The Department of Governance by Algorithm: How DOGE Built Cleta Mitchell’s Dream Machine
While Congress Debates the SAVE Act, the SAVE System Is Already Running
Part V of the Warrantless Surveillance Series.
On June 12, 2025, a senior federal immigration official quietly demonstrated a voter-verification system to a private political network.
The public was not invited. Voting-rights organizations were turned away. Congress would not be informed for weeks.
The system already existed. The law authorizing it did not.
The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.
What follows is not a theory. It is a documented sequence — drawn from court filings, whistleblower disclosures, internal agreements, and federal admissions — showing how a private political agenda crossed into public infrastructure, and how a system once designed to verify benefits was transformed into a national gatekeeper for citizenship itself.
Two SAVEs, One Cover Story
Why the SAVE Act debate hides the SAVE system already in use
Much of the public debate now unfolding in Congress treats the SAVE Act as the origin point of federal voter verification. It is not.
While Republicans push the stalled bill in Congress—a priority the House GOP that passed earlier this year and now sits contested in the Senate—a system with the same name is already running.
Since the spring of 2025, federal agencies have been expanding the Systematic Alien Verification for Entitlements (SAVE) program from a case-by-case immigration tool into a bulk screening pipeline—one capable of ingesting entire voter rolls, matching them against Social Security records, and flagging U.S.-born citizens for review for the first time.
That name collision matters. It creates a kind of institutional fog: search for “SAVE” and the public encounters a legislative fight in Congress, not a working database quietly processing state records. Whatever the intent, the effect is the same—the debate over the bill can obscure the system already in use.
Are you allowed to exist in the system today and without having to prove yourself again, in the databases that govern eligibility and participation?
This installment is the story of how that machine was accelerated into place: who got briefed early, who rewired the stack, and why the “verification” rationale doesn’t match the appetite of the agreements—bulk ingestion, unique identifiers, and the kind of identity data no election system needs to “check citizenship.”
Over the last year, that system has been retooled to do something unprecedented: ingest state records at scale and output a citizenship verdict for voting list data trimming. The name collision isn’t a coincidence—it’s camouflage. It turns every search into noise, while the machine keeps running.
The public didn’t learn any of this from a press conference. But one network got a walkthrough.
The Private Briefing
On June 12, 2025, U.S. Citizenship and Immigration Services (USCIS) officials held a briefing with the Election Integrity Network, a private voter-challenge organization run by activist Cleta Mitchell. The meeting, led by USCIS official David Jennings, is referenced in multiple federal court filings and was later the subject of a joint FOIA request seeking records of the briefing.
That session shows up in court filings and FOIA demands not because it was ceremonial, but because it functioned like a working handoff: here’s the machine; here’s how to use it; here’s what it will produce.
While DHS declined to provide comparable briefings to voting-rights organizations, the EIN session became a factual predicate in subsequent litigation challenging the expansion of the SAVE database.
The same network that spent years promoting mass voter challenges and disputing certified results is now positioned to influence—directly or indirectly—the federal systems used to “verify” citizenship at scale.
Jennings explained what the SAVE database could now do: bulk uploads, SSN matching, free access for states. The activists on the call had spent years trying to build exactly this capability outside the government. Now it was being handed to them from the inside.
No comparable briefing was offered to voting-rights organizations. No notice was sent to state election administrators, other than for Texas and Louisiana pilot programs. Congress would not be informed for another month.
The people who had spent years challenging the legitimacy of American elections were the first to learn how the federal government planned to verify them.
Mitchell was not a neutral election lawyer who happened to be interested in list maintenance. She was on the January 2, 2021 call where Trump pressed Georgia’s Secretary of State to “find” enough votes to overturn the result — a role that forced her resignation from her law firm.
In the years that followed, she helped build a national “election integrity” network that trained Trump supporters to challenge voters and worked to dismantle existing safeguards like the ERIC interstate data‑sharing compact.
By June 2025, the same ecosystem that had tried to overturn the 2020 election from the outside was being invited inside the federal government’s new citizenship‑verification machine and given a private briefing on how to use it at scale.
The Rewrite (When SAVE Quietly Changed Scope)
In early 2025, USCIS did not announce a new voter-screening system. It updated a fact sheet.
