Preliminary Draft of Proposed Rules

Office of the Colorado Secretary of State
Election Rules
8 CCR 1505-1

June 29, 2018

Disclaimer:
In accordance with the State Administrative Procedure Act, this draft is filed with the Secretary of State and submitted to the Department of Regulatory Agencies.
This is a preliminary draft of the proposed rules that may be revised before the August 8, 2018 rulemaking hearing. If changes are made, a revised copy of the proposed rules will be available to the public and a copy will be posted on the Department of State’s website no later than August 3, 2018.
Please note the following formatting key:
Font effect	Meaning	
Sentence case	Retained/modified current rule language	
Small caps	New language	
Strikethrough	Deletions	
Italic blue font text	Annotations	

Amendments to 8 CCR 1505-1 follow:
Amendments to Rule 1.1.4:
1.1.4	“Ballot marking device” (BMD) means a device that may integrate components such as an optical a ballot scanner, printer, touch-screen monitor, audio output, and a navigational keypad and uses electronic technology to:
(a)	Mark a paper ballot at voter direction;
(b)	Interpret the ballot selections;
(c)	Communicate the interpretation for voter verification; and
(d)	Print a voter-verifiable ballot.
Amendments to Rule 1.1.6:
1.1.6	“Blank ballot” means a ballot on which the voter has made no marks in any voting position, has marked with an unreadable marker, or has consistently marked outside of the “read” area of the optical ballot scanner.
Current Rule 1.1.31 is amended and recodified as New Rule 1.1.7:
1.1.31 1.1.7	“Optical scanner or ballot Ballot scanner” means an optical or digital ballot scanner.
[Not shown: renumbering Current Rules 1.1.7-1.1.23 to Rules 1.1.8-1.1.24]
Amendments to Rule 1.1.24:
1.1.24 1.1.25	“Electronic ballot” means a non-paper ballot such as on a touch screen or through audio feedback. After a voter casts an electronic ballot, the voter’s choices must be:
(a)	Marked and printed on a paper ballot for subsequent counting by an optical a ballot scanner; or
(b)	Digitally recorded and counted by the touch screen device, commonly referred to as a Direct Recording Electronic (DRE) device.
[Not shown: renumbering Current Rules 1.1.25-1.1.30 to Rules 1.1.26-1.1.31]
[Current Rule 1.1.31 is amended and recodified as New Rule 1.1.7 as shown above. No changes to Current Rules 1.1.32-1.1.42]
Amendments to Rule 1.1.43:
1.1.43	“Trusted build” means the write-once installation disk or disks for software and firmware for which the Secretary of State has established the chain-of-custody to the building of the disk(s) disks, which is then used to establish or re-establish the chain-of-custody of any component of a voting system that contains firmware or software. The trusted build is the origin of the chain-of-custody for any software and firmware component of the voting system.
Amendments to Rule 2.1 and New Rule 2.1.6:
2.1	Submission of voter registration forms applications
[No changes to Current Rules 2.1.1 through 2.1.5]
2.1.6	The effective date of a voter registration application completed through the online voter registration system is the date and time the applicant submits it. 
Amendments to Rule 2.2:
2.2	For purposes of precinct caucus lists the elector’s duration of residency within a precinct is based upon the date the elector moved to his or her current residence address, as provided by the elector in his or her application. [Section 1-3-101, C.R.S.]on the effective date shown in SCORE. 
2.2.1	In SCORE, the county clerk must enter the date provided by the elector that he or she moved to his or her current residence address.
2.2.2	If the elector submits an application and does not include the date he or she moved, the county clerk must use the date the application is received or postmarked, whichever is earlier, as the date moved. If the elector submits the application during the 22 days before election day and does not provide the date he or she moved, the county clerk must use as the date moved the twenty-second day before election day based upon the affidavit.
Amendments to Rule 2.8:
2.8	Registration of homeless electors who have no fixed permanent home
2.8.1	For the purpose of voter registration residence, an elector who has no fixed permanent home a homeless elector must identify a specific location within a precinct that the applicant considers his or her home base in accordance with section 1-2-102(1)(a)(II), C.R.S.
(a)	A home base is a location the applicant returns to regularly and intends to remain, and a place where he or she can receive messages and be contacted.
(b)	A home base may include a homeless shelter, a homeless provider, a park, a campground, a vacant lot, a business address, or any other physical location.
(c) 2.8.2	For an elector whose home is in foreclosure, the elector may register to vote or remain registered to vote at the foreclosed address until the elector establishes a new permanent residence.
2.8.2	If the home base does not include a mailing address, the applicant must provide a mailing address in accordance with section 1-2-204(2)(f), C.R.S.
