Holly Z. Lowder
Director, Elections Division

Mike Coffman
Secretary of State

 STATE OF COLORADO
 Department of State
 1700 Broadway
 Suite 250
 Denver, CO  80290

NOTICE OF ADOPTION

Pursuant to sections 1-1-107(2)(a) and 1-1.5-104(1)(e), C.R.S. (2006) and the rulemaking provisions of the State Administrative Procedure Act, section 24-4-103 C.R.S. (2006), I, Mike Coffman, Colorado Secretary of State, do hereby adopt and give NOTICE of the temporary and permanent rule adoption this 16th day of March, 2007, of the amendments to the attached Secretary of State Election Rules (8 CCR 1505-1).  

Such amendments are effective immediately, and the permanent adoption of these rules shall take effect twenty (20) days after publication in the Colorado Register in accordance with the State Administrative Procedures Act.  In accordance with section 24-4-103(6), C.R.S (2006), attached is a statement of the findings of the Secretary of State justifying the adoption of these amendments on a temporary basis.

         	Dated this 16th Day of March, 2007.

	_/s/ Mike Coffman			
Mike Coffman
Colorado Secretary of State

Holly Z. Lowder
Director, Elections Division

Mike Coffman
Secretary of State

 STATE OF COLORADO
 Department of State
 1700 Broadway
 Suite 250
 Denver, CO  80290

Holly Z. Lowder
Director, Elections Division

Mike Coffman
Secretary of State

 STATE OF COLORADO
 Department of State
 1700 Broadway
 Suite 250
 Denver, CO  80290

Statements of Basis, Purpose and Specific Statutory Authority

Office of the Secretary of State
Amended and Revised Rules: 25.3, 26.2, 30.3, 38.10, 38.12, and 45
Election Rules

1.	Basis and Purpose

This statement pertains to the amendments and revisions to the Colorado Secretary of State Election Rules for the administration of Colorado State Constitution Article VII, and Article 1, Title 1 of the Colorado Revised Statutes.  The amendments are implemented to achieve the uniform and proper administration and enforcement of the election laws of the State of Colorado, specifically with regard to the requirements of the “Help America Vote Act of 2002”, P.L. No. 107-252. See sections 1-1.5-101 et seq., C.R.S. (2006).

The amendments and revisions to these rules are necessary for the implementation of Article VII of the Colorado Constitution and Article 1, Title 1 of the Colorado Revised Statutes.  The Secretary of State finds that the adoption and enactment of these amendments and revisions is necessary in order to comply with a court order to promulgate voting systems certification rules that include minimum security standards for direct recording electronic voting systems.  

Election Rule 45 is being revised pursuant to a court order Conroy v. Dennis, No. 06CV6072 (Denver Dist. Ct.) issued on September 22, 2006, which mandates that the Secretary must “promulgate a rule containing minimum security standards for DREs as required by § 1-5-616(1)(g), C.R.S. (2006).”  The order further requires the Secretary “to retest previously certified systems or any new systems, using the revised security standards to be promulgated by the Secretary, prior to the next primary, general or statewide ballot issue election following the November 7, 2006 general election, whichever comes first.”   The Secretary of State finds that the adoption and enactment of the amendments and revisions to Rule 45 is necessary because a statewide ballot issue election may be held in November 2007 if a qualified issue is placed on the ballot. 

The amendments and revisions to the Election Rule 45 must be adopted and implemented early in 2007 given the limited timeframe within which to test and certify voting equipment once the rules are effective.  The state is required under section 1-5-617(1)(c), C.R.S., to conduct testing and certification within ninety days from the vendor’s submission, and has an additional thirty days within which to make a report and notify the vendor and the counties of the determination.  This process should be completed no later than July 1, 2007 in order to allow the county clerk and recorders sufficient time to obtain approval for and purchase any new equipment, and perform acceptance testing before the equipment is used in an election.  

In drafting the revised Rule 45, the Secretary solicited the assistance of experts to identify specific security risks and define testing/certification requirements.  The group included state and private sector IS/IT professionals, computer scientists, and university professors.  Multiple drafting meetings were held involving the group IT/IS experts.  The Secretary held an informal public meeting, in addition to the formal rulemaking hearing for the purpose of receiving public input on the draft rule.  Following the formal rulemaking hearing held on February 6, 2007, the hearing record was held open for twenty days to allow for the submission of additional public comment.  The comments received during and following the public meeting were considered in drafting the final Rule 45.  

The Secretary of State finds that the adoption of the amendments and revisions to the Election Rules is further necessary to make technical corrections that have been requested by the Office of Legislative Legal Services, and to increase the transparency and security of the election process.  The Secretary of State therefore finds that in order to ensure the uniform and proper administration and enforcement of the election laws, the permanent adoption of the amendments and revisions to the Election Rules is necessary both to comply with law and to preserve the public welfare generally.

This rule contains scientific and technical matters.  The evaluation justifying scientific and technical rationale is as follows:

Background and Overview

Voting Equipment 

Colorado currently has a variety of optical scan and Direct Recording Electronic (DRE) voting devices from one of four national vendors distributed as summarized in Figure 1 below.

