STRUCTURAL ASSESSMENT

Democratic Integrity, Surveillance Infrastructure, and the Acceleration of Institutional Risk in the United States

April 2026

This assessment synthesizes analysis of two primary source documents — a technical report on Department of Homeland Security data centralization and a structural audit of the American electoral system — together with historical case study and examination of emerging technological factors. It is intended as a sober structural analysis, not a partisan document. The mechanisms described do not require attribution of bad faith to any individual actor. They are the accumulated result of decisions that each made local sense and collectively produced a system whose behavioral substrate is thinner than its formal architecture assumes.

I. The Core Distinction: Formal Architecture and Behavioral Substrate

Every complex system rests on two layers. The formal layer — the rules, statutes, technologies, and legal structures — is visible and legible. The behavioral layer — the commitments that actors make to operate within those rules even when violation would be advantageous — is invisible until it fails.

For most of the modern American era, the behavioral layer was not interrogated because it did not need to be. Officials certified results they did not like. Candidates conceded races they disputed. Administrators enforced legal constraints even when political pressure suggested otherwise. These were not heroic acts. They were the baseline assumption of a system that had never seriously tested whether the assumption would hold under pressure.

That assumption has now been tested across multiple domains simultaneously. The formal architecture remains nominally intact. But the operational reality of what that architecture can deliver — free and fair elections, equal protection, due process, freedom of association, meaningful judicial review — is being systematically stressed at a rate that the system's self-correction mechanisms were not designed to match.

II. The Surveillance Infrastructure

The Biometric Foundation

The Department of Homeland Security has constructed a technical surveillance architecture of unprecedented scope and capability. The cornerstone is the Homeland Advanced Recognition Technology system, known as HART, which replaces legacy fingerprint-based databases with a cloud-native infrastructure hosted within Amazon Web Services GovCloud. The system is designed to store and manage the personally identifiable information of over 290 million individuals — approaching the full adult population of the United States.

HART is not simply a larger version of what preceded it. It introduces qualitative changes in what the government can do with identity data. Beyond fingerprints and facial images, the system supports iris scans, voice data, and DNA records, alongside biographical information including Social Security numbers and passport details. Most significantly, it is engineered to identify what its designers call non-obvious relationships — mapping the social, familial, and professional networks of both foreign nationals and United States citizens.

Government Accountability Office review found that DHS had implemented only five of twelve required privacy safeguards for the system. Mission partners numbering 140 — ranging from local law enforcement to foreign governments — have not been verified to appropriately dispose of data under retention schedules that can extend to fifty years. The oversight infrastructure has not kept pace with the technical infrastructure.

AI-Driven Targeting and the Palantir Ecosystem

The centralization of data is intensified by the integration of advanced analytics platforms. Immigration and Customs Enforcement has contracted with Palantir Technologies to develop a system called ImmigrationOS, augmenting an existing case management infrastructure with artificial intelligence and data mining capability. While the public justification centers on immigration enforcement, the underlying architecture facilitates surveillance well beyond that mandate.

The existing case management system already integrates license plate reader data, cell phone records, air travel data, and driver's license scans. Funding documents explicitly state that United States citizens are subject to inclusion within the system as potential targets of criminal investigations or as individuals with affiliations to persons under immigration review. A subsystem called ELITE receives sensitive address data from the Department of Health and Human Services, including Medicaid records, allowing enforcement agents to populate targeting maps with address confidence scores derived from the correlation of health and residence data.

For United States citizens who live in mixed-status households or who are related to non-citizens, sensitive health and residence information is being leveraged for enforcement purposes. The centralization of government data that was historically siloed — tax files, Social Security records, health records, and private-sector datasets — enables the creation of comprehensive digital profiles on millions of individuals who are not themselves subjects of any investigation.