That sounds small—until you compare what the agency said before the upgrade to what it said after.
For most of its existence, SAVE was not designed to verify the citizenship of U.S.-born citizens. It was a case-by-case immigration verification tool—built to confirm eligibility for benefits using identifiers that already existed inside DHS systems.
Then, in the spring of 2025, that constraint vanished. And you can see the shift in USCIS’s own language.
Between March and May, DHS quietly re-engineered SAVE from a pull-based verification service into a push-based ingestion system. Instead of asking questions one person at a time, states were enabled to upload entire voter rolls at once—millions of records in a single batch—allowing the federal system to run automated citizenship checks across whole populations.
This was not a policy change. It was an architectural one.
From Lookup Tool to Intake Pipeline
Under the original SAVE model, verification required identifiers that already existed inside DHS systems—such as an Alien Registration Number or a naturalization certificate number. That design ensured SAVE only touched people who had already interacted with the immigration system.
The overhaul removed the boundary.
Under the new configuration, SAVE accepts Social Security numbers (including partial SSNs), names, and dates of birth. That shift brought a new population into scope for the first time: U.S.-born citizens who have never had an immigration file at all.
Once voter rolls are uploaded, SAVE does not simply answer yes or no. It performs matching across federal datasets and returns flags and status indicators that states are expected to act on—often within strict time windows.
For immigrants, the system includes a safety valve: the "Institute Additional Verification" process that triggers human review when automated checks fail. For U.S. citizens queried through the SSN pathway, that valve was removed. If the automated check fails, the case closes with no escalation. A clerical error at SSA becomes an automatic non-confirmation — with no human ever seeing it.
This is how a verification tool becomes a screening engine.
The system didn’t need Congress to exist. It needed an access channel—and someone willing to implement it.
The paper trail is now public—if you know where to look. And once states refused the handoff, the federal government tried to take the data through the courts.
The Compliance Pretext
Publicly, the Department of Justice frames these demands as routine compliance: a standard request to enforce voter list maintenance and ensure states follow federal recordkeeping rules. In that story, the lawsuits are housekeeping—transparency, integrity, compliance.
But the record describes something else: a system rebuilt for scale, then defended as if scale has no constitutional consequences.
In United States v. Weber, Judge David O. Carter did not treat the federal demand for sensitive voter file fields as ordinary. In his dismissal order, he warned that democracy is not lost all at once, but “chipped away… piece-by-piece,” and described the case as one of those cuts that “imperils all Americans.” He also emphasized that privacy erosion and voting-rights restrictions belong in public legislative debate—not unilateral executive action.
He went further. The court criticized the DOJ for obscuring its real purpose, rejecting “pretextual” explanations that conflict with what the government has said outside the courtroom. The opinion describes a nationwide push to centralize sensitive voter data—an approach the court tied to chilling effects on registration and turnout.
In the hearing itself, California’s Deputy Attorney General Malcolm Brudigam put the stakes in plain language—warning that the action should “make the stomach of every American turn,” because the federal government was moving “state by state” and “vacuuming up” voter registration data at an unprecedented scale.
That split is the point of this chapter. What DOJ describes as compliance looks, in operation, like acquisition—built to scale, normalized through litigation, and defended as if privacy harms are collateral. Once the system exists and the data starts moving, everything downstream stops being hypothetical. It becomes workflow—who gets flagged, who gets reviewed, who gets removed, and who never learns why.
What they claim: law enforcement of voter list rules.
What the record shows: a nationwide acquisition project—normalized through litigation, and defended as if privacy harms are collateral.
That is the access channel.
The Access Channel
From Administrative Integration to Legislative Backfill
Once SAVE crossed the threshold from a case-by-case lookup tool to a system capable of intake at scale, the central question was no longer technical. It was administrative: who could access it, under what conditions, and with what assumptions of authority.
This is where the story shifts from architecture to governance.
SAVE’s expansion did not arrive through a single statute or public vote. It arrived through integration—via guidance, training materials, interagency coordination, and the quiet normalization of new workflows. Access did not require a declaration that the system had changed. It required only that agencies be told how to use it.
That process has a name in modern public administration: efficiency.
