COLORADO SECRETARY OF STATE
8 CCR 1505-1
ELECTION RULES

Preliminary Draft of Proposed Rules

March 16, 2007

Disclaimer:  This draft is not yet final.  The proposed changes to be considered at the public rulemaking hearing may be different than the proposed changes in this draft.  This draft is submitted to the Department of Regulatory Agencies for the purpose of complying with section 24-4-103(2.5), C.R.S., which requires that a draft be submitted to the Department at the time that a notice of proposed rulemaking is filed with the Secretary of State.

A final copy of the proposed rule changes will be available to the public no later than April 26, 2007, and a copy will be posted on the Department of State’s web site, in compliance with the requirement of section 24-4-103(4)(a), C.R.S., that “[a]ny proposed rule or revised proposed rule by an agency which is to be considered at the public hearing . . . shall be made available to any person at least five days prior to said hearing.”

Proposed additions to the current rules are reflected in small caps or underlined.  Proposed deletions from current rules are shown in stricken type.   Annotations may be included.

Rule 12.3 would be amended as follows:
12.3	Notice of elections.
12.3.1	Call and notice.
(a)	Notice of the election is to be sent to the clerk and recorder of the county in which the election is to be held.  The notice is to include the date by which the list of registered electors is to be submitted to the political subdivision.
(b)	For multi-county political subdivisions, the notice sent to each clerk and recorder shall also include the names of all other counties in which the election will be held.
12.3.2	As soon as possible, but no later than 55 days prior to an election, a written plan must be submitted to the Secretary of State which includes the following:
(a)	Date of the election;
(b)	Type and name of jurisdiction involved in the election;
(c)	Description of the type of election to be conducted;
(d)	Citation of the statute or home rule charter provisions authorizing the election;
(e)	Estimated number of eligible electors;
(f)	Name of the designated election official who will be responsible for all aspects of the election;
(g)	Indication of whether the county clerk and recorder will assist in the election for the entity other than by providing a list of registered electors and other information required by statute;
(h)	Total number of “places of deposit”.  For security reasons, unmonitored freestanding places of deposit located outside will not be allowed;.
(i)	Total number of walk-in balloting locations;
(j)	Number of accessible voting machines anticipated being used for walk-in balloting locations;
(k)	Length of time accessible voting machines will be available for walk-in voting;
(il)	Written timetable for the conduct of the election in accordance with the statute;.
(jm)	Indication of how postage will be handled for ballot packets returned as undeliverable (e.g. “return postage guaranteed”);
(kn)	Indication of procedures to be followed to ensure compliance with statutes and rules, including persons responsible for each stage;
(lo)	Description of procedures to be used to ensure ballot security at all stages of the process;
(p)	Description of procedures for maintaining privacy and security of accessible machines;
(mq) Description of procedures to be used for signature verification;
(nr)	Description of procedures to ensure privacy by use of a secrecy sleeve or secrecy envelope so receiving judges cannot tell how the elector voted;.
(os)	Description of procedures to be used to reconcile ballots issued, ballots received, defective ballots and substitute ballots; and
(pt)	An actual sample of the secrecy sleeve or secrecy envelope to be used in the mail ballot election.
12.3.3		In addition to the mail ballot plan, the designated election official is also required to submit a security plan in accordance with Rule 43.
12.3.34	Written timetable specifications:
(a)	The designated election official shall prepare a written timetable for conducting the mail ballot election with specific dates or range of dates when each activity is to be completed;
(b)	The timetable shall include the following dates:
(1)	Copy of written plan to governing body;
(2)	Date of approval of election by governing body;
(3)	Date of submission of written plan to Secretary of State’s office;
(4)	Anticipated date of approval by Secretary of State;
(5)	Date of publication of notice of election;
(6)	Date of notice of election to the county clerk;
(7)	Date of notice of election to the county assessor, if property owners are eligible to vote in the election;
(8)	Date of close of registration;
(9)	Date by which the county clerk and recorder must submit the list of eligible electors to the political subdivision and, if property owners are eligible to vote in the election, the date by which the county assessor must submit the list of property owners;
(10)	Date notice will be given to voters of walk-in balloting and accessible voting options;
(110)	Date ballots will be mailed;
(121)	Date verification and counting of ballots will begin; and
(132)	Date of the election.
.
Rule 12.5 would be amended as follows:
12.5	Absentee and Early Voting.
12.5.1	Absentee voting occurs in a mail ballot election when a registered, eligible elector requests that the ballot be mailed to a place other than the address of record.
12.5.2	An “in person” request for an absentee ballot that is delivered to the elector in the clerk and recorder’s office may be filed any time after January 1 of the year of the election, but no later than the close of business on the Friday prior to the election; except that, if the applicant wishes to receive the absentee ballot by mail, the application shall be filed no later than the close of business on the seventh day before the election. 
12.5.3	Upon receipt of a request for an absentee ballot, the designated election official shall deliver the original ballot or a replacement ballot to that elector.
12.5.4	A record shall be made on the registration rolls that a request for an absentee ballot was received, a ballot was mailed to the alternate address and the ballot number shall be recorded.
12.5.5	For mail ballot elections, the notation “Absentee Ballot No. A.V.___” shall not be required on the absentee ballots.
12.5.6	Establishment of polling place for early voting shall not be required for a mail ballot election, however the location for walk-in balloting shall be maintained for the period starting two (2) days after the initial mailing of ballots through the close of polls on election day.  