Field-Level Biometric Capture

The Mobile Fortify application represents a further extension of this infrastructure into daily life. The application allows field agents to capture facial images and fingerprints using a smartphone, comparing results in real time against a centralized database drawing on over 200 million images from DHS, the FBI, and the Department of State. Unlike biometric screening at airports, which typically involves notice and an opportunity to decline, Mobile Fortify is used during street-level encounters without consent. Internal documents confirm that individuals do not have the right to refuse a scan.

Critically, data collected during encounters that produce no match — where the individual is entirely unknown to existing watchlists — is retained in federal systems for fifteen years. Every United States citizen encountered by a field agent is thereby permanently enrolled in a federal tracking database regardless of any wrongdoing or legal basis for the encounter. The expansion of this capability to local law enforcement through formal partnership agreements effectively converts local police into biometric sensors for the federal government.

The Citizenship Verification Layer

The Systematic Alien Verification for Entitlements program, known as SAVE, has been modernized to extend DHS data systems into additional domains. Used by over 1,200 federal, state, and local agencies to verify eligibility for public benefits and licenses, SAVE now maintains records on naturalized citizens and individuals who have acquired citizenship through birth abroad to American parents. A significant modification in 2025 authorized SAVE data to be used for voter registration and voter list maintenance — directly integrating DHS into the administration of democratic processes.

The program employs a machine learning model that provides ranked confidence scores determining whether an individual is granted or denied a benefit. When that system produces an error — flagging a legitimate citizen as a non-citizen — the consequences include denial of essential services, suspension of licenses, or removal from voter rolls, often without a clear mechanism for the individual to contest an automated decision they may not know has been made.

III. The Electoral Architecture Under Stress

The Behavioral Commitments That Have Failed

The American electoral system depends on a series of behavioral commitments that the formal legal architecture assumes will be honored. Those commitments are being broken or severely stressed across multiple dimensions simultaneously.

The concession norm — the expectation that losing candidates accept definitive results — is broken. It was never a law. It was sustained by every prior loser's calculation that the long-term cost of refusal exceeded the short-term cost of acceptance. That calculation has been publicly revised, and the norm cannot be restored by a single election cycle.

County-level certification was assumed to be a ministerial act — administrative, not political. At least twenty-two county officials in battleground states voted to delay or refuse certification in recent cycles. Georgia's State Election Board formalized a discretionary posture that creates mechanisms for delay with no resolution pathway faster than federal deadlines require. The clerical act has become contested terrain.

The administrative workforce that operates elections has experienced severe attrition. Every county election official in Arizona has turned over since 2020. Across the western United States, half of chief local election officials have departed. Seventy percent of those who remain report experiencing intimidation. Nearly a quarter of the 2024 election workforce was handling a presidential election for the first time. The institutional knowledge of how to manage a contested high-pressure count — knowledge that lives in people, not manuals — has largely left the system at precisely the moment it is most needed.

The Legal Ambiguity Layer

The Electoral Count Reform Act of 2022 addressed the federal certification layer — the Vice President's ministerial role, the objection threshold, the Governor's authority over electoral certificates. It did not address the hundreds of smaller county and state administrative decisions that must be completed before a Governor can issue that certificate. A coordinated refusal across multiple counties in a single battleground state would generate more legal petitions than the state judiciary can process within federal deadlines.

A further ambiguity exists in the statute itself. The law is silent on what happens to the total count of appointed electors if Congress rejects individual electoral votes as not regularly given. If the denominator drops, the 270 threshold drops with it — or the calculation becomes sufficiently ambiguous to trigger a contingent election under the Twelfth Amendment, decided by one vote per state delegation. This is a documented legal gap in a statute passed specifically to close legal gaps, and it has been identified by legal scholars whose work has been read by the actors most likely to test it.

The Judiciary as Last Load-Bearing Institution

Every other mechanism of institutional containment — administrative professionalism, the concession norm, the ministerial certification, cross-state data infrastructure — has been partially compromised. The courts have absorbed the resulting stress. Mandamus petitions compel reluctant certifiers. Summary judgments dismiss manufactured litigation. Federal courts have, to date, declined to validate claims without evidentiary foundation.

