A software vendor called IDEMIA built a system that was supposed to prevent non-U.S. citizens from being registered to vote when they applied for driver’s licenses or identification cards at the state’s Motor Vehicle Agencies. The system failed for a full year — June 2023 through June 2024 — and 6,600 people who told the state they were not citizens were added to the voter rolls anyway. Fewer than 400 of them voted. They voted as Democrats, Republicans, and unaffiliated voters scattered across the state. Those are the confirmed numbers, and they are not contested by anyone with access to them.

What happened next is the story. Governor Mikie Sherrill, who took office in January 2026 — after the error had already ended and been internally identified — disclosed it publicly, ordered everyone erroneously registered removed from the rolls, launched an investigation through her chief counsel, and began the process of replacing the vendor. “When we find a problem, we don’t hide it, deny it, or invent conspiracies,” she said. “We investigate it, we fix it, and we tell the public.” That is the kind of statement a state executive is supposed to make, and it is the last uncontested sentence in this story.

The federal numbers don’t hold up

Within days of New Jersey’s disclosure, the Trump administration was pointing at the state’s error as proof of a systemic crisis. The week before, the president said in a White House address that the Department of Homeland Security had “concluded” that 250,000 noncitizens are registered to vote in New Jersey, California, Nevada, and Pennsylvania. DHS Secretary Markwayne Mullin subsequently wrote to New Jersey officials that a preliminary review found as many as 35,152 noncitizens could be registered in the state alone.

Take the federal numbers at face value for a moment. DHS says 35,152 noncitizens could be on New Jersey’s rolls. New Jersey’s own investigation found 6,600. That gap — a federal figure roughly 5.3 times the confirmed count — is not a rounding error. It is the distance between a number someone verified and a number someone extrapolated. The DHS methodology for getting to 35,152, according to the department’s own communications, was to compare publicly available voter registration records against federal immigration data. Election experts have said the administration has not supported the 250,000 figure across four states with transparent methodology. Voting-rights groups and legal experts have been more direct: federal databases, they say, are themselves inaccurate when merged and searched in bulk.

This is not a partisan nitpick. The federal government is simultaneously suing 30 states to obtain unredacted voter rolls, and it is pushing proof-of-citizenship legislation through Congress ahead of midterm elections. The New Jersey incident is not incidental to that legislative push — it is the exhibit A. The figure 35,152 was produced for a purpose, and the purpose was not methodological transparency. More than a dozen district court judges, including several appointed by the current president, have ruled in favor of states resisting the federal demands, finding they exceed federal authority or violate privacy laws. The judicial record matters here because it means the database-matching methodology that produces the federal numbers has been tested in court and found insufficient — not by Democrats, but by the judiciary.

The Trump administration did not discover 35,152 noncitizens on New Jersey’s rolls. It generated a statistical estimate using the same kind of bulk database matching that produces false positives at scale, and it presented that estimate with the certainty of a confirmed finding. When the president said the department had “concluded” that 250,000 noncitizens are registered to vote across four states, he was converting a preliminary, unverified model run into a settled fact. That is not how data works, and the administration knows it.

The civil-liberties defense is doing the same thing in reverse

The other side of this argument has its own numbers game, and it is no more honest. The civil-liberties and data-quality frame points at the same 6,600 registrations and draws exactly the opposite conclusion: the error was bounded, fewer than 400 people voted, the margin of victory in New Jersey’s 2024 presidential race — Kamala Harris beat Donald Trump by more than 250,000 votes out of 4.27 million cast — makes those 400 votes operationally irrelevant, and the system caught and corrected the problem. The real danger, this logic argues, is not the bug but the purge — the overcorrection that could strip eligible voters from the rolls using the same unreliable federal database matching the administration is already deploying.

The argument is not wrong about the overcorrection risk. It is wrong about what it implies. A system that allowed a vendor to ship software with a citizenship-verification failure — a failure that ran undetected for a full year under the previous administration of Governor Phil Murphy — does not get to claim the victory lap. Saying “the system works” because the error was eventually caught is like saying a bridge is safe because it has not collapsed yet under the load it was carrying when nobody was inspecting it. The year-long gap between the error’s start and its discovery is not evidence of resilience. It is evidence that the detection layer was absent or nonfunctional, and that absence is precisely what Sherrill’s investigation is designed to examine.

Sherrill herself is performing this calculation in real time. Her statements serve a dual political function that is visible if you look at them as acts rather than as words. By disclosing the error and ordering its correction, she positions herself as the competent executive who fixes problems. By linking the error to the prior Murphy administration, she assigns blame upward. Both moves serve her political interest; both may also be accurate. The point is not that Sherrill is insincere — the point is that disclosure in this environment is never purely administrative. It is also a competitive move in a governance narrative, and the “we don’t invent conspiracies” line is aimed directly at the federal government’s competing framing. The disclosure is doing real work. It is also doing political work. These are not mutually exclusive.