Across federal and state agencies, “efficiency” functions as a delivery language. It justifies consolidation, accelerates deployment, and reframes structural change as technical improvement. In this case, it provided the rationale for connecting systems, broadening identifiers, and onboarding new users without pausing for explicit legislative authorization.
This is where DOGE enters the picture—not as a policy originator, but as a mechanism. The newly created Department of Government Efficiency’s (DOGE) role is procedural: streamline, modernize, standardize. But when applied to a system that touches voting infrastructure and citizenship status, that procedural framing carries substantive consequences. It changes sequencing. Instead of authorize, build, then audit, the order becomes build, deploy, normalize and then backfill oversight.
Notably, this expansion did not follow new authorizing legislation. By the time Congress began debating the SAVE Act, the underlying verification infrastructure was already in use—and already being introduced to outside stakeholders. When systems go live before laws do, power migrates quietly—from legislatures to administrators.
It is against this backdrop that the SAVE Act enters the narrative. And while Congress argued over statutory cover, DOGE marketed the system as a finished product.
Here’s how the system was sold publicly — and why marketing doesn’t equal legal authority.
DOGE’s public messaging frames SAVE as settled infrastructure: free, scalable, and already delivering results. In that framing, readiness is treated as permission.
But public marketing does not resolve legal exposure. Once states transmit sensitive identifiers—driver’s license numbers, partial Social Security numbers, full voter-file join keys—the risk does not remain federal. It transfers.
Some states behaved as though that distinction mattered. Others treated availability as permission. That divergence is not ideological—it is procedural.
Kentucky shows what that divergence looks like when a state pauses at the access boundary.
Kentucky: Waiting for Legal Cover
Kentucky’s posture is revealing not because it is resistant, but because it stops at the access channel. Officials did not reject cooperation outright. They limited it—providing non-sensitive fields while withholding the identifiers that make bulk matching workable.
That distinction matters. It shows that some states do not treat the existence of the SAVE system as sufficient authorization to feed it.
In Kentucky, the naming collision becomes useful. SAVE the database is already live. SAVE the Act is still being debated. And until that ambiguity is resolved, state officials are forced to decide whether “system ready” equals “authority.”
That gap—between what exists and what is authorized—is the fog.
Kentucky’s hesitation highlights a deeper sequencing problem that appears throughout this investigation. Infrastructure was built. Access pathways were established. Training and coordination followed.
Only afterward did Congress begin debating whether—and how—to authorize what was already implemented.
This is the same sequencing pattern described earlier: implementation first, authorization later. When that order is reversed, discretion fills the gap—and discretion doesn’t live in law. It lives in people.
The Personnel Pipeline: The Human API
Administrative systems don’t run on statutes. They run on people—and the fastest way to change a system’s real-world behavior is to place the right people at the routing points where policy becomes workflow.
This is where the story narrows from infrastructure to staffing.
If the architecture shift made SAVE scalable, the personnel pipeline determines how that capacity is framed, operationalized, and justified inside government. The key transition is not “outsiders influencing government.” It is a movement learning to staff government.
This is why appointments matter even when they’re procedurally normal. A title is not a headline. A title is a permission structure: it defines who sits in which meetings, who sees which briefs, who signs which memos, who controls which implementation timelines.
One of Mitchell’s closest collaborators in that post‑2020 ecosystem, Pennsylvania activist Heather Honey—whose public claims about the 2020 election and ERIC were amplified across right-wing media and used to justify “Stop the Steal” narratives—would soon be listed on an internal DHS org chart as the department’s Deputy Assistant Secretary for Election Integrity.
Because this function sits where “data outputs” become “administrative action,” it’s less a messaging desk than a conversion layer—turning flags, lists, and guidance into enforceable routines. This isn’t a claim that any single appointee controls the system. It’s a description of how staffing decisions change what gets prioritized, measured, and implemented.
In DHS materials dated August 18, 2025, Honey is listed as Deputy Assistant Secretary of Election Integrity under Office of Strategy, Policy and Plans, placing “Election Integrity” inside the department’s formal administrative chain.
On paper, that chart is just a diagram. In practice, it shows something more consequential: “Election Integrity” is not merely a political slogan or an outside pressure campaign. It is a named administrative lane inside DHS.