	Counties	Voting Locations	% of voting locations	DREs	Optical Scanners	% of equipment	
HART Intercivic	47	569	38%	1365	345	19%	
DIEBOLD Election Systems	11	351	23%	1782	478	25%	
SEQUOIA Voting Systems	4	356	24%	2355	270	29%	
Election Systems and Software (ES&S)	2	231	15%	2267	124	27%	
Grand Totals:	64	1,507	 	7769	1217	 	

Figure 1.  2007 Data on Voting Systems used in Colorado.  http://www.elections.colorado.gov/DDefault.aspx?tid=113

Modern DRE devices fall into two categories; full face and ATM/Kiosk style units.  The functionality of the units is the same; the presentation in the design of the unit is different.  The full-face styled units allow all contests on a ballot to be displayed at once while the ATM/Kiosk style units require users to page through the contests in order to vote.  The newer generation DREs (ATM/Kiosk) are distinguished by software platforms that are compatible with Windows operating systems and that interface with the voter to cast a ballot.  Both styles feature redundant and removable memory on a standard memory card or cartridge, have the ability to present the ballot in different languages, and require some form of activation by a poll worker to “enable” the device for voting.   The devices include voter activation cards which can be handled by the voter, activation codes which the voter can enter on a machine and activation devices which are used by poll workers.  All of the devices are designed to allow poll workers to provide the voter with the correct ballot style and to limit each voter to casting only one ballot.

Voting equipment used in Colorado must pass through several layers of security and testing.  These requirements increase the quality, transparency and accuracy of votes as well as the public confidence and trust in the approval process for the devices and the accuracy of elections.

Federal Certification Process 

Colorado Revised Statutes (C.R.S.) Section 1-5-601.5 requires the State to adopt and implement federal requirements for voting systems that are purchased for use within Colorado.  The federal voting systems standards currently in effect are the 2002 Voting Systems Standards developed by the Federal Election Commission (FEC).  All voting systems purchased for use in Colorado after May 28, 2004 must be tested and recommended for certification by a nationally approved Voting System Testing Laboratory (VSTL – formerly Independent Testing Authorities or “ITAs”).

During federal certification, the VSTL will create a “trusted build” of the voting system which establishes the chain of evidence from the technical data package and source code to the actual computer programs and firmware that are being evaluated for certification.  This chain of evidence will be sufficient to provide assurance that:

•	The system was built as described in the technical data package; 
•	The reviewed and approved source code was actually used in building the system; and
•	Elements that are not included in the technical data package are not introduced in the system build.

According to the Election Assistance Commission (EAC), the final product will provide the following:

“The final product, the Trusted Build, provides an audited reference package, meeting legal rules of evidence in the form of a documented chain of custody, which may be used by technical reviewers at both the national and state level for certification.”  Voting Systems Technical Guidelines Development Committee (2006). Voting Systems Trusted Build – Guidelines.

State Certification Process 

The Secretary of State’s office has established new procedures and guidelines for Colorado’s Trusted Build for the voting systems used in Colorado.  In addition, the Secretary of State will conduct a review of the VSTL reports for compliance with federal and state regulations.  The Secretary of State will create a trusted build for systems certified for use in Colorado where the VSTL or EAC has not already created a trusted build.  Depending upon circumstances in each county, the Secretary of State will install, witness or document the trusted build software and firmware on all devices once the chain of evidence for the supporting documentation is established. (Secretary of State Rule 45.6.2.1.3, 8 CCR 1505-1)  The Secretary of State intends that any system certified for use in Colorado will have extensive security put around the Colorado Trusted Build, and that the chain of evidence will be passed to the counties as indicated below.
	
County Acceptance Testing

The Secretary of State will be using the Colorado trusted build and shall install, witness and document the verification of the build for all equipment used in the State.  The Secretary of State will provide the counties with tools to verify hash values (digital fingerprint of software) such as Tripwire® or Maresware® to perform software audit checking routinely to ensure and update the appropriate chain of evidence for county voting equipment.  Upon validation of software and firmware, the county will perform acceptance testing with certification election data to ensure that field units match results found by the testing board for equipment used for certification testing.  This procedure provides an additional level of trust in the equipment prior to the county moving into election processing.

County Security Requirements

The Secretary of State will continue to evaluate field security conditions and procedures necessary to maintain chain of custody (protect the integrity of voting equipment software, firmware and hardware).  As systems are certified, specific new security procedures may be adapted and modified for systems based on the findings of the testing board.  Secretary of State Rule 43, 8 CCR 1505-1 establishes minimum security procedures for all equipment in use throughout the State.

Election Testing and Audits

The Secretary of State provides guidance to the counties on conducting vigorous public pre-election testing (hardware diagnostics and logic and accuracy) which is intended to assure the public that the chain of custody over the software, firmware and hardware has been maintained.  Pre-Election testing will utilize tools to verify the trusted build is being used on the device, and to validate that the election programming data is set up properly to count all votes as intended.  In addition, the Secretary of State will conduct a mandatory post-election audit, randomly selecting 5% of all equipment used in the State.  During the post-election audit, election administrators must verify that the paper record matches the count on the electronic record so that the Secretary of State can accept the electronic record as part of the certified results from any county.

Voter-Verifiable Paper Audit Trail (V-VPAT)

The V-VPAT creates the paper record that the voter verifies prior to casting a ballot.  The V-VPAT record provides a layer of redundancy of vote records on all DRE machines which is in addition to the removable memory card, the physical hard drive of the device, and in some cases, a flash memory card located inside the machine.  The record is not a receipt and cannot be removed from the voting location.  The Colorado legislature mandated the V-VPAT for additional auditing capabilities needed with electronic voting systems to provide a method to assure voters that their votes are being accurately recorded by DRE devices (C.R.S. 1-5-801).  The document created by the V-VPAT is considered an official election record used to qualify the electronic ballots in the case of a recount, and in the audit function required by the Secretary of State (C.R.S. 1-5-514).  In addition to these functions, the V-VPAT record could be used to certify results of an election in any instance where the DREs security measures may have been compromised in any of the above steps.  	

