COLORADO SECRETARY OF STATE
8 CCR 1505-1
ELECTION RULES

Preliminary Draft of Proposed Rules

December 15, 2006

Disclaimer:  This draft is not yet final.  The proposed changes to be considered at the public rulemaking hearing may be different than the proposed changes in this draft.  This draft is submitted to the Department of Regulatory Agencies for the purpose of complying with section 24-4-103(2.5), C.R.S., which requires that a draft be submitted to the Department at the time that a notice of proposed rulemaking is filed with the Secretary of State.

A final copy of the proposed rule changes will be available to the public no later than February 1, 2007, and a copy will be posted on the Department of State’s web site, in compliance with the requirement of section 24-4-103(4)(a), C.R.S., that “[a]ny proposed rule or revised proposed rule by an agency which is to be considered at the public hearing . . . shall be made available to any person at least five days prior to said hearing.”

Proposed additions to the current rules are reflected in small caps or underlined.  Proposed deletions from current rules are shown in stricken type.   Annotations are included.
Rule 25.3.7 would be amended as follows:
25.3.7.1	The electronic transmission log as well as any other ETS or fax records shall be maintained as part of the official election record.

Rule 26 would be amended as follows:
26.2	Emergency Registration and use of Provisional Ballots in the County Clerk and Recorder’s Office
26.2.1	If the elector applies for an emergency registration that cannot be qualified in the clerk’s office at the time of the registration pursuant to section 1-2-217.5(4), C.R.S., the elector shall be issued a provisional ballot.  The elector’s registration must be confirmed by the designated election official at the time that the provisional ballots are verified or the provisional ballot shall not be counted.  
26.2.2	If an elector whose name is not in the registration records, appears in person at the county clerk and recorder’s office and states that he or she has timely registered through a Voter Registration Drive (“VRD”) or an agency pursuant to section 1-2-504, C.R.S., can affirm to the name, location of, and approximate date he or she completed the application at the agency or provide an application receipt, and has both an application receipt andprovides an ID as defined in section 1-1-104(19.5), C.R.S., the elector shall be offered emergency registration and be offered a regular ballot.  
26.2.2.1	If the elector does not provide an ID and/or an application receipt, the elector shall be offered a provisional ballot. The county clerk and recorder shall note on the provisional ballot envelope that the elector did not have an  ID or an application receipt.
26.2.2.2	If the elector is able to produce an application receipt from the VRD or agency registration, but does not provide an ID pursuant to section 1-1-104(19.5), C.R.S., the elector shall surrender the receipt to the election judge, and the county clerk and recorder shall attach the receipt to the provisional ballot envelope.  
26.2.3	If an elector whose name is not in the registration records, appears in person at the county clerk and recorder’s office and states that he or she has timely registered through a Voter Registration Drive (“VRD”) pursuant to section 1-2-504, C.R.S., can affirm to the name, location of, and approximate date he or she completed the application with the VRD or provide an application receipt, and provides an ID as defined in section 1-1-104(19.5), C.R.S., the elector shall be offered emergency registration and be offered a regular ballot.
26.2.3.1	If the elector does not provide an ID the elector shall be offered a provisional ballot. The county clerk and recorder shall note on the provisional ballot envelope that the elector did not have an  ID.
26.2.3.2	If the elector is able to produce an application receipt from the VRD registration, but does not provide an ID pursuant to section 1-1-104(19.5), C.R.S., the elector shall surrender the receipt to the election judge, and the county clerk and recorder shall attach the receipt to the provisional ballot envelope.  
26.2.2.34	If the elector’s eligibility to vote cannot be verified, the provisional ballot shall not count, but may constitute a registration for future elections.

Succeeding subsections of Rule 26 would be renumbered accordingly.

Rule 30.3 would be amended as follows:
30.3	Voter Registration by Mail
30.3.1	Registering by Mail.  (Including Voter Registration Drives).
(a)	The voter must provide one of the following identification numbers:
(b)The person’s Colorado Driver’s License number or ID number issued by the Department of Revenue; if the voter does not have a current and valid Colorado Driver’s License or ID card issued by the Department of Revenue, the voter shall provide the last four digits of the voter’s  social security number. 
(bc)	If a voter has not been issued a Colorado Driver’s License number, ID card issued by the Department of Revenue or a Social Security card, the voter must provide a copy of one of the forms of identification listed in 30.1.6.
	Authority:  Sections 1-2-501(2)(ba), C.R.S. and 1-1-104(19.5), C.R.S.

Rules 38.10 and 38.12 would be emended as follows:
38.10	Prior to January 1, 2008January 1, 2006, election judges shall make one certificate for each Vote Center in the form required by section 1-7-601, C.R.S.
38.12	After January 1, 2008January 1, 2006, reconciliation shall consist of race-by-race comparison by precinct of the received tabulation to a tabulation report produced from the original tabulations sent from the precinct to those received at the Vote Center.  All tabulation reconciliations must be accomplished prior to canvassing board certification of final results and shall be certified by the canvassing board.  This certification of reconciliation shall be filed with the Secretary of State at the time  the canvassing board certification of official election results is filed.

Rule 45 would be amended as follows:
Rule 45.  Rules Concerning Voting System Standards for Certification
45.1	Definitions  The following definitions apply to their use in this rule only, unless otherwise stated.
45.1.1	“Audio ballot” means a voter interface containing the list of all candidates, ballot issues, and ballot questions upon which an eligible elector is entitled to vote at an election and that provides the voter with audio stimuli and allows the voter to communicate intent to the voting system through vocalization or physical actions.
45.1.2	“Audit log” means a system-generated record, in printed format, providing a record of activities and events relevant to initialization of election software and hardware, identification of files containing election parameters, initialization of the tabulation process, processing of voted ballots, and termination of the tabulation process.
45.1.3	“Ballot image” or “Ballot image log” means a corresponding representation in electronic form of the marks or vote positions of a cast ballot that are captured by a direct recording electronic voting device.
45.1.4	“Ballot style assignment” means the creation of unique, specific ballots for an election by the election management system based on criteria keyed into the system for districts, precincts, and races to create combinations of possibilities of races for individual voters to choose based on their individual precincts.
45.1.5	“Communications devices” means devices that may be incorporated in or attached to components of the voting system for the purpose of transmitting tabulation data to another data processing system, printing system, or display device.
45.1.6	“DRE” means a direct recording electronic voting device.  A DRE is a voting device that records votes by means of a ballot display provided with mechanical or electro-optical components that can be activated by the voter; that processes data by means of a computer program; and that records voting data and ballot images in memory components. It produces a tabulation of the voting data stored in a removable memory component and as printed copy. The device may also provide a means for transmitting individual ballots or vote totals to a central location for consolidating and reporting results from remote sites to the central location.
45.1.7	“EAC” means the United States Elections Assistance Commission.
45.1.8	“Election media” means any device including a cartridge, card, memory device, or hard drive used in a voting system for the purposes of programming ballot image data (ballot or card styles), recording voting results from electronic vote tabulating equipment, or any other data storage needs required by the voting system for a particular election function.  The election management system typically delivers (downloads) ballot style information to the election media and receives (uploads) cast ballot information in the form of a summary of results and ballot images.
45.1.9	“Equipment” or “device” means a complete, inclusive term to represent all items submitted for certification by the voting system provider.  This can include, but is not limited to any voting device, accessory to voting device, DRE, touch screen voting device, card programming device software, and hardware, as well as a complete end to end voting system solution.
45.1.10	“FEC” means the Federal Election Commission.
45.1.11	“ITA” means an independent test authority that provides engineering, testing, or evaluation services, and is certified by the National Association of State Election Directors (NASED) as qualified by the EAC to conduct qualification testing on a voting system.