This is the institutional hinge. Not character assassination. Governance mechanics.
The significance is not that any one person is uniquely powerful. It is that the pathway exists—and once a pathway exists, it attracts coordination, deference, and momentum. The meeting described in the previous section becomes legible only in this light: the system’s builders created scale; the access channel created availability; and the personnel pipeline created the conditions for normalized use.
Staffing is the accelerant — but it is not the system itself.
Once access is granted and pathways are normalized, the real work begins elsewhere: in the data layer, where records move faster than statutes and oversight arrives last. That infrastructure has a name, even if it rarely appears in public.
The Shadow Database
How the Data Actually Got There
At this point, the question is no longer whether SAVE expanded—but whether the data it relies on was ever lawfully obtained.
In Part IV of this series, we documented what the system does: bulk uploads, 45-day purge clocks, the confidential MOU that turns federal flags into state-level removals. But it left a question unanswered.
Where did the data come from?
The official story is straightforward: DHS signed a data-sharing agreement with the Social Security Administration. States upload voter rolls. SAVE queries SSA records. Citizenship status comes back.
That story is incomplete.
Whistleblower disclosures to the Senate Homeland Security and Governmental Affairs Committee reveal that the data powering SAVE’s new capabilities did not travel through normal interagency channels. Before any formal agreement existed, DOGE personnel — including Edward Coristine and others identified in Senate testimony — created a “live copy” of the Numident file — the master database containing the Social Security numbers, birthplaces, and parents’ names of every American — and placed it in an unmonitored cloud environment.
The SSA’s Chief Information Security Officer explicitly warned that “standard policy prohibits the use of production data in development environments” due to “reduced control measures and oversight.”
The Warning That Was Ignored
The SSA's career cybersecurity officials did more than warn. They quantified the danger.
On June 12, 2025 — the same day USCIS briefed the Election Integrity Network on SAVE's new capabilities — SSA's Office of the Chief Information Officer generated a formal Risk Acceptance Request Form for the cloud environment DOGE was demanding.
The form used the agency's standard five-point risk matrix:
Impact: 5 out of 5 — "Catastrophic."
The assessment noted that unauthorized access would result in "catastrophic damage to or loss of agency facilities and infrastructure" and widespread compromise of personally identifiable information.
Likelihood: 3 out of 5.
In SSA's framework, that score corresponds to a statistical probability between 35 and 65 percent.
The total risk score: 15
The agency's designation for "Very High."
The whistleblower complaint specifies what "catastrophic" meant in practice. The environment contained live production data — names, Social Security numbers, birthdates, parents' names — for between 300 and 450 million Americans. If breached, the complaint states, "the government may be responsible for re-issuing every American a new Social Security Number at great cost.”
Put simply: the system now determining citizenship status for voting was built on a copy of America’s most sensitive population database, moved without proper authorization, and knowingly placed in an environment rated “very high risk” by its own custodians.
Because the environment lacked an Authority to Operate and was self-administered by DOGE appointees, the agency had no audit trail. They would not know if the data was stolen.
Four days later, on June 16, SSA Acting Chief Information Security Officer Joe Cunningham emailed DOGE appointee Aram Moghaddassi directly:
"Most security exposures and breaches occur within development environments due to reduced control measures... our standard policy prohibits the use of production data.”
One month later, on July 15, Moghaddassi signed the authorization anyway:
"I have determined the business need is higher than the security risk... and I accept all risks associated with this implementation.” He signed his name to a coin-flip chance of catastrophic breach — and the system went live.
This is not negligence discovered after the fact. It is negligence documented in advance, calculated to two significant figures, and formally accepted in writing.
The same database that now determines whether you can vote sits in an environment whose own risk assessment gave it a coin-flip chance of catastrophic breach — and someone signed their name to accept those odds.
One whistleblower reported that Numident data subsequently appeared at DHS in an “unusual format” — a detail suggesting the transfer bypassed the secure protocols that normally govern interagency data sharing. A 19-year-old staffer who had previously been terminated for leaking data was granted administrator access to the environment without SSA supervision.
The voter verification system running today queries data that its own custodians gave even odds of catastrophic compromise. That is the foundation the Golden Record rests on.
