DOJ Built the Voter Database. The Statutory Authority Never Appeared.

A data request became a national policy

The Civil Rights Division began requesting complete, unredacted statewide voter-registration lists in May 2025. The requested fields included names, birth dates, residential addresses, driver's-license numbers, and partial Social Security numbers. The administrative record showed requests to 49 states and the District of Columbia. At least 18 states fully cooperated, according to the opinion, while DOJ sued many states that refused.

DOJ then shared received voter data with DHS. DHS ran the records through the Systematic Alien Verification for Entitlements system, known as SAVE. USCIS describes SAVE as a service for government agencies verifying immigration status and citizenship for applicants seeking benefits or licenses. The system was not originally described as a national voter-registration adjudicator.

After matching, DOJ notified states about people the system identified as potential noncitizens and urged removals. Some agreements obligated states to remove voters identified as ineligible, the court found. That sequence matters. Each step can sound administrative when isolated: obtain records, share data, run a match, send results. Together they created what the opinion called the Voter List Maintenance Policy.

The legal question was therefore not whether accurate voter rolls are legitimate. Federal and state law already require list maintenance. It was whether DOJ possessed authority for this particular system of nationwide collection, interagency disclosure, citizenship matching, and pressure on state registration decisions.

Three election statutes did not add up to one new power

DOJ relied principally on the Civil Rights Act of 1960, the National Voter Registration Act, and the Help America Vote Act. Those statutes give the federal government important enforcement tools. They also assign particular duties to states and define how the Attorney General may enforce federal requirements. The court rejected the idea that those pieces could be combined into authority for the challenged policy.

The 1960 Act permits written demands for election records when DOJ states the basis and purpose of the demand. The court held that it did not authorize collecting every voter's information as part of a general investigation or using the records to run the national matching project. The NVRA and HAVA require states to maintain accurate voter lists and allow federal civil enforcement. They do not transfer the underlying list-maintenance decision to DOJ.

This is a recurring administrative-law problem. An agency may point to several provisions that touch the subject and still lack authority for the specific architecture it built. Jurisdiction over voting law is not a blank authorization to create any data system that might advance election integrity. The power must come from the statute Congress enacted, including its allocation of responsibility and procedural limits.

Judge Sooknanan granted partial summary judgment to the plaintiffs on their Administrative Procedure Act claims and denied the government's motion to dismiss or for summary judgment. Her opinion treated the policy as final agency action with concrete consequences, not merely an exchange of information or a collection of preliminary investigative steps.

The error was not hypothetical

Database disputes often become abstract debates over accuracy rates. The administrative record here contained specific people. Nel, a derived citizen, attested that Texas cancelled his registration after the modified SAVE system did not confirm his citizenship. The same occurred to Doe, a naturalized citizen and Common Cause member. Other members had to produce additional citizenship evidence to prevent cancellation.

The opinion explains one source of the mismatch. SAVE began incorporating Social Security Administration records in 2025. Those records can retain an earlier noncitizen status after a person naturalizes or derives citizenship. A system can accurately reproduce the status in one source and still be wrong about the legal status that matters now. Data lineage is not a technical footnote when the output can determine whether a citizen remains registered.

The court held that DOJ failed to consider an important aspect of the problem: the risk that known systematic errors would cause states to remove eligible citizens. That failure made the policy arbitrary and capricious. This was not a holding that government may never use a citizenship database in election administration. It was a holding that reasoned decision-making cannot omit the foreseeable injury created by the chosen tool.

The distinction is crucial for lawyers reviewing automated government action. A mismatch may justify investigation. It does not establish ineligibility. The record needs a defined path from signal to notice, reliable current evidence, an opportunity to correct source data, and an accountable decision-maker. Without those elements, a verification system quietly becomes an adjudication system.

Privacy law governs the architecture, not only a breach

No hacker was necessary for the privacy problem in this case. The government intentionally collected, combined, and disclosed personal records. The Privacy Act regulates that architecture. It requires public notice when an agency establishes or revises a system of records, limits disclosure, demands reasonable accuracy and relevance, and restricts maintaining records about First Amendment activity unless a statutory or law-enforcement basis exists.

The Civil Rights Division placed state voter-roll information into a records system governed by a notice published in 2003. DOJ argued that registered voters could be treated as subjects of investigations covered by that notice. The court rejected the premise that every American who registers to vote thereby becomes the subject of a voter-fraud investigation. It held that the policy violated both procedural and substantive Privacy Act protections.

The opinion also found a Paperwork Reduction Act violation. DOJ imposed a common reporting demand on states without following the statute's information-collection procedures. The government invoked exceptions for investigations and litigation, but the court characterized the project as a general investigation of a category rather than a collection tied to particular identified violations.

This is why privacy compliance cannot be reduced to cybersecurity. Encryption and access controls matter, but a secure database can still be unlawfully created, populated for an undisclosed purpose, shared under an invalid exception, or used to make a decision its source records cannot reliably support. The first governance question is authority. Security comes after the government has a lawful reason to possess and use the data.

Vacatur is consequential, not final

The court set aside and vacated the Voter List Maintenance Policy under the APA. It rejected the government's request to confine relief to the named individuals, reasoning that vacatur operates on the unlawful agency action. DOJ told Reuters it was reviewing the decision. An appeal could change the legal landscape, and separate litigation concerning an expanded SAVE system has already reached the Supreme Court on interim relief.

The cases should not be collapsed. This October 9 opinion is Common Cause v. U.S. Department of Justice, a challenge to the Civil Rights Division's voter-list policy. The Supreme Court's recent interim order involved a separate case and a separate ruling. Lawyers and election officials should track the order, any appeal or stay, and the obligations imposed by state law rather than treating one headline as the final answer to every use of SAVE.

The district court also stated what its decision does not do. It does not prevent the federal government from lawfully supporting state list maintenance. It does not prevent states from maintaining accurate rolls. And it does not permit ineligible people to vote. Those limiting statements matter because they identify the dispute correctly: not whether eligibility rules exist, but who may collect the data, who decides eligibility, what process applies, and whether the evidence is reliable enough for the consequence.

That is the broader lesson. Modern government can assemble consequential systems through contracts, memoranda, database connections, and repeated requests without announcing a single formal rule. By the time someone asks where the authority came from, the system may already have changed individual rights. Common Cause restores the legal order of operations. Find the authority, publish the rules, test the records, account for error, and identify the decision-maker before the database starts making citizens prove they belong.

A national data pipeline is not lawful merely because each transfer looks administrative when viewed alone.