2.8.3	A post office box or general delivery at a post office is not a home base.
[Rule 2.9 is reserved: please see rulemaking under CCR tracking #2018-00221 for proposed New Rule 2.9 concerning registered electors absent from the state. Current Rule 2.9 and subsequent rules are renumbered accordingly.] 
Amendments to Current Rule 2.9:
2.9  2.10	A county clerk may cancel a registration record based upon information from a local law enforcement agency only if:
2.9.1 2.10.1	The information states that the individual is currently serving a sentence of incarceration or parole for a felony conviction; and
2.9.2 2.10.1	Minimum matching criteria outlined in Rule 2.7 are met.
[Not shown: renumbering Current Rules 2.10-2.17 to Rules 2.11-2.18]
[Cross reference update in Current Rule 2.16.2(1):]
2.16.2 2.17.2	All individuals who access the SCORE system must sign a SCORE Acceptable Use Policy (AUP) before the county provides a SCORE username.
(1)	The Secretary of State will audit the county AUP records for each county selected for annual inspection of its voting system maintenance records under Rule 20.8.5 20.9.5.
[Rule 2.19 is reserved. Please see rulemaking under CCR tracking #2018-00221 for proposed a New Rule 2.19 concerning registration of electors who are confined in a county jail or detention facility.]
New Rule 2.20:
2.20	The county clerk must send the county’s precinct shape files or maps to the Secretary of State annually, no later than March 1. If the county clerk adjusts precinct boundaries under section 1-5-103, C.R.S., the county must send the Secretary of State updated precinct shape files or maps within 30 days. 
Amendments to Rules 4.8 concerning ballot format and printing:
New Rule 4.8.3:
4.8.3	If there is a qualified write-in candidate on the ballot, the clerk must include “Write-in” before or directly below the space for writing in a candidate. 
[Not shown: renumbering Current Rules 4.8.3-4.8.6 to Rules 4.8.4-4.8.7]
Amendments to Rule 7.1.1 concerning mail ballot plans:
7.1.1	The county clerk must submit a mail ballot plan to the Secretary of State by email no later than 90 days before every election. The county clerk must submit with the mail ballot plan the voter instructions and secrecy sleeve, if applicable, that the clerk intends to use in the election.
Rule 7.2.7 is repealed:
7.2.7	A county must issue a mail ballot to any eligible elector who requests one in person at the county clerk’s office or the office designated in the county’s mail ballot plan beginning 32 days before an election.
[Not shown: renumbering Current Rules 7.2.8-7.2.17 to Rules 7.2.7-7.2.16]
Cross reference updates: 
7.2.12 7.2.11	If an unaffiliated voter selects a mail ballot preference for a major or minor political party that is not participating or that prohibits unaffiliated voters from voting in its primary election, the county clerk must send the voter the mail ballot packet described in Rule 7.2.10 7.2.9. The packet must include a notice explaining why the voter is receiving the packet or provide an alternative method for the voter to obtain this information.
7.2.15 7.2.14	The mail ballot return envelope for each unaffiliated voter in a primary election may provide a means for the county to determine, before opening the envelope, which party’s primary election ballot the elector returned. If the mail ballot return envelope does not provide such a means, or the county cannot determine which party’s ballot the elector returned before opening the envelope, the county must follow the process outlined in Rule 7.5.13 7.4.13. The county’s determination under this Rule may not rely solely on a voter’s self-reported selection (for example, a checkbox).
Rule 7.3 is repealed:
7.3	Absentee voting
7.3.1	An elector may request that the county clerk mail his or her ballot to an address other than the elector’s address of record by submitting an application in accordance with section 1-7.5-116, C.R.S.
7.3.2	The county clerk must mail the ballot to the address provided until the elector indicates otherwise.
[Not shown: renumbering all of Current Rule 7.4 to Rule 7.3]
Cross reference update:
7.4.6 7.3.6	Upon receipt of the ballot, election judges must verify the signature on the affidavit under Rule 7.8 7.7. After the signature on the affidavit has been verified, a bipartisan team of election judges must duplicate the ballot following the procedures outlined in Rule 18. Duplicating judges must not reveal how the elector has cast his or her ballot.
[Not shown: renumbering all of Current Rule 7.5 to Rule 7.4]
Cross reference update:
7.5.1 7.4.1
(d)	The minimum number of drop-off locations must be open during reasonable business hours as defined in Rule 7.9.1(a) 7.8.1(a) and from 7:00 a.m. through 7:00 p.m. on election day.
Amendments to Rule 7.5.5:
7.5.5 7.4.5	The county clerk may request a waiver from the Secretary of State for remote drop off locations in the county’s mail ballot plan or amended mail ballot plan, exempting them from the ballot collection requirements in Rule 7.5.4 7.4.4. If the Secretary of State grants the waiver:
(a)	The county clerk must arrange for the collection of ballots by bipartisan teams of election judges from all exempt drop-off locations as often as necessary, but at least:
(1)	Once each week after the initial mailing of non-UOCAVA ballots until the Friday before election day; and
(2)	On the Friday and Monday before election day and on election day at 7:00 p.m. MT.