45.1.12	“NASED” means the National Association of State Election Directors.
45.1.134	“Remote site” means any physical location identified by a Designated Election Official as a location where the jurisdiction shall be conducting the casting of ballots for a given election.  A remote site includes locations such as precinct polling places, vote centers, early voting, absentee ballot counting, etc.
45.1.15	“Security” means the ability of a system to protect election information and election system resources with respect to confidentiality, integrity, and availability.
45.1.16	“Split Precinct” means a precinct that has a geographical divide between one or more political jurisdictions which may cause a unique ballot style to be created for a specific election.
45.1.17	“Test Log” means documentation of certification testing and processes which is independently reproducible to recreate all test scenarios conducted by the testing board.  The log may include documentation including photographs, written notes, video and/or audio recorded notes in an effort to provide detail to the testing scenario including observation and results.
45.1.18	“Trusted Build” means the installation disk for software and firmware for which the Secretary of State or his/her agent has established the chain of custody to the building of a disk, used to establish and/or re-establish the chain of custody and ownership of any component of the voting system.
45.2	Introduction
45.2.1	Definition of voting system for certification purposes
	45.2.1.1	The definition of a voting system for the purposes of this rule shall be as the term is defined in HAVA section 301(b).  For Colorado purposes, no single component of a voting system, such as a precinct tabulation device, meets the definition of a voting system.  Sufficient components shall be assembled to create a configuration that shall allow the system as a whole to meet all the requirements described for a voting system in this rule.
	45.2.1.2	Sufficient components shall be assembled to create a configuration that shall allow the system as a whole to meet all the requirements described for a voting system in this rule.
45.2.2	Authority
	45.2.2.1  Pursuant to Articles 5 and 7 of Title 1, C.R.S., the Secretary of State is expressly authorized to adopt this rule.
	45.2.2.2	Certifications issued prior to this date shall be considered valid provided the voting system meets the requirements of HAVA section 301(a).
45.3	Certification Process Overview and Timeline
45.3.1	The voting system shall be considered as a unit, and all components of such system shall be tested at once, unless the circumstances necessitate otherwise (e.g. retrofitted V-VPATs, etc.).  Any change made to individual components of a voting system shall require re-certification of the voting system in accordance with this rule.
45.3.2	For a voting system to pass certification the voting system provider shall successfully complete all phases of the certification process that shall include: submitting a complete application, successful review of the documentation to evaluate if the system meets the requirements of this rule, successful demonstration of the system, followed by successful completion of items determined mandatory in the functional testing section of this rule.
45.3.3	The following milestones indicate the flow of the certification process – see timeline below:
	(a)  Phase I – 6 days maximum.  Voting system provider submits application and SOS reviews for completeness.  Voting system provider shall have 30 days to remedy and make application complete.
	(b) 	Phase II – 16 Days maximum.  SOS evaluates the documentation submitted and upon successful completion makes arrangement with voting system provider for demonstration.
	(c) 	Phase III – 17 36 days maximum.  When demonstration is complete, SOS performs the functional testing.
	(d) 	Phase IV – 21 days maximum.  Upon completion of functional testing, SOS produces a qualification report makes a decision to cerfity A voting system and produces applicable certification document.
	(e)	Phase V – 30 days maximum.  Upon decision to certify a voting system, SOS produces a qualification report for the voting system and components certified.

45.4	Application Procedure
45.4.1	Any voting system provider may apply to the SOS for certification at any time.
45.4.2	A voting system provider that submits a voting system for certification shall complete the SOS’s “Application for Certification of Voting System”.
45.4.3	The voting system provider shall establish an escrow account pursuant to state procurement processes to compensate the SOS for necessary outside costs associated with the testing of the system. [Criteria to be developed]
45.4.34	Along with the application, the voting system provider shall submit all the documentation necessary for the identification of the full system configuration submitted for certification. This documentation shall include information that defines the voting system design, method of operation, and related resources. It shall also include a system overview and documentation of the voting system’s functionality, accessibility, hardware, software, security, test and verification specifications, operations procedures, maintenance procedures, and personnel deployment and training requirements. In addition, the documentation submitted shall include the voting system provider’s configuration management plan and quality assurance program.
45.4.45	Where applicable, electronic copies of documentation are preferred and may be submitted in lieu of a hard copy.
45.4.56	All materials submitted to the SOS shall remain in the custody of the SOS during the life of the certification and for 25 months after the last election in which the system is used become the property of the SOS upon submission.
45.4.67	In addition to the application and the documentation specified above, the SOS may request additional information from the applicant, as deemed necessary by the SOS.
45.5	Voting System Standards
45.5.1	Federal Standards
	45.5.1.1	Pursuant to section1-5-601.5, C.R.S., and Rule 37.3, any voting system and voting equipment offered for sale on or after May 28, 2004 shall meet the voting systems standards promulgated in 2002 by the FEC and that may hereafter be promulgated by the EAC.
	45.15.1.2	All voting system software, hardware, and firmware shall meet all requirements of Federal law that address accessibility for the voter interface of the voting system. These laws include, but are not necessarily limited to, (a) the Help America Vote Act, (b) the Americans with Disabilities Act, and (c) the Federal Rehabilitation Act.  The voting system provider shall acknowledge explicitly that their proposed software, hardware, and firmware are all in compliance with the relevant accessibility portions of these laws.
	45.5.1.3	The voting system provider shall direct the ITA or the EAC to provide documentation indicating the successful completion of all necessary ITA testing based on federal requirements.  Failure to provide documentation of independent testing as defined by the EAC will result in the voting system application being rejected.
45.5.2	State Standards
	45.5.2.1	Functional requirements
		45.5.2.1.1	Functional requirements shall address any and all detailed operations of the voting system related to the management and controls required to successfully conduct an election on the voting system.
		45.5.2.1.2	The Voting system shall have the functional capabilities to:
			(a)	Prepare the system for an election;
			(b)  	Setup and prepare ballots for an election;
			(c)  	Lock and unlock system to prevent or allow changes to ballot design;
			(d)  	Conduct hardware and diagnostics testing as required herein,;
			(e)  	Conduct logic and accuracy testing as required herein,;
			(f)  	Conduct an election and meet additional requirements as identified in this section for procedures for voting, auditing information, inventory control, counting ballots, opening and closing polls, recounts, reporting, and accumulating results as required herein,;
			(g)  Conduct the post election audit as required herein; and
			(h)  Preserve the system for future election use.
		45.5.2.1.3	The voting system shall easily and accurately integrate election day voting results with absentee, early voting as well as provisional ballot results.
		45.5.2.1.4	The voting system shall be able to count all of an elector’s votes on a provisional ballot or only federal and statewide offices and statewide ballot issues and questions, as provided under section 1-8.5-108(2), C.R.S.
		45.5.2.1.5	The voting system shall provide for the voting of multiple ballot styles for a single precinct and shall provide for the tabulation of votes cast in split precincts where all voters residing in one precinct are not voting the same ballot style.
		45.5.2.1.6	The voting system shall provide for the tabulation of votes cast in combined precincts at remote sites, where more than one precinct is voting at the same location, on either the same ballot style or a different ballot style.
		45.5.2.1.7	The voting system shall provide authorized users with the capability to produce electronic files in ASCII (both comma-delimited and fixed-width) format that shall contain (a) all data or (b) any user selected data elements from the database. The software shall provide authorized users with the ability to generate these files on an “on-demand” basis. After creating such files, the authorized users shall, at their discretion, have the capability to copy the files to diskette, tape, or CD-ROM or to transmit the files to another information system.
		45.5.2.1.8	The voting system shall include hardware and software to enable the closing of the voting location and disabling acceptance of ballots on all vote tabulation devices to allow for the following:
			(a)	Machine-generated paper record of the time the voting system was closed.
