless the state turns over the “driver’s license number” and “last four digits of the social security number” for every registered voter.

This is the statutory shell game:

1. The Hook: The DOJ claims it is enforcing the National Voter Registration Act (NVRA) and Help America Vote Act (HAVA).

2. The Trap: HAVA requires states to maintain accurate lists but contains no provision forcing states to surrender those lists to the Feds.

3. The Switch: The DOJ uses the Civil Rights Act to demand the data, arguing that “list maintenance” is a federal right that requires federal oversight.

As the NAACP and League of Women Voters noted in their motion to intervene in the California case, this legal theory transforms the Attorney General from a guardian of voting rights into a “national voter registration administrator,” centralizing power in Washington that the Constitution explicitly delegated to the states.

The “Backdoor” ID Requirement

This legal maneuvering creates a functional National ID system without Congress ever voting for one.

The Fair Elections Center warns that by wiring the SAVE database (an immigration tool) into the voter registration process, the government has imposed a “backdoor documentary proof of citizenship” requirement.

Under this regime, a voter does not need to show a passport at the polls to be flagged; they simply need to have an “anomaly” in a federal file they cannot see. If a naturalized citizen’s Social Security record hasn’t updated to reflect their citizenship—a common “naturalization lag” acknowledged by the SSA—the SAVE system will flag them as a non-citizen. The state, bound by the DOJ’s “list maintenance” mandate, is then pressured to purge them.

The statute meant to stop registrars from purging eligible voters is now being used to feed a system that automates their removal.

To see how that became possible, you have to stop looking at the statute and start looking at the input tray.

The Technical Tell: Bulk Processing

Now that SSN-based queries removed the limiter; entire voter rolls are checkable.

This technical update fundamentally altered the system’s logic.

• Before: The system answered the question, "Is this specific applicant eligible?"

• Now: The system answers the question, "Who in this population is ineligible?"

The impact of this switch was immediate and explosive. When a system jumps into the hundreds of million transactions in a single year, it is no longer performing the same function. It has graduated from an administrative tool to a mass screening system.

The Scope Jump: SSA Integration Changes the Universe of Targets

If Bulk Upload provided the scale, the integration with the Social Security Administration (SSA) provided the targets.

Historically, SAVE required an Alien Registration Number (A-Number) to run a query. This acted as a structural safety valve: the system could generally only be used on individuals who had already interacted with the immigration system. U.S.-born citizens do not have A-Numbers; therefore, they were largely invisible to the database.

On November 3, 2025, USCIS removed that safety valve. The agency announced that states could now verify voters using only a name, date of birth, and the SSN4 alone.

That many people do not end up in the crosshairs by accident. To see how they got there, you have to stop looking at individual records and start looking at the machinery that is sorting them.

The Machine Behind the Screen (VIS, PCER, HART, ImmigrationOS)

To understand what the twenty-six states plugged into, you have to look past the acronyms. Public attention often fixates on "SAVE" or "ImmigrationOS" because they appear in headlines. But focusing on the dashboard misses the engine.

SAVE is merely the customer-service window. The actual machine is a multi-billion-dollar dependency stack built by private defense contractors to outlast any single administration.

From Verification to Identity Construction

In 2020, DHS’s own privacy documentation limited SAVE to immigrants, non‑immigrants, and certain naturalized citizens. U.S.‑born citizens sat outside the system’s official scope. By October 2025, that limiter was gone: the updated PIA explicitly authorizes SAVE to ingest and retain Social Security numbers for U.S.‑born citizens when agencies submit them for voter‑roll checks.

While Palantir’s $30 million contract for "ImmigrationOS" drew headlines, it functions largely as a user interface. The real scale of the system lies in the plumbing beneath it.

In May 2024, USCIS awarded IBM a $279 million task order known as FALCON to modernize the verification backbone. IBM is building and operating the Verification Information System (VIS), the central transaction engine that powers both E-Verify and SAVE.

Crucially, this modernization creates a new architectural component called the Person Centric Entity Resolution (PCER) microservice.

In the older model, verification was a momentary pull: the system checked a record, returned a result, and moved on.

Under PCER, the logic shifts toward cache and resolve—consolidating identifiers from multiple sources into a persistent identity profile. Inside the system, that profile is called a Golden Record. In plain language, it is your digital twin.

