COLORADO SECRETARY OF STATE
[8 CCR 1505-1]
Election rules

Rules as Adopted - Redline

April 16, 2012

 (Additions to the current rules are reflected in small caps and deletions from current rules are shown in stricken type.):
Rule 12.4.1(a)(8) is amended as follows:
12.4	Mail Ballot Plans
12.4.1	Coordinated and non-partisan elections.
(a)	Written plan. As soon as possible, but no later than 55 days prior to any other election, not including a Primary Election, a written plan must be submitted to the Secretary of State which includes the following:
(8)	The address and hours of operation for all drop-off locations.  For security reasons, unmonitored freestanding drop-off locations located outside will not be allowed;
Rule 12.4.2(a)(7) is amended as follows:
12.4.2	Primary Elections conducted as a mail ballot election.  
(a)	Written plan.  Pursuant to Article 7.5 of Title 1, C.R.S., no later than 120 days prior to the election the county clerk and recorder must submit a written plan to the Secretary of State that includes the following:
(7)	Description of the procedures that will be taken to ensure that each service center complies with the requirements set forth in section 1‑7.5‑107, C.R.S., including the number of accessible voting machines anticipated being used at each service center  For security reasons, unmonitored freestanding drop-off locations located outside will not be allowed;
New Rule 12.10.4 is adopted as follows:
12.10.4	Monitoring drop-off locations.  All drop-off locations must be monitored by an election judge or video security surveillance recording system, as defined in Rule 43.
(a)	Freestanding drop-off locations must be monitored at all times.
(b)	If the drop-off location utilizes a drop-slot into a building, the ballots must be collected in a locked container, and both the drop-slot and container must be monitored at all times.
Rule 27.8 is repealed as follows:
27.8	Repealed. Written Plan for Alternative Counting Method
27.8.1	General Information Concerning Plan Submittal
27.8.1.1	Any plan requiring the approval of the Secretary of State for counting votes at an alternative location or by an alternative method pursuant to section 1-7-603, C.R.S., shall be submitted in writing to the Secretary of State no earlier than 120 days and no later than 60 days prior to the election at which it is to be implemented. A separate plan shall be submitted for each election; except that a combined plan may be submitted for both the primary and general elections in the same year. If a combined plan is approved, the Secretary of State may withdraw approval or require revision of the plan after the primary election and no later than the seventieth day before the general election. A revised plan, if so required, shall be submitted for approval no later than 60 days before the general election.
27.8.1.2	The Secretary of State shall approve or disapprove the alternative counting plan no later than forty-five (45) days before the election at which the plan is to be implemented.
27.8.1.3	No alternative counting plan may be implemented without express written approval from the Secretary of State. Any submitted plan must establish minimum procedures in accordance with the requirements of this Rule 27.8.
27.8.2	Transfer Logs
27.8.2.1	The transfer logs shall at minimum contain: the date of the election; the precinct number; the seal numbers; and the names of the polling place judge(s), the transfer judge(s), and the counting judge(s) who carryout the ballot transfer.
27.8.3	Procedures to be Followed at the Polling Place
27.8.3.1	Each polling place shall have available for use a minimum of two (2) ballot boxes to ensure that at least one (1) ballot box is always available to receive voted ballots.
27.8.3.2	At time of ballot transfer, a bipartisan team of at least two (2) transport judges and one (1) polling place judge shall transfer ballots in accordance with the following provisions:
27.8.3.2.1	Both transfer judges and the polling place judge shall review the transfer logs to ensure that all information is complete and accurate. When all information is complete and accurate, both transfer judges and the polling place judge shall initial all copies of the transfer logs.
27.8.3.2.2	In full view of the polling place judge, the transfer judges shall secure the transfer log that is to remain with transfer case. The transfer judges shall secure the transfer case in accordance with section 1-7-307 (3), C.R.S. The seal number of the seal to be used shall be noted on the transfer logs prior to sealing the transfer case.
27.8.3.2.3	At the close of the polls, the duplicate copies of the polling place transfer log(s) shall be mailed at the nearest post office or post-office box by a polling place judge to the designated election official.
27.8.3.2.4	Pursuant to section 1-7-108 (3), C.R.S., duly appointed watchers may observe all aspects of the process described in this Rule 27.8.
27.8.4	Procedures to be Followed During Transport
27.8.4.1	During ballot transport, the sealed ballot transfer case shall be within the close physical proximity of the bipartisan team of transfer judges at all times.
27.8.4.2	Delivery of the sealed ballot transfer case to the counting location shall be made at once and with all convenient speed. However, nothing in this Rule 27.8.4.2 shall be interpreted to prohibit transfer judges from stopping at multiple polling places before arriving at the counting location.
27.8.5	Procedures to be Followed at the Counting Location
27.8.5.1	Upon arrival at the counting location, the bipartisan team of transfer judges shall deliver the sealed ballot transfer case to the designated election official or counting judges.
27.8.5.2	The designated election official or counting judges shall take possession of the transferred ballots by noting the delivery date and time and verifying the seal numbers on the transfer log.
(Current Rule 27.8 is relocated to Rule 43.2.7(c) for clarity)
Rule 43 is amended as follows:
Rule 43. County Security Procedures
43.1	Definitions
43.1.1	“Chain of custody Chain-of-custody log” shall, for the purposes of this rule means a written record that shows that the equipment and all associated data are secured according to these procedures and in the documented control of an employee or deputized election judge through the entire time of ownership by the jurisdiction.