Rule 12.9 would be amended as follows:
12.9	Ballots Delivered in Person.
12.9.1	If a political subdivision desires to establish a site for walk-in voting outside of the county, municipality or district, permission must be obtained from the Secretary of State.
12.9.2	Any eligible elector may deliver in person to the designated or coordinated election official’s office no more than 5 voted mail ballots from members of his or her household. 
12.9.3	The county clerk and recorder shall keep a list, to the extent possible, of the names and mailing addresses of all individuals who deliver more than five voted mail ballots to the designated or coordinated election official’s office.
12.9.4	The county clerk and recorder shall notify each individual on the list required by 12.9.3 by letter that they have violated this Rule by delivering more than five absentee ballots to the designated election official.

Rule 12.10.4 would be amended as follows:
12.10.4	The election judge issuing a replacement ballot shall indicate on the outside of the return-verification envelope whether a sworn statement must be returned with the voted ballot.  No replacement ballot shall be counted until it has been determined that an affidavit has been completed by the voter and has been received on or before election day by the election official.
New Rule 12.11 would be adopted as follows:
12.11	Surrender of Mail Ballot
	12.11.1	Any voter may surrender a mail ballot to the designated election official and vote in-person on the accessible device provided for the election as required by 1-5-705 C.R.S.
	12.11.2	The election judge receiving the surrendered ballot shall indicate on the outside envelope that the ballot issued is cancelled.  The voters’ record shall be updated with the same vote credit as assigned to voters who returned ballots by mail.
	12.11.3	Any accessible device used for the purposes under this rule shall be handled with the same privacy, security and accuracy concerns as required pursuant to the Secretary of State Rules and Title 1 C.R.S.  

Rule 12.11 would be amended as follows:
12.112	Verification of Replacement Ballots 
12.112.1	Upon issuance of a replacement ballot, the first voted ballot returned by the elector shall be considered the elector’s official ballot, pursuant to section 1‑8‑111(3), C.R.S.
12.1112.2	If a return verification envelope is submitted which contains a replacement ballot it shall be set aside until 7:00 p.m. on election day.  If it can be determined that the replacement ballot is the only ballot issued to the elector or that all prior ballots issued to the elector have been voided, it may be processed in the same manner as the original ballot.
12.1112.3	The information on the return verification envelope may be checked prior to 7:00 p.m. on election day, but the ballot may not be removed until the polls close.
12.1112.4	When all voted ballots have been received and the polls closed, the replacement ballots shall be checked to ensure that the elector only voted with the replacement ballot.  If it appears that the elector only voted the replacement ballot and if all the information is complete on the return verification envelope, the ballot may be removed and counted as the other ballots.

Rule 12.12 would be amended as follows:
12.1213	Judges Duties.
12.1213.1	The judges shall record the results of the election on the judges’ certificate and statement.
12.1213.2	The judges shall deliver the results of the election to the designated election official along with all election materials.
12.1213.3	The judges shall deliver all election materials bound separately as follows:
(a)	Ballots which were counted;
(b)	Ballots which were defective, as defined in 1-7-309(4);
(c)	Additional ballot pages returned after the voter cast his/her ballot that were appropriately marked and not counted in accordance with rule 12.4.1;
(d)	Ballots/verification return envelopes which may be challenged;
(e)	Verification Return envelopes with ballots removed;
(f)	Defective verification return envelopes with ballots inside;
(g)	Ballot packets which were returned as undeliverable.

Succeeding subsections of Rule 12 would be renumbered accordingly.