Field Observations
As a final measure, the Secretary of State monitors equipment used.  The Secretary of State uses field reports to evaluate whether any corrective action is necessary.  After each election, the Secretary of State compiles malfunction reports received from the field and requires voting system vendors to provide detailed analysis with explanation and steps to prevent of malfunctions in the future.  The Secretary of State’s office reviews and audits county maintenance records throughout the year.  In addition to these reports, the Secretary of State considers information from any of the following sources when considering certification status: The Election Assistance Commission (EAC); Voting Systems Testing Laboratories (VSTL); The Federal Election Commission (FEC); The National Software Reference Library (NSRL); The National Association of State Election Directors (NASED); The National Association of Secretaries of State (NASS); Information from any state elections department or secretary of state; and/or information from the Colorado County Clerk and Recorders or their association.

The Secretary of State employs a multi-layer process for handling the testing and security of voting systems used in the State.  Several layers of testing and security procedures mitigate many of the risks associated with voting devices.  Additionally, the Secretary of State includes the public to the extent possible during key moments in voting system testing and auditing by the counties.

Evaluated Threats and Vulnerabilities
The Secretary of State reviewed the following nationally known evaluations and reports on voting systems that have appeared over time.  The following reports were evaluated.  The Secretary of state has mitigated the vulnerabilities in Colorado as follows:

A.  Brennan Center Report on Voting System Security, Accessibility, Usability, and Cost

On October 10, 2006, the Brennan Center for Justice released a report outlining a series of issues regarding voting systems security, accessibility, usability, and cost.  With regard to security, the report identifies in the first chapter that all voting systems have significant security and reliability vulnerabilities which they indicate “can be substantially remedied if proper countermeasures are implemented at the state and local level.” (Norden, 2006).  The six recommended remedies include:
	
	1.	Conduct post-election audits comparing V-VPAT records to electronic records.
	2.	Perform parallel testing on election day.
	3.	Ban the use of wireless components on voting machines.
	4.	Use a transparent and random selection process for all auditing procedures.
	5.	Decentralize the programming and voting systems administration.
	6.	Implement procedures for addressing evidence of fraud or error.

The report determined the risks by creating a threat analysis which evaluated nine categories of threats and analyzed them against currently used systems by type, including evaluating DREs, optical scanners used in polling places, and central count optical scanners.  The report finds that the least difficult attacks are software attacks involving the insertion of corrupt software in order to take over the voting machine and switch votes to a preferred candidate.  Use of wireless components makes systems particularly vulnerable to software attack programs and other attacks.

•	The Secretary of State has implemented all but one of the recommendations of the Brennan Center report as follows:
1.	Post-Election Audits have been conducted since November of 2005 as required by statute and detailed out in Secretary of State Rule 11, 8 CCR 1505-1, which identifies that the V-VPAT record must be compared to the electronic record.
2.	For the mandatory post-election audit, the Secretary of State randomly selects machines to be audited without advance notice to the counties.  The Secretary of State is evaluating methods to make this process more publicly transparent.
3.	Use of wireless components is banned in voting machines as identified in Secretary of State Rule 45, 8 CCR 1505-1.
4.	Programming and voting systems administration is decentralized because each county clerk is independently responsible for each of these functions.  The Secretary of State is not involved with any functions related to the programming of voting equipment to ensure this decentralization.  In addition there is an even distribution of the different manufacturers’ voting products. Table 1. 
5.	Through Secretary of State Rule 43, 8 CCR 1505-1, the State has implemented a series of procedures and remedies for handling voting equipment that may have evidence of fraud. The trusted build that is required under Secretary of State Rule 45.4, 8 CCR 1501-1, strengthens the effectiveness of these and future remedies because the Secretary of State will verify the current trusted state of the software and firmware of a machine, and may repeat this process once more on any machine that is suspected to be tampered with to ensure future use is safe and reliable.  DRE equipment in the State also contains V-VPAT records which is used as the official record of votes for the election should machine tampering occur.
6.	The only recommendation not presently in place is parallel testing on election day.  The Secretary is still evaluating the benefits of parallel testing and will amend procedures if deemed necessary in the future.

B.  Analysis of an Electronic Voting System – “Hopkins Report”
	
On February 27, 2004, Johns Hopkins University released a report outlining security issues with the Diebold TS (also known as R6) DRE touch screen voting system.  The main findings of the report indicate that through software exploits, voters can cast multiple ballots, easily gain access to administrative functions, and the system is overall lacking in security.  Aside from a continuation of source code review, the only recommendation in the report was to mandate the addition of V-VPAT records with DRE voting devices. 

•	The analyzed system is no longer certified for use in the State of Colorado and V-VPAT records are required by statute.  Thus, threats identified in the above report for that system are fully mitigated. However, the Secretary of State considered the concerns outlined in the report respective to other currently certified systems.   The concerns are mitigated by V-VPAT requirements, random post-election audits aimed at identifying any discrepancies between paper and electronic records, implementing the trusted build mandate, requiring multiple tamper-evident seals on the case, doors and memory card slots of all DRE units to prevent unauthorized access.

