COLORADO SECRETARY OF STATE
[8 CCR 1505-1]
Election rules

Rules as Adopted - Clean

April 16, 2012

Rule 12.4.1(a)(8) is amended as follows:
12.4	Mail Ballot Plans
12.4.1	Coordinated and non-partisan elections.
(a)	Written plan. As soon as possible, but no later than 55 days prior to any other election, not including a Primary Election, a written plan must be submitted to the Secretary of State which includes the following:
(8)	The address and hours of operation for all drop-off locations;
Rule 12.4.2(a)(7) is amended as follows:
12.4.2	Primary Elections conducted as a mail ballot election.  
(a)	Written plan.  Pursuant to Article 7.5 of Title 1, C.R.S., no later than 120 days prior to the election the county clerk and recorder must submit a written plan to the Secretary of State that includes the following:
(7)	Description of the procedures that will be taken to ensure that each service center complies with the requirements set forth in section 1‑7.5‑107, C.R.S., including the number of accessible voting machines anticipated being used at each service center;
New Rule 12.10.4 is adopted as follows:
12.10.4	Monitoring drop-off locations.  All drop-off locations must be monitored by an election judge or video security surveillance recording system, as defined in Rule 43.
(a)	Freestanding drop-off locations must be monitored at all times.
(b)	If the drop-off location utilizes a drop-slot into a building, the ballots must be collected in a locked container, and both the drop-slot and container must be monitored at all times.
Rule 27.8 is repealed as follows:
27.8	Repealed.
Rule 43 is amended as follows:
Rule 43. County Security Procedures
43.1	Definitions
43.1.1	“Chain-of-custody log” means a written record that shows that the equipment and all associated data are secured according to these procedures and in the documented control of an employee or deputized election judge through the entire time of ownership by the jurisdiction.
43.1.2	“DRE” means a direct recording electronic voting device. A DRE is a voting device that records votes by means of a ballot display provided with mechanical or electro-optical components or an audio ballot that the voter can activate; that processes data by means of a computer program; and that records voting data and ballot images in memory components or other media. The device may produce a tabulation of the voting data stored in a removable memory component and as printed copy. The device may also provide a means for transmitting individual ballots or vote totals to a central location for consolidating and reporting results from remote sites to the central location. 
43.1.3	“Employee” means all full-time, part-time, permanent, and contract employees of the county who have had a criminal history check conducted in accordance with Rule 11.2 and are deputized by the county clerk and recorder to prepare or maintain the voting system or election setup materials, staff the counting center and who have any access to the electromechanical voting systems or electronic vote tabulating equipment.
43.1.4	“Removable card or cartridge” means any programming card or cartridge, except a voter activation card, that stores firmware, software, or data.
43.1.5	“Seal” means a serial-numbered tamper-evident device that indicates a seal is broken or removed.
43.1.6	“Trusted Build” means the write-once installation disk or disks for software and firmware for which the Secretary of State or his/her agent has established the chain of evidence to the building of a disk, which is then used to establish and/or re-establish the chain of custody of any component of a voting system that contains newly installed firmware or software. The trusted build is the origin of the chain of evidence for any software and firmware component of the voting system.
43.1.7	“Video security surveillance recording” means video monitoring by a device that continuously records a designated location or a system using motion detection that records one frame, or more, per minute until detection of motion triggers continuous recording.
43.2	Annual security plan. In accordance with section 1‑5‑616(5), C.R.S., each county must submit a security plan to the Secretary of State annually and no later than 60 days prior to the first election in which the security plan procedures are used. The plan must, at a minimum, include the following:
43.2.1	General Requirements:
(a)	The county clerk and recorder shall maintain on file all documentation of seals, chain of custody, and other documents related to the transfer of equipment between parties These documents are subject to inspection by the Secretary of State.
(b)	The county must maintain and document the chain of custody for each voting device throughout the county’s ownership or leasing of the device.
(c)	Only deputized clerks, election judges, or canvass board members sworn under oath are allowed to handle ballots, which include V-VPAT records.
(d)	The county may install additional or modified software developed by the Vendor on any component of the voting system only if the software is specifically listed on the Secretary of State’s certificate and verified against the state trusted build. Nothing in this rule shall preclude the use of commercial off-the-shelf software, provided that the software is included in the certified list of services and executables for the certified voting systems.