But the judiciary's own behavioral commitment is not a fixed quantity. It is subject to appointment architecture designed to shift its composition, jurisdiction-stripping legislation that removes certain questions from its reach, and a volume of litigation that exceeds its operational capacity. A system whose resilience depends entirely on a single institution's behavioral commitment — and that institution is itself under structural pressure — has transferred its fragility to the last node in the chain.

IV. The DOGE Episode and the Data Access Question

The Department of Government Efficiency episode represents a convergence of the surveillance infrastructure and electoral integrity concerns into a single acute event. A small team with minimal security vetting, unclear legal authority, and no meaningful external oversight sought and in some cases obtained access to the most sensitive federal data systems in existence — Treasury payment systems, Social Security Administration records, Office of Personnel Management files, Education Department loan records, and IRS taxpayer data.

The mechanism of access was as significant as the access itself. Previous administrations accessed sensitive data through established channels with legal frameworks, oversight structures, audit trails, and personnel operating under defined authorities. This episode routed access through individuals whose governmental status was ambiguous — employees, contractors, consultants, or advisors, depending on the framing — creating jurisdictional uncertainty that existing law does not cleanly resolve. This is structurally identical to the fusion center model that routes federal surveillance through local police to circumvent legal restrictions on direct federal collection.

Career officials who resisted access — enforcing the legal constraints their positions required them to enforce — faced removal or reassignment in some agencies. The institutional knowledge of how to resist improper access requests, which legal provisions apply, what escalation paths exist, what documentation to create, lives in people. When those people are replaced, the knowledge goes with them. The next improper request meets a workforce that has not seen the resistance playbook executed.

Federal courts issued temporary restraining orders blocking access to Treasury and Social Security systems, with judges finding likely violations of the Privacy Act. The legal question of whether a line was crossed remains in litigation. The more important question is technical and may be unanswerable: when an AI system accesses a dataset, it can ingest, index, model, and potentially transmit the entire contents in seconds. The access and the permanent capture are simultaneous. Revoking access going forward does not address what may have been captured during access. Audit logs that might answer that question were in some cases managed by the same personnel conducting the access.

V. The AI Factor

Breaking the Arithmetic of Surveillance

Every prior surveillance and control system was ultimately constrained by a fundamental arithmetic problem: the ratio of watchers to watched. You can monitor a dissident. You can monitor a movement. You cannot manually monitor a population. The resource cost of monitoring grows linearly with the number of targets while the state's capacity to hire, train, and deploy human analysts remains fixed. This constraint historically gave civil society its operational space — the state simply could not watch everyone.

Artificial intelligence breaks that arithmetic. The surveillance infrastructure described in this report does not require human analysts to review footage, read files, or trace connections. HART's relationship mapping identifies social networks automatically. ImmigrationOS's pattern finding predicts location and behavior from historical data. Mobile Fortify's non-match retention builds the training dataset with every deployment, including every deployment that finds nothing. The constraint that gave resistance movements time to organize has been structurally removed.

Laundering Political Decisions into Administrative Ones

Perhaps the most consequential capability is subtler than identification or tracking. Confidence scoring systems — in ImmigrationOS, in the SAVE Verification Match Model, in targeting systems across the DHS ecosystem — convert political decisions into administrative outputs that carry the authority of algorithmic objectivity.

Decades of research on automation bias confirm that humans systematically over-trust algorithmic outputs, especially under time pressure and cognitive load. The official who might push back against a questionable human directive will often defer to a system score without question — because the system appears neutral, objective, and unchallengeable. When an algorithm determines whether someone receives benefits, remains on voter rolls, or becomes an enforcement target, the human reviewing that output experiences it as a fact rather than a decision. The political judgment that produced the system design has been laundered into an administrative process.