That shift matters because the system no longer just verifies who you are at a moment in time. It constructs an authoritative version of you—and, by design, that version can persist beyond the original purpose of the query. Once that digital twin exists, the system doesn’t ask whether the record is right. It asks whether it clears.

This is the point where “verification” stops being a check and becomes a model.

The Memory: HART and Relationship Mapping

If VIS provides the logic, HART provides the memory.

Managed by Peraton (following its acquisition of Northrop Grumman’s IT division), the Homeland Advanced Recognition Technology (HART) system is the massive biometric database replacing the legacy IDENT system.

HART is not just a digital fingerprint repository. It is a cloud-native platform hosted on AWS GovCloud designed to fuse "multimodal" biometrics: face, iris, and fingerprint data.

The DHS technical specifications confirm that HART is designed to store and map "Relationship Patterns". By linking biographic data, encounter locations, and third-party data, the system builds a social graph of individuals—moving the question from “Who is this?” toward “How is this person connected?”

That shift is the tell. Once a system can model relationships, it stops being a records tool and becomes an operational instrument. And operational instruments don’t live in spreadsheets—they live behind dashboards, where complex pipelines get turned into simple choices: flag / route / detain / remove.

The Dashboard: ImmigrationOS

Sitting on top of this stack is ImmigrationOS, the platform built by Palantir Technologies under a $30 million contract awarded in April 2025.

ImmigrationOS is not the database; it is the lens. It creates a digital twin of the immigration lifecycle, fusing data from the IRS, SSA, and local police to track individuals through the deportation pipeline. It is designed to provide "near real-time visibility" into targets, utilizing the data lakes filled by the systems below it.

Seen from above, the full structure looks like this:

Once you see the stack, the marketing language about “simple verification” reads differently. This is not a lookup; it is a rules engine with a memory, built to be called again and again by other systems that depend on its decisions.​

The last question is who controls that engine—because once verification becomes national, whoever owns the stack effectively owns the rules of citizenship.​

The Privatization of Sovereignty

The most dangerous feature of this stack is not its power, but its ownership. The core logic of American identity verification is now wrapped in the intellectual property rights of private vendors.

• Peraton holds the biometric keys.

• IBM manages the verification logic.

• NEC Corporation provides the "black box" facial recognition algorithms.

• Amazon (AWS) hosts the data.

You cannot FOIA an algorithm owned by Peraton. You cannot vote out the board of IBM. The "Intellectual Property" laws—like those passed in Texas—protect their trade secrets, which happen to be your movements and biometrics.

The government has outsourced the machinery of the Fourth Amendment to companies that view your identity as a renewable contract.

Permanence Without Consent

The architecture of this system was not debated in Congress. It was not authorized by a specific ballot initiative. It was assembled through a series of administrative agreements and vendor contracts designed to survive political turnover.

Here’s the tell: the pipes were connected before the public was even told the pipes existed.

The durability of the Leviathan relies on three specific mechanisms: retroactive legalization, contractual lock-in, and the inversion of the burden of proof.

Retroactive Legalization: The SORN Maneuver

The most telling detail in the construction of this network is the timeline of its authorization. The federal government built the data pipelines first and asked for legal permission second.

• The Act: On May 15, 2025, DHS, USCIS, and the Social Security Administration (SSA) signed a "Letter Agreement" to begin bulk-matching voter rolls against the SSA Numident file.

• The Cover: The agencies did not publish the legally required System of Records Notice (SORN) describing this new surveillance capability until October 31, 2025—five months after the data sharing began.

By the time the public was invited to comment on the system, millions of records had already been processed. The "comment period" was a formality for a system that was already operational. This is known as "policy laundering": implementing a capability in secret, then codified it as a "routine use" once it is too entrenched to remove.

Contractual Lock-In: The Long Horizon

Even if a future administration wanted to dismantle this system, they would face a firewall of private contracts and binding settlements.

The settlement agreement announced by Iowa Attorney General Brenna Bird does not just authorize data sharing; it mandates it for 20 years. By entering into this agreement, Iowa, Florida, Ohio, and Indiana have legally bound future governors and legislatures to a federal data-sharing regimen that extends well into the 2040s.

For the other states signing the "Confidential MOU," the lock-in is technical rather than contractual. Under the Department of Homeland Security’s retention protocols, once a state feeds its voter rolls into the SAVE system, that data is retained for 10 years—meaning the federal government maintains the digital dossier long after any single election cycle has passed.