(e)	Any form or log containing “date” means to note the month, calendar day, year, hour, minute, and whether the time is a.m. or p.m.
43.2.2	Physical Locking Mechanisms and Seals. The county must record the serial number of every seal on the appropriate chain-of-custody log. Two individuals must verify, and indicate by signing and dating the log, that the seal serial numbers match the logged serial numbers. If a seal is inaccessible and cannot be removed, then it is not necessary to verify that seal serial number.
(a)	DREs. The county must seal DRE voting devices as follows:
(1)	The county must place a seal over any removable card or cartridge that is inserted into the unit, or over the slot or door covering the card or cartridge.
(2)	The county must place a seal over any removable card slot or cartridge slot when no card or cartridge is inserted into the unit.
(3)	If the county cannot verify the firmware or software hash value (MD5 or SHA-1), the county must seal the DRE case. To detect unauthorized access, the county must use seals at either the seams of the case or at key entry points such as screw access points.
(4)	If the voting device contains one or more slots for a flash memory card, the county shall affix a seal over each each flash card slot, door, or access panel.
(5)	These same procedures also apply to the Judge’s Booth Controller (JBC) unit for the Hart InterCivic System.
(6)	Two employees or election judges must verify, and indicate by signing and dating the chain-of-custody log, that all seal serial numbers match the logged serial numbers.    
(b)	V-VPATs. Prior to attaching a V-VPAT to a specific voting device, the judges shall seal the unit after verifying that no votes were cast. At least two election judges must verify that seals are intact prior to the start of voting, and at the close of voting. V-VPAT records shall either remain in the V-VPAT canister, or be sealed and secured in a suitable device for protecting privacy or as described in Rule 11.
(c)	Remote or Central-count Optical Scanners. Optical scanners used in a remote or central tabulating location shall meet the following seal requirements:
(1)	The county must place a seal over each card or cartridge inserted into the unit, or over any door or slot containing the card or cartridge.
(2)	The county must place a seal over each empty card or cartridge slot or door covering the area where the card or cartridge is inserted.
(3)	Prior to the start of voting and after the close of voting, two employees or election judges must visually confirm that all seals are intact and that the seal serial numbers match those logged in the chain-of-custody log.
(d)	Memory Cards/Cartridges.
(1)	The county must assign and securely affix a permanent serial number to each removable card or cartridge. The county may use the manufacturer assigned serial number for this purpose.
(2)	The county must handle Removable memory cards and cartridges in a secure manner at all times. The county must transfer and store any removable card and/or cartridge that is not sealed in a voting machine in a secure container with at least one seal. Upon delivery and receipt, election judges or county personnel must verify, and indicate by signing and dating the chain-of custody log, that all seal serial numbers match those listed in the log.
(3)	The county clerk and recorder must maintain a written or electronic log to record card or cartridge seal serial numbers and track seals for each voting unit. The county clerk and recorder must be notified if control of a card/cartridge or door or slot for a card/cartridge is breached before an election, and he/she must follow the procedures specific to the incident outlined in Rule 43.2.11.
43.2.3	Individuals with Access to Keys, Door Codes, and Vault Combinations
(a)	For employees with access to areas addressed in Rule 43.2.3(c), the county must state the employees’ titles and the dates of CBI background checks. [Section 24‑72‑305.6, C.R.S.]
(b)	The county must change all keypad door codes or locks, vault combinations, computer and server passwords, encryption key codes, and administrator passwords at least once per calendar year prior to the first election of the year.
(c)	Employee access
(1)	The county may grant employees access to the codes, combinations, passwords, and encryption keys described in this Rule 43.2.3 in accordance with the following limitations:
(A)	Access to the code, combination, password, or encryption key for the storage area for voting equipment and the mail-in ballot counting areas is restricted to employees as defined in Rule 43.1.3.
(B)	Access to the code, combination, password, or encryption key for the mail-in ballot storage area and counting room or tabulation workstations is restricted to ten employees as defined in Rule 43.1.3.
(C)	Except for emergency personnel, no other individuals shall be present in these locations unless supervised by one or more employees as defined in Rule 43.1.3.
(i)	Each individual who has access to the central election management system or central tabulator shall have their own unique username and password. No individual shall use any other individual’s username or password. Shared accounts are prohibited.