(b)	The county clerk must post a notice on each exempt drop box of the dates and approximate times ballots will be collected.
(c)	If the Secretary of State determines that the county failed to collect ballots from a remote drop-off location as often as necessary, the Secretary of State may revoke or modify the waiver.
Amendments to Rule 7.5.8:
7.5.8 7.4.8	After election judges verify the elector’s eligibility and signature, the county clerk must dissociate and segregate the mail ballot return envelope from the secrecy sleeve, if applicable, and a voted ballot in a manner that ensures no person is able to determine how an individual voted.
Amendments to Rule 7.5.13:
7.5.13 7.4.13	Unaffiliated voters in a primary election. If an election judge is unable to determine, before opening the envelope, which party’s ballot the elector returned as outlined in Rule 7.2.10 7.2.9, the county must separate the elector’s ballot from the envelope in the following manner:
(a)	An election judge must remove the ballot, enclosed in its secrecy sleeve, from the mail ballot return envelope and pass it to a bipartisan team of judges without allowing the team of judges to determine the identity of the elector.
(b)	The bipartisan team of election judges must remove the ballot from its secrecy sleeve, review the ballot, and audibly report to the first election judge which political party’s election the elector voted in.
(c)	The first election judge must record in SCORE which political party’s election the elector voted in, or document the proper party information for later recording in SCORE.
Cross reference update:
7.5.14 7.4.14
(a)	If the bipartisan team determines the elector voted in only one party’s primary election, the election judge with access to the envelope must record the party chosen in SCORE under Rule 7.5.13(c) 7.4.13(e) and the ballot must be counted. The county must retain any unvoted ballot as an election record.
[Not shown: renumbering Current Rule 7.6 to Rule 7.5]
[Not shown: renumbering all of Current Rules 7.7-7.16 to Rules 7.6-7.15]
Cross reference updates:
7.7.1 7.6.1	If a mail or provisional ballot return envelope lacks a signature, the county clerk must follow the procedures for discrepant signatures outlined in section 1-7.5-107.3(2)(a), C.R.S., except as provided in Rule 7.7.4 7.6.4.
7.9.10 7.8.10	Each county required to measure under Rule 7.9.9 7.8.9 must report its results to the Secretary of State no later than 30 days after the election.
7.11.3 7.10.3	Every voter service and polling center designated by the county clerk must meet the minimum security procedures for transmitting voter registration data as outlined in section 1-5-102.9, C.R.S., and Rule 2.16 2.17.
8.7.4	Watchers must remain outside the immediate voting area while an elector is voting. The six-foot limit in Rule 1.1.28 1.1.29 applies only to voting.
10.6.2	A county must submit the state portion of the abstract and the ENR upload required by Rule 11.10.5 11.9.5 to the Secretary of State in the format approved by the Secretary of State. The state portion of the abstract must include: (a) The summary of votes cast for each state race and each ballot question or issue; and (b) The total number of ballots counted in the election.
Amendments to Rule 10.13.3 concerning counting ballots during a recount:
10.13.3	Ballots must be reviewed for voter intent using the standards in Rule 18.
(a)	Every overvote, undervote, blank vote, ambiguous mark, and write-in vote in the race(s) races or measure(s) measures subject to the recount must be reviewed in accordance with the Voter Intent Guide.
(b)	The judges conducting the voter intent review may resolve the intent differently than the judges in the election.
Amendments to Rule 11.2.3 concerning voting system inventory: 
11.2.3	The designated election official must file the a complete voting system inventory, noting which equipment will be used for the election with the Secretary of State no later than ten days before the election for use in the Logic and Accuracy Test and the Post-Election Audit.
Amendments to Rule 11.3.1(a) concerning hardware diagnostic test:
(a)	The designated election official must perform the Hardware Diagnostic Test before the election on each device that the designated election official will use in the election, including spare or back up devices. The test must include the following devices and provide the following information:
(1)	All input and output devices;
(2)	Communications ports;
(3)	System printers;
(4)	System modems when applicable;
(5)	System screen displays;
(6)	Boot performance and initializations;
(7)	Firmware loads;
(8)	Software loads;
(9) (7)	Display of firmware or software hash value (MD5 or SHA-1) when possible;
(10) (8)	Confirmation that screen displays are functioning; and
(11) (9)	Date, time and calibration of systems., if applicable; and
(10)	Scanner calibration, if applicable.