(Current Rule 43.1.2 is amended and relocated to Rule 43.1.7)
43.1.32	“DRE” means a direct recording electronic voting device. A DRE is a voting device that records votes by means of a ballot display provided with mechanical or electro-optical components or an audio ballot that can be activated by the voter can activate; that processes data by means of a computer program; and that records voting data and ballot images in memory components or other media. The device may produce a tabulation of the voting data stored in a removable memory component and as printed copy. The device may also provide a means for transmitting individual ballots or vote totals to a central location for consolidating and reporting results from remote sites to the central location. 
43.1.43	“Employee” shall, for the purposes of this rule, means all full-time, part-time, permanent, and contract employees of the county who have had a criminal history check conducted in accordance with Rule 11.2 and are deputized by the county clerk and recorder to prepare or maintain the voting system or election setup materials, staff the counting center and who have any access to the electromechanical voting systems or electronic vote tabulating equipment.
43.1.54	“Removable card or cartridge” shall, for the purposes of this rule, means all any programming cards or cartridges, except a voter activation cards, that stores firmware, software, or data.
43.1.5	“Seal” means a serial-numbered tamper-evident device that indicates a seal is broken or removed.
43.1.6	“Trusted Build” means the write-once installation disk or disks for software and firmware for which the Secretary of State or his/her agent has established the chain of evidence to the building of a disk, which is then used to establish and/or re-establish the chain of custody of any component of the a voting system which that contains newly installed firmware or software. The trusted build is the origin of the chain of evidence for any software and firmware component of the voting system.
43.1.27	“Continuous video Video security surveillance recording” shall, for the purposes of this rule, means video monitoring by a device which that continuously records a designated location or a system using motion detection that records one frame, or more, per minute until detection of motion triggers continuous recording. Alternatively, this definition may be met by the use of a “non-continuous” recording, provided that a device is used which samples the functionality of the video recorder without interruption, evaluates the detector response at least once every 15 seconds, and computes and records the average value at least every 60 seconds, except during allowable periods of calibration. 
43.2	Pursuant to section 1-5-616(5), C.R.S., each county shall file with the Secretary of State a security plan that meets or exceeds the standards set forth in this rule. The plan filed with the Secretary of State in accordance with this rule shall provide a point by point detailed response with a proposed solution to each of the requirements set forth in this rule. Annual security plan. In accordance with section 1‑5‑616(5), C.R.S., each county must submit a security plan to the Secretary of State annually and no later than 60 days prior to the first election in which the security plan procedures are used. The plan must, at a minimum, include the following:
43.3	The county shall file security procedures annually no later than sixty (60) days prior to the first election in which the procedures will be used.
43.4	If no changes have occurred since the last security procedures filed, the county shall file a statement to that effect. 
43.5	Revisions to previously filed security procedures shall clearly state which part of the procedures previously filed have been revised. 
43.6	Each designated election official county may change the security procedures within sixty (60) days of an election as a result of an emergency situation or other unforeseen circumstance, and document any changes. The county designated election official shall file any revisions with the Secretary of State within five (5) days of the change.
43.7	If, pursuant to section 1-5-616(5)(b), C.R.S., the Secretary of State is unable to complete its review, the procedures or revisions shall be temporarily approved until such time as the review is completed. The Secretary of State shall notify the county of temporary approval. 
(Current rules 43.3-43.7 is amended and relocated as rule 43.4)
43.8	Security Procedures shall at a minimum include, if applicable:
43.8.143.2.1	General Requirements:
a.	At all times removable memory cards and cartridges shall be handled in a secure manner as follows. When not sealed in voting machines, all removable cards and cartridges shall be transferred and stored in secure containers with at least one tamper-evident seal with printed serial numbers. The integrity and serial number of each seal shall be verified by election judges or county personnel at shipping and receiving locations.
(a)b.	All The county clerk and recorder shall maintain on file all documentation of seals, chain of custody, and other documents related to the transfer of equipment between parties shall be maintained on file by the county clerk and recorder and is These documents are subject to inspection by the Secretary of State.
(b)c.	The county must maintain and document the chain of custody for each voting device must be maintained and documented throughout the county’s ownership or leasing of the device by the county clerk and recorder.
(c)d.	Only deputized clerks, election judges, or canvass board members sworn under oath are allowed to handle ballots, which include V-VPAT records.
(d)e.	No additional  The county may install additional or modified software developed by the Vendor that is not specifically listed on the Secretary of State’s certificate and verified against the state trusted build shall be installed on any component of the voting system only if the software is specifically listed on the Secretary of State’s certificate and verified against the state trusted build. Nothing in this rule shall preclude the use of commercial off-the-shelf-software commercial off-the-shelf software, provided that the COTS software is included in the certified list of services and executables for the certified voting systems.
(e)f.	Any form or log containing “date” means to note the month, calendar day, year, hour, minute, and whether the time is a.m. or p.m.
43.8.243.2.2	Physical Locking Mechanisms and Seals. The county must record the serial number of every seal on the appropriate chain-of-custody log. Two individuals must verify, and indicate by signing and dating the log, that the seal serial numbers match the logged serial numbers. If a seal is inaccessible and cannot be removed, then it is not necessary to verify that seal serial number.
(a)a.	DREs. All The county must seal DRE voting devices shall have industry standard, commercial off the shelf tamper-evident seals with printed, unique serial numbers affixed as follows as follows:
(1)i.	A The county must place a seal shall be placed over any removable card or cartridge that is inserted into the unit, or over the slot or door covering the card or cartridge.
(2)ii.	A The county must place a seal is to be placed over any removable card slot or cartridge slot when no card or cartridge is inserted into the unit.