			(b)	Readings of the public counter and/or protective counter shall become a part of the paper audit record upon disabling the voting system to prevent further voting.
			(c)	Ability to print an Abstract of the count of votes to contain:
	●	Names of the offices
	●	Names of the candidates and party when applicable
	●	A tabulation of votes from ballots of different political parties at the same voting location in a primary election
	●	Ballot titles
	●	Submission clauses of all initiated, referred or other ballot issues
	●	The number of votes counted for or against each candidate or ballot issue.
			(d)	Abstract shall include a Judge’s certificate and statement that contains:
	●	Date of election (day, month and year)
	●	Precinct Number (ten digit format)
	●	County or Jurisdiction Name
	●	State of Colorado
	●	Count of votes as indicated in this section
	●	Area for judge’s signature with the words similar to: “Certified by us”, and “Election Judges”.  Space should allow for a minimum of two signatures.
			(e)	Votes counted by a summary of the voting location, and by individual precincts.
			(f)	Allow for multiple copies of the unofficial results at the close of the election.
		45.5.2.1.9	Voters voting on DRE devices shall be able to navigate through the screens without the use of page scrolling.  Features such as next or previous page options shall be used.
		45.5.2.1.10	The system shall ensure that an election setup may not be changed once ballots are printed and/or device media is downloaded for votes to be conducted without proper authorization and acknowledgement by a system administrator
		45.5.2.1.11	The system shall be able to receive programming information from the Statewide Voter Registration System in XML format.
		45.5.2.1.12	The system shall be able to export election results in either a web based format, or a delimited file (text, CSV, etc.) for use in other applications.
			(a)	Exports necessary for the SOS shall conform to XML format.
			(b)	Export files shall be generated so that election results can be communicated to the SOS on election night both during the accumulation of results and after all results have been accumulated.
	45.5.2.2	Performance Level
		45.5.2.2.1	Performance Level shall refer to any operation related to the speed and efficiency required from the voting system to accomplish the successful conduct of an election on the voting system.
		45.5.2.2.2	The voting system shall meet the following minimum requirements for casting ballots:
			(a)	Optical Scan Ballots at voting location(s) = 100 ballots per hour
			(b)	DRE / Touch Screen = 20 ballots per hour
			(c)	Central Count Optical Scan Ballots = 100 ballots per hour
		45.5.2.2.3	For the purposes of evaluating software, the voting system provider shall be required to provide detailed information as to the type of hardware required to execute the software.  The performance level shall be such that a user of the software would have minimal pauses in the system during the ballot design and creation, along with the downloading and uploading of election media devices.  Specifically, the following minimum standards are required:
			(a)	Ballot style assignment is less than 10 seconds per ballot style
			(b)	Election Media Download is less than 35 seconds per media
			(c)	Election Media Upload is less than 20 seconds per media
			(d)	View Ballot image (on screen) is less than 30 seconds. per ballot image
		45.5.2.2.4	At no time shall third party hardware or software impact performance levels, unless a voting system provider specifically details through documentation the specific hardware or software, the performance impact, and a workaround for the end user to overcome the issue.
	45.5.2.3	Physical and Design Characteristics
		45.5.2.3.1	Physical and design characteristics shall address any and all external or internal construction of the physical environment of the voting system, or the internal workings of the software necessary for the functioning of the voting system to accomplish the successful conduct of an election on the voting system.
		45.5.2.3.2	The physical design of the proposed system (non-software) shall be in a way such that it enhances or assists in the “voter friendly” aspect of voting, as well as meets the requirements indicated in section 4 of the “Usability and Accessibility of Voting Systems and Products” study conducted by NIST.  (A copy of the document is located on the SOS web site.)
		45.5.2.3.3	The voting system shall meet the following environmental controls allowing for storage and operation in the following physical ranges:
●	Operating – Max. 100 Degrees Fahrenheit; Min 40 Degrees Fahrenheit, with max. humidity of 90%, normal or minimum operating humidity of 15%.
●	Non-Operating – Max. 130 Degrees Fahrenheit; Min. -15 Degrees Fahrenheit.  Non-operating humidity ranges from 5% to 90% for various intervals throughout the day.
The material supplied by the voting system provider shall include a statement of all requirements and restrictions regarding environmental protection, electrical service, telecommunications service, and any other facility or resource required for the installation, operation, and storage of the voting system.
		45.5.2.3.4	The ballot definition subsystem of the voting system consists of hardware and software required to accomplish the functions outlined in this section 45.5.2.3. System databases contained in the Ballot Definition Subsystem may be constructed individually or they may be integrated into one database. These databases are treated as separate databases to identify the necessary types of data that shall be handled and to specify, where appropriate, those attributes that can be measured or assessed for determining compliance with the requirements of this standard.
		45.5.2.3.5	The Ballot Definition Subsystem shall be capable of formatting ballot styles in multiple languages, including English and Spanish. The subsystem shall be capable of being updated to format ballot styles in additional languages as necessary under state or federal law.
		45.5.2.3.6	The voting system shall allow the user to generate and maintain an administrative database containing the definitions and descriptions of political subdivisions and offices within the jurisdiction.
		45.5.2.3.7	The ballot definition subsystem shall provide for the definition of political and administrative subdivisions where the list of candidates or contests may vary within the remote site and for the activation or exclusion of any portion of the ballot upon which the entitlement of a voter to vote may vary by reason of place of residence or other such administrative or geographical criteria.  This database shall be used by the system with the administrative database to format ballots or edit formatted ballots within the jurisdiction.
		45.5.2.3.8	For each election, the subsystem shall allow the user to generate and maintain a candidate and contest database and provide for the production or definition of properly formatted ballots and software.
		45.5.2.3.9	The environment in which all databases in the subsystem are maintained shall include all necessary provisions for security and access control. Any database may be generated and maintained in any file structure suitable to the requirements of the end user. It shall be the intent of the database hierarchy described herein to ensure that data entry, updating, and retrieval be effectively integrated and controlled.
		45.5.2.3.9	The ballot definition subsystem shall be capable of handling at least 500 potentially active voting positions, arranged to identify party affiliations in a primary election, offices and their associated labels and instructions, candidate names and their associated labels and instructions, and issues or measures and their associated text and instructions.
		45.5.2.3.10	The ballot display may consist of a matrix of rows or columns assigned to political parties or non-partisan candidates and columns or rows assigned to offices and contests. The display may consist of a contiguous matrix of the entire ballot or it may be segmented to present portions of the ballot in succession.
		45.5.2.3.11	The voting system shall provide a facility for the definition of the ballot, including the definition of the number of allowable choices for each office and contest, and for special voting options such as write-in candidates. It shall provide for all voting options and specifications as provided for in Articles 5 and 7, Title 1, C.R.S.  The system shall generate all required masters and distributed copies of the voting program in conformance with the definition of the ballot for each voting device and remote site.  The distributed copies, resident or installed in each voting device, shall include all software modules required to: monitor system status and generate machine-level audit reports, accommodate device control functions performed by remote location officials and maintenance personnel, and register and accumulate votes.
		45.5.2.3.12	All The trusted build of the voting system software, installation programs, and third party software (such as operating systems, drivers, etc.) used to install or to be installed on voting system devices shall be distributed on a write-once media.
		45.5.2.3.13	The voting system shall allow the system administrator to verify that the software installed is the certified software by comparing it to the “trusted build” or other reference information.
		45.5.2.3.14	All DRE voting devices shall use touch screen technology or other technology providing accurate visual ballot display and selection.  The voting system provider shall include documentation concerning the use of touch screen or other display and selection technology, including but not limited to:
			(a)	Technical documentation describing the nature and sensitivity of the tactile device (if the system uses touch screen technology);
			(b)	Technical documentation describing the nature and sensitivity of any other technology used to display and select offices, candidates, or issues;
			(c)	Any mean time between failure (MTBF) data collected on the vote recording devices; and
			(d)	Any available data on problems caused for persons who experience epileptic seizures due to the DRE voting devices' screen refresh rate.