Rule 14.6 would be amended as follows:
14.6	Counting of Optical Scan Ballots - Recount
14.6.1	All optical scan tabulation machines voting equipment to be used in the recount must be tested prior to the recount, utilizing the procedures set forth in this section.  Prior to the recount, the canvass board shall choose at random and test Voting Devices and precinct(s) to be utilized as a test deck for purposes of section 1-10.5-102.  The purpose of a test deck is to assure the tabulation machines are counting properly.  The precinct devices chosen shall contain at least 50 5 ballots.  A hand tally shall be conducted of the selected devices pursuant to 1-10.5-102(3)(a)precinct or of a minimum of fifty ballots contained within the selected precinct.  A blank prom cartridge, rom cartridge, or memory card shall be utilized for the test deck.  The ballots from the selected precinct test deck shall be processed through all scan tabulation machines that will be utilized for the recount.  The totals of the recounted contest obtained from the test precinct devices and precinct(s) reports from close of polls shall be compared to the hand-tallied total.
14.6.2	The canvass board shall choose at random five percent (5%) of voting devices containing votes from the election, which are affected by the recount, for the test.
	(a)	Prior to the start of the test, the canvass board shall verify that devices randomly chosen were not used in the audit conducted pursuant to 1-7-514 (1)(b).
	(b)	The proportion of Optical Scan devices to DRE/Electronic voting devices selected for the test shall match the proportion of machines used in the election by the designated election official.
	(c)	At least one device selected for the test shall be a central count/absentee ballot scanner.
14.6.3	For testing central count/absentee scanners the canvass board shall randomly select one percent (1%) or 300 ballots, whichever is greatest.  A blank prom cartridge, rom cartridge or memory card shall be utilized for the test.  The ballots selected shall be processed through the central count/absentee scanner and compared to the hand-tallied total.
14.6.24	If the test deck precinct totals differ from the hand count totals, and the discrepancy cannot be accounted for by voter error, all ballots containing the recounted contest shall be tallied by hand following procedures for paper ballot recounts.  If the test deck precinct totals are exactly the same, the recount tabulation shall be conducted by machines.

Succeeding subsections of Rule 14.6 would be renumbered accordingly.

Rule 14.7 would be amended as follows:
14.7	Counting of Ballots Using the “Ballot Now” Voting System
14.7.1	In the case of a recount, the designated election official shall identify all precincts with the contest(s) designated for a recount using the following procedures:
(a)	Using the Ballot Now Scanned Ballots by Precinct report from the original election database, locate the batches containing any ballot type (Election, Absentee, and Provisional) for the recount.
(b)	Remove ballots from each batch and label them as “Recount”.
14.7.2	Required scanner testing shall be performed using a test deck from aat least three (3) randomly chosen precinct(s) with at least 50 150 ballots total as prescribed by statute, following testing procedures outlined in the State of Colorado Procedures for the use of the Ballot Now Voting System.  A Recount Test spreadsheet shall be created based on the chosen precinct in the same fashion as the ballot options test spreadsheet.	
.
Rule 32.2 would be amended as follows:
32.2  Signature requirements
	32.2.1	For petitions to recall school district directors the petition must be signed by the eligible electors of the school director’s district equal in number to at least 40% of the ballots cast in the district in the last preceding election at which the director to be recalled was elected as indicated by the pollbook or abstract for the election. See section 1-12-105, C.R.S.

32.2.2   When determining the number of required valid signatures for an elected office for which electors were allowed to vote for more than one candidate in a single race, the signature requirements shall be based on the number of ballots cast for that race as indicated by the pollbook or abstract for the election.

Rule 43 would be amended as follows:
Rule 43.  County Security Procedures
43.1	Definitions
	43.1.1	“Chain of custody log” shall, for the purposes of this rule mean a written record that shows that the equipment and all associated data is secure from the time the equipment is deemed ready for the election through the time the results of the election are officially certified.
	43.1.2	“Continuous recording” shall mean monitoring by a device which continuously samples the regulated parameter without interruption, evaluates the detector response at least once every 15 seconds, and computes and records the average value at least every 60 seconds, except during allowable periods of calibration.
	43.1.3	“Employee” shall, for the purposes of this rule, mean all full-time, part-time, permanent and employees of the county who have had a criminal history check conducted in accordance with Rule 11.2 and are deputized by the county clerk and recorder to prepare or maintain the voting system or election setup materials, staff the counting center and who have any access to the electromechanical voting systems or electronic vote tabulating equipment.
	43.1.4	“Removable” card or cartridge shall, for the purposes of this rule, mean all programming cards or cartridges except activation cards,  that store firmware, software or data.
43.12	Pursuant to section 1-5-616(5), C.R.S., each county shall file with the Secretary of State security procedures that meet the minimum standards set forth in this rule. 
43.23	The county shall file security procedures annually no later than sixty (60) days prior to the first election in which the procedures will be used.  
43.34	If no changes have occurred since the last security procedures filed, the county shall file a statement to that effect.
43.45	Revisions to previously filed security procedures shall clearly state which part of the procedures previously filed have been revised. 
43.56	Each designated election official may change the security procedures within sixty (60) days of an election as a result of an emergency situation or other unforeseen circumstance, and document any changes.  The designated election official shall file any revisions with the Secretary of State within five (5) days of the change.
43.67	If, pursuant to section 1-5-616(5)(b), C.R.S., the Secretary of State is unable to complete its review, the procedures or revisions shall be temporarily approved until such time as the review is completed.  The secretary of state shall notify the county of temporary approval. 
43.78	Security Procedures shall at a minimum include, if applicable:
43.8.1	General Requirements:

