DATA FLOWS · NUMBERS MATCH THE LINES (1–117) · ORDERED BY WHERE EACH LINE STARTS, LEFT TO RIGHT, TOP TO BOTTOM
1State voter-registration DBs → Voter-roll collection. Full state rolls demanded and collected (commercial copies where states refused)
CNA v. Mullin ECF 87 p.2; Common Cause v. DOJ ECF 51 (vacatur Oct 9, 2026; no deletion order) · D
2State voter-registration DBs → Voter-data intake & target lists. Public voter files from states not using SAVE (CA, PA, NJ, NV) reviewed by DHS: more than 250,000 flagged (DHS’s count; method and matching source not stated). New edge, Oct 28 (late batch)
DHS “Alien Voter Registration Summary” p.1 (White House release) · D
3State voter-registration DBs → SAVE. Whole voter rolls uploaded in bulk (name, DOB, full or last-4 SSN), one case per person. Per DHS, 25 states and more than 68M records had been run by Jun 22, 2026 (10 full lists), and Georgia ran its full file in 2026 (counts as DHS states them)
SAVE PIA-006(d) pp.5–6; User Guide (Jun 2026) §§8.2, 10.2; LWV v. DHS ECF 111 (vacated Jun 22, 2026), stayed by the Supreme Court Sept 25, 2026; DHS voter-registration summary p.1; DHS letter to the AG p.3 · D
4DMV / Nlets → ERIC. Member states send “all licensing or identification records from motor vehicles departments” at least every 60 days, including SSNs and license numbers; records indicating non-citizenship may not be sent (ERIC model contract, as quoted by DHS)
DHS Secretary’s letter to the Attorney General, Sept. 2, 2026, pp.2–3 · D
5DMV / Nlets → SAVE. Driver’s-license search added to SAVE on paper; the Jun 2026 User Guide §8 says SAVE “cannot verify” status from a DL number
SAVE SORN Oct 31, 2025: “not live at the time of publication” · D, not live
648.2M records → Voter-data intake & target lists. 48.2M records “obtained … through independent sources” by DHS’s DAS for Election Integrity
ECF 87 p.2; FOIA Bates 057 and 131 say 48.4M (unreconciled) · D
7Data brokers → Voter-file purchase (Title 13). Commercial voter-registration data (Bridgetree) bought by Census. Signed Aug 10, 2026, performance from Sept 1: eight days before the Aug 18 brief
USAspending 13ADDC26C0002, $796K · D
8Data brokers → Fraud Detection directorate. Ad-tech-type commercial data (address, demographics, consumer behavior) used to clear or confirm names
ECF 87 p.3 (Dkt. 78-4 at 5); Bartell Decl. ECF 46-1 ¶10 · D
9SSA OIG → Fraud-center hub. SSA OIG is a charter partner; membership D, no data flow documented
DOJ NFDC release · U
10Passport records → ICE and CBP (agency level). Routine use (a), in place since 2015: DHS border, law-enforcement and fraud screening
FR 2026-21695; 80 FR 15653 (2015) · D, permitted
11Passport records → FBI field offices & IC3. Routine use (b): DOJ, including the FBI
FR 2026-21695 · D, permitted
12Passport records → Verification-platform users. Routine use (w), effective Nov 23, 2026, after Election Day and before certification: passport records to agencies and nonprofits “utilizing federal government verification platforms,” incl. “voter eligibility.” DHS and the platform are not named
FR 2026-21695, 91 FR 66906 (Oct 23, 2026) · D, permitted
13Consular Consolidated Database → SAVE. Passport and naturalization data (certificate and passport numbers, A-number, images); State receives name, DOB, SSN
SAVE PIA pp.6, 9, 13–14 · D
14Consular Consolidated Database → Identity Index. Visa applications from State’s CCD shown in PCIS
PCIS PIA-087 p.12 · D
15American Citizen Record Query → SAVE. U.S.-citizen passport record matches
SAVE PIA pp.6, 9 · D
16Immigration-court records → SAVE. Immigration-court records (IRIES)