Failure by the voting system provider to provide this documentation within the timelines established in section 45.3.3 shall delay the certification process
		45.5.2.3.15	The voting system shall contain a control subsystem that consists of the physical devices and software that accomplish and validate the following operations.
			(a) 	Voting system Preparation - The control subsystem shall encompass the hardware and software required to prepare remote location voting devices and memory devices for election use. Remote site preparation includes all operations necessary to install ballot displays, software, and memory devices in each voting device.  The control subsystem shall be designed in such a manner as to facilitate the automated validation of ballot and software installation and to detect errors arising from their incorrect selection or improper installation.
			(b)	Error Detection – the voting system shall contain a detailed list and description of the error messages that will appear on the voting devices, the controller (if any), the paper ballot printer, programmer, or any other device used in the voting process to indicate that a component has failed or is malfunctioning.
		45.5.2.3.16	The voting system shall have a high level of integration between the ballot layout subsystem and the vote tabulation subsystem. This integration shall permit and facilitate the automatic transfer of all ballot setup information from the automated ballot layout module to the single ballot tabulation system that will be used in a fully integrated manner for DRE, optical scan, and any other voting devices included in the voting system.
		45.5.2.3.17	The processing subsystem contains all mechanical, electromechanical, and electronic devices required to perform the logical and numerical functions of interpreting the electronic image of the voted ballot and assigning votes to the proper memory registers.  Attributes of the processing subsystem that affect its suitability for use in a voting system, are accuracy, speed, reliability, and maintainability.
			(a)	 Processing accuracy refers to the ability of the subsystem to receive electronic signals produced by vote marks and timing information, to perform logical and numerical operations upon these data, and to reproduce the contents of memory when required without error. Processing subsystem accuracy shall be measured as bit error rate, which is the ratio of uncorrected data bit errors to the number of total data bits processed when the system is operated at its nominal or design rate of processing in a time interval of four (4) hours. The bit error rate shall include all errors from any source in the processing subsystem. For all types of systems, the Maximum Acceptable Value (MAV) for this error rate shall be one (1) part in five hundred thousand (500,000) ballot positions, and the Nominal Specification Value (NSV) shall be one (1) part in ten million (10,000,000) ballot positions.
			(b)	Memory devices that are used to retain control programs and data shall have demonstrated at least a ninety-nine and a half (99.5) percent probability of error-free data retention for a period of six months for operation and non-operation.
		45.5.2.3.18	The reporting subsystem contains all mechanical, electromechanical, and electronic devices required to print reports of the tabulation.  The subsystem also may include data storage media and communications devices for transportation or transmission of data to other sites. Communications Devices shall not be used for the preparation or printing of an official canvass of the vote unless they conform to a data interchange and interface structure and protocol that incorporates some form of error checking and auditing process control.
		45.5.2.3.19	The approach to design shall be unrestricted, and it may incorporate any form or variant of technology that is capable of meeting the requirements of this rule, and other attributes specified herein.  The frequency of voting system malfunctions and maintenance requirements shall be reduced to the lowest level consistent with cost constraints. Applicants are required to use MIL-STD-454; "Standard General Requirements for Electronic Equipment" that is hereby adopted and incorporated by reference, as a guide in the selection and application of materials and parts.
		45.5.2.3.20	The voting system and all associated components shall have a an estimated useful life of at least eight (8) years.  Voting system provider shall provide documentation of basis for the estimate.
		45.5.2.3.21	The voting system provider shall submit drawings, photographs, and any related brochure documents to assist with the evaluation of the physical design of the use of the voting system.
	45.5.2.4	Documentation Requirements
		45.5.2.4.1	In addition to Section 45.3 above, the voting system provider shall provide the following documents:
●	Standard Issue Users/Operator Manual
●	System Administrator’s Manual
●	Training Manual (and materials)
●	Systems Programming and Diagnostics Manuals
		45.5.2.4.2	All ITA qualification reports that are material to the determination that a voting system may be certified shall be evaluated to determine if the test procedures, records of testing, and reporting of results meet the requirements of this rule and the applicable federal certification requirements at the time of certification.
		45.5.2.4.3	Prior to applying for certification, the voting system provider shall have completed an independent analysis of the system which includes:
			(a)	Application penetration test; [Additional details to be developed]
			(b)	Source code evaluation for software security weaknesses; [Additional details to be developed]
			(d)	A list of approved contractors will be provided upon request of the voting system provider; [Additional details to be developed]
			(c)	[Additional criteria to be developed]
		45.5.2.4.34	Documentation submitted to the SOS shall be reviewed to ensure the voting system meets the 2002 Voting Systems Standards, or the most current, implemented voting system standards enacted by the EAC FEC.  The submitted documentation shall include methods for implementing future releases and versions of the future standards.
	45.5.2.5	Audit capacity
		45.5.2.5.1	The voting system shall be capable of producing electronic and printed paper audit logs of system operation and system operators which shall be sufficient to allow all operations and input commands to be audited (“Audits”, “audit reports”, or “audit records”), generated by the system components, or in some cases, by the system operators, from which all operations may be audited.  Except for the storage of vote images that shall be maintained in a random sequence, the audit records shall be created and maintained in the sequence in which the operations were performed.
		45.5.2.5.2	The voting systems shall include detailed documentation as to the level, location, and programming of audit trail information throughout the system.  The Audit information shall apply to:
(a)	Operating Systems (workstation, server, and/or DRE)
(b)	Election Programming Software
(c)	Election Tabulation devices – optical scan and DRE
		45.5.2.5.3	The system shall track and maintain audit information of the following events:
(a)	Log on and log off activity
(b)	Application start and stop
(c)	Printing activity (where applicable)
			(d)	Election events – setup, set for election, unset for election, open polls, close polls, end election, upload devices, download devices, create ballots, create precincts, create districts, create poll places (or Vote Centers), and voting activity.
			(e)	Hardware events – add hardware, remove hardware, and change hardware properties.
		45.5.2.5.4	All tabulation devices shall display the unit serial number(s) both physically and within any applicable software or PROM/ROM devices.
		45.5.2.5.5	If a vote tabulation device employs the use of removable memory storage devices, the devices shall allow for the transfer of audit records if the device and/or memory storage device is damaged or destroyed.
		45.5.2.5.6	All transaction audit records of the database shall be maintained in a file outside or separate from the database. [Criteria to be developed]
	45.5.2.6	Security Requirements
		45.5.2.6.1	All voting systems submitted for certification shall meet the following minimum system security requirements:
			(a)	The voting system shall accommodate a general system of access by least privilege – or – role based access control.  The following requirements shall apply
				●	Administrator of System does not have access to administrative rights to the database;
				●	Administrator of Application; [Criteria to be developed]
				●	Administrator of Database; [Criteria to be developed]
			(b)	The voting system shall meet the following requirements for network security:
				●	All components of the voting system shall only be operated on a closed network only for the use of the voting system;
				●	Vendor documentation shall include the limited use of non-routable IP address configurations for any device connected to the closed network;
				●	[Additional Requirements to be developed]
			(c)	The voting system shall meet the following requirements for database security:
				●	After January 1, 2008 all voting system database designs must be hardened to the requirements identified in the NSA guidelines for database hardening; [additional criteria to be developed]
				●	After January 1, 2008. all voting systems databases must be restricted to allowing access to database authentication from application only; (or through application only).