(3)iii.	Tamper-evident, numbered seals shall be affixed across the seam at which the two sides of the case of the electronic components of the voting unit join, with at least one seal for each of the four sides of the device; except in the instances where the hash value (MD5 or SHA-1) of the firmware or software can be displayed or printed by the device as verified by the State Certification process. In such cases, additional seals for the case are not required. Officials shall produce documentation of the verification of the hash value during Hardware Diagnostics Testing, Pre-Election testing and prior to the Post Election Audit as required in Rule 11 If the county cannot verify the firmware or software hash value (MD5 or SHA-1), the county must seal the DRE case. To detect unauthorized access, the county must use seals at either the seams of the case or at key entry points such as screw access points.
(4)iv.	If the voting device contains one or more slots for a flash memory card, the county shall affix a seal shall be affixed over each flash card or each flash card slot, door, or access panel.
(5)v.	These same procedures also apply to the Judge’s Booth Controller (JBC) unit for the Hart InterCivic System.
(6)vi.	All seals are to be verified by twoTwo employees or election judges must verify, and indicate by signing and dating the chain-of-custody log, that all seal serial numbers match the logged serial numbers.    
(b)b.	V-VPATs. all V-VPAT units shall be sealed upon verification of no votes having been cast on the paper record prior to being attached to a specific voting device. Prior to attaching a V-VPAT to a specific voting device, the judges shall seal the unit after verifying that no votes were cast. Seals must be verified as being intact by at At least two election judges must verify that seals are intact prior to the start of voting, and at the close of voting. V-VPAT records shall either remain in the V-VPAT canister, or be sealed and secured in a suitable device for protecting privacy or as described in Election Rule 11.
(c)c.	Remote or Central-count Optical Scanners. Optical scanners used in a remote or central tabulating location shall have tamper-evident seals as follows meet the following seal requirements:
(1)i.	A seal is to be placed The county must place a seal over each card or cartridge inserted into the unit, or over any door or slot containing the card or cartridge.
(2)ii.	A seal is to be placed The county must place a seal over each empty card or cartridge slot or door covering the area where the card or cartridge is inserted.
(3)ii.	Prior to the start of voting and after the close of voting, two employees or election judges must visually confirm that all seals are to be verified as being  intact by two employees or election judges are intact and that the seal serial numbers match those logged in the chain-of-custody log.
(d)d.	Memory Cards/Cartridges. Each removable card or cartridge shall have a permanent serial number assigned and securely affixed to it. The manufacturer assigned serial number may be utilized for this purpose. 
e.	The county clerk and recorder shall maintain a written or electronic log that records which card or cartridge and which seal is assigned to each voting unit. The Any breach of control over a card/cartridge or door or slot for a card/cartridge before an election shall require that the county clerk and recorder be notified and follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
(1)	The county must assign and securely affix a permanent serial number to each removable card or cartridge. The county may use the manufacturer assigned serial number for this purpose.
(2)	The county must handle Removable memory cards and cartridges in a secure manner at all times. The county must transfer and store any removable card and/or cartridge that is not sealed in a voting machine in a secure container with at least one seal. Upon delivery and receipt, election judges or county personnel must verify, and indicate by signing and dating the chain-of custody log, that all seal serial numbers match those listed in the log.
(3)	The county clerk and recorder must maintain a written or electronic log to record card or cartridge seal serial numbers and track seals for each voting unit. The county clerk and recorder must be notified if control of a card/cartridge or door or slot for a card/cartridge is breached before an election, and he/she must follow the procedures specific to the incident outlined in Rule 43.2.11.
43.8.343.2.3	Individuals Withwith Access to Keys, Door Codes, and Vault Combinations
(a)43.8.3.1	Counties are required to For employees with access to areas addressed in Rule 43.2.3(c), the county must state the positions employees’ titles and the dates of CBI background checks for employees with access to the areas addressed in this Rule 43.8.3. [Section 24‑72‑305.6, C.R.S.]
(b)43.8.3.2	For all counties, use of The county must change all keypad door codes or locks, vault combinations, computer and server passwords, encryption key codes, and administrator passwords shall be changed at least once per calendar year prior to the first election of the year.
(c)	Employee access
(1)	Only employees may be given access The county may grant employees access to such the codes, combinations, passwords, and encryption keys, pursuant to described in this Rule 43.2.3 in accordance with the following limitations:. Counties may request a variance from the Secretary of State for the requirements set forth in this Rule 43.8.3 only in extreme circumstances.
43.8.3.3	The requirements for an employee to be given access to a code, combination, password, or encryption key are as follows:
(A)a.	Access to the code, combination, password, or encryption key for the storage area for voting equipment and the mail-in ballot counting areas shall be is restricted to employees as defined in Rule 43.1.4 43.1.3.
(B)b.	Access to the code, combination, password, or encryption key for the mail-in ballot storage area and counting room or tabulation workstations shall be is restricted to ten (10) employees as defined in Rule 43.1.4 43.1.3.
(C)c.	Except for emergency personnel, no other individuals shall be present in these locations unless supervised by one or more employees as defined in Rule 43.1.4 43.1.3.
(i)i.	Each individual who has access to the central election management system or central tabulator shall have their own unique username and password. No individual shall use any other individual’s username or password. Shared accounts shall be are prohibited.
(ii)ii.	The county shall maintain a log of each person who enters the ballot storage room, including the person’s name, signature, and date and time of entry. If access to the ballot storage room is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.
(2)	In extreme circumstance, the county may request and the Secretary of State may grant exemption from the requirements outlined in Rule 43.2.3(c)(1).