(ii)	The county shall maintain a log of each person who enters the ballot storage room, including the person’s name, signature, and date and time of entry. If access to the ballot storage room is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.
(2)	In extreme circumstance, the county may request and the Secretary of State may grant exemption from the requirements outlined in Rule 43.2.3(c)(1).
(d)	Computer room access is limited to authorized employees and election judges only. Messengers or runners delivering ballots between the preparation room and computer room shall wear distinguishing identification. This rule does not supersede access by watchers, official observers, and media observers in accordance with Rule 8. 
43.2.4	Temperature-controlled Storage.
	The county must maintain all components of the voting system and ballots in a temperature-controlled environment. The county shall attest to the temperature-control settings used with the following components of a voting system. Information submitted to the Secretary of State shall indicate the specifics for each type of component, as well as the specific environment used, which may include, but is not limited to controlled offices, controlled vaults, and controlled warehouses. The county must maintain the following required temperature settings:
(a)	Servers and Workstations. The county shall maintain the temperature so that the maximum temperature at no time exceeds 90 degrees Fahrenheit.
(b)	DREs. The county shall maintain the temperature at a minimum of 50 degrees Fahrenheit and a maximum of 90 degrees Fahrenheit.
(c)	Optical Scanners. The county shall maintain the temperature at a minimum of 50 degrees Fahrenheit and a maximum of 90 degrees Fahrenheit.
(d)	V-VPAT Records. In addition to the requirements set forth in Rule 11, the county shall maintain the temperature at a minimum of 50 degrees Fahrenheit and a maximum of 90 degrees Fahrenheit. The county shall maintain V-VPAT records in a dry environment, with storage at least four inches above the finished floor, for a period of 25 months following the election. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall store V-VPAT records in a manner that prevents exposure to light, except as necessary during recounts and audits.
(e)	Paper Ballots. The county shall maintain paper ballots in a dry, humidity-controlled environment. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall store paper ballots at least four inches above the finished floor, for a period of 25 months following the election.
(f)	Video Data Records. The county shall maintain video data records in a dry, temperature-controlled environment. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall maintain temperature at a minimum of 50 degrees Fahrenheit and a maximum of 90 degrees Fahrenheit. The county shall store video data records at least four inches above the finished floor, for a period of 25 months following the election.
43.2.5	Security Cameras or Other Surveillance
(a)	Unless otherwise instructed, the county shall make video security surveillance recordings of specified areas beginning at least 60 days prior to the election and continuing through at least 30 days after the election, unless there is a recount or contest. The recording system shall ensure that records are not written over when the system is full. The recording system shall provide a method to transfer the video records to a different recording device or to replace the recording media. If replaceable media is used then the county shall provide a process that ensures that the media is replaced often enough to prevent periods when recording is not available. If a recount or contest occurs, the recording shall continue through the conclusion of all such activity. The following are the specific minimum requirements: 
(1)	If the county has 50,000 or more registered voters, then the county shall make video security surveillance recordings of the following areas, excluding voting booths:
(A)	All areas in which election management software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
(B)	All areas used for processing mail-in ballots, including but not limited to areas used for Signature Verification, tabulation, or storage of voted ballots beginning at least 35 days prior to the election and continuing through at least 30 days after the election, unless there is a recount or contest. If a recount or contest occurs, the recording shall continue through the conclusion of all such activity.
(C)	The storage area for all voting equipment.
(2)	If the county has fewer than 50,000 registered voters then the county shall make video security surveillance recordings of all areas, excluding voting booths, in which election management software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
(b)	The county must adequately and continuously light the area(s) subject to video surveillance to provide visibility for video recording.
43.2.6	Equipment Maintenance Procedures.
	In addition to the requirements for voting systems specified in Rule 11, the county shall adhere to the following minimum standards:
(a)	The county shall store all equipment throughout the year with seals over the memory card slots for each device. The county shall maintain a log of the seals used for each device consistent to the logs used for tracking Election Day seals.
(b)	For equipment being sent to the vendor for offsite repairs/replacements, the county must keep a maintenance log for the device that shall contain the following: the model number, serial number, and the type of device; the firmware version; the software version (as applicable); the printed name and signature of the person sending the equipment; and the date of submission to the vendor.
