COLORADO SECRETARY OF STATE

8 CCR 1505-1
Election Rules

Rules as Adopted – Clean
September 10, 2014

Please note the following formatting key:
Font effect	Meaning	
Italic blue font text	Publication notes and annotations	

Amendments to Rule 20.1:
20.1	The county must submit its annual security plan on the form prescribed by the Secretary of State in accordance with section 1-5-616(5), C.R.S.  A county must also submit a comprehensive procedure for ballot delivery in an emergency under section 1-7.5-115(1), C.R.S.
Amendments to Rule 20.2.2, regarding general requirements concerning chain-of-custody:
20.2.2	The county must maintain and document uninterrupted chain-of-custody for each voting device from the installation of trusted build to the present, throughout the county’s ownership or leasing of the device. For optical scanners approved for use under section 1-5-613(2), C.R.S. but for which no trusted build exists, the county must maintain and document uninterrupted chain-of-custody for each voting device from the successful completion of acceptance testing conducted according to Rule 20.8.4.
Amendments to Rules 20.3.1 and 20.3.1(e), regarding physical locking mechanisms and seals for DREs and ballot marking devices:
20.3.1	DREs, ballot marking devices and Judge’s Booth Controllers (JBCs)
(e)	In each voter service and polling center, the county must provide a minimum of one accessible DRE with a headset that has adjustable volume control.
Amendments to Rule 20.4:
20.4	Individuals with access to keys, door codes, and vault combinations
20.4.1	For employees with access to areas addressed in Rule 20.4.3, the county must state in the security plan each employee’s title and the date of the criminal background check performed under Rule 6.5. [Section 24-72-305.6, C.R.S.]
Amendments to Rule 20.5.2, regarding internal controls for the Voting System:
20.5.2	In addition to the access controls discussed in Rule 20.4, the county must change all passwords and limit access to the following areas:
(a)	The county must change all software passwords once per calendar year prior to the first election. This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
(b)	The county must change all hardware passwords once per calendar year prior to the first election. This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
(c)	Administrative and user accounts for election management system and election databases.
(1)	The county may use the administrative user account only to create individual user accounts for each election database.
(2)	The county must create individual user accounts that are associated and identified with each individual authorized user of the election management system or election database. 
(3)	The county must restrict access to each individual user account with a unique password known only to each individual user. Authorized users must access the election management system and election database using his or her individual user account and unique password.
(4)	The county may grant administrative privileges to no more than ten individual user accounts per election.
(d)	Other than for the purpose of programming the election, the voting system provider may not have administrative or user access to the county’s election management system.
(e)	The county may not connect or allow a connection of any voting system component to the Internet.
(f)	If any component of the voting system is equipped with Wi-Fi capability or a wireless device, the county must disable the wireless capability or device.
(g)	The county may not connect any component of the voting system to another device by modem.
(h)	The county must include in its security plan the title and date of background checks for each employee with access to any of the areas or equipment set forth in this Rule. The county must maintain a storage facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained. If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log must meet the requirements of this Rule. [Section 24-72-305.6, C.R.S.]
Amendments to Rules 20.8.4 and 20.8.5; stylistic changes:
20.8.4	Upon completion of any maintenance, the county must verify or reinstate the trusted build and conduct a full acceptance test of equipment that must, at a minimum, include the hardware diagnostics test, as indicated in Rule 11, and a mock election in which an employee(s) must cast a minimum of five ballots on the device to ensure tabulation of votes is working correctly. The county must maintain all documentation of the results of the acceptance testing on file with the specific device.
20.8.5	The Secretary of State will annually inspect county maintenance and chain-of-custody records and verify the integrity of trusted build on a randomly selected basis.
Amendments to Rule 20.9.3(d):
(d)	If a seal is broken or chain-of-custody is unverifiable, the county clerk must investigate, document his or her findings, and report the incident to the Secretary of State, as appropriate.
New Rule 20.11.1(d), regarding VVPAT security:
