Rep. Josh Gottheimer (D-Tenafly) is calling for a sweeping federal audit of every government contract involving IDEMIA, the French identity and security software company linked to a glitch that improperly registered approximately 6,600 noncitizens to vote in New Jersey.
In a letter sent Tuesday to General Services Administration Administrator Edward Forst and Office of Management and Budget Director Russell Vought, Gottheimer said the New Jersey failure raises broader questions about IDEMIA’s software, quality-control practices, and its extensive role in federal identity, biometric, and national security programs.
“This incident raises serious concerns about the reliability of IDEMIA’s software, the company’s quality control practices, and the federal government’s reliance on a single contractor to manage highly sensitive identity and biometric systems,” Gottheimer said.
Gov. Mikie Sherrill disclosed Tuesday that the Motor Vehicle Commission software error occurred between June 2023 and June 2024, nearly three years before she took office. Fewer than 400 of the affected individuals subsequently cast ballots, according to the Sherrill administration.
The noncitizens had identified themselves as ineligible to vote while applying for driver’s licenses or state identification cards but were registered anyway. State officials are working to identify and remove any ineligible voters from the rolls while an independent investigation examines how the failure occurred and why it was not disclosed earlier.
“This is alarming and unacceptable,” Gottheimer said. “But New Jersey is only where this came into view. The deeper problem is national.”
IDEMIA pushed back against suggestions that it determines voter eligibility, saying its role is limited to transmitting information collected through the motor vehicle system.
“The voter registration information is transmitted to the New Jersey Department of State, Division of Elections, which is ultimately responsible for verifying eligibility to vote,” the company said. “Information submitted by IDEMIA must still be validated and adjudicated by the Division of Elections.”
IDEMIA has worked with the New Jersey Motor Vehicle Commission for more than 40 years, supporting the process through which eligible residents may indicate an interest in registering to vote while obtaining or renewing a driver’s license or identification card.
But Gottheimer said the company’s reach extends far beyond New Jersey’s motor vehicle agencies, making a comprehensive federal review imperative.
IDEMIA serves as a contractor for the Transportation Security Administration, operating enrollment systems for TSA PreCheck, the Transportation Worker Identification Credential program and the Hazardous Materials Endorsement Threat Assessment Program. The company says it has processed more than 19 million enrollments at more than 630 centers nationwide.
Its credential authentication technology has also been deployed at roughly 120 airports since 2019.
“A ‘small’ software issue like what happened in New Jersey could, right now, be allowing improperly vetted individuals to enter our airports and board our airplanes,” Gottheimer warned.
The congressman also cited IDEMIA’s work with Customs and Border Protection on biometric entry-and-exit systems, its status as an FBI-approved fingerprint channeler and its role as a leading driver’s license provider in 36 states. Those states account for approximately 70% of licenses issued nationwide.
IDEMIA National Security Solutions also holds contracts involving defense, intelligence, law enforcement and homeland security operations.
“A single vendor is thus embedded, simultaneously, in how the government screens travelers, secures ports and hazardous-materials handlers, processes travelers at the border, runs criminal background checks, issues civilian identity credentials, and supports military and intelligence identity operations,” Gottheimer said.
Gottheimer asked the GSA and OMB to compile a complete inventory of all federal contracts, task orders, blanket purchase agreements, and interagency agreements involving IDEMIA or any of its affiliates. The review would identify the contracting agency, dollar value, period of performance, and scope of work for each agreement.
He also wants auditors to determine what biometric and personally identifiable information IDEMIA collects, stores, or transmits, including fingerprints, facial images, iris data, and biographical records, as well as where the information is physically and electronically maintained.
The audit would examine IDEMIA’s data retention and sharing policies, its use of subcontractors, potential foreign access to sensitive information, and compliance with federal privacy and cybersecurity requirements.
Gottheimer further requested a review of any security breaches, contract terminations, performance deficiencies, or suspension and debarment referrals involving the company in the United States or abroad.
The congressman also wants federal officials to determine whether viable competitors could perform IDEMIA’s critical functions, reducing the government’s dependence on a single company.
“Protecting Americans’ most sensitive data and safeguarding the integrity of federal identity, elections, screening, and border systems are core government obligations,” Gottheimer said. “They cannot be met without knowing exactly what a vendor of this magnitude is doing with the information entrusted to it.”
Gottheimer asked the agencies to begin the audit promptly and immediately brief his office on its scope and expected timeline.