Oregon Division of Driver and Motor Vehicle Services they need to do a better job translating its online web portal for non-English speakers and ensuring that customer data is secure, an audit found largely positive.

The report released Wednesday by the Audit Division of the Secretary of State’s Office does not address the DMV’s latest major data problem: revelations that wrong information sent for 1,561 people who did not prove their citizenship to election officials to automatically register them to vote. At least 10 of the incorrectly registered voters went on to vote, although election officials have since determined that five of those 10 were citizens when they voted.

Gov. Tina Kotek has ordered a pause in the automatic voter registration program pending the completion of an independent external audit. The report is expected by the end of the year.

The audit also did not address a May 2023 hack that compromised personal information, including dates of birth, addresses and driver’s license numbers, for about 3.5 million Oregonians. The MOVEit file transfer service hack affected more than 2,700 other agencies and organizations and more than 95 million people worldwide.

Two Oregonians, Caery Evangelist and Brian Els, filed a class-action lawsuit in Marion County Circuit Court in April over the 2023 hack. The state is trying to dismiss the suit, and a judge has scheduled a hearing in November to set a date for a hearing on this motion.

Instead, the state audit looked at how the DMV — which has nearly 900 employees and a two-year budget of $311 million — assesses and collects taxes and how well its recently expanded online services work. Auditors found that the DMV and its computer systems accurately assess fees for the approximately 200,000 new driver’s licenses and more than 350,000 renewals it processes each year, as well as vehicle registrations, titles and license plates.

Registration and title fees vary by plate design, driver’s county, age of vehicle and fuel efficiency. Auditors reviewed all driver and vehicle transactions during fiscal year 2023 — more than 20 million rows of data — and found that 99.6 percent of those transactions were complete, accurate and valid.

But they also found that Oregonians who don’t speak English or have limited English skills struggle to use the state’s online portal for license renewals, vehicle registrations and address updates. That portal, DMV2U, relies on Google Translate to translate directions into other languages, and auditors found that it did not work well on mobile devices and often failed to translate the site’s content.

The audit also found that the DMV was not doing enough to ensure that employees could only access the data they needed and closing accounts when employees quit.

“Without robust access controls, unauthorized individuals can surreptitiously access sensitive data, copy it, and make undetected changes or deletions for malicious intent or personal gain,” the report said.

DMV Administrator Amy Joyce wrote in a letter attached to the audit that she agreed with each of the auditor’s recommendations, which included having a more diverse group of people test their online services and periodically reviewing access to DMV data.

— Julia Shumway, Oregon Capital Chronicle

Oregon Capital Chronicle is part of The editorial office of the Statesthe nation’s largest nonprofit state-focused news organization.