(c)	When a vendor provides on-site maintenance of equipment, vendor personnel shall annually provide to the county a CBI or equivalent background check for all vendor personnel that will have access to any component of the voting system. The county must keep current CBI or equivalent background check information on file. Additionally, an employee shall escort the vendor’s representative at all times while on-site. At no time shall the voting system vendor have access to any component of the voting system without supervision by an employee. [Section 24‑72‑305.6, C.R.S.]
(d)	Upon completion of any maintenance, the county shall verify or reinstate the trusted build and conduct a full acceptance test of equipment that shall, at a minimum, include the Hardware Diagnostics test, as indicated in Rule 11, and conduct a mock election in which an employee(s) shall cast a minimum of five ballots on the device to ensure tabulation of votes is working correctly. The county shall maintain all documentation of the results of the acceptance testing on file with the specific device.
(e)	The Secretary of State will annually inspect county maintenance records on a randomly selected basis.
43.2.7	Transportation of Equipment, Memory Cards, Ballot Boxes, and Ballots
(a)	The county shall submit detailed plans to the Secretary of State prior to an election regarding the transportation of equipment and ballots both to remote voting sites and back to the central elections office or storage facility. While the method of transportation of equipment may vary, the following standards shall apply when transporting voting equipment to the voting location:
(1)	Transportation by County Personnel. County personnel shall at all times display a badge or other identification provided by the County. Two signatures and date of employees are required at the departure location verifying that the equipment, including memory card or cartridge, is sealed to prevent tampering. Upon delivery of equipment, at least two employees or election judges shall verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact and that the serial numbers on the seals match the logged serial numbers. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(2)	Transportation by Election Judges. Election judges that are receiving equipment from county personnel shall inspect all components of voting devices and verify the specific numbers by signature and date on the chain-of-custody log for the device. The election judge receiving the equipment shall request two election judges at the voting location to inspect the devices and to sign and date the chain-of-custody log indicating that all seals are intact and that the serial numbers on the seals match with those on the seal-tracking log. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(3)	Transportation by Contract. A county electing to contract the delivery of equipment to remote voting locations shall perform CBI background checks on the specific individuals who will be delivering the equipment. Two employees or election judges shall verify, sign, and date the chain-of-custody log upon release of the equipment to the individual(s) delivering the equipment. Two other employees or election judges shall verify, sign, and date the chain-of-custody log after delivery of the equipment, and prior to the opening of the polls. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11. [Section 24‑72‑305.6, C.R.S.]
(b)	Standards for transporting voting equipment to and from the voting location:
(1)	Required procedures if memory cards or cartridges are removed from voting devices at remote voting locations:
(A)	Before removing a memory card or cartridge, two election judges shall inspect and verify that all seals on the device are intact and that the serial numbers on the seals match those listed on the chain-of-custody log. Both election judges shall sign and date the chain-of-custody log prior to breaking the seal. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(B)	Election judges shall place the memory cards or cartridges in a sealable transfer case and must seal the case with at least one seal. The election judges shall maintain a chain-of-custody log for the transfer case of the memory cards or cartridges.
(C)	Election judges shall place new seals over the empty memory card/cartridge slot and/or door and document the seal numbers used.
(D)	At least two county personnel or election judges shall accompany the transfer case containing the memory  cards/cartridges to the drop off location. The election judges who receive the equipment must verify, and indicate by signing and dating the chain-of-custody log, that the seals are intact and seal serial numbers match those listed in the log. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, the county personnel or election judges shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(E)	County personnel or election judges transporting secured voting equipment must maintain chain-of-custody logs. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(2)	Required procedures if devices are delivered with memory cards/cartridges intact:
(A)	Two county personnel or election judges shall verify that all seals are intact at the close of polls. Election judges shall sign and date the chain-of-custody log with such indication. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(B)	At least two county personnel or election judges shall accompany the secured equipment to the drop-off location. Seals will be verified, and logs will be signed and dated by the county election official receiving the equipment. If there is any evidence of possible tampering with a seal, or if the serial numbers do not match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in Rule 43.2.11.
(C)	Upon confirmation that the seals are intact and bear the correct numbers, election judges shall remove and upload the memory cards/cartridges into the central count system.