(d)43.8.3.4	Computer room access shall be is limited to authorized employees and election judges only,. Messengers or runners and the delivery of delivering ballots between the preparation room and computer room shall wear distinguishing identification shall be performed by messengers or runners wearing distinguishing identification. This rule does not supersede access by watchers, official observers, and media observers in accordance with Rule 8. 
43.8.443.2.4	Temperature-controlled Storage.
43.8.4.1	Counties The county must maintain all components of the voting system and ballots in a temperature-controlled environment. The county shall attest to the temperature-control settings used with the following components of a voting system. Information submitted to the Secretary of State shall indicate the specifics for each type of component, as well as the specific environment used, which may include, but is not limited to controlled offices, controlled vaults, and controlled warehouses. The county must maintain the following required temperature settings for temperature control must be at least the following:
(a)a.	Servers and Workstations. Servers and workstations shall be maintained in a temperature-controlled environment. Maximum The county shall maintain the temperature so that the maximum temperature shall at no time exceeds 90 degrees fahrenheit Fahrenheit.
(b)b.	DREs. DREs shall be maintained in a temperature-controlled environment. The county shall maintain the temperature settings shall be maintained at a minimum of 60 50 degrees fahrenheit Fahrenheit and a maximum of 90 degrees fahrenheit Fahrenheit.
(c)c.	Optical Scanners. Optical scanners shall be maintained in a temperature-controlled environment. The county shall maintain the temperature settings shall be maintained at a minimum of 50 degrees fahrenheit Fahrenheit and a maximum of 90 degrees fahrenheit Fahrenheit.
(d)d.	V-VPAT Records. In addition to the requirements set forth in Rule 11, the county shall maintain the V-VPAT records shall be maintained in a temperature-controlled environment. The temperature settings shall be maintained at a minimum of 50 degrees fahrenheit Fahrenheit and a maximum of 80 90 degrees fahrenheit Fahrenheit. The county shall maintain V-VPAT records shall also be maintained in a dry environment, with storage at least 4 four inches above the finished floor, for a period of 25 months following the election. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall store V-VPAT records shall be stored in a manner that prevents exposure to light, except as necessary during recounts and audits.
(e)e.	Paper Ballots. The county shall maintain P paper ballots shall be maintained in a dry, humidity-controlled environment. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall store Additionally, paper ballots shall be stored at least 4 four inches above the finished floor, for a period of twenty-five (25) months following the election.
(f)f.	Video Data Records. The county shall maintain V video data records shall be maintained in a dry, temperature-controlled environment. The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours. The county shall maintain T temperature settings shall be maintained at a minimum of 40 50 degrees fahrenheit Fahrenheit and a maximum of 80 90 degrees fahrenheit Fahrenheit. The county shall Additionally, store video data records shall be stored at least 4 four inches above the finished floor, for a period of twenty-five (25) months following the election.
43.8.543.2.5	Security Cameras or Other Surveillance
(a)43.8.5.1	Unless otherwise instructed, continuous the county shall make video security surveillance recordings of specified areas shall be made beginning at least sixty (60) days prior to the election and continuing through at least thirty (30) days after the election, unless there is a recount or contest. The recording system shall ensure that records are not written over when the system is full. The recording system shall provide a method to transfer the video records to a different recording device or to replace the recording media. If replaceable media is used then the county shall provide a process that ensures that the media is replaced often enough to prevent periods when recording is not available. If a recount or contest occurs, the recording shall continue through the conclusion of all such activity. The following are the specific minimum requirements: 
(1)a.	Counties If the county has 50,000 or more registered voters, then the county over 50,000 registered voters shall make continuous video security surveillance recordings of the following areas, excluding voting booths:
(A)i.	All areas in which election management software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
(B)ii.	All areas used for processing mail-in ballots, including but not limited to areas used for Signature Verification, tabulation, or storage of voted ballots beginning at least thirty-five (35) days prior to the election and continuing through at least thirty (30) days after the election, unless there is a recount or contest. If a recount or contest occurs, the recording shall continue through the conclusion of all such activity.
(C)iii.	The storage area for all voting equipment.
(2)b.	If the county has fewer than Counties under 50,000 registered voters then the county shall make continuous video security surveillance recordings of the following areas:
i.	All all areas, excluding voting booths, in which election management software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
(b)	The county must adequately and continuously light the area(s) subject to video surveillance to provide visibility for video recording.
43.8.643.2.6	Equipment Maintenance Procedures.
43.8.6.1	In addition to the requirements for voting systems specified in Rule 11, the county shall adhere to the following minimum standards shall be adhered to:
(a)a.	All The county shall store all equipment shall be stored throughout the year with serially-numbered, tamper-evident seals over the memory card slots for each device. The county shall maintain a log of the seals used for each device consistent to the logs used for tracking Election Day seals.
(b)b.	For equipment being sent to the vendor for offsite repairs/replacements, the county must maintain keep a maintenance log file for the device that shall contain the following: the model number, serial number, and the type of device; the firmware version; the software version (as applicable); the printed name and signature of the person sending the equipment; and the date of submission to the vendor.
(c)c.	For equipment receiving maintenance on-site by the vendor, the county shall verify that a CBI background check has been conducted on all vendor personnel with access to any component of the voting system. When a vendor provides on-site maintenance of equipment, vendor personnel shall annually provide to the county a CBI or equivalent background check for all vendor personnel that will have access to any component of the voting system. The county must keep current CBI or equivalent background check information on file. CBI information shall be updated and maintained on file annually. Additionally, an employee shall escort the vendor’s representative shall be escorted at all times by an employee while on-site. At no time shall the voting system vendor have access to any component of the voting system without supervision by an employee. [Section 24‑72‑305.6, C.R.S.]
