Preliminary Draft of Proposed Rules

Office of the Colorado Secretary of State
Election Rules
8 CCR 1505-1

June 12, 2014

Disclaimer:
In accordance with the State Administrative Procedure Act, this draft is filed with the Secretary of State and submitted to the Department of Regulatory Agencies.
This is a preliminary draft of the proposed rules that may be revised before the July 17, 2014 rulemaking hearing. If changes are made, a revised copy of the proposed rules will be available to the public and a copy will be posted on the Department of State’s website no later than July 11, 2014.
Please note the following formatting key:
Font effect	Meaning	
Sentence case	Retained/modified current rule language	
Small caps	New language	
Strikethrough	Deletions	
Italic blue font text	Annotations	

Amendments to Rule 20.1:
20.1	The county clerk must submit its annual security plan on the form prescribed by the Secretary of State in accordance with section 1-5-616(5), C.R.S.  A county must also submit a comprehensive procedure for ballot delivery in an emergency under section 1-7.5-115(1), C.R.S.
Amendments to Rule 20.2.2, regarding general requirements concerning chain-of-custody:
20.2.2	The county must maintain and document the uninterrupted chain-of-custody for each voting device from the installation of trusted build to the present, throughout the county’s ownership or leasing of the device. For optical scanners approved for use under section 1-5-613(2), C.R.S. but for which no trusted build exists, the county must maintain and document uninterrupted chain-of-custody for each voting device from the successful completion of acceptance testing conducted according to Rule 20.8.4.
Amendments to Rule 20.3.1(e), regarding physical locking mechanisms and seals for DREs and ballot marking devices:
(e)	These same procedures also apply to the Judge’s Booth Controller (JBC) unit for the Hart InterCivic System. In each voter service and polling center, the county must provide a minimum of one accessible DRE with a headset that has adjustable volume control.
Amendments to Rule 20.4:
20.4	Individuals with access to keys, door codes, and vault combinations.
20.4.1	For employees with access to areas addressed in Rule 20.4.3, the county must state in the security plan each employee’s title and the date of the the criminal background check performed under Rule 6.5. [Section 24-72-305.6, C.R.S.]
Amendments to Rule 20.5.2, regarding internal controls for the Voting System:
20.5.2	In addition to the access controls discussed in Rule 20.4, the county must change all passwords and limit access to the following areas:
(a)	Software. The county must change all software passwords once per calendar year prior to the first election. This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
(b)	Hardware. The county must change all hardware passwords once per calendar year prior to the first election. This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
(c)	Password Management The county must limit access to the administrative passwords to the election management software to two employees. The county must limit access to passwords for all components of the election software and hardware to two employees. The county may provide an additional ten employees with access to the administrative passwords for the software components, and an additional ten employees with access to the administrative passwords for the hardware components of the voting system. The voting system provider may not have an administrative or application user/operator account, or administrative account access to the account.
(c)	Administrative and user accounts for election management system and election databases.
(1)	The county may use the administrative user account only to create individual user accounts for each election database.
(2)	The county must create individual user accounts that are associated and identified with each individual authorized user of the election management system or election database. 
(3)	The county must restrict access to each individual user account with a unique password known only to each individual user. Authorized users must access the election management system and election database using his or her individual user account and unique password.
(4)	The county may grant administrative privileges to no more than ten individual user accounts per election.
(d)	Other than for the purpose of programming the election, the voting system provider may not have administrative or user access to the county’s election management system.
(d) (e)	Internet Access. The county must never may not connect or allow a connection of any voting system component to the Internet.
(f)	If the election management system workstation is equipped with Wi-Fi capability or a wireless device, the county must disable the wireless device.
(e) (g)	Modem Transmission. The county must never may not connect any component of the voting system to another device by modem except for the vote tally software.
(f)	Remote voter service and polling centers. At remote voter service and polling centers, the county may use modem functions of optical scanners and DREs only for the purpose of transmitting unofficial results.
(g) (h)	Authorized Employees. The county must include in its security plan each employee’s the title and the date of background checks for employees each employee with access to any of the areas or equipment set forth in this Rule. Each The county must maintain a storage facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained. If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log must meet the requirements of this Rule. [Section 24-72-305.6, C.R.S.]
Amendments to Rules 20.8.4 and 20.8.5, regarding equipment maintenance procedures:
20.8.4	Upon completion of any maintenance, the county must verify or reinstate the trusted build and conduct a full acceptance test of equipment that must, at a minimum, include the hardware diagnostics test, as indicated in Rule 11, and conduct a mock election in which an employee(s) must cast a minimum of five ballots on the device to ensure tabulation of votes is working correctly. The county must maintain all documentation of the results of the acceptance testing on file with the specific device.