(D)	to secure the equipment, election judges shall place a tamper-evident seal over the memory card slot and update the chain-of-custody log to reflect the new seal number(s).
(c)	Required procedures for transportation of ballot boxes:
(1)	Election judges shall seal all ballot boxes that contain voted ballots so that no person can access the ballots without breaking a seal. The election judges shall record all seals in the chain-of-custody log and two election judges shall verify, and indicate by signing and dating the log, that the required seals are intact.
(2)	Two county personnel or election judges shall accompany all ballot boxes that contain voted ballots at all times, except when the ballot box is located in a vault or secure physical location.
(3)	The ballot box exchange requirements of section 1‑7‑305, C.R.S., are met if a chain-in-custody log is completed for each ballot box.
43.2.8	Contingency plans
(a)	Emergency Contingency Plans for Voting Equipment and Voting Locations
(1)	All remote devices used in an election shall have sufficient battery backup for at least two hours of use. If this requirement is met by reliance on the internal battery of the voting device, then the county clerk and recorder shall verify that all batteries are fully charged and in working order prior to the opening of polls at the voting location. The use of third-party battery backup systems also meets this requirement.
(2)	In the event of a serious or catastrophic equipment failure, or when equipment is removed from service at one or more polling locations, or there is not adequate backup equipment to meet the requirements of section 1‑5‑501, C.R.S., the county clerk and recorder shall notify the Secretary of State that the county is using provisional ballots or mail-in ballots as an emergency voting method.
(b)	A security plan must contain a section entitled “contingency plan” that includes the following:
(1)	Evacuation procedures for emergency situations including fire, bomb threat, civil unrest, and any other emergency situations identified by the designated election official;
(2)	Back up plans for emergency situations including fire, severe weather, bomb threat, civil unrest, electrical blackout, equipment failure, and any other emergency situations identified by the designated election official;
(3)	An emergency checklist for election judges; and
(4)	A list of emergency contact numbers provided to election judges.
43.2.9	Internal Controls for the Voting System
(a)	The County must enable, create, and use passwords.
(b)	In addition to the access controls discussed in Rule 43.2.3(c), the county shall change all passwords and limit access to the following areas:
(1)	Software. The county shall change all software passwords once per calendar year prior to the first election. This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
(2)	Hardware. The county shall change all hardware passwords once per calendar year prior to the first election. This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
(3)	Password Management. The county shall limit access to the administrative passwords to the election management software to two employees. The county shall limit access to passwords for all components of the election software and hardware to two employees. The county may provide an additional ten employees with access to the administrative passwords for the software components, and an additional ten employees with access to the administrative passwords for the hardware components of the voting system.
(4)	Internet Access. The county must never connect or allow a connection of any voting system component to the Internet. 
(5)	Modem Transmission. The county must never connect any component of the voting system to another device by modem except for the vote tally software as allowable by the certification of the specific device. 
(6)	Remote sites may use modem functions of optical scanners and DREs only for the purpose of transmitting unofficial results, as permitted by the Secretary of State’s certification documents for the specific systems. A county using modem devices to transmit results shall meet the following requirements:
(A)	A county may use a modem device only after all steps to close the polls are complete and summary tapes are printed, and may only use the device to transmit test data or unofficial results.
(B)	The county shall not use a modem for any programming, setup, or individual ballot-casting transmissions.
(C)	The county shall change the receiving telephone number for the modem transmission at least once per calendar year prior to the first election.
(D)	The county may provide the telephone number of the modem receiving the transmission to no more than six employees. The county shall not publish or print the receiving modem telephone number for any election judge. To the extent possible, the county shall program the telephone number into the device and use the device in a way that hides the display of the number from the view of election judges and voters at all times.
(7)	Authorized Employees. The county shall include in their security plan the employees’ titles and the dates of CBI background checks for employees with access to any of the areas or equipment set forth in this Rule. Each county shall maintain a storage facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained. If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule. [Section 24‑72‑305.6, C.R.S.]
43.2.10	Security Training for Election Judges
(a)	The county shall include in their security plan the details of their security training for their election judges. The county must  address the anticipated time of training, location of training, and number of election judges receiving the security training, as it applies to the following requirements:
(1)	The county shall conduct a separate training module for field technicians and election judges responsible for overseeing the transportation and use of the voting systems, picking up supplies, and troubleshooting device problems throughout the Election Day.