C.  Diebold Optical Scan Security Alert – Hursti Report 1

On July 4, 2005, Black Box Voting released a report outlining security issues with the Diebold Optical Scan (OS) design.  The report identifies a one-man type of attack using commercial off-the-shelf technology.  The attack requires unfettered inside access to the OS unit.  Through this report, the author is capable of modifying the paper trail to report false results, hide any pre-loaded votes on the device, and program conditional reporting behavior based on time/date or number of votes counted triggers.  Such attacks are done by modifying the reporting files on the OS unit or central tabulation software.  The modifications would then be passed to other OS units either remotely or by direct connection to each one with the proper programming.  Evidence of the tampering is not documented in the audit reports of the OS unit.
	The recommended remedies are:
1.	Further evaluation of the software architecture in Diebold version 1.96.x and 2.0.x.
2.	Memory cards should be deemed to contain critical data and should be retained for 22 months following a federal election.
3.	Memory cards and/or voting systems themselves should be examined in all jurisdictions using any Diebold voting system by someone experienced in computer forensics.
4.	The architecture of other manufacturers should be examined for similar vulnerabilities.

•	The Secretary of State has several layers of protection against the types of security issues identified in this report.  The specific attack described affects the unofficial results report that is printed from the OS unit itself at the close of polls.  However, even when this threat is realized, the accurate election results appear when an election administrator uploads the memory cards into the central count tabulator.  The attack affects only the reporting function of the OS unit. Nonetheless, canvass reports will clearly show evidence of such an attack and would trigger a hand count of the paper records.

In addition to the above, the Secretary of State has other additional procedures in place to address this type of attack:
1.	Colorado Bureau of Investigations background screens are required for individuals with this type of access to voting systems and memory cards. If the background screen indicated that the employee or contract employee has been found guilty of a crime involving breach of trust, fraudulent, coercive, or dishonest practices or demonstrating incompetence, untrustworthiness, or election offenses pursuant to sections 1-13-101 et seq., C.R.S., the county clerk and recorder shall prohibit such employee or contract employee from preparing, programming, operating, using or having any access whatsoever to electromechanical voting systems or electronic vote tabulating equipment at any time during that person’s employment.  These screens are performed annually, and anyone with such access must be deputized to uphold the constitutions of the United States and Colorado in the execution of their duties.
2.	 Memory cards are sealed upon downloading data, and are secured by tamper-evident seal when in a voting device.  The required seals must be checked and verified by at least two people as in place.  Seals must be numbered and verified on chain of custody documentation maintained by the county.
3.	Random post-election audits are conducted verifying the V-VPAT paper ballot to the report printed by the device on election night.
4.	The Colorado trusted build will reset each component of a voting system to the trusted state after Secretary of State Certification of each device, and upon upgrades to the system.

D.  Diebold TSx Evaluation – Hursti Report 2

On May 11, 2006, Black Box Voting released a report outlining security issues with the Diebold TSx touch screen voting machine.  The study describes a method of enabling a malicious person to compromise the equipment well in advance of actually using the exploit.  The report identifies three specific security problems associated with this threat.  First, the system architecture makes it possible for an individual to modify files by changing the boot loader operation.  This is known as boot loader re-flashing (or rebooting).  In addition, the operating system may be modified through a process of re-flashing.  Finally, the system architecture makes it possible to use either of the two previous methods to perform selective file replacement to modify the voting system software undetected.
	
Other weaknesses involve the internal workings of the system.  By removing the six screws that hold the case together, an individual may access additional memory card slots including a “hidden” or at least unlabeled Secure Disk (SD) memory card slot.  Files and/or programs could be installed modifying certified code on the system by gaining access to these ports.
 	
	The recommended remedies are to:
1.	Re-flash all systems with a known good version;
2.	Establish extensive chain of custody management;
3.	Re-engineer the boot loader program; and
4.	Properly seal the case.

•	The Secretary of State implemented various methods of addressing these issues, including:  sealing the four sides of a case to prevent opening with tamper-evident seals, extensive chain of custody procedures, and installation of a trusted build version to ensure no changes are made to the software and firmware components of the voting system.  The Secretary of State has anticipated software issues such as the boot loader program and has added requirements in the Colorado certification process.
  
E.  Princeton Report on the Security of the Diebold AccuVote TS Voting Machine
	
On September 13, 2006, Princeton University released a report outlining security vulnerabilities in the Diebold AccuVote Touch Screen (TS) voting machine.  The focus of the study involves the TS Voting unit (also known as the R6) from Diebold which is not used in the State of Colorado.  The report identifies two classes of attack, the Vote Stealing attack, and the Denial of Service attack.  Both classes of attack could be conducted by introducing malicious code through the memory card via electronic election data card, or by introducing virus type spreading software onto the EPROM chip located on the motherboard (which effectively could spread to any memory card inserted into the unit).
	
Additional weaknesses in security involve key access to the memory card slot, modification of the boot loader files, and upgrades made to the machine via memory card.  These vulnerabilities could go undetected with proper programming.
	
The reports main findings are as follows:
1. Malicious software running on a single voting machine can steal votes with little, if any, risk of detection.  The malicious software can modify all of the records, audit logs, and counters kept by the voting machine, so that even careful forensic examination of these records will find nothing amiss. The author of the Princeton Report has constructed demonstration software that carries out this vote-stealing attack.

2. Anyone who has physical access to a voting machine, or to a memory card that will later be inserted into a machine, can install said malicious software using a simple method that takes as little as one minute.  In practice, poll workers and others often have unsupervised access to the machines.

3. AccuVote-TS machines are susceptible to voting-machine viruses—computer viruses that can spread malicious software automatically and invisibly from machine to machine during normal pre and post-election activity.  The author of the Princeton Report has constructed a demonstration virus that spreads in this way, installing their demonstration vote-stealing program on every machine it infects.

4. While some of these problems can be eliminated by improving Diebold’s software, others cannot be remedied without replacing the machines’ hardware. Changes to election procedures would also be required to ensure security.
	