The Asymmetry of Offense and Defense

AI-powered systems can generate, at essentially zero marginal cost, litigation documents, administrative challenges to voter registrations across millions of records simultaneously, and targeted scrutiny of individuals or groups meeting specified criteria. The defensive institutions — courts, journalists, election officials, civil society lawyers — respond to each of these at human speed, with human resources, one at a time. The load being applied to the judiciary as the last load-bearing institution can be increased essentially without limit, while the institution's capacity to bear it remains fixed.

Irreversibility

The AI factor introduces a form of institutional path dependency that has no clear historical parallel. Physical infrastructure can be dismantled. Laws can be repealed. Officials can be replaced. But a trained model running on cloud infrastructure, having ingested the biometric profiles of 290 million people and modeled the social graph of the American population, does not get unbuilt. The data exists. The models exist. The infrastructure exists. It becomes more comprehensive and more accurate with every deployment. A future administration seeking to reverse course would inherit a surveillance apparatus that would be extraordinarily difficult to dismantle technically, and perhaps more difficult politically.

VI. The Historical Template: Hungary

The Hungarian experience under Viktor Orbán since 2010 is the most thoroughly documented modern example of democratic backsliding within an existing constitutional framework. Its relevance to the present American moment lies not in the outcome but in the method. Orbán never broke the law. He changed it — incrementally, simultaneously, with a procedural justification available for each individual step. The autocratization was accomplished entirely through legal mechanisms, which made it both harder to resist and more difficult to recognize as it was occurring.

The sequence is instructive. Constitutional Court expansion and subsequent jurisdiction stripping. Electoral map revision producing supermajority results from minority vote shares. Media consolidation through allied private actors rather than state nationalization. Civil service replacement eliminating professional independence. NGO legislation stigmatizing and operationally burdening civil society. Centralized population registries under executive-aligned administration. Each step had a plausible justification. None individually was disqualifying. The direction of travel was only apparent in retrospect, and by the time it was undeniable, the institutional capacity to reverse it had been sufficiently degraded.

The American situation follows this template with critical differences in both direction. The scale and diversity of American institutions — fifty state governments, hundreds of independently appointed federal judges, civil society of unprecedented scale — provides genuine friction that Hungary never had. These are not nothing. But the American timeline is faster, for the reasons this assessment describes: the infrastructure was already built, AI removes the human bottleneck, the legal architecture was pre-positioned, and the personnel replacement playbook has been executed at speed.

The Hungary lesson that analysts consistently underweighted at the time was sequential capture. You do not need to defeat all load-bearing institutions simultaneously. You need only ensure that by the time you reach the last one, the others are no longer available to support it. Hungary's Constitutional Court was the last node. It held longer than expected. Then it was restructured rather than defeated. The question the American situation poses is whether that sequence is being repeated at a pace the remaining functional institutions can interrupt.

VII. Velocity as the Critical Variable

The historical parallels are instructive but insufficient because they describe the same playbook running at a fundamentally different clock speed. The velocity of the current American situation may be the single most important variable that conventional institutional analysis underweights.

Three structural factors drive the acceleration. First, the infrastructure was already built. Orbán spent years constructing surveillance and data architecture from scratch. The American executive inherited a fully developed apparatus — HART, fusion centers, Palantir contracts, Mobile Fortify, the SAVE program — built across multiple administrations over two decades. Deployment rather than construction is the task, which compresses the timeline dramatically.

Second, AI removes the human bottleneck at every stage. Monitoring at population scale. Confidence scoring at decision scale. Litigation generation at volume scale. The constraint that historically gave resistance movements time to organize and gave oversight institutions time to respond has been structurally reduced.

Third, the legal architecture was pre-positioned. The Privacy Act exemptions, the manufactured litigation frameworks, the administrative rule-making expanding data collection — these were developed, tested, and refined over time. When the moment arrives to deploy them, there is no lag. The arguments exist. The precedents have been partially established.