What both sides are hiding from

The pattern is structural: a confirmed error is seized as ammunition for a pre-existing legislative program, and the actual scale of the error is subordinate to the scale of the story each side needs to tell.

For the Trump administration, 6,600 is a floor. The security-threat logic treats any confirmed noncitizen registration as proof that the mechanism exists and that uncovered registrations imply an iceberg of uncovers beneath the surface. The 6,600 becomes evidence of 35,152, which becomes evidence of 250,000, which becomes proof of a systemic failure requiring federal intervention. The logic is unfalsifiable: the absence of evidence for larger numbers is reinterpreted as evidence that the search was not thorough enough. This is the construction method for a policy conclusion, not a factual finding.

For the data-quality defense, 6,600 is a ceiling. The error was found, it was bounded, 400 votes were cast out of 4.27 million, and the margin was 250,000 — so what is the problem? The problem is the year. The July 2023-to-June 2024 error window represents a period in which the system failed its primary gating function and nobody noticed. The defense skips over that detection lag because acknowledging it undermines the “the system is resilient” thesis. A system that needs a change of governor to find a year-old registration error is not resilient — it is lucky that someone cared to look.

The real question neither side wants asked is the simplest one: what would have happened if the error had not been caught? If Sherrill had not taken office, or if the transition had not prompted an internal review, how many more years of erroneous registrations would have accumulated? The answer to that question determines whether the 6,600 is a one-time glitch or a symptom of an architectural failure in how motor vehicle agencies connect to voter rolls — a failure that vendor replacement may or may not fix, depending on whether the defect was in IDEMIA’s code or in the state’s integration of that code, a determination the investigation has not yet made.

IDEMIA, for its part, declined to comment. The company provides driver’s license and identity services to more than 30 states. Whether the software defect was in IDEMIA’s code, a system integration failure by New Jersey’s Motor Vehicle Commission, or a configuration error is not determined. That determination has blown past the debate entirely because neither the security-threat frame nor the civil-liberties frame needs it. Both frames have their conclusions already. The vendor’s silence and the technical causation gap are casualties of a discourse that has moved past what happened to what the incident is useful for.

Who is actually hurt

The approximately 6,600 people whose names were removed from the voter rolls are the one party in this story with no representation and no public voice. They told the state they were not citizens. The state registered them to vote anyway. Now they have been removed — but they also exist in a data environment in which DHS is matching voter rolls against immigration databases and the federal government is pushing to expand its access to state records. Whether any of them face immigration consequences from having been erroneously added to and then removed from a voter roll is a question nobody in New Jersey’s disclosure is positioned to answer, because the answer depends on federal enforcement decisions that are not in the state’s control.

Sherrill’s statement — that the state would contact affected residents through the removal process and “protect people” — implies an acknowledgment that public exposure carries risk for these individuals. Their silence is not a data point. It is a structural feature of an environment in which being named in a voter-registration error is a liability across multiple government systems simultaneously. They are the direct causal subject of this story and they are entirely absent from the policy debate their error has inflamed. Every framing instrument deployed in this debate — the 6,600 as a floor, the 6,600 as a ceiling, the 400 votes as a breach, the 400 votes as a rounding error — treats these individuals as a number. Nobody is asking what the error meant for them.

What actually happened

New Jersey found a defect in a vendor-supplied system. The defect ran for a year and registered 6,600 people who should not have been on the rolls. Fewer than 400 voted in a state where the presidential margin was 250,000. The governor disclosed the error, ordered the names removed, launched an investigation, and began replacing the vendor. That is the administrative story, and it is what good governance looks like when it works.

The rest of this story is politics. The federal government is using 6,600 confirmed names to justify a national legislative program built on unverified methodology. The civil-liberties defense is using the same 6,600 names to argue that the system is fundamentally sound despite a year of undetected failure. Both sides have a political infrastructure invested in what the incident confirms: the security-threat frame needs the incident to prove systemic fraud, the data-quality frame needs it to prove systemic resilience, and neither frame can tolerate the possibility that the incident proves only that a vendor shipped bad software and the state eventually found it.

New Jersey caught a bug and told the public about it. That is the part both sides would prefer you forget. In a political environment in which a confirmed, bounded error becomes the raw material for competing national narratives — one inflating it into proof of a crisis, the other deflating it into proof of resilience — the boring, important fact is that the system did what it was supposed to do. It found the problem. It removed the names. It told the voters. The competing narratives about what the error means for federal legislation, for state sovereignty, for civil liberties, and for the midterm elections are all playing out on top of that fact, and none of them can change it.

The numbers in this piece — 6,600, fewer than 400, 35,152, 250,000, 4.27 million — are confirmed from the source record. The political spinning of those numbers is confirmed from the same record. The attribution of motive to political actors reflects documented conduct, not speculation.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Red-Team Assessment
Models a capable adversary probing a plan for the seams they would exploit.
Stakeholder Mapping
Charts the parties to a situation — their interests, power, and alignments.
Worldview Cartography
Maps the clashing worldviews underlying a dispute.