The report concludes the best methods to overcome these vulnerabilities are recommended as follows:
	1. 	Modification of software and hardware to current federal standards;
	2.	Use tamper-evident seals on memory card access doors and slots;
	3.	Parallel testing DREs on election day;
	4.	Implement stronger certification procedures to evaluate source code;
	5.	Identified as the most important mitigation:  Require V-VPAT and post-	election random audits.

•	The Diebold TS (R6) touch screen DRE is no longer certified for use in the State of Colorado.  However, it is important for voter confidence to identify the solutions, the Secretary of State has already implemented in Colorado due to the high visibility of these reports.  Colorado currently requires tamper-evident seals on memory cards and access door slots and an advanced chain of custody that the counties must maintain for the life of the equipment.  Through this rule the Secretary of State is implementing more stringent standards for certification that include an additional source code review and penetration tests. As the report indicated, the most crucial mitigation is V-VPAT and post-election random audits, both of which are required in Colorado.  The Secretary of State is still evaluating the benefits of parallel testing on election day.  In addition, through Rule 45, 8 CCR 1505-1, the Secretary of State is requiring installation of a trusted build version followed by strict chain of custody requirements to ensure no changes are made to the software and firmware components of the voting system.

F.  UConn Security Assessment of the Diebold OS Voting Terminal.
	
On October 30, 2006, the UConn VoTeR Center and Department of Computer Science and Engineering Department of the University of Connecticut released a report outlining security vulnerabilities in the Diebold AccuVote Optical Scan (OS) unit.  This unit and the associated 1.96.6 firmware are certified for use in the State of Colorado.  The report outlines and identifies a basic attack with several different outcomes including, neutralizing one candidate so that their votes are not counted, swapping the votes of two candidates, or biasing the results by shifting some votes from one candidate to another.  The tabulation corruptions can lay dormant within the system, avoiding detection through pre-election tests.  The report shows that these attacks can be conducted using only commercial off-the-shelf equipment and without any access to the memory card or physically opening the OS unit.

The report prescribes the following “safe-use” recommendations for the OS Unit:  
1.	Tamper-evident seals protecting removable memory card ports when in use and not in use;
2.	Tamper-evident seals protecting all communications ports on back of unit; and
3.	Tamper-evident seals over screws that allow access into the terminal’s interior.

Alternatively, a jurisdiction could seal the entire OS unit into a tamper-resistant container at all times when not in use for preparation of election and deployment in election.  An unbroken chain of custody must be enforced at all times, and post-election audits are advised.

•	The Secretary of State has implemented the report’s recommendations to conduct post-election audits, maintain unbroken chain of custody, and tamper-evident seals over the seams of the OS Unit.  Additionally the Secretary of State will implement new county security procedures (Secretary of State Rule 43, 8 CCR 1505-1) which will require either sealing the entire unit in a case, or additional tamper-evident seals as recommended by the report. 

Expert Panel Findings
The Secretary of State assembled a panel of provide advice concerning the security of electronic voting devices in Rule 45, 8 CCR 1505-1.  The experts include nationally known experts on voting systems who have assisted in the development of federal testing procedures, have performed security audits on voting systems and assisted states such as Maryland, Pennsylvania, California, and Florida to draft standards for certification and in some cases conduct certification tests.  Additionally, the panel consisted of computer scientists from Denver University Computer Science Department, University of Colorado Computer Science Department, and security experts from the Colorado Office of Cyber Security.

The security recommendations of the expert panel are as follows:

A.  Federal Testing and Requirements

1.  	The expert panel recommended that the Secretary of State’s office continue to adopt federal guidelines where appropriate while at the same time avoid duplicating the efforts of the EAC/VSTL process.  Because some of the federal requirements are not specific to Colorado needs, and because some portions of the federal standards will not be implemented until a future date, the State must implement its own procedures for source code review and software coding standards in a manner that allows the state to comply with federal and state standards.

•	The Secretary of State has adopted many procedures for source code review, coding standards, security and hardening of operating systems, databases and communications devices as identified below with significant discussion by the expert panel.

B.	Implementation of Multiple Layers of Security

1.  	The expert panel recommended that the Secretary of State’s office adopt procedures and requirements that build upon each other in a layering fashion.  In particular, the first layer of security is the trusted build, including the verification of the build itself as well as the chain of evidence documents related thereto.  Additionally, experts recommended that the Secretary of State or his designee install, witness or document the installation of the trusted build onto the equipment.  After completing installation, witnessing the installation, or documenting the installation, the experts recommended that the Secretary of State or his designee immediately validate the versions and build numbers installed against trusted configurations.  This is intended to ensure that all prior builds on the voting equipment are eliminated and that only the Secretary of State’s authorized and trusted build is utilized on voting systems used in the State of Colorado.

•	The Secretary of State implemented this recommendation in Rule 45, 8 CCR 1505-1 (section 45.6.2.1.3).  The Secretary of State will witness, install or document the verification of all voting devices in the State to be of the same version as the trusted build through either reformat of device, rebuild of device, or hash valued verification/CRC check of the components.  This procedure will be documented and to the extent possible video recorded.

2.  	The expert panel also recommended an independent source code review against known coding standards for hardened systems.  The experts recommended a review of the vendors’ source code to standards provided from the National Institute for Standards and Technology (NIST), National Security Agency (NSA) and/or manufacturers of certain software.  As these standards are continually updated, the experts recommended the analysis be to presently known coding standards.  As recommended by the expert panel, the source code review should include specific known NIST developed guidelines for software hardening which include: input validations, range errors, API abuses, Time and State conditions, code quality conditions, and encapsulation conditions.

