On July 21, Governor Sherrill announced that roughly 6,600 people who told the Motor Vehicle Commission they were not U.S. citizens had been registered to vote anyway, in a window running from June 2023 to June 2024. Fewer than 400 of them ever cast a ballot. The flaw was fixed in June 2024 — but the registrations it had already created stayed on the rolls for another two years, and nobody outside a small circle of officials was told.

Within a week the story had settled into the two versions you’d expect. In one, this is the proof that noncitizens vote. In the other it’s a glitch, a rounding error, nothing to see. Neither version asks where the number came from or what it’s actually a number of.

We spend a lot of time inside New Jersey’s statewide voter file — the same export whose vote-history quirks we wrote about earlier this week — so we read this one a little differently than the people arguing about it on television. To us it’s a data story. A handoff between two systems failed, the cleanup never happened, nobody said anything for two years, and now the whole thing is running into a legal deadline that has barely come up in the coverage. That sequence is worth walking through carefully, because the political fight will burn out and the plumbing will still be there.

The gate recorded the answer and opened anyway

New Jersey has run automatic voter registration at the MVC since 2018. Walk in for a license or a state ID and, unless you opt out, the visit that proves who you are also starts the process that puts you on the rolls. “Automatic” is doing some work in that sentence, though. New Jersey uses a back-end model: the MVC doesn’t decide anything — it collects answers and passes a package downstream, where the Division of Elections and the county commissioners of registration decide who actually goes on the roll.

That architecture is the whole story. Two systems, one counter, and a handoff between them carrying an answer that is supposed to stop everything.

The state says applicants who answered “no” to the citizenship question were carried into registration anyway. The vendor, Idemia, disputes the “software error” framing: its system recorded both answers correctly, it says — the no on citizenship and the yes on registering. The citizenship answers were right there for the MVC to see. No noncitizen was ever mislabeled a citizen in the database. And checking eligibility, it says, was the state’s job.

The uncomfortable part is that all of it can be true at once. That’s what an integration failure looks like: each system did its own job, nothing was corrupted, nothing was lost, and the rule connecting them — that a “no” over here has to stop the process over there — was never enforced by either one.

An answer that gets stored instead of acted on is a field, not a gate. A field is information about the transaction; a gate is a branch in it. Turning one into the other doesn’t happen by itself, it isn’t obviously anyone’s job, and skipping it is invisible, because the record still looks complete. It just isn’t binding on anything.

Two years later, the state and its vendor still don’t agree on whose gate it was — which is the tell. Nobody owned that check, so nobody tested it, so its failure made no sound. A flow can run wrong for twelve months that way without a single alarm going off.

One more piece of context, since some coverage has leaned hard on New Jersey officials describing registration as an “honor system” for citizenship. It is one — but that’s not a New Jersey quirk. Voter registration in this country runs on sworn attestation under penalty of perjury because that’s the design Congress chose in 1993, and it’s how nearly every state works. Maybe that design should change. But it isn’t evidence that New Jersey was uniquely careless, especially in a case where the applicants told the truth and the system ignored them.

Four other states got here first

The most useful fact about New Jersey’s error is that it isn’t new. The same failure has now turned up in at least four other states, under governors and secretaries of state from both parties.

Illinois is the near-exact match. A programming error in its automatic voter registration system sent the records of 574 people who had identified themselves as noncitizens through to election officials in 2018 and 2019. They answered the citizenship question correctly — no — and were passed along anyway. Same seam, same bug, six years earlier.

Pennsylvania found a version of it in its electronic driver licensing system: about 200 noncitizens were able to register because of a glitch, according to 2017 testimony that also covered a longer look back at self-reported cases going back to 2000. Colorado ran the error in reverse in 2022, mailing registration postcards to roughly 30,000 noncitizens. And Oregon found about 1,600 people in 2024 who had been registered through its DMV without the citizenship documentation its process requires — most of whom, on review, turned out to be citizens, with about 30 ineligible people found to have actually voted.

That’s five states with different vendors, different statutes, and different parties in charge, all finding the same shape. If this were a story about one careless administration, it wouldn’t keep happening in states that run elections completely differently. It’s better read as the predictable cost of bolting an eligibility decision onto a service transaction. The DMV counter exists to issue licenses; the citizenship question rides along, and things that ride along get treated like cargo. Every state that has wired these systems together has had to learn, usually the expensive way, that the disqualifying answer has to change what the system does next — not just travel along in the record.