(d)d.	Upon completion of any maintenance, the county shall verify or reinstate the trusted build and conduct a full acceptance test of equipment that shall, at a minimum, include the Hardware Diagnostics test, as indicated in Rule 11, and conduct a mock election in which an employee(s) shall cast a minimum of five ten (10) ballots on the device to ensure tabulation of votes is working correctly. All The county shall maintain all documentation of the results of the acceptance testing shall be maintained on file with the specific device.
(e)e.	The Secretary of State shall be required to will annually inspect the counties’ county maintenance records on a randomly selected one percent (1%) of all voting devices in possession of the counties throughout the state in even-numbered years, and to inspect the maintenance records on a randomly selected five percent (5%) of all voting devices in possession of the counties throughout the state in odd-numbered years basis.
43.8.743.2.7	Transportation of Equipment, Memory Cards, Ballot Boxes, and Ballots
(a)43.8.7.1	Counties are required to The county shall submit detailed plans to the Secretary of State prior to an election regarding the transportation of equipment and ballots both to remote voting sites and back to the central elections office or storage facility. While the method of transportation of equipment may be handled in a multitude of methods vary, the following standards shall be followed apply when transporting voting equipment to the voting location:
(1)a.	Transportation by County Personnel. County personnel shall at all times display a badge or other identification provided by the County. Two (2) signatures and date of employees shall be are required at the departure location verifying that the equipment, including memory card or cartridge, is sealed to prevent tampering. Upon delivery of equipment, at least two (2) employees or election judges shall verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact and that the serial numbers on the seals agree with match those the logged serial numbers on the seal-tracking log, and sign and date the seal-tracking log. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(2)b.	Transportation by Election Judges. Election judges that are receiving equipment from county personnel shall inspect all components of voting devices and verify the specific numbers by signature and date on the seal-tracking chain-of-custody log for the device. The election judge receiving the equipment shall request two (2) election judges at the voting location to inspect the devices and to sign and date the seal-tracking chain-of-custody log indicating that all seals are intact and that the serial numbers on the seals agree match with those on the seal-tracking log. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(3)c.	Transportation by Contract. Counties A county electing to contract the delivery of equipment to remote voting locations shall perform CBI background checks on the specific individuals who will be delivering the equipment. Two (2) employees or election judges shall verify, sign, and date the seal-tracking chain-of-custody log upon release of the equipment to the individuals individual(s) delivering the equipment. Two (2) other employees or election judges shall verify, sign, and date the seal-tracking chain-of-custody log after delivery of the equipment has been delivered, and prior to the opening of the polls. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11. [Section 24‑72‑305.6, C.R.S.]
(b)43.8.7.2	The following standards shall be followed when Standards for transporting voting equipment to and from the voting location:
(1)a.	If Required procedures if memory cards or cartridges are to be removed from voting devices at remote voting locations, the following procedures are to be followed:
(A)i.	Before removing a memory card or cartridge, two (2) election judges shall inspect and verify that all seals on the device are intact and that the serial numbers on the seals agree with match those listed on the seal-tracking chain-of-custody log. Both election judges shall sign and date the seal-tracking chain-of-custody log prior to breaking the seal. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(B)ii.	Election judges shall place the memory cards or cartridges in a sealable transfer case that shall be sealed and must seal the case with at least one (1) seal. Additional The election judges shall maintain seal logs shall be maintained a chain-of-custody log for the transfer case of the memory cards or cartridges.
(C)iii.	Election judges shall place new seals over the empty memory card/cartridge slot and/or door and document the seal numbers used.
(D)iv.	At least two (2) county personnel or election judges shall accompany the transfer case containing the memory card/cartridge cards/cartridges to the drop off location. Seal integrity and serial numbers will be verified, and logs will be signed and dated by election judges receiving the equipment. The election judges who receive the equipment must verify, and indicate by signing and dating the chain-of-custody log, that the seals are intact and seal serial numbers match those listed in the log. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, the county personnel or election judges shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(E)v.	County personnel or election judges transporting secured voting equipment must maintain chain of custody chain-of-custody logs and seal-tracking logs. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(2)b.	If Required procedures if devices are to be delivered with memory cards/cartridges intact, the following procedures shall be followed:
(A)i.	Two (2) county personnel or election judges shall verify that all seals are intact at the close of polls. Election judges shall sign and date the seal-tracking chain-of-custody log with such indication. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(B)ii.	At least two (2) county personnel or election judges shall accompany the secured equipment to the drop-off location. Seals will be verified, and logs will be signed and dated by the county election official receiving the equipment. If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree match those listed in the chain-of-custody log, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule 43.2.11.
(C)iii.	Upon confirmation that the seals are intact and bear the correct numbers, election judges shall remove and upload the memory card or cartridge cards/cartridges shall be removed and uploaded into the central count system.
(D)iv.	Election to secure the equipment, election judges shall secure the equipment by placing place a tamper-evident seal over the memory card slot and by updating update the documentation chain-of-custody log to reflect the new seal numbersnumber(s).
(c)	Required procedures for transportation of ballot boxes:
(1)	Election judges shall seal all ballot boxes that contain voted ballots so that no person can access the ballots without breaking a seal. The election judges shall record all seals in the chain-of-custody log and two election judges shall verify, and indicate by signing and dating the log, that the required seals are intact.
(2)	Two county personnel or election judges shall accompany all ballot boxes that contain voted ballots at all times, except when the ballot box is located in a vault or secure physical location.