a.	At all times V-VPAT records shall be handled in a secure manner similar to the handling of paper ballots.  When not sealed in voting machines, all removable cards and cartridges shall be transferred in secure containers with at least two tamper-evident seals with printed serial numbers, and the integrity and serial number of each seal shall be verified by election officials at shipping and receiving locations.

b.	All documentation of seals, chain of custody, and other documents related to the transfer of equipment between parties shall be maintained on file by the Clerk and Recorder and is subject to inspection by the Secretary of State.

c.	The chain of custody for each voting device must be maintained and documented throughout ownership or leasing of the device by the Clerk and Recorder.

d.	Only deputized clerks, judges, or canvass board members sworn under oath are allowed to handle ballots, which include V-VPAT records.

e.	No additional or modified software developed by the Vendor that is not specifically listed on the Secretary of State’s certificate shall be installed on any component of the voting system.

f.	Any form containing “date” means to note the month, calendar day, year, hour, minute, and whether the time is a.m. or p.m.
43.8.2.	Physical Locking Mechanisms and Seals

a.	DREs – all Direct Record Electronic Voting devices shall have tamper-evident seals with printed, unique serial numbers affixed as follows:

			i.	A seal is to be placed over any removable card or cartridge that is inserted into the unit, or over the door covering the card.

			ii.	A seal is to be placed over any removable card or cartridge slot when no card or cartridge is inserted into the unit.

			iii.	Tamper-evident, numbered seals shall be affixed across the seam at which the two sides of the exterior case of the voting unit join, with at least one seal for each of the four sides of the device.

			iv.	If the voting device contains one or more slots for a flash memory card, a seal shall be affixed over each flash card or each flash card slot, door, or access panel.

			v.	These same procedures also apply to the Judge’s Booth Controller (JBC) unit for the Hart InterCivic System.

			vi.	All seals are to be verified by two elections officials.

b.	V-VPATs – all V-VPAT units shall be sealed upon verification of no votes being cast on the paper record prior to being attached to a specific voting device.  Seals must be verified by at least two election officials prior to the start of voting, and at the close of voting.  V-VPAT records shall either remain in the V-VPAT canister, or be sealed and secured in a suitable device for protecting privacy or as described in Election Rule 11.

c.	Remote or Central-count Optical Scanners – Optical scanners used in a remote or central tabulating location shall have tamper-evident seals as follows:

			i.	A seal is to be placed over each card or cartridge inserted into the unit, or over any door containing the card or cartridge.

			ii.	A seal is to be placed over each empty card or cartridge slot.

iii. 	All seals are to be verified by two elections officials.

d.	Memory Cards/Cartridges – Each removable card or cartridge shall have a permanent serial number assigned and securely affixed to it.

e.	The Clerk and recorder shall maintain a written or electronic log that records which card or cartridge and which seal number is assigned to each voting unit.  Any breach of control over a card/cartridge or door or slot for a card/cartridge before an election shall require that the County Clerk be notified and follow the procedures specific to the incident as described in Section 10 of these security requirements.
43.8.3	Individuals With Access to Keys, Door Codes, and Vault Combinations

43.8.3.1	Counties are required to state the positions and dates of CBI background check for employees with access to the following areas.    

43.8.3.2	For all counties, use of keypad door codes or locks, vault combinations, computer and server passwords, encryption key codes, and administrator passwords shall be changed at least once per calendar year prior to the first election of the year.  Only county employees may be given access to such codes, combinations, passwords, and encryption keys, pursuant to the following limitations.  Counties may request from the Secretary of State variance with the following requirements only in extreme circumstances.