20.8.5	The Secretary of State will annually inspect county maintenance and chain-of-custody records and verify the integrity of trusted build installation on a randomly selected basis.
Amendments to Rule 20.9.3(d):
(D) (d)	If a seal is broken or chain-of-custody cannot be verified is unverifiable, the county clerk must investigate, document his or her findings, and report the incident to the Secretary of State, as appropriate.
New Rule 20.11.1(d), regarding VVPAT security:
(d)	If the VVPAT is external, the county must secure the connection between the VVPAT and the DRE with tamper-evident seals, and must maintain chain-of-custody logs.
Amendments to Rule 20.11.2:
20.11.2	Anonymity. The designated election official must implement measures to protect the anonymity of voters choosing to vote on DREs.
(a)	Measures to protect anonymity include:
(1)	The county may not keep any record indicating the order in which people voted on the DRE, or which VVPAT record is associated with the voter.
(2)	When more than one DRE is available at a voting location, the county must, to the extent practicable, allow the voter must be given the choice as to which to choose the DRE they would like he or she wishes to vote on, to the extent practicable.
(b)	The county clerk must remove the date/time stamp from any report or export generated from an electronic pollbook. The county clerk may not use this field as a sort method. The county clerk must randomly assign any Record ID, Key ID, or Serial Number stored in the database of votes. The county clerk may not release a report generated from SCORE that includes a date and time stamp that could potentially identify a voter who cast a specific ballot.
(c)	At no time may an election official simultaneously access a VVPAT and the list of voters. Examination of If the VVPAT record requires inspection, at least two election officials must be performed by at least two election officials conduct the examination.
(d)	The county must arrange voter service and polling center DREs in a manner that prevents election officials and other voters from observing how a DRE voter casts his or her ballot.
Repeal of Rule 20.11.3(c), regarding VVPAT storage:
(c)	A master catalog must be maintained for the election containing the complete total number of VVPAT spools used in the election.
New Rule 20.17:
20.17	Voting system conditions for use
20.17.1	The county must use the voting system only on a closed network as defined in Rule 21.1.6 or in a standalone fashion.
20.17.2	Access logs.
(a)	In addition to the audit logs generated by the election management system, the county must maintain access logs that record the following:
(1)	The date, time, and user’s name for each instance that a user enters or exits the system or the system’s report printing functions; and
(2)	Modifications to the system’s hardware, including insertion or removal of removable storage media, as defined in Rule 21.1.15, or changes to hardware drivers.
(b)	The county may create and maintain the access logs in the manner the county deems most suitable, including key stroke recording software, video surveillance recordings, manually or electronically written records, or a combination of these methods.
20.17.3	The county must create a backup copy of the election setup records on a read-only, write-once CD, immediately after completing the Logic and Accuracy Test.
(a)	The county must identify the master database name and date of election on the label of the backup cd.
(b)	The county must store the backup CD in a sealed container. Two election officials of different party affiliations must sign and date entries to the chain-of-custody log for the sealed container.
20.17.4	DREs.
(a)	The county’s election judges must:
(1)	Test the VVPAT printer immediately after changing the VVPAT paper; and
(2)	Lock and re-seal the VVPAT canister, and make appropriate entries on the VVPAT chain-of-custody log, before voting resumes on the DRE.
(b)	At least one DRE in each voter service and polling center must have or be connected to an uninterruptible power supply sufficient to sustain continuous operation for a minimum of two hours in the event of power loss.
(c)	The county must maintain logs indicating administrator function use.
20.17.5	Optical scanners as defined in Rule 21.1.13:
(a)	When issuing ballots, the county must provide in-person voters with a secrecy sleeve sufficient to conceal a voter’s marked ballot from others in the polling location, including election officials.
(b)	The county must record the optical scanner serial number on all chain-of-custody logs and reports generated by the device.
(c)	Each optical scanner must have or be connected to an uninterruptible power supplies sufficient to sustain continuous operation for a minimum of two hours in the event of power loss.
(d)	The county must maintain logs indicating administrator function use.
(e)	The county must program each optical scanner to permit an election judge to override rejection of overvoted ballots that cannot be duplicated in accordance with Rule 18.
20.18	ES&S voting system conditions
20.18.1	If the county must provide language minority assistance under section 203 of the Voting Rights Act (42 U.S.C. §§ 1973 to 1973bb-1), it may not use an ES&S voting System.
20.18.2	DREs. The county may only use the nine inch screen on the VVPAT.
20.18.3	For optical scanners with a zip disk drive, the county must save the cast vote records for each batch of tabulated ballots to a zip disk.
20.19	Hart DRE conditions. If a county shortens a lengthy candidate name on the VVPAT, it must provide printed notice of the change to voters at the voter service and polling center.
20.20	Sequoia DRE conditions
20.20.1	The county must add clarifying text to the display screen during the VVPAT review process that instructs the voter to review his or her ballot choices.
20.20.2	The county must lock the activate button to prevent its use during an election.
20.20.3	A county may not modify the screen display using an override.ini file without approval from the Secretary of State.