(3)	The ballot box exchange requirements of section 1‑7‑305, C.R.S., are met if a chain-in-custody log is completed for each ballot box.
(New rule 43.2.7(c) replaces the written plan for alternate counting method in current Rule 27.8)
43.2.8	Contingency plans
(a)43.8.8	Emergency Contingency Plans for Voting Equipment and Voting Locations
(1)43.8.8.1	All remote devices used in an election shall have sufficient battery backup for at least two (2) hours of use. If this requirement is met by reliance on the internal battery of the voting device, then the county clerk and recorder shall verify that all batteries are fully charged and in working order prior to the opening of polls at the voting location. This requirement also can be met with the purchase The use of third-party battery backup systems also meets this requirement.
(2)43.8.8.2	In the event of a serious or catastrophic equipment failure, or removal of when equipment being is removed from service at one or more polling locations, or there is not adequate backup equipment to meet the requirements of Section section 1‑5‑501, C.R.S., the county clerk and recorder shall contact notify the Secretary of State for authorization to use that the county is using provisional ballots or mail-in ballots as an emergency voting method.
(b)	A security plan must contain a section entitled “contingency plan” that includes the following:
(1)	Evacuation procedures for emergency situations including fire, bomb threat, civil unrest, and any other emergency situations identified by the designated election official;
(2)	Back up plans for emergency situations including fire, severe weather, bomb threat, civil unrest, electrical blackout, equipment failure, and any other emergency situations identified by the designated election official;
(3)	An emergency checklist for election judges; and
(4)	A list of emergency contact numbers provided to election judges.
(Current rule 43.10 is amended and relocated to this new rule 43.2.8(b))
43.8.943.2.9	Internal Controls for the Voting System
(a)	The County must enable, create, and use passwords.
(b) 43.8.9.1	In addition to the access controls discussed in section 43.8.3 of this Rule 43.2.3(c), counties are required to the county shall change all passwords and limit access to the following areas:
(1)a.	Software. All The county shall change all software passwords shall be changed once per calendar year prior to the first election. This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
(2)b.	Hardware. All The county shall change all hardware passwords shall be changed once per calendar year prior to the first election. This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
(3)c.	Password Management. Access The county shall limit access to the administrative passwords to the election management software shall be limited to two (2) employees. The county shall limit access to passwords for all components of the election software and hardware shall be limited to two (2) employees. The county may provide an additional ten (10) employees may have with access to the administrative passwords for the software components, and an additional ten (10) employees may have with access to the administrative passwords for the hardware components of the voting system.
(4)d.	Internet Access. At no time shall The county must never connect or allow a connection of any voting system component of the voting system be connected, directly or indirectly, to the Internet. 
(5)e.	Modem Transmission. At no time shall The county must never connect any component of the voting system be connected to another device by modem except for the vote tally software, directly or indirectly, by modem as allowable by the certification of the specific device. 
(6)f.	Remote sites may use modem functions of optical scanners and DREs only for the purpose of transmitting unofficial results, as permitted by the Secretary of State’s certification documents for the specific systems. Counties A county using modem devices to transmit results shall meet the following requirements:
(A)i.	A county may use a modem device only after all steps to close the polls are complete and summary tapes are printed, and may only use the device to transmit test data or unofficial results.  Transmissions may be used only for sending test data or unofficial results; after all other steps have been taken to close the polls. All summary tapes shall be printed before connecting any of the machines to a modem or telephone line.
(B)ii.	Modems shall not be used The county shall not use a modem for any programming, setup, or individual ballot-casting transmissions.
(C)iii.	The county shall change the receiving telephone number for the modem transmission shall be changed at least once per calendar year prior to the first election.
(D)iv.	A maximum of The county may provide the telephone number of the modem receiving the transmission to no more than six (6) employees shall have access to the telephone number receiving the transmission. Counties The county shall not publish or print the receiving modem telephone number for any election judge. To the extent possible, the county shall program the telephone number shall be programmed into the device and used by use the device in a way that is hidden hides the display of the number from the view of election judges and voters from seeing the display of the number at any time at all times.
(7)g.	Authorized Employees. Counties The county shall include in their security plans plan the positions employees’ titles and the dates of CBI background checks for employees with access to any of the areas or equipment set forth in this Rule. Each county shall maintain a storage-facility storage facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained. If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule. [Section 24‑72‑305.6, C.R.S.]
43.8.1043.2.10	Security Training for Election Judges
(a)43.8.10.1	Counties The county shall include in their security plan the details of their security training for their election judges., which shall include The county must  address the anticipated time of training, location of training, and number of election judges receiving the security training, as it applies to the following requirements:
(1)a.	The county shall conduct a separate training module for field technicians and election judges who will be responsible for overseeing the transportation and use of the voting systems, picking up supplies, and troubleshooting device problems throughout the Election Day.
(2)b.	Security training shall include the following components:
(A)i.	Proper application and verification of seals and seal-tracking chain-of-custody logs;
(B)ii.	How to detect tampering with voting equipment, memory cards/cartridges, or election data on the part of anyone coming in contact with voting equipment, including employees, other election judges, vendor personnel, or voters;
(C)iii.	Ensuring privacy in voting booths;
(D)iv.	The nature of and reasons for the steps taken to mitigate the security vulnerabilities of voting systems;
(E)v.	V-VPAT requirements;
(F)vi.	Chain-of-custody requirements for voting equipment, memory cards/cartridges, and other election materials;
(G)vii.	Ballot security;
(H)viii.	Voter anonymity.; and
(I)ix.	Recognition and reporting of security incidents.

