Secretary of State officials brief committee: Oregon tabulation systems air-gapped; voter-registration systems require ongoing cybersecurity support

Officials from the Oregon Secretary of State's office briefed the Joint Committee on Information Management and Technology on Feb. 20 on the cybersecurity posture of county election systems.

Mary Kraybel, chief of strategic initiatives, said the office structured information security and IT so the chief information security officer and chief information officer operate at the same leadership level to surface risks directly to agency leadership. Steve Monachamson, the Secretary of State's CIO, described layered network protections, monitoring, multi-factor authentication, immutable backups, vulnerability management and an expanded program of security-awareness training.

Dina Dawson, Elections Division Director, emphasized that Oregon's tabulation systems are not connected to the Internet and that counties use strict physical security, bipartisan chain-of-custody procedures, logic-and-accuracy testing and tamper-evident seals. She said Oregon uses paper ballots for all voters and conducts post-election audits and canvassing to verify that tabulated results match paper records.

Legislators asked whether completed election results can be accessed and changed. Dawson replied that tabulation systems are air-gapped, strictly controlled by counties, and that audit procedures and pre/post tests confirm results; she said the primary cyber risk is to voter-registration databases and other supporting systems, which receive attention through funding and coordination but remain a focus for continued resourcing.

Secretary of State presenters asked the committee to consider continued funding and support for cybersecurity capacity-building, especially for smaller counties without dedicated cybersecurity staff.