Cross-reference update:
11.3.2	Logic and Accuracy Test
(c)	Preparing for the Logic and Accuracy Test
(1)	The county must prepare a test deck of ballots that includes every ballot style and, where applicable, precinct. The county test deck must include a sufficient number of ballots to mark every vote position for every contest including write-in candidates, allow for situations where a contest permits an elector to vote for two or more positions, and include overvotes and undervotes for each contest. The county test deck must include at least one write-in vote for each qualified write-in candidate so that all qualified write-in candidate names will appear in the LAT result uploaded to ENR as required by Rule 11.10.3 11.9.3.
[No other changes to Current Rule 11.3.2(c)(1)]
Amendments to Rules 11.3.2(d) and (e) concerning logic and accuracy test:
(d)	Conducting the Test
(1)	The county and Testing Board must observe the tabulation of all test ballots, compare the tabulation with the previously retained records of the test vote count, and correct any discrepancies before the device is used in the election.
(2)	The county must reset the public counter to zero on all devices and present zero tapes or summary report to the Testing Board for verification.
(3)	The county must make an appropriate number of voting devices available and the Testing Board may witness the programming and/or downloading of memory devices necessary for the test.
(4)	The Testing Board and designated election official must count the test ballots as follows, if as applicable:
(A)	Optical Ballot Scanners:
(i)	The Testing Board must test at least one central count optical ballot scanner and at least one optical ballot scanner used at a voter service and polling center, if applicable.
(ii)	The Testing Board must randomly select the machines to test.
(iii)	The Testing Board must count the board and county’s test ballot batches separately and generate reports to verify that the machine count is identical to the predetermined tally.
[No changes to Rules 11.3.2(d)(4)(B) and (C)]
(e)	Completing the test
(1)	The county must keep all test materials, when not in use, in a durable, secure box. Each member of the Testing Board must verify the seals and initial the chain-of-custody log maintained by the county clerk. If the records are opened for inspection, at least two election officials must verify the seals and initial the chain-of-custody log.
(2)	The county must upload the results from all tested scanners and DREs to the tabulation software, export, and save the tabulation results for the ENR test required under Rule 11.10.3 11.9.3.
(3)	After testing, the Testing Board must watch the county reset and seal each voting device, if applicable.
(4)	The Testing Board and the county clerk must sign a written statement attesting to the qualification of each device successfully tested, the number of the seal attached to the voting device at the end of the test, if applicable, any problems discovered, and any other documentation necessary to provide a full and accurate account of the condition of a given device.
(5)	The county may not change the programming of any voting device after completing the logic and accuracy test for an election, except as required to conduct a recount or as authorized by the Secretary of State.
Amendments to Rule 11.4:
11.4	The county must submit election setup records by regular mail to the Secretary of State so that they are received no later than 5:00 p.m. on the seventh day before election day.
11.4.1	Jurisdictions that contract with either a software service bureau another county or an electronic vote counting equipment voting system vendor may choose to have the other county or vendor deliver the election setup records.
11.4.2	Election setup records must be in an electronic media format that is native to the jurisdiction’s specific ballot creation and tabulation system. Acceptable media formats include tape, diskette, cartridge, CD-ROM, DVD-ROM, floppy, external hard drive, or flash media.
11.4.3	The designated election official must include a point of contact and method of contact (phone, fax, email, etc.).
11.4.4	Within 24 hours of receipt of the election setup records, the Secretary of State’s office will contact the jurisdiction to confirm receipt.
11.4.5	The Secretary of State’s office will store the election setup records in a secured, fire proof, limited-access location.
11.4.6	All parties must treat as confidential all escrowed materials and any other related information that comes into their possession, control, or custody.
[Current Rule 11.6 is amendments and recodified as New Rule 11.10]
Amendments to Rule 11.7:
11.7 11.6	Rules Concerning Accessible Voting Systems. A political subdivision may not purchase or lease voting systems for use by people with disabilities unless the system is certified in accordance with the 2002 Voting System Standards promulgated by the Federal Election Commission by the Secretary of State.
[Not shown: renumbering all of Current Rules 11.8-11.10 to Rules 11.7 to 11.9]
Amendments to Rules 11.8.1 and 11.8.3 concerning notice of voting system malfunction:
11.8.1 11.7.1	The voting system provider must submit a software or hardware incident report to the Secretary of State no later than 72 hours after a software incident has occurred.
11.8.3 11.7.3	If the Secretary of State requires additional information the vendor or the designated election official must submit a report to the Secretary of State's office detailing the reprogramming, repair, or any other actions necessary to correct a voting system malfunction.