Documentation note:
All Pillar Investigations are free to read. If you want release alerts and access to the supporting document archive, subscribe here.
Full fact sheets, court filings, FOIA responses, and source PDFs cited in this section are preserved in the RDP Evidence Vault for subscribers who want to review primary materials directly.
The Cache, Not the Query
The technical architecture confirms what the whistleblowers described.
Under the old SAVE model, verification worked like a library lookup: a clerk submitted a query, SSA’s mainframe returned an answer, the transaction ended. The system touched records one at a time. It did not retain them.
The overhauled system operates differently. The Person Centric Entity Resolution (PCER) microservice — the engine behind SAVE’s new bulk capabilities — does not query SSA in real time. It queries a cached copy.
DHS technical documents describe PCER as a system that “caches and consolidates” data from source systems, then resolves identity fragments into a single persistent profile: the “Golden Record.” That record is stored in the DHS cloud infrastructure (AWS GovCloud), where it can be matched against incoming voter rolls at scale.
The infrastructure runs on a $279 million contract awarded to IBM, known internally as FALCON — the procurement vehicle that funded the Person Centric Entity Resolution engine now powering bulk verification.
This is the architectural shift that made bulk processing possible. SAVE is no longer asking SSA a question. It is querying a copy of SSA’s answers — a copy that was initially populated, according to whistleblower accounts, through the irregular data dump DOGE personnel created to bypass legacy constraints.
Retroactive Authorization
The government attempted to legitimize this arrangement months after the data began flowing.
The timeline is documented:
April 2025: DHS and DOGE announce the SAVE overhaul. Fees are eliminated. Bulk upload is enabled.
May 15, 2025: A secret “Letter Agreement” is signed between DHS, USCIS, and SSA — retroactively authorizing the matching of voter rolls against Numident records.
October 31, 2025: The legally required System of Records Notice is finally published — five months after the system went live.
For five months, SAVE operated in a legal gray zone: processing U.S. citizens, ingesting SSA data, and building golden records without the public notice the Privacy Act requires.
Extraordinary Risk
The Senate Committee report does not mince words. It calls for the “immediate shutdown” of the new cloud environment at SSA that contains the Numident data, citing an “extraordinary risk” of data exfiltration by private actors or foreign adversaries.
That risk is not hypothetical. The same database that determines whether you can vote now sits in an environment that was built to circumvent oversight, staffed by personnel who lacked appropriate clearances, and authorized only after the fact.
This is not a procedural footnote. It is the foundation the system rests on.
Part IV showed the downstream machinery: the MOUs, the purge clocks, the states under pressure to “clean” their rolls. This section shows what sits upstream: a shadow database, an irregular transfer, and a retroactive paper trail designed to legitimize what had already been built.
If the data's provenance is irregular, every output derived from it inherits that irregularity. A voter flagged by a system built on an unauthorized data transfer has grounds to challenge not just the flag — but the foundation.
The question is no longer whether the system exists. It is whether anyone authorized it to exist — and whether the data it runs on was ever secure.
From Output to Outcome
How Scale Turns Errors into Consequences
The consequences of scale are not abstract. They’re procedural. They show up as letters, deadlines, and “cure windows” that convert database outputs into life disruptions.
Under a case-by-case model, errors are annoying but containable. A clerk notices a discrepancy, makes a phone call, resolves it before anything happens. Under a bulk model, errors become structural — produced at volume, processed on a clock, and routed into administrative action before anyone reviews them.
A bulk matching system doesn’t “discover truth.” It produces categories: match, mismatch, further review. Those outputs feed downstream workflows with fixed timelines. And because election administration runs on calendars, the burden shifts onto the individual to prove the machine is wrong — frequently on short notice.
This is where the mismatch becomes the event.
Name changes. Data entry variations. Naturalization delays that haven’t propagated to SSA. Partial SSN collisions. All of it becomes consequential — not because the system is uniquely malicious, but because the workflow is unforgiving. At scale, even a modest error rate becomes a pipeline of false flags. And those false flags do not remain in the database. They become notices, challenges, removals, or bureaucratic limbo.
Part IV documented the 45-day “clean” mandate. This is what that mandate looks like in practice: a mismatch flag, generated by an algorithm querying cached data of uncertain provenance, triggering a countdown that ends in removal unless the voter can prove the machine wrong.
