Trump administration’s citizenship database avoids oversight; ignites Big Brother fears

In a sweeping move that has reshaped the architecture of federal identity verification, the Trump administration has created a searchable nationwide citizenship data exchange that ostensibly is being used to verify U.S. citizenship status for voter eligibility, but which could just as easily be used to monitor every American citizen in apparent violation of a slew of federal privacy laws and without Congressional oversight.

The expansion of the U.S. Citizenship and Immigration Services’ Systematic Alien Verification for Entitlements (SAVE) system and its convergence with the Federal Data Services Hub (FDSH) reflects a broad shift toward predictive governance and centralized identity control. While the original purpose of SAVE was to validate non-citizen eligibility for entitlements, the new system undergirds a sweeping new framework of automated citizenship verification that easily could be used not just for determining voting eligibility, but potentially for law enforcement, immigration enforcement, financial eligibility assessments, or outright profiling and dossier compilations on citizens reminiscent of a SciFi dystopian world.

Civil liberties advocates warn there are no current statutory frameworks that limit how this data can be shared or reused by other agencies once it is collected and centralized, or who can access, change, and manipulate it. In the absence of robust oversight, public transparency, and judicial review, the system’s expansion marks not just a technical evolution, but a transformation in the relationship between the individual and the state.

The question is not whether the system can verify citizenship for voter eligibility purposes, but whether it can do so lawfully, fairly, and without eroding the constitutional rights its supporters claim to protect.

According to reporting, the system compiles data from Department of Homeland Security (DHS) immigration files and Social Security records to allow state election officials to check the citizenship status of registered or potential voters by simply submitting basic identifiers such as name, date of birth, and Social Security number.

The system has been built on top of SAVE with significant data streams from the FDSH, which is a central platform administered by the Centers for Medicare and Medicaid Services (CMS) that facilitates the exchange of identity and eligibility data between various federal agencies, including DHS, the Social Security Administration (SSA), Internal Revenue Service (IRS), Department of Veterans Affairs, and Department of Defense. It marks a profound shift in how government agencies verify eligibility for public benefits, voter registration, and more, triggering widespread alarm among privacy advocates and civil liberties groups.

Originally a backend verification tool that was used to confirm non-citizens’ eligibility for federal programs, SAVE now functions as a de facto national citizenship index. It was executed largely without public debate or Congressional oversight as smaller databases were quietly merged into it from across DHS, SSA, IRS, the Office of Personnel Management, and other federal entities like the Treasury Department’s Financial Crimes Enforcement Network.

This initiative was propelled by Executive Order 14248, Preserving and Protecting the Integrity of American Elections, signed by President Donald Trump on March 25. The order authorized DHS, with support from the Department of Government Efficiency (DOGE), to access SAVE, FDSH, and other federal databases to conduct batch screenings of voter rolls against immigration, citizenship, Social Security, and other identity records.

In prior years, SAVE was accessed on a case-by-case basis, with states manually verifying the immigration status of select individuals applying for public benefits. Now, the system supports batch processing of entire voter rolls, allowing election officials to screen millions of individuals in minutes. The White House claims that this tool ensures that only U.S. citizens are registered to vote. DHS officials have said the system has already processed over nine million voter records with an alleged 99.99 percent match rate confirming citizenship.

The core technology rests on a fusion of federal data sources, but it now uses Social Security Numbers alongside more traditional identifiers like Alien Registration Numbers to verify the status of naturalized and U.S.-born citizens, extending its scope far beyond its original purpose of verifying non-citizen eligibility. According to reports, this updated capability hinges on new data flows from the Social Security Administration and is tightly integrated with FDSH.

The Trump administration says this data convergence has significantly boosted administrative efficiency, particularly in verifying income, tax filing status, military service, and citizenship for public benefits eligibility and health coverage enrollment under the Affordable Care Act. However, the expansion of this infrastructure into voter and citizenship verification has introduced deep constitutional and legal concerns.

One major glaring issue is transparency. According to privacy experts, the rollout of the upgraded SAVE system was conducted with minimal notice and likely sidestepped requirements under the Privacy Act of 1974, a law that regulates how federal agencies collect, maintain, use, and disseminate personally identifiable information from individuals. The law further mandates public notification and a comment period when federal systems of records are significantly altered or repurposed – requirements critics argue were ignored in the rush to deploy the new system.

