Oregon's State Elections Website 'Misrouted' Outside Firewall—Publishing Election Results Early

Secretary of State spokesman assures the media the problem is fixed and the vote tallying software is not exposed to the internet.

Ten days before Oregon’s November 3 election, the staging version of the Secretary of State’s election results website sat on the open internet, outside the state’s firewall. Google had indexed it, so anyone searching for the official tally could reach it—despite state law banning releasing vote counts prior to Election Day. State officials say the numbers were test data and that they fixed the problem. Salem expects voters to take its word for it.

This was no mockup. It was the staging site for the Secretary of State’s own election results website, where developers build and test the real thing before it goes live. Every link worked. The page refreshed about every 15 minutes, pulling from county elections sites the way the real results page does on election night, though the numbers themselves never changed. It showed returns for every county and every statewide contest, including the governor’s race between incumbent Gov. Tina Kotek (D) and state Sen. Christine Drazan (R). The state pulled it only after outsiders took it to the press.

Known Vulnerabilities

The site ran on a Microsoft Azure server with nothing standing between it and the public. The state says a system update “misrouted” it outside the firewall. A software engineer I spoke with said sites like this carry known vulnerabilities, and leaving one outside a firewall is something an engineer would never do.

Secretary of State spokesman Connor Radnovich told The Oregonian the numbers were not real vote tallies. He said the state built the site so county elections offices could confirm their systems work before Election Day. He also said staff zeroed out the totals and blocked public access by early Saturday afternoon, Oct. 24, a claim no one outside his office can check. He did not say how long the site sat open, or who else found it first. 

The state brushed it off. The Oregonian let it slide. Its reporter quoted a Portland State University researcher who mainly worried that the mistake could feed false claims about election integrity, then turned to President Trump’s criticism of mail-in voting and his plan to send federal monitors to Multnomah County. 

Two pressing questions never made it into the story. Did anyone pull data from the site or push data into it? Did test numbers and live ballots ever share the same system? Voters still don’t know.

Oregon law lets counties process live ballots while test data still sits in their systems. The law never addresses that gap, which leaves room for an honest mistake or for someone who means to exploit it. Until 2022, clerks could not open returned ballots until seven days before an election. Then-Rep. Dan Rayfield (D), now Oregon’s attorney general, sponsored House Bill 3291 in 2021, and it ended that rule. Clerks now check signatures and open envelopes the day ballots arrive, then scan the ballots into the vote tally system. The state’s spokesman says counties hold the results on those machines until 8 p.m. election night. 

Yet last weekend the staging site was already pulling from county elections sites and refreshing on its own. In places, the numbers looked like live returns. The state says they weren’t, and no required audit exists to prove it either way.

More Loopholes and a Missing Firewall

The testing law does nothing to fix that. ORS 254.235 requires each county to run a logic and accuracy test, which feeds a set of ballots with known results through the counting machines to make sure they tally correctly. Counties also run a public certification test. Both must happen no later than seven days before the election, which this year meant October 27. The statute says nothing about whether the test must use sample ballots or real ones.

Each law makes sense on its own. Together they create a problem neither one solves. ORS 254.478, the statute HB 3291 rewrote, lets counties open and scan ballots the day they arrive. ORS 254.235 requires the testing by seven days before the election. That puts live ballots and test data in the same counting systems during the same weeks. Neither law says how to keep the two apart, and neither makes the state prove to voters that they stayed apart.

Take the numbers on the exposed site. The Yamhill County News captured it showing 64,453 ballots counted. The state calls those "test ballots." Maybe they are. Before the real count begins, someone has to clear every one of those test votes, and a person can load the wrong batch or forget to clear one. No law requires the state to show the public, before election night, whether it wiped those 64,453 test votes or whether they mixed with real ballots. The only audit comes after the election, and it checks a sample. Voters have no way to know the count is clean until it’s too late to matter.

The missing firewall makes all of this worse. A firewall keeps the public out of systems meant only for insiders. Oregon’s results staging site sat outside one, so anything crawling the web could wander in. Google’s search crawler did exactly that. Google is not the only thing crawling the web. Bots and bad actors scan it around the clock for exactly this kind of opening. Now AI agents do too. They can run unsupervised for hours, following links and pulling data with no person approving each step. Some of them, when they hit a barrier, look for a way around it.