SAVE PIA pp.8–9 · D
17Immigration-court records → Identity Index. Planned: “PCIS will connect to and query” immigration-court data; whether it went live is not shown
PCIS PIA-087 p.12 · U
18Cyber-victim notification → CISA (agency). Before anyone outside the Federal Cybersecurity Centers contacts a U.S. victim of a cyber incident, the notification is deconflicted through CISA and NCIJTF CYWATCH. Who leads NCIJTF is not stated in the report
Declassified “6 States” voter-data report (Jan. 2022 activity) p.2 n.1 · D
19Other systems SAVE queries → SAVE. Systems SAVE queries to answer agency requests: the 11 in the panel (incl. USCIS Salesforce CRM, contents not described, U), plus State CCD and ACRQ, HHS CMS and DOJ EOIR IRIES, drawn as lines 13, 15, 93, 16
SAVE PIA-006(d), Oct 31, 2025, pp.6–9 · D
20ERIC → State voter-registration DBs. Reports only when a state asks: eligible-but-unregistered lists, built by comparing the state roll with motor-vehicle records, and deceased registrants; states contact the people listed. DHS has asked DOJ whether this use of motor-vehicle data complies with the DPPA; ERIC says it is permitted (government-function exception), per the same letter
DHS Secretary’s letter to the Attorney General, Sept. 2, 2026, pp.2–4 and n.10 · D
21Voter-roll collection → Voter-data intake & target lists. DOJ voter rolls passed to DHS: 50.6M records ingested
ECF 87 p.2; FOIA Bates 057, 131; OLC opinion May 12, 2026 (“no impediment” to sharing with HSI) · D
22Voter-roll collection → DOJ-controlled SAVE account. Collected state lists run through SAVE under a DOJ-controlled account; DHS staff read-only. Status after the Oct 9 vacatur is U
OLC opinion, May 12, 2026, p.29; Common Cause v. DOJ ECF 51 pp.12–13 · D
23Voter-data intake & target lists → Fraud Detection directorate. Target lists to USCIS (FDNS), treated as “presumptively valid”: minimum 40 reviews, ≤12 minutes each (ECF 87); “≥40 a day” per the whistleblower disclosure. The review is USCIS’s own; no outside check is described
ECF 87 p.3; Bartell Decl. ECF 46-1 ¶¶10, 17; US v. California ECF 149 p.24 relies on the same disclosure · D
24Voter-data intake & target lists → iLab AI enrichment. DOJ rolls, “independent sources” records and USCIS-FDNS records to the iLab for “a compiled list of individual profiles”
ECF 87 pp.2–3; FOIA Bates 057, 125, 131; ECF 50-2 (Aug 31, 2026 weekly, “50 State Voter Roll Processing”) · D
25Enterprise data warehouse → SAVE. eCISCOR feeds VIS, the system behind SAVE and E-Verify; ad hoc extracts to federal law enforcement
eCISCOR PIA (Jan 2015) App. C and §6.1 · D
26Sprinklr social listening → Enterprise Data Lake. Social-media listening fed back into the lake
PLANXS II RFI · D
27CISA (agency) ↔ 2020 Election Day coordination. CISA led two of the day’s interagency partner syncs (ODNI led five, the NSC three); support was planned “through certification timeframe.” The log’s author unit is redacted
Election Day 2020 watch log pp.8–13, 51–53, 69–70 · D
28DOGE teams → Numident. DOGE in SSA systems; Numident searches after court limits
DOJ correction filing Jan 16, 2026, as reported by Nextgov and The Register (filing not in hand) · R
29DOGE teams → Enterprise Data Lake. DOGE access to the data lake via Databricks
USCIS CIO memo, Mar 28, 2025 (FedScoop) · R
30DOGE teams → Political advocacy group. “Voter Data Agreement” signed with an advocacy group; the filing reports no evidence SSA data was shared
DOJ correction filing Jan 16, 2026 (Guardian, Jan 21); Hatch Act referrals · R, use U
31DOGE teams → Cloudflare. SSA data shared through Cloudflare without approval