43.8.1143.2.11	Remedies 
(a)43.8.11.1	If it is detected that the a seal has been is broken or if there is a discrepancy between the log and the serial number of either a voting device, or a memory card or cartridge, in a chain-of-custody log, the condition must be confirmed by one or more of the remaining election judges for the location. The election judges shall immediately notify the county clerk and recorder, who shall investigate, report the incident to the Secretary of State, complete and submit to the Secretary of State an internal incident report, and follow the appropriate remedy as indicated in this rule or as directed by the Secretary of State.
43.8.11.2	If a seal has been broken or removed under the following conditions:
a.		During either the transportation, setup, opening polls, or closing polls for the device; 
b.		Two election judges can verify the breaking or removing of the seal; and
c.		The chain of custody has not been broken, meaning the device has been within ownership of election judges or employees only during this time;
		The county clerk and recorder shall instruct the election judges to complete a security incident report detailing the incident, replacing the seals, and updating the chain of custody log as appropriate.
		The Security incident report shall be filed with the Secretary of State during the canvass period.
(b)43.8.11.3	If a seal has been broken or removed outside of the situation in rule 43.8.11.2, any If the county clerk and recorder conducts an investigation in accordance with Rule 43.2.11(a) and is unable to determine why a seal was broken or why a discrepancy exists in a chain-of-custody log, then the county clerk and recorder shall file an incident report with the Secretary of State as soon as practicable, but no later than the close of the canvass period for the election. Any unit involved must undergo the reinstatement or verification of the trusted build, in accordance with State instructions. County clerk and recorders will be required to complete a security incident report. The minimum specific requirements on the remedy are as follows the following remedial actions are required if a device has been was tampered with (the county clerk and recorder may determine additional requirements may be determined based on the details of the incident report):
(1)a.	For instances where the county can display, verify, or print the trusted build hash value (MD5 or SHA-1) of the firmware or software can be displayed or printed by the device as verified by the State Certification process, the election official shall will be required to document and verify that the hash value matches the documented number associated with the Trusted Build for the software or firmware of that device.
(2)b.	If the evidence indicates that the tampering occurred is prior to the start of voting:
(A)i.	The election judges shall seal the device shall be sealed and securely delivered it to the county clerk and recorder.
(B)ii.	The county clerk and recorder or his or her designee shall remove and secure the memory card following the procedures in section 43.8.1(a) Rule 43.2.2(d). The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device. The county clerk and recorder or his or her designee shall install a new, secure memory card into the device, conduct a hardware diagnostics test as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots on the device. All The county shall maintain on file all documentation of testing and chain of custody shall be maintained on file for each specific device.
(C)iii	Complete The county shall complete the necessary seal process and documentation to re-establish the chain of custody for the device and new memory card.
(D)iv.	Set The county shall set the machine to election mode ready for a zero report.
(E)vi.	Complete necessary reports for the Secretary of State regarding the incident as soon as practicable, but prior to the close of the canvass period for the election Repealed.
(3)c.	If the evidence indicates that the tampering occurred is after votes have been were cast on the device but before the close of polls:
(A)i.	The election judges shall seal the device shall be sealed and securely delivered it to the county clerk and recorder.
(B)ii.	The county clerk and recorder or his or her designee shall close the election on that device, and perform a complete manual verification of the paper ballots (or V-VPAT Records records) to the summary tape printed on the device that represents the record of votes on the memory card. 
(C)iii.	If the totals do not match then only the paper record will be accepted as the official results for that device., and the The county clerk and recorder shall re-seal and secure the device shall be re-sealed, secured and immediately reported the discrepancy to the Secretary of State immediately. The county must not use the device shall not be used for the remainder of the election unless the firmware and/or software have been reformatted with the trusted build is reinstalled.
(D)iv.	If the totals match, the county may upload the memory card cannot uploaded into the tally software at the close of polls.
(E)v.	After verifying the totals, the county shall secure the paper records and memory card shall be secured with seals and documented properly a chain-of-custody log.
(F)vi.	A The county shall place a new and secured memory card shall be placed in the device. The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device. The county clerk and recorder or his or her designee shall conduct a hardware diagnostics test as prescribed in Rule 11. All The county shall maintain on file all documentation of testing and chain of custody shall be maintained on file for each specific the device.
(G)vii.	Complete The county shall complete the necessary seal process and documentation to establish the chain of custody for the device and memory card.
(H)viii.	Set The county shall set the machine to election mode ready for a zero report.
(I)ix.	At the conclusion of the election, the county shall conduct a full (all races) post-election audit shall be conducted on the device and report results reported to the Secretary of State as required by Rule 11. This requirement is in addition to the random selection conducted by the Secretary of State.
(J)x.	Complete necessary reports for the Secretary of State regarding the incident as soon as practicable, but prior to the close of the canvass period for the election Repealed.
(4)d.	If the evidence indicates that the tampering occurred is after the close of polls:
(A)i.	The election judges shall seal the device shall be sealed and securely delivered it to the county clerk and recorder.
(B)ii.	The county clerk and recorder or his or her designee shall perform a complete manual verification of the paper ballots (or V-VPAT Records records) to the summary tape printed on the device that represents the record of votes on the memory card. 
(C)iii.	If the totals do not match then only the paper record will be accepted as the official results for that device., and the The county clerk and recorder shall re-seal and secure the device shall be re-sealed, secured and immediately reported the discrepancy to the Secretary of State immediately. The county must not use the device shall not be used for the remainder of the election unless the firmware and/or software have been reformatted with the trusted build is reinstalled.