The system doesn’t need to be malicious to cause harm. It only needs to be fast, opaque, and indifferent to its own error rate.
The rollout did not unfold as a cautious pilot. Adoption-window data shows states integrating in bursts — clustered around DOJ pressure campaigns, not around readiness assessments. The system scaled before the safeguards did.
But even this understates what was built.
The public debate has focused on voters — adults, registrations, rolls. That focus assumes a boundary: that the system activates when you turn eighteen and register. That the surveillance begins at civic adulthood.
The architecture tells a different story. Errors at scale are one failure mode. But the system's appetite extends beyond names and numbers.
When “Verification” Asks for Your Face
Citizenship is a legal status. You can verify it with biographical records — name, date of birth, Social Security data, naturalization documentation. You do not need a face.
That’s why the most revealing signal in this buildout isn’t a policy memo. It’s the data they demand. When a “voter verification” pipeline requests driver’s license numbers — and the infrastructure to resolve them — it stops looking like eligibility checking. It starts looking like identity ingestion.
From Iowa’s Settlement to a National Template
Part III of our series showed how Iowa and three other states signed a settlement committing to give DHS “full use” of their driver’s license records through Nlets, the law‑enforcement backbone that already moves photos during traffic stops and warrants. That language was not a drafting accident. It was the prototype: once “full use” exists in one settlement, it can be copied, pressured, and litigated into others.
Part IV traced how DOJ’s confidential MOU overlaid that template onto the rest of the map — demanding unredacted voter files that include driver’s license numbers, and suing states that refused.
Your driver’s license number connects your voter registration to your full DMV file — photograph, signature, address history, and in many states, the biometric template used for facial‑recognition matching. The MOU’s insistence on driver’s license numbers is not about verifying that you exist. It is about acquiring the key that unlocks everything else.
DHS’s revised SAVE notice completes the circuit. It explicitly authorizes using those identifiers to “validate information against NLETS” and to reach “other government enumerators” — bureaucratic shorthand for querying external systems, including DMV repositories, once the join‑key is in hand. At that point, the voter file is the intake. The DMV vault is the destination.
What Changes When the System Can See Your Face
SAVE already supports photo‑based identity confirmation as a built‑in feature. The Person Centric Identity Services architecture behind it is designed to fuse biographic and biometric data into a single “Golden Record” that persists across checks. Once states provide driver’s license numbers — by settlement, MOU, or court order — the federal engine holds the key to attach a face to every name it ingests.
The “verification” frame collapses under that weight. Photos are not about citizenship. You cannot be more or less American based on your bone structure. Photographs are about building a biometric‑ready identity layer — one that can be queried, matched, and repurposed far beyond the narrow question of who is eligible to vote.
That is the quiet shift Parts III and IV were pointing toward. The same pipeline that now checks your name against SSA and SAVE can, with the same join‑key, see your DMV portrait, your signature image, your address trail — and fold them into a permanent identity model.
Once a system can ingest faces alongside names and Social Security numbers at nationwide scale, the question is no longer whether it works. It is who controls it, who gets to query it, and what the next administration does with it when the machinery is already humming and normalized.
The Golden Record: Surveillance Without a Birthday
For months, the public defense of this system has rested on a single, comforting premise: “It’s just about protecting the vote.”
That defense assumes the system only looks at adults. Because you have to be 18 to vote, we imagine the machinery of “election integrity” activates on your eighteenth birthday — not before.
That assumption is wrong.
The technical shift to SSN4 didn’t just make the system faster. It made it universal.
When DHS and DOGE rewired SAVE to query the Social Security Administration’s Numident file, they stopped checking a list of immigrants. They started querying the master registry of the American population.
The Numident is not a voter roll. It is not a list of drivers. It is a list of every human being who has ever been assigned a Social Security Number.
And you don’t get an SSN when you register to vote.
You get it when you are born.
By linking the verification engine to the Numident, the architects removed the floor from the surveillance architecture. The “Golden Record” — the persistent digital profile that follows you across federal systems — is no longer created when you enter civic life. It is created in the maternity ward.
