OR - elections

Good day, AJ,

Thank you for your email. If you are seeking public records, please use the Public Records Request form located on the Secretary of State's website: https://sos.oregon.gov/Pages/public-records-request.aspx. This form helps us ensure we have your complete request and can direct it to the appropriate records custodian.

Once we receive your form, you will receive a response about your request from the Public Records Team.

Elections Division
Oregon Secretary of State
phone: (503) 986-1518
email: elections.sos@sos.oregon.gov<mailto:elections.sos@sos.oregon.gov>
[Oregon Secretary of State My Vote] <https://secure.sos.state.or.us/orestar/vr/showVoterSearch.do?lang=eng&source=SOS>

= Oregon Secretary of State =

== Public Records Request ==

Thank you for your request. This copy is for your records. 

Please allow 2-5 business days for us to acknowledge your request and up to
10 additional business days to provide records unless your request is
non-routine. We will notify you if we expect our response to take longer.

== Entry Details ==

NameAJ VicensAddressMuckRock News, DEPT MR129102, 263 Huntington Ave,
Boston, Massachusetts 02115Phone(617)
299-1832Email129102-71493739@requests.muckrock.comDescribe your requestTo
Whom It May Concern:

Pursuant to the Oregon Public Records Law, I hereby request the following
records:

Any emails, memos, recordings or other material available to the Oregon
Secretary of State's office and/or the Oregon Elections Division related to
the reported ransomware attack on Opus Interactive.

The requested documents will be made available to the general public, and
this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform
me of the total charges in advance of fulfilling my request. I would prefer
the request filled electronically, by e-mail attachment if available or
CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I
look forward to receiving your response to this request within 10 business
days.

Sincerely,

AJ Vicens

Good Afternoon,

Thank you for contacting the Oregon Secretary of State. I am writing to acknowledge receipt of this request. The request has been forwarded to the relevant staff person. We will be back in touch with the requested records or additional questions.

Thanks again!
--

Oregon Secretary of State
Public Records Inbox
Managed by the Public Records Officer or Deputy

Hello again,

I spoke with our IT team about this request and wanted to follow up to clarify a few things before we proceed.

Most importantly, we want to make sure you know what to expect because the scope of the request is large enough that there will be fees associated with completing it.

Our involvement with the Opus ransomware attack was limited. None of our systems were compromised. Since one of the campaign finance firms that uses our software stored their data on Opus's servers, we forced a password reset with a group of users in ORESTAR (oregon's campaign finance software).

The records we have include notice from the company of the attack, and internal communications related to our password reset response.

In order to fulfill the request we will need to do a keyword search — "Opus Interactive" AND "ransomware" — on the staff members who were involved in the incident. There are 14 of them. We estimate it will take 1 hour per user to collect the records and prepare them for delivery. At $75 per hour (the standard fee for technical staff) we estimate this will cost $1,050 to complete, plus additional fees for reviewing materials and redacting non disclosable information.

As a potential shortcut, we could provide you with communications between Opus Interactive, C&E Systems and the Oregon Secretary of State. That is a much more limited request that we could complete fast enough to waive the fees.

Please let me know if you'd like us to proceed.
Thanks,
Ben Morris
Communications Director
Oregon Secretary of State

--

Oregon Secretary of State
Public Records Inbox
Managed by the Public Records Officer or Deputy

Hello Again,

I'm attaching the email communication between our agency and C&E systems, alerting us to the ransomware attack. We did not have any communications with Opus Interactive to disclose.

Let me know if I can be of further assistance.
--

Oregon Secretary of State
Public Records Inbox
Managed by the Public Records Officer or Deputy