[No changes to Current Rules 11.8.3(a) through (g)]
Amendments to Rules 11.9.3(e) and (f) concerning purchases and contracts:
11.9.3 11.8.3	In the case of electromechanical or electronic voting systems, devices or related components certified for use in Colorado on or after January 1, 2016, the Secretary of State will approve a political subdivision’s application to purchase, lease, or use the voting system, device, or related component, after considering all relevant factors, including without limitation:
[No changes to Rules 11.9.3(a) through (d)] 
(e)	The voting system’s ability to support efficient risk-limiting audits, or the commitment of the voting system provider to develop such capability, in time for the 2017 coordinated election, as required by section 1-7-515.51-7-515, C.R.S.;
(f)	The voting system’s compatibility, or the voting system provider’s commitment to develop such compatibility on or before December 31, 2016, with dependent systems that are not directly related to the tabulation of votes and ballots, but are nevertheless utilized by designated election officials in conducting elections in Colorado, including:
(1)	Ballot-on-demand systems,
(2)	Election Night Reporting systems,
(3)	Electronic ballot delivery systems, and
(4)	Election definition data exported from SCORE; and
(5) 	The Secretary of State’s RLA software.
[No changes to Rules 11.9.3(g) through (q)]
Amendments to Rules 11.9.4 concerning purchases and contracts:
11.9.4 11.8.4	The Secretary of State will approve a county’s application for the purchase, lease, or use of an electromechanical or electronic voting system, device, or related component, certified on or after January 1, 2016, only if:
(a)	The voting system includes, and the county acquires, digital ballot resolution and adjudication capability;
(b)	The voting system includes, and the county acquires, central count ballot scanners equipped with automatic document feeders capable of scanning multiple ballots rather than a single ballot at a time;
(c)	The voting system integrates all components of the election management system, including the data management application, if any, into a single user interface that is operable or accessible from the same server or workstation;
(d)	The voting system is capable of supporting efficient risk-limiting audits, or the commitment of the voting system provider to develop such capability, on or before December 31, 2016, in the manner required by Rule 21.4.14 21.4.12;
(e)	The voting system is compatible, or the voting system provider commits to develop such compatibility on or before December 31, 2016, with dependent systems that are not directly related to the tabulation of votes and ballots, but are nevertheless utilized by designated election officials in conducting elections in Colorado, including:
(1)	Ballot-on-demand systems,
(2)	Election Night Reporting systems,
(3)	Electronic ballot delivery systems, and
(4)	Election definition data exported from SCORE;, and
(5)	The Secretary of State’s RLA Software; 
(f)	The voting system provider’s software and hardware license agreements expressly permit political subdivisions that purchase, lease, or use the system to loan or borrow voting devices and related components to or from one another, without charge, as exigencies and other circumstances warrant, and as approved by the Secretary of State; and
(h)	The voting system provider’s software and hardware license agreements expressly permit the Secretary of State, or political subdivisions that license the hardware and software applications necessary to program elections and voting devices, to perform those services without charge for other political subdivisions that are licensed to use the voting system.
11.9.5 11.8.5	Due to their unsuitability for risk-limiting audits, the Secretary of State will not approve a county’s application to purchase, lease or use a ballot scanner certified for use on or after January 1, 2016, that is not equipped with an automatic document feeder, whether intended for use by voters at polling locations, or by election judges at central count locations.
11.9.6 11.8.6	A political subdivision’s contract to purchase or lease a voting system under Rule 11.9.1 11.8.1 must provide for user training and preventative maintenance.
11.9.7 11.8.7	The Secretary of State will only approve a political subdivision’s application to purchase or lease a voting system or component if the voting system or component allows the designated election official to conduct elections in accordance with Colorado law, as amended.
11.9.8 11.8.8	The Secretary of State will maintain a list of all certified electromechanical or electronic voting systems, devices and related components, purchased, leased, or used by Colorado political subdivisions. The list will include, at minimum, the name of the jurisdiction, the name and version of the voting system, the date of acquisition, and the serial number(s)numbers of voting devices.
Not shown: renumbering all of current Rule 10.10 to New Rule 10.9.
Cross-reference updates:
11.10.1 11.9.1	A data entry county must upload a results data file to ENR containing the election results on the dates and times specified in Rules 11.10.3 11.9.3 through 11.10.5 11.9.5. The county must program its election database so that the results file exported from the voting system is formatted in accordance with the following requirements:
[No changes to Current Rule 11.10.1(a)]
Amendments to Rules 11.10.1(b) concerning Election Night Reporting: 
(b)	Contest order: Except as otherwise provided in subsections (1) – (4) of this Rule, the results file must list the contests in the same order as they are certified for the ballot.
(1)	For primary elections, the results file must list the contests in the order prescribed by section 1-5-403(5), C.R.S., with results for each contest grouped in ascending alphabetical order of the abbreviated names of the participating major political parties, followed by the abbreviated names of participating minor political parties and qualified political organizations (e.g., “United States Senator – DEM,” “United States Senator – REP,” “United States Senator – GRN,” “United States Senator – LIB,” “United States Senator – UNI,”).
(2)	The results file must list ballot measures in the order certified by the Secretary of State, followed by the ballot measures certified by other participating political subdivisions in the order and using the numbering conventions specified in Rule 4.5.2(e).