New Jersey had five years and a nearly identical public case in Illinois to learn from. That, more than the raw count, is the part that should sting.

The patch shipped. The backfill never did.

The June 2024 fix is the detail that bothers me most, and it has nothing to do with anyone’s party.

Fixing the code that produces bad records is half a cleanup. The other half is going back for the records the bug already wrote — and that half is slower, more tedious, and much easier to skip, because the moment the patch ships, everything looks fine. The error rate drops to zero. The damage already done just sits there, indistinguishable from ordinary data. Anyone who has run a data pipeline knows this failure by heart: you fix the writer and forget the written.

It’s worse here, because these particular records hid themselves. Once a bad registration landed on the roll, it looked like every good one — a name, an address, a date, a county. Nothing about it invited a second look, because the flaw was in how it was created, not in what it contained. After June 2024, the only remaining evidence lived in MVC transaction data, not on the voter file, and every month that passed made the cleanup a little harder and a little less likely to happen.

New Jersey shipped the patch and, as far as the public record shows, never went back. Roughly 6,600 records stayed on the rolls, and the knowledge that they were there stayed in a drawer until July 15 of this year, when Sherrill says the Attorney General’s office told her. She went public six days later. The outside firm CSG Law is now working out who knew what in 2024 and why nothing happened next. All 23 Assembly Republicans and 15 Senate Republicans have called for a legislative committee with subpoena power; as of late July, Democratic leaders hadn’t agreed to one.

Whatever the investigation concludes about intent, one structural finding is already visible: nobody owned the cleanup, and nobody owned the telling. Those are two different jobs, and both need a name attached before an incident rather than after. The silence might turn out to be people protecting themselves, or it might just be what an organization does when it has no rule for what happens once a defect is found. I’m honestly not sure which of those is worse.

New Jersey already had the pipes

One detail moves this from unfortunate to avoidable, and it has gotten almost no attention: New Jersey joined the Electronic Registration Information Center in August 2022, before the failure window even opened. ERIC’s entire mechanism is the kind of comparison this incident was begging for — member states send in their voter rolls and their motor vehicle data at least every sixty days, and get back reports on records that don’t line up.

The catch is what ERIC checks. It flags voters who moved, voters who died, and duplicate registrations. It doesn’t check citizenship — never has, and the data it holds couldn’t support it.

So through the entire failure window, the state was already in the habit of cross-matching MVC data against the voter file every sixty days. It just wasn’t running the one comparison that mattered — and that one wouldn’t have needed ERIC, or a federal database, or anyone’s permission. It’s an internal join: the citizenship answers the MVC recorded, against the registrations the MVC generated. Two tables the state already owned, keyed on an ID it already had. The mismatch count should have been zero every month. Instead it was running at something like 550 a month — that’s just the 6,600 spread over the twelve months the flaw was live — and nothing was looking.

That’s the cheapest lesson in this whole mess: the fix that would have caught it is a scheduled query.

Why 6,600 became 4,500 and a question mark

A week after the announcement, the number moved. On July 28 the state said about 4,500 registrations would be removed outright, and roughly 2,100 would go to county election officials for individual review first — because, in the governor’s words, the initial review suggested a number of those people may actually be citizens. Some may have fat-fingered a keypad. Others may have been ineligible when they registered and naturalized in the years since.

This was the most instructive moment of the whole episode, and it went by fast.

A voter file isn’t a list of facts. It’s a ledger of claims, each one collected at a particular counter by a particular process, and each carrying that process’s error rate. On that ledger, citizenship is an answer somebody gave on a Tuesday — and one of the few answers that can honestly change afterward. Naturalization isn’t a data error; it’s the record drifting out of date with the world, which is what records do.

There’s also a second error running underneath the first, in the opposite direction. The 6,600 itself came from a keypad at a DMV counter, tapped through by people juggling documents, a line behind them, sometimes a language barrier. Some share of those “no” answers were wrong the moment they were entered. We know this because Oregon ran the same experiment in 2024, and most of the people its DMV flagged turned out, on inspection, to be citizens.

So “6,600 noncitizens are on the voter rolls” was never a fact. It was a claim about 6,600 records — about a third of which the state now says it can’t resolve in either direction without a human reviewing them one at a time. That doesn’t shrink the failure. It does mean the file is a blunter instrument than either side of this argument wants it to be, which is why the remedy is county-by-county review instead of a mass delete, and why the first number was never going to be the final one. It will probably move again.