•	The Secretary of State implemented this recommendation in Rule 45, 8 CCR 1505-1 (section 45.5.2.4.3).

3.  	The expert panel also recommended an independent penetration test be conducted on the software to the Open Source Security Testing Methodology Manual (OSSTMM) 2.2 standards as defined for white box or double gray box testing, which provides:
“In white box testing, the auditor engages the target with limited knowledge of its defenses and assets and full knowledge of channels.  The target is notified in advance of the scope and timeframe of the audit but not the channels tested or the test vectors. A double gray box audit tests the skills of the auditor and the target's preparedness to unknown variables of agitation. The nature of the test is efficiency. The breadth and depth depends upon the quality of the information provided to the auditor and the target before the test as well as the auditor's applicable knowledge.”  Herzog, Peter (2006). OSSTMM 2.2. - Open-Source Security Testing Methodology Manual. P12.

•	The Secretary of State implemented this recommendation in Rule 45, 8 CCR 1505-1 (section 45.5.2.4.3).

4.  	The expert panel recommended the Secretary of State consider and mitigate known risk and threat models by implementing additional conditions on certifications, increased county security measures or other restrictions as necessary on a case by case basis.  The experts generally recommended that the Secretary of State allow himself reasonable discretion to do this, as well as to address other minor concerns with the voting systems.  The experts explained this recommendation is based upon the reality that the systems are unique and each may raise distinct issues that can be reasonably addressed through procedures.

•	The Secretary of State implemented this recommendation in Rule 45, 8 CCR 1505-1 (section 45.5.2.4.3).

5.  	The expert panel recommended increased county acceptance testing and State oversight of the distribution of the trusted build.  As stated earlier, the experts recommended the Secretary of State install, observe or document the installation and validation of the trusted build on the county equipment.  The expert panel recommended that, immediately after this step the Secretary of State mandate and enforces acceptance testing of the systems at the moment of the installation of the trusted build and documents the results of acceptance testing.

•	The Secretary of State implemented this recommendation in Rule 45, 8 CCR 1505-1 (section 45.11).  At the time of distribution and documentation of the trusted build, the Secretary of State will conduct acceptance testing of the device using ballots and election files from certification testing with known outcomes to verify proper operation of the device. 

C.  Specific Security Requirements

The Secretary of State requested the expert panel to make recommendations for security requirements that should be adopted as part of the process for certification of voting systems.  The following sections represent the findings of the expert panel:

1.	Access Controls.  The expert panel suggested restricting access to the voting system to the least amount of privilege possible for the system.  The layers of account access include: Operating System Administrative Account, Operating System User Account, Voting System Application Administrative Account, and Voting System Application User Account.  Specifically, the panel recommended restricting the Operating System Administrative Account from having the ability to delete or modify the election database.  With tightly restricted access controls, this known risk is mitigated. 

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(a).

2.	Network Security.  The expert panel recognized the need for elections administrators to use the election management software in a closed, non-routable, non-traceable environment where peripheral devices may be attached at various times in the process.  The experts recommended the Secretary of State clearly define a closed network and ensure that the networks are restricted to allow only the above network activity items. 

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(b) and used the definition provided by the expert panel for closed network.

3.	Database Security.  The expert panel recommended implementing database hardening to accepted industry standards that have been developed by either the NSA or NIST.

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(c) using guidelines currently adopted by the NSA.

4.	Operating System Security.  The expert panel recommended implementing operating system hardening to accepted industry standards that have been developed by either the NSA or NIST.

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(d) using guidelines currently adopted by the NSA.
 
5.	Password Security.  The expert panel evaluated the use of passwords in various components of the voting system and recommended strengthening for password requirements to a minimum of eight characters, including a combination of alpha and numeric and possibly special characters.  Additionally, the panel recommended restricting the use of administrator level passwords on all components for normal activity, requiring the use of separate passwords for user level functions, and prohibiting the use of blank passwords.

•	The Secretary of State implemented all of these recommendations in section 45.5.2.6.1(e).  Based on feedback provided by the experts, the Secretary of State determined that in order to adequately implement the eight character password, that design changes to the voting systems may be necessary, and would require approval by the federal testing authorities.  Thus, the Secretary of State determined this requirement will not take effect until 3/31/2008.  The Secretary of State implemented all other recommendations at the current time.  

6.	Software Coding Standards.  The expert panel recommended using software hardening standards similar to standards implemented by either NSA or NIST requirements.  The panel recommended that these requirements include standards for at least:  input validations, range errors, API abuses, Time and State conditions, code quality conditions, and encapsulation conditions.

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(f).  The Secretary of State gave careful consideration to the forthcoming VVSG requirements that may duplicate the requirements listed here; however the coding restrictions more closely define parameters for the source code evaluation and were included in the requirements for that reason.  

7.	Removable Media Security.  The expert panel recommended that security controls on removable storage media include authentication and validation of stored data through standard cryptography requirements as identified in documents such as Federal Information Processing Standards (FIPS) 140, and FIPS 180.  Additionally, the panel recommended requiring virus scan software to operate on any workstation and/or server where removable media could be inserted.

•	The Secretary of State implemented these recommendations in section 45.5.2.6.1(g).

8.	Telecommunication Security.  The expert panel recommended that telecommunications devices be restricted as much as possible given the threat potential of public networks, provided hardening requirements for modems to include cryptography verification to FIPS 180 standards, requested wireless communications be completely restricted, and that audit capabilities be required for any transmission stream.

•	The Secretary of State implemented the recommendation of the expert panel in section 45.5.2.7 of Rule 45, 8 CCR 1505-1.  In addition to this, the Secretary of State also mitigates these concerns through county security procedures.
	