DOJ correction filing Jan 16, 2026, as reported (filing not in hand) · R
32DOGE teams → ICE and CBP (agency level). File with ~1,000 people’s PII went to DOGE with copies to DHS (office not stated) and a Labor DOGE associate; nothing ties it to target lists
DOJ correction filing Jan 16, 2026, as reported by Nextgov / The Register · R
33SAVE ↔ Numident. Query and response, not a bulk SSA load: SAVE sends name, DOB and SSN; SSA returns a match flag, citizenship code, death indicator and A-number
SAVE PIA pp.4–6, 12–13; DHS–SSA agreement May 15, 2025; SSA SORN 60-0058 RU 49 · D
34SAVE → Numident. Write-back: SSA updated about 25M records missing citizenship using SAVE data, and is “correcting” 8.5M it calls inaccurate
SSA press release, Oct 20, 2026 · D
35SAVE → Fraud Detection directorate. SAVE → FDNS referrals stopped after the Jun 22, 2026 LWV order; earlier ones kept under the FDNS SORN; whether they resumed after the Sept 25 stay is U
Bartell Decl. ECF 46-1 ¶¶11–15 · D
36SAVE → TECS subject records. Planned: passport matching through a CBP TECS passport service (“exploratory/planning”); whether built is U
SAVE PTA v.02-2025 pp.7–8, 17–19 · D, planned
37SAVE → CBFCC election pipeline. ~25,000 SAVE-flag leads; a further ~15,000 went to HSI’s financial-crimes unit (by Jan 2026)
ProPublica, Aug 14, 2026 (corrected Oct 16) · R
38SAVE → ICE and CBP (agency level). Shared case by case with ICE and CBP “when potential fraud or misuse is indicated”; who decides, and any review of the decision, is not described
SAVE PIA-006(d) p.15 · D, permitted
39SAVE → Law-enforcement & other agencies. Routine use G permits disclosure to law enforcement investigating violations. The SORN says SAVE data is not for civil immigration enforcement; no outside check on that limit is described
SAVE SORN, Oct 31, 2025, RU G · D, permitted
40SAVE → SAVE oversight accounts. Oversight accounts can view other agencies’ case data by benefit type or state; the holders are not named
SAVE PIA p.7; SORN RU M (eff. Dec 1, 2025) · D; holders U
41Fraud Detection directorate → Voter-lookup portals. Officers query state voter-lookup portals (attesting to be the voter in some states)
Whistleblower disclosure (allegation), public Sept 14, 2026; ECF 87 confirms only that it exists · R
42Fraud Detection directorate ↔ LexisNexis Accurint. California roll: FDNS sent names and addresses; Accurint returned aliases, SSNs, DOBs, dates of death, phones and addresses. FDNS’s contract vehicle is not identified
Bartell Decl. #2, US v. California ECF 107-2 ¶15, Ex. A · D
43Fraud Detection directorate → Numident. Direct SSA query outside SAVE (name, DOB, commercial SSN); SSA returns citizenship indicator, death date, A-number. No agreement or legal basis is stated (U); records with no Accurint SSN are not sent
Bartell #2 ¶¶14, 17 · D
44Fraud Detection directorate → Passport records. Direct State query (name, DOB, SSN) for passports, confirmed by hand in State systems. No agreement is stated (U)
Bartell #2 ¶¶17, 19 · D
45Fraud Detection directorate → CIS2, ELIS, CLAIMS, CPMS…. Enhanced records paired with an internal A-number “that may be the same individual” (multi-field match); databases not named
Bartell #2 ¶16 · D
46Fraud Detection directorate → TECS subject records. USCIS creates TECS “unlawful voter” records, including U.S. citizens (whistleblower, per ECF 87). The Oct 21 injunction bars field operations based wholly on TECS records against suspected citizens in 9 states; it does not stop record creation
ECF 87 pp.3–4 (citing ECF 10-7 at 21, 23, 50–51); ECF 46 pp.15, 37 · D