				●	All data stored in any voting system database shall be encrypted to 128 Bit DES; [Additional criteria to be developed]
				●	ODBC connections are prohibited for the voting system software.  All operating system services related to the use of this feature shall be disabled;  [Additional criteria to be developed]
				●	Data encryption standards and data encryption usage – defining the algorithm for encryption;  [Additional criteria to be developed]

				●	All Cryptography modules shall be documented by the voting system vendor to be in compliance with US Federal Information Processing Standard (FIPS-140-2). [Additional criteria to be developed]
			(d)	The voting system shall meet the following requirements for operating system security:
				●	The voting system shall be fully functional with the following services disabled by the operating system:
					i.	ODBC;
					ii.	Messenger;
					iii.	Automatic Updates;
					iv.	DNS Client;
		v.	NetMeeting remote desktop sharing;
		iv.	[Additional services that must be disabled to be developed].
				●	The voting system shall be fully functional with the following list of prohibited applications:
					i.	Any/All IRQ/IM applications;
		ii.	[Additional applications that are prohibited to be developed].
				●	The voting system provider shall provide documentation containing a list of minimum services and executables that are required to run the voting system application.
				●	The voting system provider shall disable auto boot and auto run features capable by operating system.
				●	The voting system provider shall use a virus protection/prevention application on the election management server(s)/workstations which must be capable of manual updates without the use of the internet.
				●	[Additional requirements to be developed]
			(e)	The voting system shall meet the following requirements for password security:
				●	All passwords shall be stored and used in encrypted/Hard-Coded  format;
				●	Passwords to database must not be stored in database; [Additional criteria to be developed]
				●	The system shall be designed in such a way that the use of the administrator password shall not be required at any remote location.
			(f)	The voting system shall meet the following requirements for software security:
				●	All voting system software shall be in compliance with known software coding standards applicable to the base language of the application meeting the following minimum standards: [to be developed]
				●	Use of High Level programming languages shall be limited to:  Pascal, Visual Basic, Java, C, C++, and C#.  The requirement for the use of high-level language for logical operations does not preclude the use of assembly language for hardware-related segments, such as device controllers and handler programs.
				●	The following input validations shall be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
					i.	Path manipulation;
					ii.	Cross Site Scripting.Basic X;
					iii.	Resource Injection;
		iv.	OS Command Injection (also called “Shell Injection”);
					v.	SQL Injection.
				●	The following range errors shall be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
					i.	Stack Overflow;
					ii.	Heap Overflow;
					iii.	Format string vulnerability;
					iv.	Improper Null Termination.
				●	The following API abuses will be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
					i.	Heap Inspection;
		ii.	String Management/Manipulation.
			●	The following Time and State conditions shall be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
		i.	Time-of-check/Time-of-use race condition;
		ii.	Unchecked Error Condition.
			●	The following code quality conditions shall be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
		i.	Memory Leaks;
		ii.	Unrestricted Critical Resource Lock;
		iii.	Double Free;
		iv.	Use After Free;
		v.	Unintialized variable;
		vi.	Unintentional pointer scaling;
		vii.	Improper pointer subtraction;
		viii.	Null Dereference.
			●	The following encapsulation conditions shall be prohibited and verified through independent analysis in accordance with section 45.5.2.4.3: [Additional criteria to be developed]
		i.	Private Array-Typed Field Returned from a Public Method;
		ii.	Public Data Assigned to Private Array-Typed Field;
		iii.	Overflow of static internal buffer;
		iv.	Leftover Debug Code.
		45.5.2.6.12	The voting system provider shall provide documentation detailing voting system security in the areas listed below.  At no time shall the system contain documented configurations, properties and procedures to prevent, detect and log a system allow for unauthorized changes to system capabilities for:
(a)	Defining ballot formats;
(b)	Casting and recording votes;
			(c)	Calculating vote totals consistent with defined ballot formats;
			(d)	Reporting vote totals;
			(e)	Alteration of voting system audit records;
			(f)	Changing, or preventing the recording of, a vote;
			(g)	Introducing data for a vote not cast by a registered voter;
			(h)	Changing calculated vote totals;
			(i)	Preventing access to vote data, including individual votes and vote totals, to unauthorized individuals; and
			(j)	Preventing access to voter identification data and data for votes cast by the voter such that an individual can determine the content of specific votes cast by the voter.
		45.5.2.6.23	The voting system provider shall submit to the SOS its recommended policies or guidelines governing:
			(a)	Software access controls;
			(b)	Hardware access controls;
			(c)	Data communications;
			(d)	Effective password management;
			(e)	Protection abilities of a particular operating system;
			(f)	What software for virus and spyware protection the voting system shall use
			(f g)	General characteristics of supervisory access privileges;
			(gh)	Segregation of duties; and
			(fi)	Any additional relevant characteristics.
		45.5.2.6.34	The voting system shall include detailed documentation as to the security measures it has in place for all systems, applicable software, devices that act as connectors (upload, download, and other programming devices), and any security measures the voting system provider recommends to the end users that purchase the voting system.
	45.5.2.7	Telecommunications Requirements
		45.5.2.7.1	Telecommunications includes all components of the voting system that transmit data over public or private network communications.  This includes wired, wireless, phone/ modem, LAN, and WAN connections.
		45.5.2.7.2	All electronic transmissions from a voting system across public networks shall meet the following minimum standards:
			(a)	Modems from remote devices shall be “dial only” and cannot be programmed to receive a call;  [Additional criteria to be developed]
			(b)	Modems from tally computer (central servers, including rally servers) shall be hardened to industry standards;  [Additional criteria to be developed]
			(c)	All communications shall be authenticated and encrypted to a minimum of 128 Bit DES;  [Additional criteria to be developed]
			(d)	Any modem in any component failing to meet this criteria shall not be used by any voting system.
		45.5.2.7.2	All electronic transmissions across public networks shall be secured to the level and using the technologies prescribed in the State of Colorado’s “Minimum IT Architecture Standards” as adopted by the Information Management Commission at the time of certification. The voting system provider shall provide documentation describing in detail the steps and methods used for those electronic transmissions. This documentation will describe, at a minimum, the methods by which authentication, confidentiality, integrity, and availability of the transmission and verification of electronically transmitted information will be performed.
		45.5.2.7.3	The voting system provider is required to provide to the SOS an affidavit of compliance with the State’s “Minimum IT Architecture Standards” and is further required to indicate to the State any variance(s) between the vendor’s systems and the State’s standards within the documentation submitted for certification of the voting system.
		45.5.2.7.4	Any system that incorporates wireless transmission shall include a detailed security plan specific to the wireless protocol being deployed with the voting system.  The detailed plan shall include specific instructions for end users of the system to allow passwords and security keys to be set and/or generated by the end user.
		45.5.2.7.3	All wireless components on voting systems shall be disabled with the exception of line of sight infrared technology used in a closed environment where the transmission and reception is shielded from external infrared signals and can only accept infrared signals generated from within the system.
		45.5.2.7.54	All systems that transmit data over public telecommunications networks shall maintain a clear audit trail that can be provided to the SOS when election results are transmitted by telephone, microwave or any other type of electronic communication.
		45.5.2.7.65	Systems designed for transmission of voter information (i.e. electronic pollbooks) over public networks shall meet security standards that address the security risks attendant with the casting of ballots at remote sites controlled by election officials using the voting system configured and installed by election officials and/or their voting system provider or contractor, and using in-person authentication of individual voters.
		45.5.2.7.76	Any voting system provider of systems that cast individual ballots over a public telecommunications network shall provide detailed descriptions of:
			(a)	All activities mandatory to ensuring effective system security to be performed in setting up the system for operation, including testing of security before an election.
			(b)	All activities that should be prohibited during system setup and during the time frame for voting operations, including both the hours when polls are open and when polls are closed.