What velocity does to institutional resistance is not simply to speed things up. It changes the nature of the problem. Every institutional check identified in this assessment operates on a slower clock than the stress being applied to it. Courts have dockets and appeals processes. Congressional oversight has committee schedules and election cycles. Journalism operates on publication timelines. The Electoral Count Reform Act's deadlines do not accommodate the pace of judicial deliberation when triggered simultaneously across multiple jurisdictions.

High-velocity, multi-front pressure also deploys exhaustion as a strategic instrument. The lawyers, journalists, activists, officials, and engaged citizens who form the behavioral substrate of democratic function have finite cognitive and emotional bandwidth. Sustained high-velocity crisis demands more from them while degrading their capacity to deliver it. Hungary's civil society was robust in 2010 and largely exhausted by 2018 — not because its members had changed their values but because the cost of continued resistance had exceeded what individuals could sustain. Burnout is a political strategy.

VIII. The Integrated Picture

The four layers described in this assessment — the surveillance infrastructure, the electoral mechanism under stress, the legal architecture enabling both, and the AI acceleration underlying all of them — are not parallel developments. They are components of an integrated system, whether or not they were designed as such.

The SAVE program's integration into voter roll maintenance is where the surveillance infrastructure and the electoral mechanism directly connect. The data system DHS uses for immigration enforcement now participates in determining who votes. The biometric identity layer, the financial profile layer accessed through DOGE's data efforts, the social network mapping layer, and the legal status verification layer together produce something that no prior government has possessed: a comprehensive and continuously updated model of the American population that can be queried to answer questions about identity, association, financial vulnerability, and legal status.

The Privacy Act exemptions that insulate these systems from judicial review ensure that the individuals affected cannot know what records exist, cannot access them, and cannot contest their accuracy. The chilling effect this produces is not incidental to the system's function. A population that knows it is being comprehensively monitored but cannot see the specific records held about it cannot rationally calculate what behavior to modify. The surveillance is generalized and diffuse, shaping behavior without providing the information necessary to navigate around it.

The terminal logic of this integration, taken to its structural conclusion, is a system in which the executive authority controls the layer that defines who is a legitimate voter, who is a legitimate citizen, who is a legitimate threat, and whose associations make them a subject of interest — while being insulated from the judicial review and legislative oversight that would normally constrain that authority. The election becomes one input among many rather than the determinative mechanism it is constitutionally designed to be.

IX. What Remains

This assessment is not a prediction. Systems under this kind of stress do not fail on schedule. They absorb, adapt, and hold until a specific combination of conditions they were not designed for arrives simultaneously. Whether that combination arrives in the current cycle or the next or not at all cannot be determined from structural analysis alone.

The nodes that have not fallen matter. Some federal judges are ruling correctly and quickly enough to interrupt specific actions. Some states are functioning as genuine resistance infrastructure. Some career officials are holding their positions and enforcing legal constraints at professional cost. Investigative journalism continues to produce the disclosures that make analysis like this possible. Civil society is litigating, organizing, and documenting at a scale that Hungary never achieved. These are not nothing.

But the framework this assessment has applied throughout demands honesty about what those remaining nodes are carrying. Each institution that absorbs stress without support from the institutions that have partially failed is carrying more load than it was designed for. The judiciary is carrying what the concession norm, the ministerial certification, the administrative workforce, and the data protection framework used to share. When the last load-bearing node is reached, the question is not whether it will hold in principle. The question is whether it can hold in practice, simultaneously, under coordinated stress, at the speed that AI-enabled pressure makes possible, within deadlines that do not move.

The behavioral commitments that answer that question are made by specific people, in specific roles, facing specific pressure — many of whom have never been in that position before, with tools that have never existed before, at a speed the system was never designed to handle.

Whether that is enough is the only question that ultimately matters. It will not be answered in any document. It will be answered by those people, in those moments, when they arrive.

Some of them already have.