SALEM — State and county officials say they have buttressed the state’s voting systems against intruders.
“I am confident that Oregon’s voting system is as safe as it can be from malicious outside entities,” Steve Trout, state elections director, said in a prepared statement. “That being said, we continue to evaluate and improve our security processes to ensure our systems are secure.”
Elections officials reiterated the security of Oregon’s procedures amid national concerns about foreign interference in this year’s midterms and reports earlier this month that Oregon voter information was being peddled online.
A majority of Americans are concerned about possible technological interference in voting systems.
According to survey results published this week by the Pew Research Center, 55 percent of Americans aren’t confident that U.S. elections systems are secure from hacking and other technological threats.
Respondents – 66 percent — were more confident in the security of state elections systems.
Experts divide technological risks into two categories: voter registration information and the voting system itself.
Nationally, voter registration systems “could be manipulated in an attempt to block voters, cause disruption and undermine confidence when citizens vote,” according to a report last year by the Brennan Center for Justice at the New York University Law School.
And voting machines “could be hacked to cast doubt on the integrity of vote tallies or to even change them,” that report said.
Last year, the federal Department of Homeland Security notified Oregon that hackers from Russia had attempted but failed to breach a state computer network during the 2016 general election.
According to Trout, elections in 2016, 2017 and this year have been administered “without incident.”
“On average, our security tools block 24 million malicious attempts daily from both domestic and international actors,” Trout said. “Our multi-layered systems have successfully protected our election systems from these attempts for years. This targeting activity was not new in 2016. We have been thwarting these attacks for decades and continue to build our defenses to deal with new threats.”
Oregon has had a security blip regarding data it maintains on registered voters.
Earlier this month, a California cyber security company, Anomali Labs, discovered that voter registration information for 19 states, including Oregon, was for sale on the “dark web,” which isn’t indexed by search engines and requires a special browser to access.
The databases contain information such as names, birth dates, addresses and party affiliation, and is publicly available. Anomali Labs said that public access is a risk because hackers could change registration information.
That data can also be combined with other breached personal information, the report said.
“When these lists are combined with other breached data containing sensitive information, e.g., social security number and driver’s license, on underground forums it provides malicious actors with key data points for creating a target profile of the U.S. electorate,” Anomali Labs wrote in a report on their findings.
Oregon sells voter information for $500 but state law prohibits using that information for commercial purposes. The Oregon Secretary of State’s office referred the matter to the Oregon Department of Justice and the FBI.
Trout said the state backs up the electronic voter registration files daily, and the state can detect illegal changes.
And when it comes to the voting system itself, elections officials say that Oregon’s vote by mail system is more secure because it creates a paper trail.
Officials can double-check the paper ballots by hand to ensure machine tallies are accurate. Those machines, furthermore, aren’t connected to the internet, which officials say makes them less susceptible to hacking.
Oregon’s ballot counting machines are certified by a federally accredited testing lab, according to Trout.
After the lab tests, the state does its own analysis of the machines’ security.
State law requires that elections officials test voting systems. Workers scan test ballots through tally machines to make sure that the results match the markings on the ballots. The same test occurs after the election to confirm the program wasn’t changed.
Each county is required to have a security plan approved by the state.
The counties are required to provide security for ballots in transit and for vote tally systems.
In Marion County, the tabulators are kept in a locked room and under camera surveillance.
In a demonstration test at the Marion County Clerk’s office last week, two workers checked test ballots for the system’s ability to read them accurately.
Marion County Clerk Bill Burgess said every effort is made to prevent tampering and hacking.
“Is it impossible? No. But it’s improbable,” Burgess said.
The county takes elaborate precautions to verify and secure ballots.
Marion County election workers and a security service pick up ballots left in drop boxes, Burgess said.
Envelopes containing the sealed ballots are fed into a machine that scans the signature and physically sorts the ballot envelopes by precinct.
Voters have to sign the back of their ballot envelope. Each signature on the envelope is scanned in. Then workers review that scanned image against a scan of a signature on file.
If the match isn’t good, a second worker reviews it. If there is still doubt, a letter is sent to the voter notifying them that the ballot hasn’t been counted and that they may take additional steps to verify the signature.
Approved envelopes then go to workers serving on the county’s Election Board for a two-step process to take the ballots out of the envelopes and to check that they can be read by the scanning machines.
Those workers swear to “diligently endeavor to prevent the violation of any provision of law” in conducting their duties, and that they’re not related to any candidate on the ballot.
Working in two-person teams knowing as “opening boards,” workers take ballots out of the envelopes and optional secrecy sleeves.
Then another team checks the quality of the ballot. Machines can read most of the ballots without problems, but sometimes voters don’t use the right ink or the ballot is torn or the barcode used to scan the ballot is marked out. Workers take extra steps to check those ballots.
Once a batch of ballots has been cleared for counting, it is taken into a special “tally room” to be scanned. The individual votes are transferred by thumb drive to another computer for the actual counting. Only county elections employees, typically supervisors, have access to that computer.
The room is also under video surveillance and an internal audit log tracks computer keystrokes.
The official count is transferred by yet another thumb drive for loading to the Marion County clerk’s website and made public. The results are also sent to the state.
Federal authorities are also taking precautions on Election Day, according to Billy Williams, Oregon’s top federal prosecutor.
Assistant U.S. Attorney Adrian Brown will serve as Oregon’s district elections officer, part of a longstanding national program though the U.S. Department of Justice to monitor complaints of election fraud and voting rights abuses.
Under federal law, it’s a crime to intimidate, bribe, or impersonate voters, buy and sell votes, alter vote tallies or mark ballots for voters against their wishes or without their say. Harassing or challenging voters by questioning them at ballot drop boxes may also violate federal law.
Voters have the right to mark their own ballot or choose someone to help them if they have a disability or cannot read.
“Every citizen must be able to vote without interference or discrimination and to have that vote counted without being stolen because of fraud,” Williams said in a prepared statement. “The Department of Justice will act promptly and aggressively to protect the integrity of the election process. Ensuring free and fair elections depends in large part on the cooperation of the American electorate.”
The public can call Brown at 503-727-1003 or the FBI at 503-224-4181.
Reporter Claire Withycombe: [email protected] or 503-385-4903. Withycombe is a reporter for the East Oregonian working for the Oregon Capital Bureau, a collaboration of EO Media Group, Pamplin Media Group, and Salem Reporter.
