Audit finds Oregon DMV needs to improve data security, accessibility

PORTLAND, Ore. (KOIN) — An audit of the Oregon Department of Motor Vehicle Services Division released Wednesday found the department’s data system “works well” when it comes to managing fees and Oregonians’ data, but also discovered security and accessibility concerns.

The audit focused on the DMV’s data system — the Oregon License and Vehicle Registration system, or OLIVR — which was implemented in 2019 and helped expand the DMV’s online services. OLIVR is also responsible for maintaining personally identifiable information for millions of Oregonians, such as birth dates and home addresses.

Overall, the Oregon Secretary of State Audits Division said their findings were “largely positive,” and that OLIVR accurately collects and transfers Oregonians’ fees and data.

However, auditors also learned that the DMV should make improvements surrounding security and website accessibility.

According to the auditors, the DMV needs to improve how it manages employees’ access to OLIVR.

“The OLIVR application uses role-based access and has appropriate roles and separation of duties. However, user account management processes governing access to OLIVR are not sufficient to ensure DMV employees only have access to system functionality needed to perform their duties,” the auditors wrote.

Additionally, the DMV needs to improve passwords and conduct more regular security risk assessments of OLIVR, according to the auditors.

Officials also found one area that needs “significant” improvement: accessibility.

According to the audit, the DMV needs to improve accessibility to online services for people with disabilities and people who are not proficient in English.

Even though the DMV website has language translation services, the service portal itself does not and instead uses Google Translate in the web browser, officials said – noting Google Translate was not intuitive for DMV website users, was inconsistent across pages and didn’t work on mobile devices.

In a statement about the findings, Audits Director Kip Memmott said, “Oregonians should be reassured by the findings in this audit, and the DMV should be happy with the work that’s already been done to implement and secure OLIVR.” Memmott added, “They’ve established a good foundation, but now it’s time to build on it and further strengthen IT controls.”

Officials noted the audit did not assess how the system identifies voter registration records for automatic voter registration in the state amid calls in early October from Gov. Tina Kotek and Secretary of State LaVonne Griffin-Valade for an independent audit after the DMV mistakenly registered more than 1,500 people to vote who were ineligible.

According to the Secretary of State’s Office, a data processing error at the DMV led to the ineligible registrations.

The DMV said these voters did not impact previous elections and will not impact the election in November.