D.  Procedural Changes

The expert panel encouraged the Secretary of State to reconsider previous practices to modify and enhance the evaluation and documentation process of work product through the certification process.

1.	VSTL Review Process.  The expert panel suggested that the Secretary of State review all VSTL documents for compliance with federal standards.  Individual reports may only contain a picture of the devices that were tested, and multiple reports may be required for a full picture of the VSTL Testing process.  In addition, the panel recommended that the Secretary of State review not just the test reports, but also the test logs, technical data packages and require that vendors consent to the Secretary of State discussing any questions or concerns regarding the VSTL testing with the VSTL testers.  The goal is not to determine if the VSTL properly conducted the test, but instead to determine whether the VSTL conducted the test as required, drew a conclusion on the results of the test and made recommendations to the EAC for certification.  If the federally mandated tests are not completed, then the Secretary of State will send the system back to the VSTL/EAC for re-testing of that specific component.

•	The Secretary of State implemented this into Rule 45, 8 CCR 1505-1 for certification in section 45.5.2.4.2.

2.	Chain of Evidence.  The expert panel suggested that the Secretary of State adopt federal guidelines for the establishment and distribution of a trusted build version of a voting system used for testing.  Having the capability to test the same build version of the software that VSTL labs are using for testing is imperative to maintaining the public confidence in DREs.  Additionally, the State should research and consider methods other states have used in distributing and maintaining the chain of evidence of the software from the federal level down to the county level.

•	The Secretary of State implemented this procedure into Rule 45, 8 CCR 1505-1, and additionally has implemented models similar to those used in Maryland and Georgia for physically observing and documenting the chain of evidence for the trusted build being distributed to each device used in the State.

3.	Documentation of Testing.  The expert panel suggested that a detailed test log be developed including specific sections to document test scripts used, test environment, expected outcome, mitigating controls, test numbers, and a section for observations, notes and document attachments.  Additionally, the expert panel recommended that the Secretary of State video document both the certification process and the implementation of the trusted build.

•	The Secretary of State implemented these recommendations and has revised the test log to reflect the suggestions, and has developed a strategy for adding video documentation of certification testing and trusted build installation.

Review of Public Comments

The Secretary of State evaluated and determined which public comments to adopt, modify or accept based on the overall direction of Rule 45, 8 CCR 1505-1.   With respect to public comments, the Secretary of States’ findings with input from the expert panel fell into one of the following four categories:

1.	Already Addressed 

The drafting and notice process evolved over the course of three months and various drafts were released to the public.  The first draft released identified many areas that included items that “needed development” which would be coming at a later time.  Many of the initial comments received were addressed by the panel during the various drafting meetings held.  Some examples of the submissions:
•	“We feel there is no method by which to test a voter friendly system (45.5.2.3.2) and this will be lead to subjective judgment by the State staff.”  Consistent with the expert panel’s recommendation, this item was removed by the Secretary of State.
•	“The types of standards being discussed are not even in the draft of VVSG 2007 and are still under debate in some cases (like EAL-4).”  Initially, the expert panel recommended this requirement, but later withdrew this recommendation because the standards are not yet defined and therefore cannot be evaluated or enforced.  The Secretary of State removed the requirement from the draft versions of the rule.
•	“Rule 45.11.5 allows a jurisdiction to opt out of acceptance testing of machines if they choose which is inconsistent with the other portions of the rule.”  The expert panel had recommended mandatory acceptance testing, which was implemented by the Secretary of State.

2.	Implemented with Modifications
	
Based on the technical nature of the requirements and specific direction that the expert panel gave to drive the process, there were instances where the panel had to modify an initial suggestion to ensure consistency.  Some examples of this in the submissions are: 
•	“This [45.6.2.3.3] should indicate that it includes a recall question and successor that counts the successor vote only if a choice has been selected on the recall question.”  The expert panel recommended the Secretary of State, the addition of the recall question in the requirement.  The Secretary of State added the requirement for testing, but deferred to C.R.S. Title 1 for the specifics on handling the detail of the recall question and suggested adding the requirements to the functional testing procedures.  This process is understood as the normal method for rule-making by the Secretary of State’s office so that in the event a statute changes, the rule will not be invalidated.
•	“A closed network must provide no communications path to the outside world.”  The expert panel recommended tightening the definition of a closed network to be consistent with their other recommendations on security standards in relation to networks.  The panel agreed with the Secretary of State’s requirements that with the combination of the new definition of closed network and the telecommunications devices hardening requirements provided in 45.5.2.7, that the environment is secured. 
•	“This would have to be done electronically [45.5.2.9.24]; I see no feasible way to get a paper printout to include/exclude races unless it was fed through some type of pre-programmed tabulator system.”  The Secretary of State changed the wording of the requirement be clarified to allow an elections administrator to properly identify provisional ballots recorded on V-VPAT paper. 