47Fraud Detection directorate → Homeland Security Investigations. Refined list of people FDNS judged “highly likely to be noncitizen aliens,” after a confidence score and two levels of FDNS’s own manual review
Bartell #2 ¶¶18–22, 24 · D
48Fraud Detection directorate → CBFCC election pipeline. Referrals to HSI: 26,235 USCIS-derived records prioritized (May 25, 2026), 1,586 leads sent to 24 field offices. Which HSI system receives them is U. Replaces the old “TECS → RAVEn” line
FOIA Bates 057, 130; Bartell #2 ¶¶12, 20, 22, 24; HSI Decl. ECF 46-2 ¶¶12–19 · D
49Fraud Detection directorate → iLab AI enrichment. “USCIS-FDNS Reviews” records sent for “secondary enrichment and identification of high-value targets”
FOIA Bates 057, 125–126, 131 · D
50CIS2, ELIS, CLAIMS, CPMS… → State Citizenship List. EO 14399 orders a list built from citizenship and naturalization records, SSA data, SAVE data and “other relevant Federal databases” (build deadline Jun 29, 2026)
EO 14399 (Mar 31, 2026) · D, ordered
51CIS2, ELIS, CLAIMS, CPMS… → Enterprise Data Lake. 130+ internal feeds into the data lake
PLANXS II RFI, Oct 29, 2024 · D
52CIS2, ELIS, CLAIMS, CPMS… → Identity Index. About 8 USCIS systems resolved into one profile per person
PCIS PIA-087 p.8 (“the list will change”) · D
53State Citizenship List → Chief election officials. State lists due ≥60 days before the election; enjoined for plaintiff states (“cease and reverse”); delivery elsewhere U. The EO lets people view and correct entries through a DHS-run process; no independent check is described
EO 14399 §2(a); First Circuit order Jul 25, 2026; FOIA Bates 140 · D, ordered; delivery U
54Enterprise Data Lake → Enterprise data warehouse. Warehouse and lake share the eCISCOR hub
PLANXS II RFI; P00022 (Aug 2026) · D
55Enterprise Data Lake → Senzing + Databricks graph. Entity-resolution graph built over lake data (2024 and 2026 orders checked; an earlier start is not established)
PLANXS II RFI; USAspending 70SBUR24F00000273, 70SBUR26F00000235 (renewed Sept 30, 2026) · D
56Enterprise Data Lake → Identity Index. Initial Identity Index load from the lake (CIS2, CPMS, ELIS, CLAIMS, State CCD, RAILS and others)
PCIS PIA-087 pp.20–21 · D
57TECS subject records → SAVE. TECS listed as a SAVE record source
SAVE SORN, Oct 31, 2025, record source categories · D
58TECS subject records → Encounter points. Lookouts surface when the person is encountered (border, benefit interview, field stop) and can prompt secondary inspection or HSI follow-up
ECF 87 pp.3–4; ECF 46 pp.15, 37; TECS PIA-021 pp.4, 12, 21 · D
59TECS subject records → Identity Index. Planned, not an input: “PCIS plans to connect to … CBP TECS … PCIS will display TECS information.” Whether it went live is not shown
PCIS PIA-087 (Dec 2022) pp.12–13 · U
60Automated Targeting System → Identity Index. Planned PCIS query of ATS; whether it went live is not shown
PCIS PIA-087 p.13 · U
61Biometric repository → Identity Index. Biometric events from IDENT feed PCIS
PCIS PIA-087 · D
62Identity Index → SAVE. SAVE’s verification service calls the Identity Index: class of admission, work authorization, naturalization
PCIS PIA-087 p.9 · D
63Identity Index ↔ CBP encounter systems. Two-way identity exchange with CBP e3, Unified Secondary and UIP; A-number validation and issuance
PCIS PIA-087 pp.14–15, 20–21 · D
64Identity Index → Human review of close matches. Low-confidence matches go to human review
PCIS PIA-087 pp.10, 25 · D
65Identity Index → Do Not Pay. PCIS-covered SORNs gain a Treasury Do Not Pay routine use; use not shown