(2)	Security training shall include the following components:
(A)	Proper application and verification of seals and chain-of-custody logs;
(B)	How to detect tampering with voting equipment, memory cards/cartridges, or election data on the part of anyone coming in contact with voting equipment, including employees, other election judges, vendor personnel, or voters;
(C)	Ensuring privacy in voting booths;
(D)	The nature of and reasons for the steps taken to mitigate the security vulnerabilities of voting systems;
(E)	V-VPAT requirements;
(F)	Chain-of-custody requirements for voting equipment, memory cards/cartridges, and other election materials;
(G)	Ballot security;
(H)	Voter anonymity; and
(I)	Recognition and reporting of security incidents.

43.2.11	Remedies 
(a)	If a seal is broken or if there is a discrepancy in a chain-of-custody log, the election judges shall immediately notify the county clerk and recorder, who shall investigate, complete and submit to the Secretary of State an internal incident report, and follow the appropriate remedy as indicated in this rule or as directed by the Secretary of State.
 (b)	If the county clerk and recorder conducts an investigation in accordance with Rule 43.2.11(a) and is unable to determine why a seal was broken or why a discrepancy exists in a chain-of-custody log, then the county clerk and recorder shall file an incident report with the Secretary of State as soon as practicable, but no later than the close of the canvass period for the election. Any unit involved must undergo the reinstatement or verification of the trusted build, in accordance with State instructions. The following remedial actions are required if a device was tampered with (the county clerk and recorder may determine additional requirements based on the details of the incident report):
(1)	For instances where the county can display, verify, or print the trusted build hash value (MD5 or SHA-1) of the firmware or software, the election official shall document and verify that the hash value matches the documented number associated with the Trusted Build for the software or firmware of that device.
(2)	If the evidence indicates that the tampering occurred prior to the start of voting:
(A)	The election judges shall seal the device and securely deliver it to the county clerk and recorder.
(B)	The county clerk and recorder or his or her designee shall remove and secure the memory card following the procedures in Rule 43.2.2(d). The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device. The county clerk and recorder or his or her designee shall install a new, secure memory card into the device, conduct a hardware diagnostics test as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots on the device. The county shall maintain on file all documentation of testing and chain of custody for each specific device.
(C)	The county shall complete the necessary seal process and documentation to re-establish the chain of custody for the device and new memory card.
(D)	The county shall set the machine to election mode ready for a zero report.
(E)	Repealed.
(3)	If the evidence indicates that the tampering occurred after votes were cast on the device but before the close of polls:
(A)	The election judges shall seal the device and securely deliver it to the county clerk and recorder.
(B)	The county clerk and recorder or his or her designee shall close the election on that device, and perform a complete manual verification of the paper ballots (or V-VPAT records) to the summary tape printed on the device that represents the record of votes on the memory card. 
(C)	If the totals do not match then only the paper record will be accepted as the official results for that device. The county clerk and recorder shall re-seal and secure the device and immediately report the discrepancy to the Secretary of State. The county must not use the device for the remainder of the election unless the trusted build is reinstalled.
(D)	If the totals match, the county may upload the memory card into the tally software at the close of polls.
(E)	After verifying the totals, the county shall secure the paper records and memory card with seals and a chain-of-custody log.
(F)	The county shall place a new and secure memory card in the device. The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device. The county clerk and recorder or his or her designee shall conduct a hardware diagnostics test as prescribed in Rule 11. The county shall maintain on file all documentation of testing and chain of custody for the device.
(G)	The county shall complete the necessary seal process and documentation to establish the chain of custody for the device and memory card.
(H)	The county shall set the machine to election mode ready for a zero report.
(I)	At the conclusion of the election, the county shall conduct a full (all races) post-election audit on the device and report results to the Secretary of State as required by Rule 11. This requirement is in addition to the random selection conducted by the Secretary of State.
(J)	Repealed.
(4)	If the evidence indicates that the tampering occurred after the close of polls:
(A)	The election judges shall seal the device and securely deliver it to the county clerk and recorder.
(B)	The county clerk and recorder or his or her designee shall perform a complete manual verification of the paper ballots (or V-VPAT records) to the summary tape printed on the device that represents the record of votes on the memory card. 