3.	Clarified Intention in Rule
	
In both the public comments received and internal meetings, certain language inconsistencies (SOS vs. Secretary of State for example) and unclear issues were raised, requiring clarification.  Examples are :
•	“In section 45.5.2.3.19 does the Secretary really want to test for fungus growth as required in the Guideline Four of the MIL HDBK 454?”  The expert panel recommended this requirement only apply with respect to the handbook’s requirements for parts and materials.  The Secretary of State modified the requirement for clarity.
•	“How is a system supposed to log a hardware reset [45.5.2.5.3]?”  The Secretary of State clarified the requirement to apply to hardware initialization. 
•	“Do they [requirements] apply equally to the ballot definition system, the reporting system, the DRE as well as the optical scan [45.5.2.6.1(a)]?”  The expert panel evaluated requirements and made recommendations to clarify instances where specific components should be referenced versus the broader “voting system” reference when all components should be addressed.  The Secretary of State modified the requirements per the recommendations.
•	“Is ‘user’ here [45.5.2.8.2(i)] defined as the voter?”  The expert panel reviewed the entire document searching for terms such as user, voter, and operator, and recommended clarifications particular to those references, which were implemented by the Secretary of State.
•	“Very detailed software structuring requirements should not be codified in Colorado statutes or regulations like this.  Instead there should be good security evaluations against more established criteria.”  The expert panel re-evaluated the requirements for source code review, independent testing, operating system hardening, and software coding constructs.  The experts recommended industry standard requirements from NIST, the NSA, or in the case of the software coding requirements, directly from the language of the VVSG.

4.	Not Implemented
	
In some cases, public comments and suggestions could not be adopted either due to the limited scope of Rule 45, 8 CCR 1505-1, inconsistencies with the general direction previously recommended by the expert panel, or because the Secretary of State did not have statutory authority to adopt such suggestions.  Some examples of this are:
•	“Improve Logic and Accuracy test and equipment acceptance test procedures.”  This suggestion would require modification to Rule 11, 8 CCR 1505-1, which is not in the scope of Rule 45 and certification testing.  The rule for certification testing does ensure certification tests are conducted in “election mode” only (45.6.2.3.2).
•	“Election results should not be revealed publicly until at least 24 hours after the close of polls.”  This suggestion is not within the scope of certification testing and should be addressed with the Colorado Legislature.
•	“The rule does not require compliance with the new standard [2005 VVSG] but instead provides that vendors only need to document their plans to comply with the requirement – a whole year later.”  The Secretary of State may not incorporate standards into a rule that are not yet in place (C.R.S. 24-4-103 (12.5)(a)).  The 2005 VVSG becomes effective in December of 2007.  The expert panel recommended that the rule be re-evaluated after that time.  However, the expert panel studied the 2005 VVSG to determine if it should recommend that any of those requirements be adopted by Colorado now.  In several instances, the experts recommended and the Secretary of State adopted recommendations to include some of those requirements in the present rule changes, including:  password requirements, the trusted build model, software design controls, database hardening, and source code review.
•	“There are standards organizations working on Electronic Data Interchange standards, specifically the IEEE [45.5.2.1.7].  Reference should be added that with the proclamation of such standards, the standards will be adopted by the State.”  As stated earlier, the Secretary of State may not incorporate standards that are not yet in place (C.R.S. 24-4-103(12.5)(a)).  Nonetheless, the expert panel reviewed some of the documents by the IEEE and recommended that the existing requirement remain as written for data transfers.
•	“If the systems applying for certification… are approved and certified by the EAC why use valuable state resources to evaluate those previously tested requirements and components[45.5.2.4.2]?”  The expert panel recommended that the Secretary of State review the documentation submitted to determine that the system meets or exceeds federal qualifications and not duplicate efforts by the testing authorities and federal authorities.  This was recommended due to prior instances where required federal tests were not completed, or not completed satisfactorily, which may impact State-level testing.

2. 	Statutory Authority

Amendments and revisions to the Colorado Secretary of State Election Rules are adopted pursuant to the following statutory provisions:

1. Section 1-1-107(2)(a), C.R.S. (2006), which authorizes the Secretary of State: 
“[t]o promulgate, publish, and distribute . . . such rules as the secretary of state finds necessary for the proper administration and enforcement of the election laws.”  

2. Section 1-1.5-104(1), C.R.S. (2006), which provides that:
“The secretary may exercise such powers and perform such duties as reasonably necessary to ensure that the state is compliant with all requirements imposed upon it pursuant to HAVA . . . including, without limitation, the power and duty to: 
(e) Promulgate rules in accordance with the requirements of article 4 of title 24, C.R.S., as the secretary  finds necessary for the proper administration, implementation, and enforcement of HAVA and of this article.”  
	
	3. Section 1-5-616(1), C.R.S. (2006), which states:
“The secretary of state shall adopt ruled in accordance with article 4 of title 24, C.R.S. that establish minimum standards for electronic and electromechanical voting systems regarding:
(g) Security Requirements”

References

Feldman, Ariel, Halderman, Alex, Felten, Edward (2006).  Security Analysis of the Diebold AccuVote-TS Voting Machine.  Center for Information Technology Policy and Department of Computer Science, Princeton University.

Hursti, Harri (2005).  The Black Box Report.  Security Alert:  July 4, 2005. Critical Security Issues with Diebold Optical Scan Design. Black Box Voting.

Hursti, Harri (2006).  Diebold TSx Evaluation.  Security Alert: May 11, 2006.  Crtitical Security Issues with Diebold TSx.  Black Box Voting.

Kiayias, A., Michel, L., Russell, A., Shvartsman, A.A. (2006).  Security Assessment of the Diebold Optical Scan Voting Terminal.  UConn VoTeR Center and Department of Computer Science and Engineering, University of Connecticut.

Kohno, Tadayoshi, Stubblefield, Adam, Rubin, Aviel, Wallach, Dan (2004).  Analysis of an Electronic Voting System.  John Hopkins University, Information Security Institute; Department of Computer Science, Rice University; Department of Computer Science and Engineering, University of California at San Diego.

Norden, Lawrence (2006).  Voting System Security, Accessibility, Usability, and Cost.  The Brennan Center For Justice Voting Technology Assessment Project.