43.8.3.3	The requirements for a county employee to be given access to a code, combination, password, or encryption key are as follows:

a. 	Access to the storage area for voting equipment, the counting room or tabulation workstations,  the absentee ballot storage and counting areas, and the election programming workstations shall be restricted to county employees as defined in Rule 43.1.3.

b.	Except for emergency personnel, no other individuals shall be present in these locations unless supervised by one or more county employees.

iv.	Each individual who has access to the central election management system or central tabulator shall have their own unique username and password.  No individual shall use any other individual’s username or password.  Shared accounts shall be prohibited.

vi.	The county shall maintain a log of each person who enters the ballot storage room, including the person’s name, signature, and date and time of entry.  If access to the ballot storage room is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.	 
43.8.4	Temperature-controlled Storage

43.8.4.1	Counties are required to attest that the temperature-control settings used with the following components of a voting system.  Information submitted to the Secretary of State shall indicate the specifics for each type of component, as well as the specific environment used, which may include, but is not limited to controlled offices, controlled vaults, and controlled warehouses.  The settings for temperature control must be at least the following:

a.	Servers and Workstations – Servers and workstations shall be maintained in a temperature-controlled environment.  Maximum temperature shall at no time exceed 90 degrees fahrenheit.

b.	DREs – DREs shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 60 degrees fahrenheit and a maximum of 90 degrees fahrenheit.

c.	Optical Scanners – Scanners shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 50 degrees fahrenheit and a maximum of 90 degrees fahrenheit.

d.	V-VPAT Records – In addition to the requirements set forth in SOS Rule 11, V-VPAT records shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 50 degrees fahrenheit and a maximum of 80 degrees fahrenheit.  V-VPAT records shall also be maintained in a dry environment, with storage at least 4 inches above the finished floor, for a period of 25 months following the election.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  V-VPAT records shall be stored in a manner that prevents exposure to light, except as necessary during recounts and audits.

e.	Paper Ballots – Paper ballots shall be maintained in a dry, humidity-controlled environment.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  Additionally, paper ballots shall be stored at least 4 inches above the finished floor, for a period of twenty-five (25) months following the election.

f.	Video Data Records – Video data records shall be maintained in a dry, temperature-controlled environment.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  Temperature settings shall be maintained at a minimum of 40 degrees fahrenheit and a maximum of 80 degrees fahrenheit.  Additionally, video data records shall be stored at least 4 inches above the finished floor, for a period of twenty-five (25) months following the election.
43.8.5	Security Cameras or Other Surveillance

43.8.5.1	Unless otherwise instructed, continuous security camera recordings of specified areas shall be made beginning at least 60 days prior to the election and continuing through at least 30 days after the election, unless there is a recount or contest.  If a recount or contest occurs, the recording shall continue through the conclusion of all such activity.  The following are the specific minimum requirements: 

a.	Counties over 50,000 registered voters shall make continuous security camera recordings of the following areas:
  
i.	All areas in which election software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.

ii.	Continuous security camera shall be made of all areas used for processing absentee ballots, including but not limited to areas used for Signature Verification, tabulation, or storage of voted ballots beginning at least 35 days prior to the election and continuing through at least 30 days after the election, unless there is a recount or contest.  If a recount or contest occurs, the recording shall continue through the conclusion of all such activity..

iii.	The storage area for all voting equipment.

b.   Counties under 50,000 registered voters shall make continuous security camera recordings of the following areas:
		
i.	All areas in which election software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.

43.8.6.	Equipment Maintenance Procedures

43.8.6.1	In addition to the requirements for voting systems specified in Election Rule 11, the following minimum standards shall be adhered to:

a.	All equipment shall be stored throughout the year with serially-numbered, tamper-evident seals over the memory card slots for each device.  The county shall maintain a log of the seals used for each device consistent to the logs used for tracking Election Day seals.

	b.	For equipment being sent to the vendor for offsite repairs/replacements, the county must maintain a log file for the device that shall contain the following:  the model number, serial number, and the type of device; the firmware version; the software version (as applicable); date of submission to the vendor.

c.	For equipment receiving maintenance on-site by the vendor, the county shall verify that a CBI background check has been conducted on all vendor personnel with access to any component of the voting system.  CBI information shall be updated and maintained on file annually.  Additionally, the vendor’s representative shall be escorted at all times by a county employee while on-site.  At no time shall the voting system vendor have access to any component of the voting system without supervision by a county employee.

d.	Upon completion of any maintenance, the county shall conduct a full acceptance test of equipment that shall, at a minimum, include the Hardware Diagnostics test, as indicated in Rule 11, and conduct a mock election in which a county election official shall cast a minimum of ten (10) ballots on the device to ensure tabulation of votes is working correctly.  All documentation of results of the acceptance testing shall be maintained on file with the specific device.