DHS technical documentation confirms the design. The Person Centric Identity Services (PCIS) system builds profiles for “all persons” it encounters, regardless of age. Children applying for CHIP. Minors processed through naturalization. Seventeen-year-olds who pre-register to vote in states that allow it. All are ingested. All are resolved into the Identity Index.
The “continuous vetting” mandate is explicit: records created for children “can be related to their adult records later.”
This is not a voter-verification system with incidental data collection. It is a longitudinal surveillance architecture — one that begins writing your file before you can walk and never stops updating it.
The infrastructure doesn’t care about your age. It cares about status resolution.
The same system that flags a naturalized citizen for removal in Pennsylvania is capable of indexing a newborn in Iowa. The same “Golden Record” logic that decides whether you can vote at 30 was initialized when your parents filled out the paperwork in the hospital.
We are no longer discussing a system that verifies voters.
We are discussing a system that logs Americans — from birth.
Mismatches Become Life Events
This installment documented the architecture: who built it, how they wired it, where the data came from, and what it’s capable of reaching.
But architecture is abstraction. The system doesn’t flag “records.” It flags people.
The finale follows what happens when the pipeline meets a person: the naturalized citizen whose SSA file still says “legal alien” five years after the oath. The county clerk with 10,000 flags and a 45-day window. The seventeen-year-old whose citizenship was queried before she could vote.
At small volumes, mismatches are clerical errors — annoying, correctable, forgettable.
At scale, mismatches become governance. Under deadline pressure, mismatches become life events.
Once citizenship verification becomes a cached, biometric-capable intake system, rollback is no longer a policy choice. It’s an infrastructure problem.
This infrastructure will outlast the people who built it. The Golden Record doesn’t expire. The cache doesn’t reset. The join-keys linking your vote to your face don’t delete themselves when administrations change.
Whoever satisfies the next election will inherit a machine that can query the citizenship status of every American, cross-reference it with biometric data, and act on the results — without asking Congress, without notifying you, and without any structural limit on what it’s used for next.
The machine is running. Part VI shows who it finds.
References
American Civil Liberties Union. (2025). Freedom of Information Act request regarding SAVE system modifications and interagency data sharing.
Bower v. Social Security Administration, Complaint, No. 1:25-cv-2713 (D.D.C. 2025).
Common Cause. (2025). Motion to intervene regarding DHS voter verification practices.
Department of Homeland Security. (2025). System of Records Notice: SAVE Verification System. Federal Register.
Department of Justice. (2025). Correspondence and filings regarding state voter-roll data requests.
League of Women Voters v. U.S. Department of Homeland Security, Complaint and Preliminary Injunction Memorandum, No. ___ (D.D.C. 2025).
Padilla, A., Peters, G., & Merkley, J. (2025). Letter to the Secretary of Homeland Security regarding SAVE system briefings and data access.
U.S. Citizenship and Immigration Services. (2025). SAVE voter registration and voter list maintenance fact sheet (archived versions).
U.S. Social Security Administration. (2025). Numident data governance and security policies.
Whistleblower disclosure to Senate Committee on Homeland Security and Governmental Affairs. (2025).
Thank you for producing this excellent and exceedingly important report. I will be elevating it for others to read.
I knew it. Thanks for this very, very, ehm, troublingly informative review of the machinery already in motion. This, perhaps, is why Bondi is willing to 'trade' Minnesota voter roles for withdrawing (to some undefined level) the shock troops from Minnesota. And, it just occurred to me this morning:
How long before the three big 'credit ratings' entities 'sees their opportunities' and and pay this dys-administration to get into that data to create an entirely new means of control with Social Credit Scoring, that applies their powerful sorting mechanisms to everything we read, everything we post or e-mail along with everything we purchase, and everything that our eyes linger upon some screen for more than a moment; and,
Determine whether or not our passport application is approved, our travel plans can come together, or that our full federal entitlements payments come in a timely fashion, if at all. I think we're nearly cooked, and if readers haven't yet burned down their social media presence and links to that bald nerd's 'shopping' operation, it's probably not too late. Meanwhile, I suggest carrying only a non-web-linked dumb phone, getting to know your local re-sale shops, and obtaining a solid touring bicycle for transport.
Tim Long, Just Up the Hill from Lock 15.