FR 2025-24030; effective Jan 30, 2026 · D, permitted
66Homeland Security Investigations → Fraud Detection directorate. HSI formatted the roll and sent it to FDNS about May 8, 2026
Bartell #2 ¶21; McLoughlin Decl. #1 ECF 62-3 ¶¶21–22 · D
67Homeland Security Investigations → Biometric image search. Observer photos sent to a CBP colleague for a biometric image search, then a name query
Hilton ECF 142 p.5 · D
68Homeland Security Investigations → “Federal law enforcement systems”. HSI refined the list “with federal law enforcement systems” and “approved analytic capabilities”; the systems are not named (U)
McLoughlin #1 ECF 62-3 ¶¶16–17, 23 · D
69Homeland Security Investigations → Enforcement & Removal Ops.. HSI voter cases sent “to ERO to determine alienage”
HSI Decl. ECF 46-2 ¶¶14, 19; ECF 46 p.14 · D
70Homeland Security Investigations → SAC offices. Each profile referred to the applicable HSI field office for criminal investigation
ECF 62-3 ¶19 · D
71Homeland Security Investigations ↔ FBI field offices & IC3. Joint voter-fraud work: HSI Cleveland and FBI plans on seven Ohio “consolidation centers” for canvasser data; NJ Election Integrity Task Force; Hennepin; Honolulu
FOIA Bates 025, 085, 094, 099, 125, 129, 141, 163 · D
72Homeland Security Investigations → Prosecutors: ballot suits & charges. 20,930-name list to DOJ and the U.S. Attorney’s Office (C.D. Cal.), Oct 13, 2026
ECF 62-3 ¶24; Bartell #2, conclusion · D
73Homeland Security Investigations → Prosecutors: ballot suits & charges. Referral to DOJ for prosecution when the person is likely a noncitizen
ECF 46 p.14 (HSI Decl. ¶¶22–23) · D
74Homeland Security Investigations → Ballot-hold demands. Same list hand-delivered to the LA County Registrar on an encrypted drive, Oct 13 (the court calls it a password-protected thumb drive)
ECF 62-3 Ex. A; US v. California ECF 149 p.3 · D
75Homeland Security Investigations → Fraud-center hub. HSI (the organization) is a founding partner; membership D, no data flow documented
DOJ NFDC release, Aug 24–25, 2026 · U
76CBFCC election pipeline → Investigative Case Mgmt.. Voter-registration nonprofits searched: “No derogatory information … in ICM, Athena, or Fincen”
FOIA Bates 129 · D
77CBFCC election pipeline → Athena (“HSI Tool”). Same nonprofit searches run in Athena (in use May 2026, not only a 2025 pilot)
FOIA Bates 129 · D
78CBFCC election pipeline → Bank Secrecy Act reports. Same nonprofit searches run against FinCEN data
FOIA Bates 129 · D
79CBFCC election pipeline → Field interviews, home visits. “Field validation” of voter leads; organizations reviewed
HSI CBFCC “Election Integrity Investigations,” Jun 15, 2026 (FOIA) · D
80iLab AI enrichment → Targeting platform. By Jul 6, 2026, HSI reported six states’ iLab-enriched rolls “pending Palantir entry into ELITE” (D); Palantir and a source say voter data was never integrated (R); whether entry happened is U
FOIA Bates 125–126 (May 25: “Discussions ongoing”), 140 (Jul 6: MO, MI, NM, CT, GA, KY) · D pending · U · R
81CORE, Lead Tracking, RAVEn GO → Investigative Case Mgmt.. RAVEn products entered in ICM by the reviewing analyst (leads become cases)
RAVEn PIA; ICM PIA · D
82CORE, Lead Tracking, RAVEn GO → Field interviews, home visits. Target lists drive field interviews (D, ECF 87); RAVEn as the system that holds them is our inference. Findings go to the CVFI Portal (line 116)
ECF 87 p.4; RAVEn PIA App. B · I
83Investigative Case Mgmt. → TECS subject records. ICM subject records become TECS lookouts; shown on U.S.-citizen observers (border detention Mar 16, 2026)
Hilton v. Mullin (D. Me.) ECF 142 pp.6, 14 (CBP 30(b)(6) deposition) · D