e.	The Secretary of State shall be required to inspect the counties’ maintenance records on a randomly selected 1% of all voting devices in possession of the counties throughout the state in even years, and to inspect the maintenance records on a randomly selected 5% of all voting devices in possession of the counties throughout the state in odd years.
43.8.7.	Transportation of Equipment, Ballot Boxes, and Ballots

43.8.7.1	Counties are required to submit detailed plans to the Secretary of State prior to an election regarding the transportation of equipment and ballots both to remote voting sites and back to the central elections office or storage facility.  While this may be handled in a multitude of methods, the following standards shall be followed when transporting voting equipment to the voting location:

a.	Transportation by County Personnel – County personnel shall at all times display a badge or other identification provided by the County.  Two signatures and date of county personnel shall be required at the departure location verifying that the equipment, including memory card or cartridge, is sealed to prevent tampering.  Upon delivery of equipment, at least two county elections personnel or Election Judges shall verify that all seals are intact and that the serial numbers on the seals agree with those on the seal-tracking log, and sign and date the seal-tracking log.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
  
b.	Transportation by Election Judges – Election Judges that are receiving equipment from county personnel shall inspect all components of voting devices and verify the specific numbers by signature and date on the seal-tracking log for the device.  The Election Judge receiving the equipment shall request two judges at the voting location to inspect the devices and to sign and date the seal-tracking log indicating that all seals are intact and that the serial numbers on the seals agree with those on the seal-tracking log.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in Section 10 of these security requirements.

c.	Transportation by Contract – Counties electing to contract the delivery of equipment to remote voting locations shall perform CBI background checks on the specific individuals who will be delivering the equipment.  Two county personnel or judges shall verify, sign, and date the seal-tracking log upon release of the equipment and two other county personnel or judges shall verify, sign, and date the seal-tracking log upon acceptance of the equipment at the delivery point.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.

43.8.7.2	The following standards shall be followed when transporting voting equipment from the voting location:

a.	If memory cards or cartridges are to be removed from voting devices at remote voting locations, the following procedures are to be followed:

i.	Before removing a memory card or cartridge, two judges shall inspect and verify that all seals on the device are intact and that the serial numbers on the seals agree with those listed on the seal-tracking log.  Both judges shall sign and date the seal-tracking log prior to breaking the seal.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in Section 10 of these security requirements.

ii.	Judges shall place the cards or cartridges in a sealable transfer case that shall be sealed with two seals.  Additional seal logs shall be maintained for the transfer case of the memory cards or cartridges.

iii.	Election judges shall place new seals over the empty memory card/cartridge slot and/or door and document the seal numbers used.

iv.	At least two county employees or judges shall accompany the transfer case containing the memory card/cartridge to the drop off location. Seal integrity and serial numbers will be verified, and logs will be signed and dated by county election officials receiving the equipment.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this rule.

v.	County personnel or election judges transporting secured voting equipment must maintain chain of custody logs and seal-tracking logs.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this rule.

b.	If devices are to be delivered with memory cards/cartridges intact, the following procedures shall be followed:

i.	Two county employees or election judges shall verify that all seals are intact at the close of polls.  Judges will sign the seal-tracking log with such indication.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this rule.

ii.	At least two county employees or judges shall accompany the secured equipment to the drop-off location.  Seals will be verified, and logs will be signed and dated by the county election official receiving the equipment.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the County Clerk who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule. 

iii.	Upon confirmation that the seals are intact and bear the correct numbers, the memory card or cartridge shall be removed and uploaded into the central count system.

iv.	Election officials shall secure the equipment by placing a tamper-evident seal over the memory card slot and by updating the documentation to reflect the new seal numbers.
43.8.8.	Emergency Contingency Plans for Voting Equipment and Voting Locations

43.8.8.1	All remote devices used in an election shall have sufficient battery backup for at least two (2) hours of use.  If this requirement is met by reliance on the internal battery of the voting device, then the clerk and recorder shall verify that all batteries are fully charged and in working order prior to the opening of polls at the voting location.  This requirement also can be met with the purchase of third-party battery backup systems.