The deadline nobody mentioned

Then there’s the calendar, which explains more of the past two weeks than the press conferences do.

Under the National Voter Registration Act, any program that systematically removes ineligible voters has to finish at least 90 days before a federal election. For this November’s midterms, that quiet period starts August 5. New Jersey began its removals on July 28 — eight days before the door closed.

The key word is systematic. The quiet period doesn’t freeze the rolls. States keep processing registrations, fixing clerical errors, honoring a voter’s own request to be removed, clearing the deceased, and acting on specific information about individual voters. What stops is the broad sweep — a database match or a list that flags a whole group at once.

Programs like this one have hit that wall before. In 2012 the Eleventh Circuit held that Florida’s noncitizen-removal effort violated the quiet period precisely because it was systematic. In 2024 a federal judge ordered Virginia to restore about 1,600 voters on the same grounds, though the Supreme Court stayed that order days before the election. The Court has since agreed to hear an Arizona case that could narrow the quiet period substantially, with a ruling expected in the spring — and the Justice Department is separately arguing that it can hand states individual names to remove right up to Election Day.

Read New Jersey’s two-track plan against that backdrop. The batch the state considers clear-cut is being removed now, while a systematic program is still legal. The uncertain 2,100 go to the counties for record-by-record review — the kind of individualized action that stays legal after August 5.

To be fair, nobody in Trenton has said the deadline drove the design, and there are good substantive reasons for both tracks. But New Jersey landed on just about the only sequence that gets this cleaned up before November without an NVRA problem — and if you’ve been wondering why a two-year-old mess went from announcement to action in a single week, the calendar is a better explanation than the politics.

The proportion, without a thumb on the scale

The fight over how much this matters is really two arguments talking past each other, and both have a point.

Start with the size. About 6,600 records sit in a statewide file that the Division of Elections’ own monthly county summaries put at roughly 6.6 million registrations — one in a thousand. Fewer than 400 ballots, spread across multiple election dates from late 2023 through this June’s primary, cast by registered Democrats, Republicans, and unaffiliated voters alike, with no evidence any result changed. As a stolen-election theory it dies on contact with arithmetic. (One of the elections those registrations were live for, incidentally, was the 2025 governor’s race — won by the person who disclosed the problem.)

At the same time, “small” is not the defense people think it is. The number is small because the population passing through that counter is small. A gate that fails open fails for everyone who reaches it — traffic sets the count, and the safeguard gets no credit for low traffic. A control that failed 100% of the time for a year is a serious finding at any volume. Put the same defect somewhere with more throughput, or leave it running for three years instead of one, and the identical bug produces a very different headline.

And the fairest summary is that nobody in the 6,600 did anything worse than answering a question truthfully at the DMV. This was never a story about voters behaving badly; it was a story about a gate that didn’t gate. Fix the gate.

The people at the end of the records

There’s a cost the one-in-a-thousand framing hides completely, and it lands entirely on people who did nothing wrong.

Registering or voting as a noncitizen carries criminal exposure and, worse, immigration consequences — up to removal proceedings. Any prosecution turns on intent: what the person understood, what the system told them, whether a sample ballot showed up in the mail for something they never asked for. On the facts as reported, intent looks very hard to establish against someone who said “no” at the counter and got enrolled anyway. But “hard to establish” is something you find out at the end of a legal process, not the beginning, and for the people involved the process itself is the punishment. New Jersey is pointing affected residents to a state legal defense initiative whose funding was doubled past $20 million in June — a reasonable response, and also a measure of the exposure the state’s own error created.

Which makes the first version of the cleanup the sharpest unforced error in the response. The letters the MVC mailed on July 25 told affected residents to contact election officials and ask to be taken off the rolls themselves.

Set the politics aside; as cleanup practice, that’s backwards. You don’t fix your own data defect by assigning the fix to the person you inflicted it on — especially when the ask is that a noncitizen walk into a government office, in writing, in 2026, to flag their own case over a registration they never wanted. The response rate on that letter was always going to be low, and lowest among the people with the most to lose. The July 28 revision, which put the work back on the state and the counties, is the right approach — it just should have been the first one.

The court fight is running on a different axis

It’s tempting to fold this summer’s litigation into the story, since they share a news cycle. They don’t actually share much else.