84Investigative Case Mgmt. → CORE, Lead Tracking, RAVEn GO. Case files, reports of investigation, tips and warrant returns flow to RAVEn (the documented automatic direction)
RAVEn PIA App. A · D
85Continuous monitoring → CORE, Lead Tracking, RAVEn GO. Possible alerts into HSI leads; the J&A says results are “compatible with ICE systems” and names no destination
DASS J&A-26-0099 pp.3–5 · I
86Mobile Fortify, body cams → Passport records. Mobile Fortify queries State visa/passport photos, plus TECS, NCIC, Nlets
404 Media, WaPo, NPR (2025–26) · R
87Mobile Fortify, body cams → Biometric repository. Field face scans retained 15 years; receiving system U
DHS document via 404 Media, Oct 2025 · R
88Enforcement & Removal Ops. → Removal charges. Removal charges for voting under INA 237(a)(6)(A), which needs no conviction or knowledge; applied Jul 4 (El Paso) and Jul 22 (400 NJ voters)
FOIA Bates 112–116, 152 · D
89Identity & Benefit Fraud Unit → Fraud Detection directorate. Voter-fraud NTA coordination with USCIS “to initiate removal proceedings”
CNA v. Mullin ECF 50-1, AR-1-001 (Mar 13, 2026 HSI broadcast) · D
90HSI weekly reports → DAS for Election Integrity. Voter-fraud weekly cleared through HSI and the ICE Director’s office to DHS Policy (DAS for Election Integrity)
FOIA Bates 044–058, 117–133, 147–151 · D
91HSI weekly reports → Voter-fraud reports. HSI fraud WAR finalized “for submission to VP Task force”
HSI report, Jun 16, 2026 (FOIA Bates 135) · D
92Criminal Voter Fraud Initiative Portal → DAS for Election Integrity. Photos and videos for “national DHS staff” for “[m]edia and [r]eporting”; the office is not named, so the Policy box is approximate (U)
ECF 87 p.4 · D
93Medicaid enrollment → SAVE. HHS CMS records
SAVE PIA pp.8–9 · D
94Medicaid enrollment → CORE, Lead Tracking, RAVEn GO. Medicaid data reach DHS/ICE (reported, line 95); landing in RAVEn is our inference: App. A does not list CMS
AP, Jun 2025; RAVEn PIA App. A (absence) · I
95Medicaid enrollment → ICE and CBP (agency level). Medicaid enrollee records to ICE; receiving system U
AP, Jun 2025 · R
96Master Earnings File → CORE, Lead Tracking, RAVEn GO. Earnings on SSNs of people not authorized to work, annually
RAVEn PIA App. A (Jun 2025 posting; may be older) · D
97Taxpayer addresses → CORE, Lead Tracking, RAVEn GO. IRS addresses reach ICE (reported, line 98); landing in RAVEn is our inference: RAVEn PIA App. A does not list IRS
IRS–ICE MOU Apr 7, 2025 (reported); RAVEn PIA App. A (absence) · I
98Taxpayer addresses → ICE and CBP (agency level). Taxpayer addresses to ICE for immigration enforcement; receiving system U
IRS–ICE MOU Apr 7, 2025 (reported) · R
99Taxpayer addresses → Fraud-center hub. IRS-CI and TIGTA are partners; membership D, no data flow documented
DOJ NFDC release · U
100Pandemic-loan data → CORE, Lead Tracking, RAVEn GO. PPP / EIDL loan data, including nationality “where … known”
RAVEn PIA App. A · D
101Pandemic-loan data → Fraud-center hub. PRAC contributes “existing data and analytical capabilities” (scope U); IG matches are exempt from the Computer Matching Act
DOJ NFDC release; PRAC statement Aug 25, 2026 · D
102Bank Secrecy Act reports → CORE, Lead Tracking, RAVEn GO. Bank Secrecy Act reports, daily
RAVEn PIA App. A · D
103Bank Secrecy Act reports → Fraud-center hub. FinCEN is a partner; membership D, no data flow documented
DOJ NFDC release · U
104Election-case concurrence → FBI field offices & IC3. FBI field offices needed PIN Election Crimes and FBI HQ Public Corruption Unit concurrence to open the case; PIN set its scope and timed overt steps around elections (JM 9-85.300, 9-85.500). A DOJ check on the FBI, not an outside one. Documented 2021–23; current practice U