(3)	A county using the Dominion, Hart, or Sequoia Clear Ballot voting system must include and populate the contest sequence number field in its results files to define the order of contests on the ballot as required by this Rule.
(4)	A county using the ES&S or Premier voting system must include and populate the contest ID field in its results file to define the order of contests as required by this Rule.
[No changes to Current Rules 11.10.1(c)-(e)]
Current Rule 11.6 is amendments and recodified as New Rule 11.10:
11.6 11.10	Methods of submission are Reports or materials required by this Rule may be submitted to the voting systems team:
11.6.1 11.10.1	By regular mail delivery to:
Colorado Secretary of State
Attn: Voting Systems
1700 Broadway – Suite 200
Denver, CO 80290
11.6.2 11.10.2	By email to:
voting.systems@sos.state.co.us
11.6.3 11.10.3	By Fax to:
303-869-4861
Amendments to Rules 14.1.2 and 14.5.5 concerning Voter Registration Drives:
14.1.2	A VRD organizer must file amendments to the Statement of Intent and Training Acknowledgment Form with the Secretary of State no later than three business days after the change(s) change occurs. Amendments may be made by fax, email, mail or in person.
14.5.5	The VRD organizer may appeal a fine and has 30 days following receipt of notification to submit a written response setting forth the reason(s) that reasons the VRD organizer is appealing the fine. The VRD organizer may request, within the 30 days, a hearing with the Secretary of State to dispute the fine.
Cross reference update:
16.2.6	Upon receipt of a voted ballot sent by electronic transmission, the county clerk must verify the elector’s signature in accordance with Rule 7.8 7.7. After the affidavit has been verified, a bipartisan team of judges must duplicate the ballot. Duplicating judges must not reveal how the elector voted.
Amendments to Rules 19.2 through 19.6 concerning certification and education of designated election officials:
19.2	Advisory Board
19.2.1	The advisory board must meet meets either in person or through electronic means at least twice each calendar year to approve the curriculum and make necessary changes. 
19.2.2	The advisory board must also review evaluations and recommend changes to the certification program or additional classes after reviewing evaluations, attendance numbers, and online trainings.
19.2.2	The advisory board must review individual applications for certification and must approve applications that are accurate and complete. The advisory board may take into account special circumstances in reviewing and approving applications.
19.2.3	The Secretary of State will appoint the following as board members:
(a)	Four county clerks or designated staff members;
(b)	Two Secretary of State Office representatives; and
(c)	Any individual(s) individual whom the Secretary of State believes could make a valuable contribution to the board.
[No amendments to current Rules 19.2.4 and 19.2.5] 
Amendments to Rule 19.3.4 concerning curriculum: 
19.3.4	To maintain Colorado certification, a person must complete at least five Continuing Elections Education courses by July 31 of every even year and complete at least one in-person class every four years.
Amendments to Rule 19. 4.2 concerning training format: 
19.4.2	The Secretary of State will provide classroom training. For certification, a person must complete at least one course in-class person.
Amendments to Rule 19.5.1 concerning credit: 
19.5.1	Individuals applying for certification must successfully complete the curriculum prescribed by the Secretary of State. If an applicant submits duplicate coursework, the advisory board Secretary of State may reject the application for certification.
Amendments to Rule 19.6: 
19.6	Application Review, Certification, and Maintenance of Records
19.6.1	Once When a person completes the required coursework, he or she must promptly submit an application for certification or continuing certification to the Secretary of State’s office on the form approved by the Secretary of State.
19.6.2	The Secretary of State must review the application with reference to the Secretary of State records. If the application is complete and accurate, the Secretary of State must forward it to the advisory board for its review and approval. Upon approval by the advisory board, the Secretary of State must issue a certificate that the person is a Certified Colorado Election Official.
19.6.3	The Secretary of State must track attendance at all classes and keep records of attendance, continuing elections education, and records of those persons who are certified and persons who are in the certification process.
19.6.4	A person is recertified when they complete the classes required under Rule 19.3.4. 
Amendments to Rule 20.2.2 regarding county security procedures; specifically, general requirements concerning chain-of-custody:
20.2.2	The county must maintain and document uninterrupted chain-of-custody for each voting device from the installation of trusted build to the present, throughout the county’s ownership or leasing of the device. For optical ballot scanners approved for use under section 1-5-613(2), C.R.S. but for which no trusted build exists, the county must maintain and document uninterrupted chain-of-custody for each voting device from the successful completion of acceptance testing conducted according to Rule 20.8.4 20.9.4.
Amendments to Rules 20.3 and 20.4 concerning county security procedures:
20.3	Physical locking mechanisms and seals. The county must record the serial number of every seal on the appropriate chain-of-custody log. Two individuals must verify, and indicate by signing and dating the log, that the seal serial numbers match the logged serial numbers. If a seal is inaccessible and cannot be removed, then it is not necessary to verify that seal serial number.