	45.5.2.8	Accessibility Requirements
		45.5.2.8.1	Specific minimum accessibility requirements include those specified in section §1-5-704 C.R.S., SOS Rule 34, Rule 35 and the following:
(a)	Buttons and controls shall be distinguishable by both shape and color.
(b)	Audio ballots shall meet the following standards:
	1.	The voting system shall allow the voter to pause and resume the audio presentation.
	2.	The audio system shall allow voters to control within reasonable limits, the rate of speech.
(c)	No voting system or any of its accessible components shall require voter speech for its operation.
		45.5.2.8.2	Documentation of the accessibility of the voting system shall include the following items at a minimum:
			(a)	If appropriate, voting booth design features that provide for privacy for the voter while voting (if a voting booth is not included with the system, then describe how voter privacy is accomplished).
			(b)	Adaptability of the proposed system for voters with disabilities as outlined in the Americans with Disabilities Act guidelines.
			(c)	Technology used by the voting system that prevents headset/headphone interference with hearing aids.
			(d)	Types and size of voice file(s) the voting system uses.
			(e)	Method for recording, sharing and storing voice files in the voting system.
			(f)	How paginating through viewable screens is accomplished if it is required with the voting system.
			(g)	Various methods of voting to ensure access by persons with multiple disabilities. Voting systems shall include push buttons, keypad, “puff-sip” tube, touch screen, switches, and blink control devices.
			(h)	Capabilities of the voting system to accurately accept a non-human touch as input on the touch screen.
			(i)	User adjustability of color settings, screen contrasts, and screen angles/tilt if the system uses a display screen.
	45.5.2.9	Voter-Verifiable Paper Record Requirements(V-VPAT)
		45.5.2.9.1	V-VPAT shall refer to a Voter-verified paper record as defined in section1-1-104(50.6)(a), C.R.S.
		45.5.2.9.2	Existing systems that are retrofitted to comply with this law shall be certified by the SOS.  Any retrofitted voting system shall comply with the process and application for certification as identified by this rule.
		45.5.2.9.3	The V-VPAT shall consist of the following minimum components:
			(a)	The voting device shall contain a paper audit trail writer or printer that shall be attached, built into, or used in conjunction with the DRE.  The printer shall duplicate a voter’s selections from the DRE onto a paper record.
			(b)	The unit or device shall have a paper record display unit or area that shall allow a voter to view his or her paper record.
			(c)	The V-VPAT unit shall contain a paper record storage unit that shall store cast and spoiled paper record copies securely.
			(d)	These devices may be integrated as appropriate to their operation.
		45.5.2.9.4	V-VPAT devices shall allow voters to verify his or her selections on a paper record prior to casting ballots.  The voter shall either accept or reject the choices represented on the paper record.  Both the electronic record and the paper record shall be stored and retained upon the completion of casting a ballot.
		45.5.2.9.5	The V-VPAT printer connection may be any standard, publicly documented printer port (or the equivalent) using a standard communication protocol.
		45.5.2.9.6	The printer shall not be permitted to communicate with any other device than the voting device to which it is connected.
		45.5.2.9.7	The printer shall only be able to function as a printer, and not perform any other services or possess network capability.
		45.5.2.9.8	Every electronic voting record shall have a corresponding paper record.
		45.5.2.9.9	The paper record shall be considered an official record of the election available for recounts, and shall be sturdy, clean, and of sufficient durability to be used for this purpose.
		45.5.2.9.10	The V-VPAT device shall be designed to allow every voter to review, and accept or reject his/her paper record in as private and independent manner as possible for both disabled and non-disabled voters.
		45.5.2.9.11	The V-VPAT system shall be designed in conjunction with State Law to ensure the secrecy of votes so that it is not possible to determine which voter cast which paper record.
		45.5.2.9.12	The V-VPAT printer shall print at a font size no less than ten (10) points for ease of readability.  Any protective covering intended to be transparent shall be in such condition that it can be made transparent by ordinary cleaning of its exposed surface.
		45.5.2.9.13	The V-VPAT system shall be designed to allow each voter to verify his or her vote on a paper record in the same language they voted in on the DRE.
		45.5.2.9.14	The V-VPAT system shall be designed to prevent tampering with unique keys and/or seals for the compartment that stores the paper record, as well as meet the security requirements of this rule.  Additional security measures may be in place on the printer to prevent tampering with the device.
		45.5.2.9.15	The V-VPAT system shall be capable of printing and storing paper record copies for at least 150 ballots cast without requiring the paper supply source, ink or toner supply, or any other similar consumable supply to be changed during the voting period, assuming a fully printed double sided eighteen (18) inch ballot.
		45.5.2.9.16	The V-VPAT unit shall provide a “low supply” warning to the election judge to add paper, ink, toner, ribbon or other like supplies. In the event that an election judge is required to change supplies during the process of voting, the voter shall be allowed to reprint and review the paper audit trail without having to re-mark his or her ballot, and the device shall prevent the election judge from seeing any voters’ ballots.
		45.5.2.9.17	The voting system provider shall provide procedures and documentation for the use of the V-VPAT device.
		45.5.2.9.18	The printed information on the printed ballot or verification portion of the V-VPAT device shall contain at least the following items:
			(a)	Name or header information of race, question or issue
			(b)	Voter’s selections for the race information.
			(c)	Write-in candidate’s names if selected.
			(d)	Undervote or overvote information – this is in addition to the information on the review screen of the DRE.
			(e)	Unique serial number (randomized to protect privacy)
			(f)	Identification that the ballot was cancelled or cast
		45.5.2.9.19	The V-VPAT shall allow a voter to spoil his or her paper record no more than two (2) times.  Upon spoiling, the voter shall be able to modify and verify selections on the DRE without having to reselect all of his or her choices.
		45.5.2.9.20	Before the voter causes a third and final record to be printed, the voter shall be presented with a warning notice that the selections made on screen shall be final and the voter shall see and verify a printout of his or her vote, but shall not be given additional opportunities to change their vote.
		45.5.2.9.21	All V-VPAT components shall be capable of integrating into existing state testing and auditing requirements of the voting system.
		45.5.2.9.22	The V-VPAT component should print a barcode with each record that contains the human readable contents of the paper record and digital signature information.  The voting system provider shall include documentation of the barcode type, protocol, and/or description of barcode and the method of reading the barcode as applicable to the voting system.
		45.5.2.9.23	The V-VPAT component shall be designed such that a voter may not be able to leave the voting area with the paper record.
		45.5.2.9.24	If used for provisional ballots, the V-VPAT system shall be able to count all of an elector’s votes on a provisional ballot or only federal and statewide offices and statewide ballot issues and questions, as provided under section1-8.5-108(2), C.R.S.
		45.5.2.9.25	The SOS shall keep on file procedures submitted by the voting system provider for how to investigate and resolve malfunctions including, but not limited to:  misreporting votes, unreadable paper records, paper jams, low-ink, misfeeds, preventing the V-VPAT from being a single point of failure, recovering votes in the case of malfunction and power failures.
45.6	Testing
45.6.1	Voting System Provider Demonstration
	45.6.1.1	The voting system provider shall demonstrate the exact proposed voting system to the SOS or his or her designee prior to any functional testing.  It should be expected that a minimum of 6 hours would be required of the voting system provider to demonstrate and assist with programming of the software as necessary.
	45.6.1.2	The demonstration period does not have a pre-determined agenda for the voting system provider to follow, however, presentations should be prepared to address and demonstrate with the specific system the following items as they pertain to each area and use within the voting system:
			(a)	System overview
			(b)	Verification of complete system matching EAC certification
			(c)	Ballot definition creation
			(d)	Import EML file from statewide voter registration system
			(e)	Printing ballots on demand
			(f)	Hardware diagnostics testing
			(g)	Programming election media devices for various count methods:
●	Absentee
●	Early Voting
●	Precinct/Poll Place
●	Provisional
●	Vote Center
			(h)	Sealing and securing system devices
			(i)	Logic and accuracy testing
			(j)	Processing ballots
			(k)	Accessible use
			(l)	Accumulating results
			(m)	Post-election audit
			(n)	Canvass process handling
			(o)	Audit steps and procedures throughout all processes.