43.8.8.2	In the event of a serious or catastrophic equipment failure or equipment being removed from service at one or more polling locations, or there is not adequate backup equipment to meet the requirements of Section 1-5-501, the county clerk shall contact the Secretary of State for authorization to use provisional ballots or absentee ballots as an emergency voting method .
43.8.9.	Internal Controls for the Voting System

43.8.9.1	In addition to the access controls discussed in section 43.8.3 of this Rule, counties are required to change all passwords and limit access to the following areas:

a.	Software – All software passwords shall be changed once per calendar year prior to the first election.  This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.

b.	Hardware – All hardware passwords shall be changed once per calendar year prior to the first election.  This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.

c.	Password Management –Access to passwords for all components of the of the election software and hardware shall be limited to two (2) county employees.  An additional ten (10) people may have access to the administrative passwords for the software components and an additional ten (10) people may have access to the administrative passwords for the hardware components of the voting system.

d. 	Internet Access – At no time shall any component of the voting system be connected, directly or indirectly, to the Internet.  

e.	Modem Transmission -- At no time shall any component of the voting system be connected to another device except for the vote tally software, directly or indirectly, by modem. 

f.	Remote sites may use modem functions of optical scanners and DREs only for the purpose of transmitting unofficial results, as permitted by the Secretary of State’s certification documents for the specific systems.  Counties using modem devices to transmit results shall meet the following requirements:

i.	Transmissions may be used only for sending testing data or unofficial results; after all other steps have been taken to close the polls.  All summary tapes should be printed before connecting any of the machines to a modem or telephone line.

ii.	Modems cannot be used for any programming, setup, or individual ballot-casting transmissions.

iii.	The receiving telephone number for the modem transmission shall be changed at least once per calendar year prior to the first election.

iv.	A maximum of six (6) county employees shall be made aware of the telephone number receiving the transmission.  Counties shall not publish or print the telephone number for any election judge.  To the extent possible, the telephone number shall be programmed into the device and used by the device in a way that is hidden from election judges and voters from seeing the display of the number at any time.

g.	Authorized County Personnel - Counties are required to include in their security plans the positions and dates of CBI background checks for employees with access to any of the above areas or equipment.  Each county shall maintain a storage-facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained.  If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.
43.8.10.	Security Training for Election Judges

43.8.10.1	Counties are required to include the details of their security training for their election judges, which shall include the anticipated time of training, location of training, and number of judges receiving the security training, as it applies to the following requirements:

a.	The county shall conduct a separate training module for field technicians and election judges who will be responsible for overseeing the transportation and use of the voting systems, picking up supplies, and troubleshooting device problems throughout the Election Day.

b.  Security training shall include the following components:

i.	Proper application and verification of seals and seal-tracking logs;

ii.	How to detect tampering with voting equipment, memory cards/cartridges, or election data on the part of anyone coming in contact with voting equipment, including county personnel, other election judges, vendor personnel, or voters;

iii.	Ensuring privacy in voting booths;

iv.	The nature of and reasons for the steps taken to mitigate the security vulnerabilities of DREs;

v.	V-VPAT requirements;

vi.	Chain-of-custody requirements for voting equipment, memory cards/cartridges, and other election materials;

vii.	Ballot security;

viii. Voter anonymity.
43.8.11.	Remedies 

43.8.11.1	If it is detected that the seal has been broken or if there is a discrepancy between the log and the serial number of either a voting device, or a memory card or cartridge, the condition must be confirmed by one or more of the remaining election judges for the location.  The judges shall immediately notify the County Clerk, who shall investigate and follow the appropriate remedy as indicated in this rule.
  
43.8.11.2	Any unit involved must undergo the reinstatement of the trusted build.  Specific requirements on the remedy are as follows:

a.	If the evidence is prior to the start of voting:

i.  The device shall be sealed and securely delivered to the Clerk and Recorder.

ii.  If the seal is not over the memory card, the Clerk and Recorder shall reset the machine to pre-election mode, conduct hardware diagnostics testing as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots for counties with less than 50,000 registered voters, 50 ballots for counties with more than 50,000 registered voters on the device.  The totals from the device shall be verified through the uploading process and determined to be accurate.

iii.  If the seal is over the memory card, the Clerk and Recorder shall remove the memory card, and insert a secured memory card into the device.  The Clerk and Recorder shall conduct a hardware diagnostics test as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots for counties with less than 50,000 registered voters, 50 ballots for counties with more than 50,000 registered voters on the device.  The totals from the device shall be verified through the uploading process and determined to be accurate.

iv.  Complete the necessary seal process and documentation to establish the chain of custody for the device and memory card.
v.  Set the machine to election mode ready for a zero report.

vi.  At the conclusion of the election a full (all races) post-election audit shall be conducted on the device and results reported to the Secretary of State as required by Rule 11.  This requirement is in addition to the random selection conducted by the Secretary of State.