20.3.1	DREs, BMDs, and Judge’s Booth Controllers (JBCs)
(a)	The county must place a seal over a removable card or cartridge that is inserted into the unit, or over the slot or door covering the card or cartridge.
(b)	The county must place a seal over any removable card slot or cartridge slot when no card or cartridge is inserted into the unit data port when the port is not being used, except slots for activation cards.
(c)	If the county cannot verify the firmware or software hash value (MD5 or SHA-1), the county must seal the DRE or BMD case. To detect unauthorized access, the county must use seals at either the seams of the case or at key entry points such as screw access points.
(d)	If the voting device contains one or more slots for a flash memory card, the county must affix a seal over each flash card slot, door, or access panel.
(e) (d)	In each voter service and polling center, the county must provide a minimum of one accessible DRE with a headset that has adjustable volume control or BMD that complies with section 1-5-704, C.R.S.
20.3.2	Before attaching a VVPAT to a specific voting device, the county must seal the unit after verifying that no votes were cast. At least two election officials must verify that seals are intact before the start of voting, and at the close of voting. VVPAT records must either remain in the VVPAT canister, or be sealed and secured in a suitable device for protecting privacy or as described in Rule 20.11 20.12.
20.3.3	Optical Ballot scanners
(a)	The county must place a seal over each card or cartridge inserted into the unit, or over any door or slot containing the card or cartridge.
(b)	The county must place a seal over each empty card or cartridge slot or door covering the area where the card or cartridge is inserted.
(c)	Before the start of voting and after the close of voting, two election officials must visually confirm that all seals are intact and that the seal numbers match those logged in the chain-of-custody log.
20.3.4	Memory cards or cartridges and activation cards
(a)	The county must assign and securely affix a permanent serial number unique identifier to each removable card or cartridge activation card. The county may use the manufacturer assigned serial number for this purpose.
(b)	The county must handle removable memory cards and cartridges activation cards in a secure manner at all times. The county must transfer and store any removable card or cartridge activation card that is not sealed in a voting machine in a secure container with at least one seal. Upon delivery and receipt, election judges or county personnel must verify, and indicate by signing and dating the chain-of custody log, that all seal numbers match those listed in the log.
(c)	The county must maintain a written or electronic log to record memory card or cartridge seal numbers activation card seals and track seals for each voting unit.
(d)	The county must maintain a complete inventory of memory cards and activation cards, including which VSPC they are assigned to during an election. Before and after a VSPC opens and closes each day, the supervisor judge must verify that all cards issued to the VSPC are present. If at any time the supervisor judge cannot account for all activation cards issued to the VSPC, the supervisor judge or a member of the county election staff must immediately submit an incident report to the Secretary of State under Rule 11.6. 
20.4	Individuals with access to keys, door codes, and vault combinations
20.4.1	For employees with access to areas addressed in Rule 20.4.3, the county must state in the security plan each employee’s title and the date of the name of each employee, their title, and the date the criminal background check was performed. [Section 24-72-305.6, C.R.S.]
20.4.2	The county must change all keypad door codes or locks, and vault combinations, computer and server passwords, encryption key codes, and administrator passwords at least once per calendar year prior to the first election of the year.
20.4.3	Employee access. The county may grant employees access to the codes, or locks and combinations, passwords, and encryption keys described in this Rule in accordance with the following limitations:
(a)	Access to the code, lock, or combination, password, or encryption key for the voting equipment,to ballot storage areas, counting room, location of adjudication, or tabulation workstations is restricted to employees who have successfully passed a criminal background check. Any person who has been convicted of an election offense or an offense with an element of fraud is prohibited from having access to a code, combination, password, or encryption key for the voting equipment, ballot storage areas, counting room, or tabulation workstations the above areas.
(b)	Except for emergency personnel, no other individuals may be present in these locations unless supervised by one or more employees with authorized access. Each individual who has access to the central election management system or central tabulator must have their own unique username and password. No individual may use any other individual’s username or password. Shared accounts are prohibited.
(c)	In extreme circumstance circumstances, the county may request and the Secretary of State may grant exemption from the requirements outlined in this Rule.
20.4.5	Access to where election management software is used is limited to authorized election officials and watchers only. Messengers or runners delivering ballots between the preparation room and computer room must wear distinguishing identification.
Amendments to Rule 20.5.2 regarding county security procedures, specifically concerning internal controls for the voting system: 
20.5.2	In addition to the access controls discussed in Rule 20.4, the county must change all passwords and limit access to the following areas:
(a)	The county must change all software passwords once per calendar year prior to the first election. This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
(b)	The county must change all hardware passwords once per calendar year prior to the first election. This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
(c)	Administrative and user accounts for election management system and election databases.
