Oregon DMV needs more accessible website, increased security, audit finds

A man uses a touch screen at a DMV location. (Oregon Department of Transportation/Flickr)

Oregon’s Division of Driver and Motor Vehicle Services needs to do a better job translating its online web portal for people who don’t speak English and ensuring customer data is secure, audit finds rather positive.

The report released Wednesday by the Audit Division of the Secretary of State’s Office does not address the DMV’s latest high-profile data problem: revelations that it information sent incorrectly for 1,561 people who have not proven their citizenship to election officials to automatically register them on the electoral roll. At least 10 of the misregistered voters later cast ballots, although election officials have since determined that five of those 10 were citizens when they cast their ballots.

Gov. Tina Kotek has ordered a pause in the automatic voter registration program until an independent external audit is completed. This report is expected by the end of the year.

The audit also did not address a May 2023 hack that put at risk the personal information, including dates of birth, addresses and driver’s license numbers, of about 3.5 million residents from Oregon. The hack of the MOVEit file transfer service affected more than 2,700 other agencies and organizations and more than 95 million people around the world.

Two Oregon residents, Caery Evangelist and Brian Els, filed a class-action lawsuit in Marion County Circuit Court in April over the 2023 hack. The state is seeking to dismiss the suit and a judge has scheduled a summons in November to set a hearing date on this request.

Instead, the state audit examined how the DMV — which has nearly 900 employees and a two-year budget of $311 million — assesses and collects fees and how well its online services recently expanded work. Auditors found that the DMV and its computer systems accurately assess fees for the approximately 200,000 new driver’s licenses and more than 350,000 renewals it processes each year, as well as for registrations, titles and plates. vehicle registration.

Registration and title fees vary depending on the design of the plate, the county where the driver lives, the age of the vehicle and fuel consumption. Auditors reviewed all driver and vehicle transactions in fiscal year 2023 – more than 20 million lines of data – and found that 99.6% of those transactions were complete, accurate and valid.

But they also found that Oregonians who don’t speak English or have limited English proficiency have difficulty using the state’s online portal to renew their licenses, vehicle registrations and update update their addresses. This portal, DMV2U, relies on Google Translate to translate instructions into other languages, and auditors found that it did not work well on mobile devices and often failed to translate the site’s content.

The audit also found that the DMV did not do enough to ensure employees could access only the data they needed and to close accounts when employees quit.

“Without robust access controls, unauthorized individuals can surreptitiously access, copy, and potentially make undetected changes or deletions to sensitive data for malicious purposes or personal gain,” the report states.

DMV Administrator Amy Joyce wrote in a letter attached to the audit that she agreed with each of the auditor’s recommendations, including asking a more diverse group of people to test its online services and periodically review access to DMV data.

Subscribe: Get morning headlines delivered to your inbox