Data accuracy poses another critical concern. Naturalized citizens may not appear in the database immediately due to lag times in updating records across agencies. Similarly, SSA records, while expansive, were never designed or intended to be definitive proof of citizenship. False negatives could result in eligible citizens being purged from voter rolls or forced to undergo cumbersome re-verification procedures. Yet, there is no clearly articulated appeals process or mechanism for individuals to be notified of potential mismatches, leaving voters in bureaucratic limbo.

Civil liberties groups warn that the centralization of sensitive personal data from Social Security Numbers and immigration history to income and veteran status makes SAVE and the FDSH high-value targets for cyberattacks and internal misuse. Government Accountability Office audits have stated that both CMS and DHS need to improve information security protocols across shared systems such as FDSH.

FDSH is increasingly viewed as the government’s central engine for identity verification. Managed by CMS, FDSH enables the federal marketplace and states to verify application information in real-time by checking it against existing federal databases. This includes confirming Social Security Numbers and citizenship status via SSA, immigration status via DHS, and income data via the IRS.

FDSH ‘s original purpose – streamlining eligibility checks for health insurance programs – has now expanded into a comprehensive infrastructure for cross-agency data sharing. While the system is said by its proponents to reduces duplicative paperwork and speed up eligibility decisions, its reliance on broad interagency access to sensitive personal information raises serious privacy concerns.

There is another critical issue. And that is governance. With over 1,100 agencies eligible to use SAVE, oversight becomes exceedingly difficult. Questions remain as to how access logs are maintained, how long data is stored, and whether external watchdogs or Congressional committees have meaningful insight into system usage.

According to privacy law scholars, SAVE queries are typically retained for ten years, but it is unclear if batch voter registration data submitted for verification is also retained or cross-referenced for future enforcement or eligibility actions. Even less is known about what other purposes SAVE is being used for, who has access, and are these users’ activity in the system logged for accountability, privacy, and security purposes.

There are also process-based concerns. Unlike traditional legal procedures that guarantee notice, the opportunity to be heard, and the ability to challenge adverse findings, the SAVE system operates largely in the background. Individuals whose citizenship is erroneously flagged as unverified may not even be aware of the error until they are denied a public benefit or are purged from voter rolls.

This black-box design not only undermines transparency, it also raises due process challenges, particularly for populations most vulnerable to bureaucratic error such as naturalized citizens, low-income individuals, and limited English speakers.

In legal terms, the SAVE expansion touches on multiple privacy frameworks. Under the Privacy Act of 1974, any federal database used to make decisions about individuals must publish a system of records notice (SORN) that includes detailed descriptions of data use, retention, and sharing practices.

Although SAVE has long operated under an official SORN – specifically DHS/USCIS‑004 covering the core SAVE database and last updated in June 2020 to outline data collection, retention, and sharing practices – there has been no new or amended SORN addressing the recent expansion that enables batch queries via Social Security Numbers or voter roll checks.

Similarly, the Federal Data Services Hub operates under its own security and privacy protocols covered by CMS SORN 09‑70‑0560, which was first published in the Federal Register on October 23, 2013, and updated on February 14, 2018. Critics contend that because of the sheer scope of what FDSH is now being used for pursuant to Trump Executive Order 14248, there are serious questions about whether existing safeguards are sufficient to protect against misuse, privacy violations and oversight, and systemic bias.

This dramatic restructuring of identity verification in the U.S. comes at a time of renewed debate over voter access, election integrity, and the appropriate role of federal data in public administration. Proponents of the new system argue that it ensures that only eligible citizens vote or receive benefits, preventing fraud and enhancing administrative efficiency, but opponents contend that it represents a step toward a national registry of citizenship – something long considered anathema to American governance – and fear that it will be used as a tool of surveillance, disenfranchisement, and political targeting.

Article Topics

data exchange platform  |  data privacy  |  DHS  |  digital ID  |  digital identity  |  identity management  |  identity verification  |  U.S. Government  |  USCIS