FBI Michigan release: opening EC Mar. 16, 2021 p.5; PIN emails Mar. 11 and Apr. 1, 2021, Feb. 2 and Oct. 3, 2023 · D; 2026 use U
105FBI field offices & IC3 → Law-enforcement & other agencies. IC3 entries are “maintained and controlled by the FBI,” go to FBI records systems and are kept for “possible referral”; no retention period stated
ic3.gov privacy page (read Oct 28) · D
106FBI field offices & IC3 → 2020 Election Day coordination. An FBI liaison embedded with the DoD/IC team passed tips into the Election Day chat (the Maricopa tip at 0100); the FBI led domestic actions
Election Day 2020 watch log (declassified Jul. 30, released Aug. 6, 2026) pp.8–13, 17–21 · D
107Law-enforcement & other agencies → CISA (agency). Federal agencies’ security logs: CISA and FBI get conditional access after a “known or suspected compromise”
OMB M-26-14 (content via an Oct 8 procurement addendum) · R
108Fraud-tip intake → Prosecutors: ballot suits & charges. Public tips and reward claims to DOJ (D). WHIP categories exclude elections, so a tie to ballot suits is our inference
DOJ WHIP launch Oct 20, 2026; FR 2026-21578 (Oct 22) · I
109Prosecutors: ballot suits & charges → Secretary of State. HSI’s declaration says DOJ passed the list to the Secretary of State (D that HSI says so); the court’s order says the requests were emailed to the Secretary without the list. Unreconciled
ECF 62-3 ¶24; ECF 149 p.3 · U
110Prosecutors: ballot suits & charges → Ballot-hold demands. 48-hour hold letters to counties from U.S. Attorneys’ offices; prosecution warnings
AP / Democracy Docket, Oct 23–24, 2026 · R
111Prosecutors: ballot suits & charges → Ballot-hold demands. US v. California asks the court to stop counting listed voters’ ballots. A county declaration in DOJ’s papers says systems can set them aside automatically; LA County says its system cannot do it safely before Election Day
Complaint, US v. California (Oct 15, 2026); ECF 107-4 ¶¶4–7; ECF 149 p.23 · D
112Prosecutors: ballot suits & charges → Chief election officials. U.S. Attorney’s request to the Washington Secretary of State to set aside ballots of 405 alleged noncitizen registrants
Washington State Standard; KOMO (Oct 26–27) · R
113Secretary of State → Homeland Security Investigations. California roll as of Aug 2025 (name, address, DOB; no SSNs). Purchased from the California Secretary of State (buyer not named in the declarations; DOJ’s ECF 57 says DHS) and given to HSI by a DHS senior counselor about Mar 19, 2026, under a release letter barring transfer without the Secretary’s authorization
Bartell #2 ECF 107-2 Ex. A p.9; McLoughlin Decl. #2 ECF 107-3 ¶¶5–6; Common Cause v. DOJ ECF 57 (Oct 16) · D
114Ballot-hold demands → FBI field offices & IC3. Election officials report cyber incidents to FBI field offices or IC3 (D). The investigating agency then holds the evidence (I)
FBI/CISA PSA I-101626-PSA (Oct 16, 2026) · D
115Ballot-hold demands → FBI field offices & IC3. Fulton County 2020 ballots, tapes and voter rolls seized by FBI warrant, Jan 28, 2026 (box count not sourced)
ABC7, Jan 29, 2026 · R
116Field interviews, home visits → Criminal Voter Fraud Initiative Portal. Agents’ findings, photos and videos documented “outside the normal operational process”
ECF 87 p.4 (Dkt. 50-2 at 2–3) · D
117Fraud-center hub → Prosecutors: ballot suits & charges. Pre-drafted warrant affidavits and complaint language to prosecutors
FBI account, Sept 17, 2026 (outlet not recorded) · R