(d)	If the DRE’s trusted build is not capable of verification by reference to the hash value (MD5 or SHA-1) of the firmware or software, the county must secure the printer port on the DRE with tamper-evident seals when the VVPAT is not connected to the DRE’s printer port.
Amendments to Rule 20.11.2:
20.11.2	Anonymity. The designated election official must implement measures to protect the anonymity of voters choosing to vote on DREs.
(a)	Measures to protect anonymity include:
(1)	The county may not keep any record indicating the order in which people voted on the DRE, or which VVPAT record is associated with the voter.
(2)	When more than one DRE is available at a voting location, the county must, to the extent practicable, allow the voter to choose the DRE he or she wishes to vote on.
(b)	The county clerk may not release a report generated from SCORE that includes a date and time stamp that could potentially identify a voter who cast a specific ballot.
(c)	At no time may an election official simultaneously access a VVPAT and the list of voters. If the VVPAT record requires inspection, at least two election officials must conduct the examination.
(d)	The county must arrange voter service and polling center DREs in a manner that prevents election officials and other voters from observing how a DRE voter marks or casts his or her ballot.
[Repeal of Rule 20.11.3(c), regarding VVPAT storage]
New Rules 20.17 through 20.20:
20.17	Voting system conditions for use
20.17.1	The county must use the voting system only on a closed network or in a standalone fashion.
20.17.2	Access logs.
(a)	In addition to the audit logs generated by the election management system, the county must maintain access logs that record the following:
(1)	The date, time, and user’s name for each instance that a user enters or exits the system or the system’s report printing functions; and
(2)	Modifications to the system’s hardware, including insertion or removal of removable storage media, or changes to hardware drivers.
(b)	The county may create and maintain the access logs in the manner the county deems most suitable, including key stroke recording software, video surveillance recordings, manually or electronically written records, or a combination of these methods.
20.17.3	The county must create a backup copy of the election setup records on a read-only, write-once CD, immediately after completing the Logic and Accuracy Test.
(a)	The county must identify the master database name and date of election on the label of the backup CD.
(b)	The county must store the backup CD in a sealed container. Two election officials of different party affiliations must sign and date entries to the chain-of-custody log for the sealed container.
20.17.4	DREs
(a)	The county’s election judges must:
(1)	Test the VVPAT printer immediately after changing the VVPAT paper; and
(2)	Lock and re-seal the VVPAT canister, and make appropriate entries on the VVPAT chain-of-custody log, before voting resumes on the DRE.
(b)	At least one DRE in each voter service and polling center must have a backup battery, or be connected to an uninterruptible power supply, sufficient to sustain continuous operation for a minimum of two hours in the event of power loss.
(c)	The county must maintain logs indicating administrator function use.
20.17.5	Optical scanners:
(a)	When issuing ballots, the county must provide in-person voters with a secrecy sleeve sufficient to conceal a voter’s marked ballot from others in the polling location, including election officials.
(b)	The county must record the optical scanner serial number on all chain-of-custody logs and reports generated by the device.
(c)	Each optical scanner must have a backup battery, or be connected to an uninterruptible power supply sufficient to sustain continuous operation for a minimum of two hours in the event of power loss.
(d)	The county must maintain logs indicating administrator function use.
(e)	The county must program each optical scanner to permit an election judge to override rejection of overvoted ballots that cannot be duplicated in accordance with Rule 18.
20.18	ES&S voting system conditions
20.18.1	If the county must provide language minority assistance under section 203 of the Voting Rights Act (42 U.S.C. §§ 1973 to 1973bb-1), it may not use an ES&S voting system.
20.18.2	DREs. The county may only use the nine inch screen on the VVPAT.
20.18.3	For optical scanners with a zip disk drive, the county must save the cast vote records for each batch of tabulated ballots to a zip disk. A batch of tabulated ballots may consist of one or more SCORE absentee ballot batches.
20.19	Hart DRE conditions. If a county shortens a lengthy candidate name on the VVPAT, it must provide printed notice of the change to voters at the voter service and polling center.
20.20	Sequoia DRE conditions
20.20.1	The county must add clarifying text to the display screen during the VVPAT review process that instructs the voter to review his or her ballot choices.
20.20.2	The county must lock the activate button to prevent its use during an election.
20.20.3	A county may not modify the screen display using an override.ini file without approval from the Secretary of State.