In late July, Judge Zahid Quraishi dismissed the Justice Department’s suit seeking New Jersey’s complete, unredacted voter database, filed back in February under Title III of the Civil Rights Act of 1960. The statute, he held, covers records that come into election officials’ possession — not a live database the state builds and maintains itself. He noted he was joining at least sixteen other district courts and a circuit in reading it that way, and that the registration error had no bearing on the legal question. In a separate case, Judge Georgette Castner found the RNC lacked standing for its National Voter Registration Act claims, and the RNC has another action pending in state court over list-maintenance records and audit logs from the June 2025 primary.

Whatever you make of the legal merits, a bulk copy of the voter file would not have caught this failure. The rolls were internally consistent — every one of the 6,600 looked like a normal registration, because that’s what the broken flow produced. The contradiction lived upstream, in an MVC transaction that recorded a “no” and passed the person through. Compare those two systems against each other and the problem surfaces in an afternoon. Export either one alone, to anyone, and it never does.

The same goes for the federal screening tool now being offered as the answer. Roughly half the states have signed up to run their rolls through the expanded SAVE system; by recent reporting, 25 states have pushed more than 68 million records through it and surfaced some 28,000 apparent noncitizens and 400,000 deceased registrants. Those are useful leads, not verdicts — SAVE’s citizenship signal leans on Social Security data that was never built to establish citizenship, and it has a documented record of false hits.

Which puts SAVE’s output where New Jersey’s own 2,100 sit: a match is a candidate for review, not a decision. Treat database output as a deletion list and you will remove citizens, at a rate set by how confident you are. New Jersey learned that about its own file inside of a week, and the lesson carries straight over to the federal tool.

What would actually prevent the next one

The real fixes are boring and cheap, and mostly not the ones being argued about.

Make refusal end the transaction — and prove it. A “no” on citizenship has to stop the flow, not annotate it, and there should be a test that runs on every release proving a “no” produces no downstream registration. Without the test, the safeguard is an intention.

Reconcile the two systems on a schedule, in public. Match the MVC’s recorded answers against the registrations it generated, monthly, and publish the mismatch count even when it’s zero — especially when it’s zero, because that’s how you know the check is still alive. A small audit that runs every month beats a blue-ribbon commission that convenes once a decade.

Write the rule that was missing in June 2024. A defect that wrote bad records isn’t closed when the code is patched — it’s closed when the affected records have a cleanup plan with an owner, a date, and a disclosure decision made by someone with the authority to make one. Half of this scandal is not the bug; it’s the two years.

Give every match a human. Individual review, notice to the voter, and a chance to correct the record before removal rather than after. That’s what the counties are doing with the 2,100, and it should be the default for any list-driven process, including whatever comes back from SAVE.

Some of this is already moving in Trenton. A353 pairs a retrospective audit of registrations with a documentary proof-of-citizenship requirement at the MVC; A3802 and S4132 go at the registration prompt itself. The audit and the flow fix are the parts nobody seriously opposes, and they shouldn’t have to wait on the rest. Proof-of-citizenship is a genuine policy fight with real costs on both sides — including eligible citizens who can’t produce papers at a counter — and it deserves to be had on its own merits. It’s just a different argument from this one: a proof requirement wouldn’t have caught a system that ignored the answer it already had.

If you work with the file

Nothing here should change how you cut a universe. One record in a thousand, skewed toward people who overwhelmingly didn’t vote, is well inside the noise you already carry on any statewide file. If a client asks whether the file is compromised, the accurate answer is no. The more useful answer is that a voter file was never the kind of thing that’s simply clean or compromised.

Three practical notes.

Expect churn in the counties for the next several months, as the 2,100 referrals get worked twenty-one different ways on twenty-one different timelines, with some share reinstated. If a refresh shows removals you can’t explain in a county you’re working, this is probably what you’re seeing. It isn’t a purge, and it isn’t worth building a program around.

Watch your vintages. Nothing needs rebuilding, but if you’re comparing registration counts across refreshes in a heavily immigrant precinct this fall, some of the movement is administrative rather than political. Read it as turnout signal and your model gets worse.

And keep the general lesson, because it outlives the news cycle. A voter file is a record of an administrative process, not a portrait of the electorate. Every field carries the error rate of the counter that produced it, and the fields that look most like facts — citizenship, address, party, status — are usually a claim someone made once that nobody has checked since. That’s why Romulus is so stubborn about provenance and vintage: knowing which process wrote a field, and when, is the difference between using data and trusting it.

New Jersey spent two years demonstrating that difference in public; the rest of us get the lesson for free. If you’re trying to work out what this fall’s file churn means for a program you’re running — or you’d just like a second set of eyes on a county that moved — we do that.