vii.  Complete necessary reports for the Secretary of State regarding the incident.

b.	If the evidence is after votes have been cast on the device but before the close of polls:

i.  The device shall be sealed and securely delivered to the Clerk and Recorder.

ii.  The Clerk and Recorder shall close the election on that device, and perform a complete manual verification of the paper ballots (or V-VPAT Records) to the summary tape printed on the device that represents the record of votes on the memory card. 

iii.  If the totals do not match then only the paper record will be accepted in the official results for that device, and the device shall be re-sealed, secured and reported to the Secretary of State immediately - the device can no longer be used in the remainder of the election until the firmware and/or software have been reformatted with the trusted build.
iv.  If the totals match, the memory card may be uploaded into the tally software at the close of polls.  
	
v.  After verifying the totals, the paper records and memory card shall be secured with seals and documented properly.

vi.  A new secured memory card shall be placed in the device.  The Clerk and Recorder shall conduct a hardware diagnostics test as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots for counties with less than 50,000 registered voters, 50 ballots for counties with more than 50,000 registered voters on the device.  The totals from the device shall be verified through the uploading process and determined to be accurate. 

vii.  Complete the necessary seal process and documentation to establish the chain of custody for the device and memory card.

viii.  Set the machine to election mode ready for a zero report.
ix.  At the conclusion of the election a full (all races) post-election audit shall be conducted on the device and results reported to the Secretary of State as required by Rule 11.  This requirement is in addition to the random selection conducted by the Secretary of State.

x.  Complete necessary reports for the Secretary of State regarding the incident.
	
c.	If the evidence is after the close of polls:

i.  The device shall be sealed and securely delivered to the Clerk and Recorder.

ii.  The Clerk and Recorder shall perform a complete manual verification of the paper ballots (or V-VPAT Records) to the summary tape printed on the device that represents the record of votes on the memory card. 

iii.  If the totals do not match then only the paper record will be accepted in the official results for that device, and the device shall be re-sealed, secured and reported to the Secretary of State immediately - the device can no longer be used until the firmware and/or software have been reformatted with the trusted build.

iv.  If the totals match, the memory card may be uploaded into the tally software at the close of polls.  	

v.  After verifying the totals, the paper records and memory card shall be secured with seals and documented properly.

vi.  Complete the necessary seal process and documentation to establish the chain of custody for the device.

vii.  During the canvass process, a full (all races) post-election audit shall be conducted on the device and results reported to the Secretary of State as required by Rule 11.  This requirement is in addition to the random selection conducted by the Secretary of State.

viii.  Complete necessary reports for the Secretary of State regarding the incident.

43.8.11.3	Prior to the submission of certified results from the county, the county clerk and recorder will provide a written report to the Secretary of State addressing the existence or absence of any security issues related to the implementation and operation of the voting system.  All county documentation related to the voting system shall be available for inspection by the office of the Secretary of State for all devices used in the election.
    43.8.12.	Any additional physical security procedures not discussed in these mandatory procedures shall be submitted to the Secretary of State for approval prior to the election.
43.7.1	The physical security of election equipment, software and firmware, election materials, polling places and counting centers, and equipment storage locations, including but not limited to:
(a)	Locking mechanisms and seals;
(b)	Individuals with Access to keys, door codes, vault combinations;
(c)	Temperature control (if necessary);
(d)	Security cameras or other surveillance;
(e)	Equipment maintenance procedures (See rule 11);
(f)	Transportation of equipment, ballot boxes, and ballots on election day;
(g)	Emergency contingency plans for equipment and polling places; 
(h)	Any other procedures used to maintain physical security;
(i)	Internal controls for the voting system including software and hardware access controls and password management; and
(j)	Security Training for election judges.
43.89	The designated election official shall submit with the security plan sample copies of maintain a file containing all referenced forms, schedules, logs, and checklists.  The Secretary of State has the authority to inspect the file.
43.910	Included in the security procedures filed with the secretary of state shall be a section entitled “contingency plan.”  The contingency plan shall include:
(a)	Evacuation procedures for emergency situations including fire, bomb threat, civil unrest, and any other emergency situations identified by the designated election official;
(b)	Back up plans for emergency situations including fire, severe weather, bomb threat, civil unrest, electrical blackout, equipment failure, and any other emergency situations identified by the designated election official;
(c)	An emergency checklist for election judges; and
(d)	A list of emergency contact numbers provided to election judges.
43.10.11	Computer room access shall be limited to authorized personnel only, and the delivery of ballots between the preparation room and computer room shall be performed by messengers or runners wearing distinguishing identification.