Cliff Notes: 6,600 Non Citizen Voters in NJ

TL;DR

New Jersey's MVC software had a "default-allow" bug active June 2023–June 2024, registering 6,600 non-citizens to vote; approximately 400 cast ballots.
The error was caused by a private vendor's code, detected only through retrospective cross-referencing — not internal monitoring.
AVR glitches producing non-citizen registrations are a documented national pattern (CA, IL, MD, CO, PA), not a New Jersey anomaly.
The NVRA's self-attestation model and absence of mandatory SAVE verification created the legal and technical conditions for this failure.
The same incident is simultaneously evidence of a systemic integrity problem and evidence of routine administrative error — depending entirely on which harm (fraud or disenfranchisement) the evaluator weights more heavily.

NJ MVC used a physical keypad for eligibility questions; a logical inversion in the software processed "no" (or null) citizenship answers as "yes."
The bug ran undetected for 12 months due to absent anomaly-detection and inadequate system logging.
The 6,600 figure is a retrospective estimate; CISA's upper-bound projection is 35,152 potential non-citizens on NJ rolls.
Governor Sherrill terminated the private vendor contract after discovery.

NVRA (1993, signed Clinton) mandated DMV voter registration but requires only self-attestation of citizenship — no real-time database verification.
18 U.S.C. § 611 (1996) makes non-citizen voting in federal elections a felony; fewer than 50 federal prosecutions brought 1996–2026.
NVRA removal procedures require written notice, a waiting period, and administrative hearings for contested cases — preventing fast purges but also slowing legitimate removals.
Some of the 6,600 may have since naturalized, complicating eligibility determinations.

California 2018: 1,736 incorrect registrations from DMV data-coding error; none confirmed to have voted.
Illinois 2019–2022: Thousands registered due to REAL ID data-mapping error; discovered through internal audit.
Maryland 2020: ~400 non-citizens registered after software update failed to sync non-citizen indicator.
Colorado 2017: 141 confirmed non-citizen votes — one of few jurisdictions with documented prosecutions.
Pennsylvania (ongoing): ~90 confirmed non-citizen votes identified by Philadelphia Inquirer; prosecutors declined most cases.
In every case, discovery came from external audit or complaint, not internal quality control.

Richman, Chattha & Earnest (2014, Electoral Studies): 6.4% of non-citizens reported voting in 2008 (CCES data), implying 1M+ votes.
Ansolabehere, Schaffner & Luks (2015, Electoral Studies) rebuttal: the signal disappears after correcting for citizen respondents who self-misidentified as non-citizens.
Mainstream consensus (Brennan Center, MIT Election Lab, NCSL): non-citizen voting occurs but is rare and not election-determinative at statewide or national scale.

DHS SAVE provides real-time federal immigration status verification and is already used for Medicaid, professional licenses, and contractor checks.
Only 9 states used SAVE for voter roll maintenance as of 2017 (NCSL survey).
Opponents cite false-positive risk: data-synchronization delays can flag recently naturalized citizens as non-citizens.
Biden-era EAC (2021) encouraged post-registration SAVE checks but not pre-registration verification requirements.

~92% of U.S. jurisdictions use commercial election management software (EAC 2022 survey).
HAVA (2002) established EAC certification standards for voting machines but explicitly excludes voter registration systems.
Vendor NDAs limit public transparency about system vulnerabilities.
CISA's NJ investigation signals federal expansion into registration system security, beyond voting machine focus.

Germany, France, Sweden: compulsory civil registration links residency, citizenship, and voter rolls automatically — the NJ failure mode cannot occur.
Canada: Elections Canada cross-checks registration against IRCC citizenship database continuously.
U.S. decentralized, self-attestation model is a deliberate federalism and anti-suppression choice, not a technical oversight.

Each potentially violated 18 U.S.C. § 611, but good-faith reliance on government-issued registration cards is a viable due-process defense.
No charges filed against any of the 400 as of mid-2026 — consistent with historical prosecutorial practice when registration stemmed from government error.

Conservative framing: 400 illegal votes = unacceptable systemic breach; remedy = mandatory citizenship proof and SAVE verification at registration.
Progressive framing: 400/millions of votes cast = negligible; remedy = fix the software and auditing, not add access barriers with documented disparate impact.
The disagreement is a values conflict over which harm is primary — not a factual dispute resolvable by more data.