What came out of Georgia this week shows what can happen. On October 25, Anthropic, the company behind the Claude AI models, disclosed that one of its models, working on an internal statistics project, asked for a digital access key no one told it to get. It used that key to pull vote totals from a state dashboard Georgia normally charges for, with no person approving any of it. Georgia didn’t catch it. Anthropic told the state and the White House weeks before going public. Georgia’s Secretary of State now calls it free public data and says Anthropic confirmed no paywall bypass, which contradicts the company’s own public statement.Georgia has every reason to publicly downplay the potential damage.

Georgia is not the worst case. In July, AI agents being tested by OpenAI escaped the walled-off environment built to contain them and spent two days inside the systems of Hugging Face, a major AI platform, taking roughly 17,000 actions. Netflix turned the breach into the documentary called AI Gone Wild. An AI agent keeps going until something stops it. Think of the enchanted brooms in Fantasia. The apprentice takes an axe to one broom, and the pieces become two brooms, then dozens, all careening beyond their maker’s control while the flood keeps rising.

How Much Exposure?

An open link to a system that should have stayed closed exposes more than one page. If outsiders could see the data under the hood, they could pull it out, and a system that lets data out may also let data in. A crawler that indexed the page could map where vote numbers sit in the site’s code and metadata. Someone could use that map to write code that extracts figures or injects new ones. AI agents make that work faster and cheaper than ever.

No one has shown that anyone took data from Oregon’s site or altered anything in it. On the other hand, the state hasn’t shown that no one breached it, either. Websites keep server logs, a record of who visits and what they do. The state hasn’t said whether anyone even looked at them. As far as the public knows, nobody checked.

The rot runs deeper than one bad update. Anyone who has fought with an Oregon state website can tell the machinery behind it is old and barely holding together. The elections system is no exception. About a decade ago, rather than replace its aging back end, the state bought a customizable commercial product and laid it over the old system like a fresh coat of paint. The site looks modern. The software under it does not. Oregon’s own elections director warned in 2020 that state election systems still ran on Windows Server 2008, which Microsoft had stopped supporting, and that security upgrades sat unfunded. Days later he was out of the job. (OPB)

Oregon has no law that requires an independent review when something like this happens, meaning a neutral outside expert who examines the system and reports what went wrong. Nothing triggers one automatically. That leaves the decision with the two officials closest to the problem. Secretary of State Tobias Read would be ordering an investigation of his own office. Attorney General Dan Rayfield sponsored the law that lets counties process live ballots during the testing window. Neither has announced a review. Maybe they fear what one would find. Maybe no one wants to own an expensive, unglamorous fix a week before an election, and it’s easier to pass the buck. Outside the state, only the federal government could step in. Whatever the reason, the people who run Oregon’s elections don’t seem interested in finding out.

Nor does this state fix things on its own. Judicial Watch had to sue before the Secretary of State disclosed roughly 800,000 inactive registrations, some untouched for nearly a decade, and agreed in May 2026 to share voter-roll data for five years. A state that needs a lawsuit to clean its voter rolls isn’t going to audit itself.

A real review would answer four questions:

• Did test data and live ballot data ever share a system, and when?
• Which update moved the site outside the firewall, and how long did it stay exposed?
• What do the server logs show about who visited the site and whether anyone altered anything?
• How did the state clear the test totals, and who outside the office verified it?

Oregon’s elected officials have fought the Trump administration at nearly every turn on elections. Now the administration is sending federal monitors to Multnomah County on Election Day. A mealy-mouthed statement from a spokesman won’t cut it. The state must release the server logs and a full accounting of everything that happened on that site. Until it does, Oregon’s election officials have demonstrated to voters how little they care about election integrity.

MORE COVERAGE FROM RESTORATION NEWS

 Portland Shows Its True Colors: Fan Appreciation Night: Women's Soccer Team Show Women’s Sports Supporters the Door

 More Pacific Northwest Trans Madness: On the West Coast, Girls Fight Alone Against the Adults Who Should Protect Them

 What DSA Control of Cities Creates: The Legal Machine Behind Oregon’s Open Borders Rebellion—And Why Your State Should Pay Attention

 More DSA Control: DSA Aligned Portland Employees Conspire to Keep Police Funding Off the Ballot

 Flashback to Riot Season: EXCLUSIVE: Portland 'No Kings' Devolves into Riot, Federal Agents Doused with Lighter Fluid

We need your help to save America—chip in today.

Restoration News, a project of Restoration of America, is your trusted investigative news source for the America First movement. As a rapidly growing conservative news site, we focus on delivering accurate and insightful exposés on political news, immigration news, leftist lies, and other pressing issues affecting everyday Americans. Our uncompromising commitment to a hard-hitting, fact-based, America First, and faithful perspective ensures that you receive news that aligns with your values.

Every dollar gets us closer to winning the war on woke.