			(p)	Certification of results (export EML to statewide voter registration system)
			(q)	Troubleshooting.
	45.6.1.3	The voting system provider shall have access to the demonstration room for one hour prior to the start of the demonstration to provide time for setup of the voting system.
	45.6.1.4	A maximum of 3 business days – 24 hours total shall be allowed for the demonstration.
	45.6.1.5	The demonstration shall be open to representatives of the press and the public to the extent allowable.  The SOS may limit the number of representatives from each group to accommodate space limitations and other considerations.
	45.6.1.6	The SOS shall post notice of the fact that the demonstration will take place in the designated public place for posting notices for at least seven (7) days before the demonstration.  The notice shall indicate the general time frame during which the demonstration may take place and the manner in which members of the public may obtain specific information about the time and place of the test.
	45.6.1.7	The voting system provider shall provide the same class of workstation and/or server for testing the voting system as the normal production environment for the State of Colorado.
	45.6.1.8	The proprietary software shall be installed on the workstation by the testing board following the documentation provided by the voting system provider after the establishment of the “trusted build.”
45.6.2	Functional Testing
45.6.2.1	Voting system provider requirements for testing
		45.6.2.1.1	The voting system provider shall submit for testing the specific system configuration that shall be offered to end users jurisdictions including the components with which the voting system provider recommends that to be used with the system be used.
		45.6.2.1.2	The voting system provider is not required to be present for the functional testing, but shall provide a point of contact for support.
		45.6.2.1.3	The voting system provider shall deposit with the Secretary of State the “trusted build”provide a copy of the version being certified of software, firmware, utilities, hardware and instructions to install, operate and test the system being submitted for certification.
		45.6.2.1.4	The test shall be performed with test ballots and an election setup file, as determined by the SOS.
		45.6.2.1.5	Functional testing shall be completed within 17 days of the successful conclusion of the voting system provider demonstrationaccording to the schedule identified in section 45.3.3.
	45.6.2.2	SOS requirements for testing
		45.6.2.2.1	The SOS or the designee shall conduct functional testing on the voting system based on this rule and additional testing procedures as determined by the SOS.
		45.6.2.2.2	The voting system shall receive a pass/fail for each test conducted with applicable notation on the test log. [Additional requirements to be developed]
		45.6.2.2.3	A test log of the testing procedure shall be maintained and recorded on file with the SOS. This test log shall identify the system and all components by voting system provider name, make, model, serial number, software version, firmware version, date tested, test number, test description, notes of test, applicable test scripts, and results of test. All test environment conditions shall be noted.
		45.6.2.2.4	All operating steps, the identity and quantity of simulated ballots, annotations of output reports, and observations of performance shall be recorded.
		45.6.2.2.5	In the event that a deviation to requirements pertaining to the test environment, voting system arrangement and method of operation, the specified test procedure, or the provision of test instrumentation and facilities is required, this deviation shall be recorded in the test log together with a discussion of the reason for the deviation and a statement of the effect of the deviation on the validity of the test procedure.
	45.6.2.3	General Testing Procedures and Instructions
		45.6.2.3.1	Certification tests shall be used to determine compliance with applicable performance standards for the system and its components.  The general procedure for these tests shall:
			(a)	Verify, by means of applicant’s standard operating procedure, that the device is in a normal condition and status.
			(b)	Establish the standard test environment or the special environment required to perform the test.
			(c)	Invoke all operating modes or conditions necessary to initiate or to establish the performance characteristic to be tested.
			(d)	Measure and record the value or the range of values of the performance characteristic to be tested.
			(e)	Verify all required measurements have been obtained, and that the device is still in a normal condition and status.
		45.6.2.3.2	All tests shall be conducted as described in this section 45.6.2.3 in regular election mode.  At no point shall testing be conducted in any form of test mode.
		45.6.2.3.3	Each voting system shall be tested and examined by conducting  a two mock elections – a Primary, and a coordinated election.
		45.6.2.3.4	Each component of the voting system shall contain provisions for verifying it is functioning correctly and, whether operation of the component is dependent upon instructions specific to that election.
		45.6.2.3.5	Both election scenarios shall feature at least 10 districts (or district types), comprised of at least 20 precincts that will result in a minimum of 5 unique ballot styles or combinations.
		45.6.2.3.6	The voting system provider is required to produce a minimum of 500 ballots for each of the two elections.  Enough ballots need to be created to conduct the testing of the voting system as defined in this rule.  One complete set of ballots will be tested in each of the applicable counter types (or groups) indicated below:
			(a)	Poll Place or Vote Center - ballots are flat – no score marks
			(b)	Early Voting – ballots are flat – no score marks
			(c)	Absentee – ballots are scored and folded to fit in standard Colorado Absentee Mailing Envelopes.
			(d)	Provisional – ballots are flat- no score marks
		45.6.2.3.7	The voting system provider shall pre-mark all ballots used for testing, with the exception of at least 175 blank ballots that shall represent 5 blank ballots for every precinct and precinct-split based on the programming mentioned in this section 45.6.2.3.  Pre-marked ballots shall also have a predetermined tally that the voting system provider shall provide to the SOS for the testing of the ballots.  Markings shall represent all of the testing scenarios as described in this rule.
		45.6.2.3.8	The voting system provider shall provide 10 ballot marking pens/pencils/markers as defined by their system for marking ballots by the SOS or the designee.
		45.6.2.3.9	Ballots shall be cast and counted in all applicable counter types (or counter groups) as necessary based on the parts included in the voting system.  These are at a minimum:  Poll Place (or Vote Center), Absentee, Provisional, and Early Voting.  Ballots may be run through components 10 or more times depending on components and counter group being tested to achieve a minimum number of ballots cast as follows for each group:
			(a)	Polling Place / OS	=	 1,500
			(b) 	Polling Place / DRE	=	    500
			(c)	Vote Center/ OS 	=	 5,000
			(d)	 Vote Center / DRE	=	    500
			(e)	 Early Voting / OS	=	 5,000
			(f)	Early Voting / DRE	=	    250
			(g) 	Absentee			=	10,000
			(h) 	Provisional 		=	  5,000
		45.6.2.3.10	Ballot design shall cover the scope of allowable designs for the given system.  For example, if a system is capable of producing 11” and 18” ballots, then both ballot styles shall be tested in each of the elections above.  If more sizes are available, they shall also be tested.  Ballots must be designed and presented with a maximum of four (4) columns and a minimum of one (1) column.
		45.6.2.3.11	Ballots shall be printed in applicable languages as required by state and/or federal law.
		45.6.2.3.12	Ballots shall include candidates to represent the maximum number of political parties in the State of Colorado, and shall accommodate all qualified political parties and political organizations.
		45.6.2.3.13	Ballots shall include the following minimum race situations to simulate and test “real world” situations in the State of Colorado:
			(a)	Parties for different races.
			(b)	Selection of a pair of candidates (i.e. president and vice president)
			(c)	In a Primary Election, allow a voter to vote for the candidate of the party of his or her choice and for any and all non-partisan candidates and measures, while preventing the voter from voting for a candidate of another party.
			(d)	In a general election, allow a voter to vote for any candidate for any office, in the number of positions allowed for the office, and to select any measure on the ballot that the candidate is allowed to vote in, regardless of party.
			(e)	A minimum of 20 pairs of “yes” and “no” positions for voting on ballot issues.