(D)iv.	If the totals match, the county may upload the memory card may be uploaded into the tally software at the close of polls.
(E)v.	After verifying the totals, the county shall secure the paper records and memory card shall be secured with seals and documented properly a chain-of-custody log
(F)vi.	The county clerk and recorder or his or he designee shall follow the State instructions for installing/verifying the trusted build for the specific device and complete the necessary seal process and documentation to establish the chain of custody for the device.
(G)vii.	During the canvass process, the county shall conduct a full (all races) post-election audit shall be conducted on the device and report results reported to the Secretary of State as required by Rule 11. This requirement is in addition to the random selection conducted by the Secretary of State.
(H)viii.	Complete necessary reports for the Secretary of State regarding the incident prior to the close of the canvass period for the election Repealed.
(c)43.8.11.4	Prior to the submission of certified results from the county, the county clerk and recorder shall provide a written report to the Secretary of State addressing the existence or absence of any security issues related to the implementation and operation of the voting system. All The county shall make all documentation related to the voting system and for every device used in the election shall be available for inspection by the Secretary of State inspection for all devices used in the election.
43.8.1243.2.12	Any The county shall submit any additional physical security procedures not discussed in these mandatory procedures shall be submitted in this rule to the Secretary of State for approval prior to the election.
43.93	The designated election official county shall submit with the security plan sample copies of all referenced forms, schedules, logs, and checklists.
43.4	Amendments and review of Security Plans
43.4.1	If no changes have occurred since the last security plan was filed, the county shall file a statement to that effect.
43.4.2	The county shall clearly identify and describe any revisions to a previously filed security plan.
43.4.3	The county may change the security plan within 60 days of an election as a result of an emergency situation or other unforeseen circumstance. The county must document the changes and file the revisions with the Secretary of State within five days of the change.
43.4.4	If, under section 1‑5‑616(5)(b), C.R.S., the Secretary of State is unable to complete its review, the Secretary will notify the county that the security plan or revisions are temporarily approved until the review is complete. 
(New rule 43.4 includes the amended and relocated current rules 43.3 through 43.7)
43.10	Included in the security procedures filed with the secretary of state shall be a section entitled “contingency plan.” The contingency plan shall include:
(a)	Evacuation procedures for emergency situations including fire, bomb threat, civil unrest, and any other emergency situations identified by the designated election official;
(b)	Back up plans for emergency situations including fire, severe weather, bomb threat, civil unrest, electrical blackout, equipment failure, and any other emergency situations identified by the designated election official;
(c)	An emergency checklist for election judges; and
(d)	A list of emergency contact numbers provided to election judges.
(Current rule 43.10 is amended and relocated to new rule 43.2.8(b))
43.115	Lease, Loan, or Rental of Election Equipment
43. 115.1	Nothing in this Rule shall be construed to require requires a county clerk to lease, loan, or rent any election equipment to any municipality, special district or other local jurisdiction.
43. 115.2	A county clerk who chooses to lease, loan, or rent any certified election equipment to a municipality, special district, or other local jurisdiction for use in their elections shall follow at least one of the following procedures in order to maintain or reestablish an acceptable chain of custody and appropriate documentation pursuant to in accordance with Rule 43.8 43.2.1.
(a)a.	After the local jurisdiction returns the certified equipment has been returned to the county clerk by the applicable jurisdiction, the county clerk must reinstate or verify the trusted build in accordance with Rule 43 before use of the equipment is used in any primary, general, congressional vacancy, statewide ballot issue (including recall), or special election conducted by the county clerk, reinstatement or verification of the trusted build, pursuant to Rule 43.8.11.3(a) , shall be completed.
(b)b.	The county clerk or their deputized representative shall:
(1)I.	Deliver the certified equipment to the jurisdiction;
(2)II.	Witness and document the installation of the memory card(s) or cartridge(s) to be used by the jurisdiction;
(3)III.	Place one or more secure and numbered seals on the voting equipment pursuant to in accordance with Rule 43.8.2 43.2.2. If during the course of the jurisdiction’s election, the designated election official requires removal of a memory card or cartridge as a function of the election process, the county clerk or their deputized representative shall witness and document the removal and proper resealing of the memory card or cartridge; and
(4)IV.	Upon return of the equipment to the county clerk and recorder, the county clerk shall verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact and document that the seals are intact. If any seal appears to be is damaged or removed, the county clerk shall reinstall or verify the trusted build in accordance with this Rule 43.
(c)c.	The county clerk and recorder shall designate and station deputized county staff to be stationed with the loaned certified equipment at all times while the equipment is under control of the designated election official. The deputized county staff must maintain physical custody of the certified equipment shall not be allowed out of the physical custody of the deputized county staff at any time. The deputized county staff shall at all times to ensure that no unauthorized access occurs.
(d)d.	Pursuant to In accordance with section 1‑5‑605.5, C.R.S., the county clerk shall appoint the designated election official as a deputy for the purposes of supervising the certified voting equipment. The designated election official shall:
(1)I.	Sign and submit to the county clerk and recorder an affirmation that he/she will ensure the security and integrity of the certified voting equipment at all times;
(2)II.	Affirm that the use of the certified voting equipment shall be is conducted in accordance with Rule 43 and the specific conditions for use Conditions for Use of the certified voting equipment; and 
(3)III.	Agree to maintain all chain of custody chain-of-custody logs for the voting device(s).
43. 115.3	Upon return of the certified voting equipment to the county clerk and recorder, the county clerk shall not be is required to verify the trusted build, in accordance with State instructions, if the documentation and chain of custody does not support the proper maintenance of the trusted build software and chain of custody.