Whether by a 20-year contract or a 10-year retention policy, the result is the same: the data checks in, but it doesn't check out.

Furthermore, the physical infrastructure of the system is owned by private vendors. The $17.1 million contract between the Texas Department of Public Safety and Flock Safety includes a provision that data uploaded to the state LPR database must be retained for a minimum of three years. Because this data is legally designated as the "intellectual property" of the state intelligence center under recently enacted Texas SB 1499, it is insulated from standard public records requests and legislative oversight. The state cannot simply "delete" the data, because contractually, the data has become a permanent asset.

The Inversion of the Burden

The final mechanism of permanence is the shift in legal burden. In the traditional justice system, the state must prove you are ineligible. In the Leviathan, the algorithm presumes you are ineligible until you prove otherwise.

The "Confidential MOU" codifies this inversion. Under Section VIII, once the federal PCER engine flags a "data anomaly," the clock starts. The state must "clean its VRL/Data" within 45 days.

There is no pause button for the voter to hire a lawyer. There is no requirement for a judge to sign a removal order. The machine generates a flag, and the contract mandates an execution. If the citizen cannot navigate the bureaucracy of three different federal agencies (SSA, DHS, USCIS) to correct the Golden Record within that window, their rights are administratively deleted.

The system is designed to be fast, mechanical, and permanent. The appeals process is designed to be slow, manual, and rare.

That is not a glitch; it is a theory of governance. Once eligibility is delegated to a timed, opaque flag, the country is effectively ruled by whatever the red light on the dashboard says.

Republic of the Red Flag

We were raised to think the most dangerous government power comes from laws passed in public, debated by legislatures, and signed by governors.

In reality, the most dangerous power comes from systems built as “administration,” expanded as “modernization,” and then normalized as “best practice”— until the public wakes up one day and discovers the country is running on a permission layer they never consented to.

The 45 day "clean" mandates are not requests for accuracy; they are algorithmic purge orders.

A system that defines eligibility before it corrects errors is not neutral. It is decisive. And it is already running.

This is governance by database: a regime where eligibility is decided first, and error correction — if it happens at all — comes too late to matter.​

The system does not know who you are.

And when the system decides you don't clear, there is no one left to call.

Documentation note: Key terms and quotes come from filed federal exhibits and public records (PACER). A full reference list and primary-document vault are available to paid subscribers.

References & Primary Documents

• Department of Homeland Security. (2025, October 31). Privacy Act of 1974; System of Records (DHS/USCIS-004 Systematic Alien Verification for Entitlements). Federal Register, 90(209), 48948–48953.

• Department of Homeland Security. (2025, October 31). Privacy impact assessment for the Systematic Alien Verification for Entitlements (SAVE) program (DHS/USCIS/PIA-006(d)).

• Department of Justice. (2025). Confidential memorandum of understanding regarding participation in the SAVE program for voter registration and voter list maintenance purposes. (Exhibit 2 in United States v. Griswold).

• Neff, E. (2025, December 1). Voter registration list request follow up [Email to Andrew Kline, Colorado Deputy Secretary of State]. U.S. Department of Justice, Civil Rights Division.

• Reynolds, K. (2025, October 8). Executive order number 15. State of Iowa Executive Department.

• Social Security Administration. (2025, February 20). Privacy Act of 1974; System of Records (Master Files of Social Security Number (SSN) Holders and SSN Applications). Federal Register, 90(34), 10025–10029.

• Social Security Administration, Office of the Inspector General. (2006). Congressional response report: Accuracy of the Social Security Administration’s Numident file (A-08-06-26100).

• U.S. Citizenship and Immigration Services. (2025, November 3). USCIS enhances voter verification systems [Press release].

• United States v. Griswold. (2025). Complaint (Case No. 1:25-cv-03967). U.S. District Court for the District of Colorado.

• United States v. Weber. (2025). Transcript of proceedings (Motion Hearing, Dec. 4, 2025) (Case No. 2:25-cv-09149-DOC-ADS). U.S. District Court for the Central District of California.

Share

Introduction: The Shield Wall of Evidence

Welcome to the Evidence Locker for our Pillar Investigation, DOJ’s Confidential SAVE MOU to Federalize the Voter Rolls. In the spirit of full transparency, we are making our primary source documents, financial recor…

Read more