			(f)	Ability to contain a ballot question or issue of at least 200 words.
		45.6.2.3.14	Additional tests and procedures may be requested at the discretion of the SOS.
45.6.3	Failure Criteria
	45.6.3.1	Voting systems shall successfully complete all of the requirements in this rule, and any additional testing that is deemed necessary by the SOS.
	45.6.3.2	If any malfunction or data error is detected, its occurrence and the duration of operating time preceding it shall be recorded for inclusion in the analysis and the test shall be interrupted. If corrective action is taken to restore the devices to a fully operational condition within 8 hours, then the test may be resumed at the point of suspension.
45.7	Temporary Use
45.7.1	If a voting system provider has a system that has been approved by an ITA, but has not yet been approved for certification through the SOS, the voting system provider or the designated election official may apply to the SOS for temporary approval of the system to be used for up to one year.
45.7.2	Upon approval of temporary use, a jurisdiction may use the voting system, or enter into a contract to rent or lease the voting system for a specific election upon receiving written notice from the SOS’s office.  At no time shall a jurisdiction enter into a contract to purchase a voting system that’s been approved for temporary use.
45.7.3	The SOS shall approve use of a temporarily approved voting system for each election that a jurisdiction would like to conduct with the voting system.
45.7.4	Temporary use does not supersede the certification requirements and/or process, and may be revoked at any time at the discretion of the SOS.
45.8	Periodic Review
45.8.1	The SOS shall periodically review the voting systems in use in Colorado to determine if the system(s):
	(a)	Are defective, obsolete, or unacceptable for use based on the requirements of this rule.
	(b)	Have been modified from cCertified and approved “trusted build” versions of hardware or software have been modified.
	(c)	The software matches with the software in escrow with the SOS.
45.8.2	The SOS shall review a minimum of two randomly selected jurisdictions and voting systems per calendar year at the choosing of the SOS.
45.8.3	The SOS shall conduct an annual visual inspection of all software incident records maintained by each vendor certified for use in the State of Colorado.
45.8.34	After such review, certification or temporary approval for use may be withdrawn.  Three (3) months notice shall be given prior to withdrawing certification of any voting system unless the SOS shows good cause for a shorter notice period.
45.8.45	All forms, notes and documentation from a periodic review shall be kept on file with the SOS.
45.9	Decertification
45.9.1	If after any time the SOS has certified a voting system, it is determined that the voting system fails to meet the standards set forth in this rule, the SOS shall notify any end users jurisdictions in the State of Colorado and the voting system provider of that particular voting system that the certification of that system for future use and sale in Colorado is to be withdrawn.
45.9.2	Certification of a voting system may be revoked and/or suspended at the discretion of the SOS based on information that may be provided after the completion of the initial certification.  This information may come from any of the following sources:
 	(a)	The Election Assistance Commission (EAC)
	(b)	Independent Testing Authorities (ITA)
	(c)	 The Federal Election Commission (FEC)
	(d)	The National Software Reference Library (NSRL)
	(e)	National Association of State Election Directors (NASED)
	(f)	The National Association of Secretaries of State (NASS)
	(g)	Information from any state elections department or SO Ssecretary of state
	(h)	Information from Colorado County Clerk and Recorders or their association.
45.9.3	Any use of a decertified or uncertified voting system for any jurisdiction in the State of Colorado shall result in possible loss of future and other existing certifications within the state, at the discretion of the SOS.
45.9.4	Pursuant to section 1-5-621, C.R.S., the SOS shall hold a public hearing to consider the decision to decertify a voting system.
45.10	Modifications and Re-examination
45.10.1	Any field modification, change, or other alteration to a voting system shall require approval or certification before it may be used in any election within the State of Colorado.
45.10.2	A voting system provider may apply to the SOS for the review of a modification of an existing certified system at any time during the year.  The voting system is required to go through the complete certification process.
45.11	Acceptance Testing by Jurisdictions 
45.11.1	Whenever an election jurisdiction acquires a new system or modification of an existing system certified by the SOS, the election jurisdiction shall perform acceptance tests of the system before it may be used to cast or count votes at any election.  The voting system shall be operating correctly, pass all tests as directed by the acquiring jurisdiction’s project manager or contract negotiator, and shall be identical to the voting system certified by the SOS.
45.11.2	The voting system provider shall provide all manuals and training necessary for the proper operation of the system to the jurisdiction, or as indicated by their contract.
45.11.3	The election jurisdiction shall perform a series of functional and programming tests that shall test all functions of the voting system at their discretion.
45.11.4	The jurisdiction shall coordinate acceptance testing with the SOS’s designated agent and complete a Jurisdiction Acceptance Test form provided by the SOS.
45.11.5	Acceptance testing is at the discretion of the purchasing jurisdiction, however, if the jurisdiction chooses to waive the opportunity to conduct acceptance testing of the voting system they are purchasing, such indication shall be made on the Jurisdiction Acceptance Test form..
45.1112	Purchases and Contracts
45. 1112.1	Any voting system that has been certified under the procedures of this Rule are eligible for purchase, lease, or rent for use by jurisdictions within the State of Colorado upon written approval by the SOS of the contract between the jurisdiction and the voting system provider.
45. 1112.2	At the completion of contract negotiations, a jurisdiction entering into a contract to purchase, lease or rent a voting system for use in the State of Colorado shall request approval of the contract from the SOS prior to signing the contract.
45. 1112.3	The SOS or his or her designee shall approve the contract based on the following minimum criteria:
	(a)	The voting system is certified for use within the State.
	(b)	Contract contains training and maintenance costs for Jurisdiction.
	(c)	Contract identifies components contained in the certified voting system, and appears complete with all accessories necessary for successfully conducting an election within the laws and rules of the State of Colorado.
	(d)	The voting system and associated components are purchased at or below the following costs:

Item and Description	Maximum Contracted Cost	
Ballot Tabulation Only Software	$48,000.00	
Complete Software Package	$420,000.00	
DRE with V-VPAT	$7,000.00	
DRE without V-VPAT	$5,000.00	
DRE Card Activator or Programmer	$3,000.00	
DRE Disabled Devices attachment	$1,000.00	
Extended DRE Warranty Per unit Per Year	$2,000.00	
Precinct/Vote Center Level Optical Scanner	$7,000.00	
High Speed Absentee Scanner	$120,000.00	
Card Reader/Device to complete tabulation	$7,000.00	
Extended Warranty Per scanner unit Per Year	$10,000.00	
Yearly Maintenance	$108,000.00	
Ballot Programming Charges (complete)	$65,000.00	
Memory Cards or Cartridges (each)	$1,000.00	
45. 1112.4	The SOS shall take no more than three (3) business days forty-eight (48) hours to review the contract and return a decision to the corresponding jurisdiction.
45. 1112.5	The SOS shall annually review the costs in the table in section 45. 1112.3 and update it as necessary.
45. 1112.6	The SOS shall maintain on file a list of all components used and purchased for use.  The list shall include at a minimum, the name of the jurisdiction, the date of purchase, the serial number(s) of voting devices and voting systems that was purchased.
45. 1112.7	Additionally, the voting system provider shall, through the process of this rule, complete and negotiate with the SOS a purchase price agreement for counties to use when purchasing equipment in the State of Colorado.  The pricing agreement shall:
	(a)	Be valid for one year from the date of certification;
	(b)	Require renegotiations at the end of the pricing agreement period to continue future sales within the state;
	(c)	Allow counties to purchase equipment listed on the agreement at the agreed upon price for the duration or to negotiate directly with the voting system provider for a potentially lower price; and
	(d)	Be inclusive of the best costs the voting system provider is willing to sell all components, including any support, warranty or maintenance costs of the system being certified through this rule.