The Burden of an Uncertain Record

The modified SAVE program is now part of a dispute about voter-citizenship verification. The system began in 1986 as a way for government agencies to check the immigration status of people applying for public benefits. In 2025, the federal government expanded its use for voter verification, incorporated Social Security Administration records and allowed state and local users to submit bulk queries. A submitted name and identifying information are checked against SSA records; SAVE can confirm citizenship or ask the agency to resubmit with additional information.

That workflow is easy to describe as a technical sequence. Its consequences are not merely technical. A match is a database result; it is not, on its own, a complete account of a person’s status. The Court states that when SAVE cannot confirm citizenship, the state or local agency must contact the person and request proof of citizenship to register or remain registered. That is a required proof request, not a description of an automatic removal from the rolls. The legal question is who may share and use the information. The practical question is what happens to a person when the record does not settle the question.

The Supreme Court’s 25 September action must be read at the right scale. The district court had entered judgment for the plaintiff organizations and vacated the modified program and related notices; the D.C. Circuit denied the government’s request to pause that judgment. The Supreme Court then granted an interim stay while the appeal proceeds. The majority concluded that the organizations likely have standing but that the government is likely to prevail on the merits, reasoning that federal law likely authorizes the information exchange. That is a preliminary stay-stage assessment, not a final merits judgment after the full appeal.

The order discusses a naturalized citizen in Louisiana whose Social Security record did not accurately reflect her naturalization. The majority says that, had the modified program not been set aside, she likely would have needed to provide additional proof to avoid risk. It treated the prospect of having to take affirmative steps as an injury sufficient for standing. The order does not say that this Louisiana declarant was removed from the voter rolls or prevented from voting. Precision here is not a defense of the system. It is how we distinguish a burden the Court recognized from a harm it did not find had already occurred to this person.

Justice Jackson’s dissent, joined by Justices Sotomayor and Kagan, describes separate Texas cases in which the district court found that one person’s registration had been revoked without her knowledge and two others had to provide proof to maintain their registered status. Those reported harms should not be reassigned to the Louisiana declarant. Nor should the Louisiana declarant’s prospective burden be inflated into a completed denial of her vote. The records are different; keeping them distinct makes the argument stronger, not weaker. Together they raise a serious question about the path from a government data query to an administrative consequence, but they do not license us to invent the steps in between.

There is a second disagreement about procedure. The majority reads 8 U.S.C. §1373 as likely authorizing the information exchange despite other statutory restrictions. The dissent argues that DHS and SSA changed the system without first publishing required Privacy Act notices and inviting comment, and that this procedural safeguard is separate from whether information may be shared at all. The Court’s interim stay does not erase that disagreement; neither does the dissent settle it.

The distinction between a system’s uncertainty and a person’s eligibility is the point at which the burden of proof becomes a design choice. A database may be useful for checking records. It cannot make every conflict between records and people disappear. The Court specifies an initial consequence—contact the person and request proof if SAVE cannot confirm citizenship—but the order does not spell out every detail of notice, timing, review or correction. The dissent also notes a constraint on systematic voter-list maintenance near elections under the National Voter Registration Act; it does not follow that every individual or state procedure is resolved by that timing rule.

My proposal is narrower than a claim about what the current system already requires: when government records conflict, the agency should first identify what it can verify from the records it controls and tell the person what remains uncertain before treating that uncertainty as a reason to alter their status. Any request for further proof should state the discrepancy and preserve a meaningful way to challenge the decision. The case does not establish this procedure as law. It is a practical rule for assigning responsibility to the institution that assembled and uses the records, rather than treating a database response as if it were a verdict.

The question is not whether a public agency may ever verify eligibility. It is whether uncertainty in government data should travel downstream until it becomes a personal burden without an accountable decision-maker or an effective remedy. The Supreme Court has not yet resolved the underlying case. The record already gives us enough to insist on a basic distinction: a system can report what its files contain; government must still answer for what it does with that report.