(C)	If the totals do not match then only the paper record will be accepted as the official results for that device. The county clerk and recorder shall re-seal and secure the device and immediately report the discrepancy to the Secretary of State. The county must not use the device for the remainder of the election unless trusted build is reinstalled.
(D)	If the totals match, the county may upload the memory card into the tally software at the close of polls.
(E)	After verifying the totals, the county shall secure the paper records and memory card with seals and a chain-of-custody log
(F)	The county clerk and recorder or his or he designee shall follow the State instructions for installing/verifying the trusted build for the specific device and complete the necessary seal process and documentation to establish the chain of custody for the device.
(G)	During the canvass process, the county shall conduct a full (all races) post-election audit on the device and report results to the Secretary of State as required by Rule 11. This requirement is in addition to the random selection conducted by the Secretary of State.
(H)	Repealed.
(c)	The county shall make all documentation related to the voting system and for every device used in the election available for Secretary of State inspection.
43.2.12	The county shall submit any additional physical security procedures not discussed in this rule to the Secretary of State for approval prior to the election.
43.3	The county shall submit with the security plan sample copies of all referenced forms, schedules, logs, and checklists.
43.4	Amendments and review of Security Plans
43.4.1	If no changes have occurred since the last security plan was filed, the county shall file a statement to that effect.
43.4.2	The county shall clearly identify and describe any revisions to a previously filed security plan.
43.4.3	The county may change the security plan within 60 days of an election as a result of an emergency situation or other unforeseen circumstance. The county must document the changes and file the revisions with the Secretary of State within five days of the change.
43.4.4	If, under section 1‑5‑616(5)(b), C.R.S., the Secretary of State is unable to complete its review, the Secretary will notify the county that the security plan or revisions are temporarily approved until the review is complete. 
43.5	Lease, Loan, or Rental of Election Equipment
43.5.1	Nothing in this Rule requires a county clerk to lease, loan, or rent any election equipment to any municipality, special district or other local jurisdiction.
43.5.2	A county clerk who chooses to lease, loan, or rent any certified election equipment to a municipality, special district, or other local jurisdiction for use in their elections shall follow at least one of the following procedures in order to maintain or reestablish an acceptable chain of custody and appropriate documentation in accordance with Rule 43.2.1.
(a)	After the local jurisdiction returns the certified equipment to the county clerk, the county clerk must reinstate or verify the trusted build in accordance with Rule 43 before the equipment is used in any primary, general, congressional vacancy, statewide ballot issue (including recall), or special election conducted by the county clerk.
(b)	The county clerk or their deputized representative shall:
(1)	Deliver the certified equipment to the jurisdiction;
(2)	Witness and document the installation of the memory card(s) or cartridge(s) used by the jurisdiction;
(3)	Place one or more secure and numbered seals on the voting equipment in accordance with Rule 43.2.2. If during the course of the jurisdiction’s election, the designated election official requires removal of a memory card or cartridge as a function of the election process, the county clerk or their deputized representative shall witness and document the removal and proper resealing of the memory card or cartridge; and
(4)	Upon return of the equipment to the county clerk and recorder, the county clerk shall verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact. If any seal is damaged or removed, the county clerk shall reinstall or verify the trusted build in accordance with this Rule 43.
(c)	The county clerk and recorder shall designate and station deputized county staff with the loaned certified equipment at all times while the equipment is under control of the designated election official. The deputized county staff must maintain physical custody of the certified equipment at all times to ensure that no unauthorized access occurs.
(d)	In accordance with section 1‑5‑605.5, C.R.S., the county clerk shall appoint the designated election official as a deputy for the purposes of supervising the certified voting equipment. The designated election official shall:
(1)	Sign and submit to the county clerk and recorder an affirmation that he/she will ensure the security and integrity of the certified voting equipment at all times;
(2)	Affirm that the use of the certified voting equipment is conducted in accordance with Rule 43 and the specific Conditions for Use of the certified voting equipment; and 
(3)	Agree to maintain all chain-of-custody logs for the voting device(s).
43.5.3	Upon return of the certified voting equipment to the county clerk and recorder, the county clerk is required to verify the trusted build, in accordance with State instructions, if the documentation and chain of custody does not support the proper maintenance of the trusted build software and chain of custody.