(1)	The county may use the administrative user account only to create individual user accounts for each election database.
(2)	The county must create individual user accounts that are associated and identified with each individual authorized user of the election management system or election database.
(3)	The county must restrict access to each individual user account with a unique password known only to each individual user. Authorized users must access the election management system and election database using his or her individual user account and unique password.
(4)	The county may grant administrative privileges to no more than ten individual user accounts per election.
(d)	Other than for the purpose of programming the election, the The voting system provider may not have administrative or user access to the county’s election management system.
(e)	The county may not connect or allow a connection of any voting system component to the Internet.
(f)	If any component of the voting system is equipped with Wi-Fi capability or a wireless device, the county must disable ensure that the wireless capability or device is disabled before use in an election.
(g)	The county may not connect any component of the voting system to another device by modem.
(h)	The county must include in its security plan the title name, title and date of background checks for each employee with access to any of the areas or equipment set forth in this Rule. The county must maintain a storage facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained. If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log must meet the requirements of this Rule. [Section 24-72-305.6, C.R.S.]
New Rule 20.5.3:
20.5.3	Removable storage devices
(a)	The county must reformat all removable storage devices immediately before inserting them into any component of the voting system, except as provided in Rule 20.5.3(b)-(d).
(b)	The county may insert, without first reformatting, a removable storage device containing only election definition data files downloaded from SCORE if:
(1)	The county reformats the removable storage device immediately before inserting it into the SCORE workstation and downloading the election definition data files; and 
(2)	Before and while downloading the SCORE election definition data, the county installs and operates the advanced network monitoring and threat detection applications provided or approved by the Secretary of State.
(c)	The county may insert, without first reformatting, a removable storage device into a BMD, if: 
(1)	The removable storage device contains only election and ballot style data files necessary to program the BMD for testing or use in an election; 
(2)	The county downloaded the election and ballot style data files directly from the EMS workstation; 
(3)	The county did not expose the removable storage device to the internet or insert it into an internet-connected device after downloading the election and ballot style data files from the EMS; and
(4)	The county reformatted the removable storage device immediately before inserting it into the EMS and downloading the election and ballot style data files.
(d)	The county may insert a removable storage device without first reformatting it if the removable storage device contains only election database or project files remotely programmed by the voting system provider in accordance with Rule 20.7.
Amendments to Rule 20.6 concerning county security procedures:
20.6	The county must keep all components of the voting system, ballots, servers, workstations, DREs, optical ballot scanners, BMDs, VVPAT records, and video data records in a temperature-controlled storage environment that maintains a minimum temperature of 50 degrees Fahrenheit and a maximum temperature of 90 degrees Fahrenheit. The storage environment must be dry with storage at least four inches above the floor. The county must provide the Secretary of State with a description of the specific environment used for each type of component.
New Rule 20.7 concerning remote election programming:
20.7	Remote election programming services. 
20.7.1	A county may not install or import into its voting system an election database or project programmed or created by the voting system provider using voting system components other than those owned or leased by the county and situated in the county’s secure elections facility, unless the voting system provider first affirms on a form provided by the Secretary of State that: 
(a)	At all times during the election database or project programming, the voting system provider used only hardware and software certified for use in Colorado, as configured and verified during trusted build by the Secretary of State; 
(b)	At all times after installation of trusted build, the voting system provider operated all hardware utilized to program the election on a closed network, and did not connect the hardware to the internet or any internet-connected device; 
(c)	At all times during the election programming process, the voting system provider complied with the security protocols for removable storage devices in Rule 20.5.3(a) – (c); and
(d)	The voting system provider physically delivered to the county removable storage media containing the finished election database or project, and did not transmit using any method connected or exposed to the internet. 
Amendments to Current Rule 20.7 regarding county security procedures:
20.7 20.8	Security cameras or other surveillance
20.7.1 20.8.1	The county must maintain a log of each person who enters the areas specified in Rule 20.7.3 20.8.3, including the person’s name, signature, and date and time of entry. If access to the specified areas is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, the log must meet the requirements of this Rule.
20.7.2 20.8.2	Unless otherwise instructed, the county must make video security surveillance recordings of the areas specified in Rule 20.7.3 20.8.3 beginning at least 60 days before election day and continuing through at least 30 days after election day. If a recount or contest occurs, the recording must continue through the conclusion of all related activity. The recording system must ensure that records are not written over when the system is full. The recording system must provide a method to transfer the video records to a different recording device or to replace the recording media. If replaceable media is used then the county must provide a process that ensures that the media is replaced often enough to prevent periods when recording is not available.
20.7.3 20.8.3	The following are the specific minimum requirements:
(a)	If the county has 50,000 or more registered voters, then the county must maintain a log and make video security surveillance recordings of the following areas, excluding voting booths:
(1)	All areas in which election management software is used, including but not limited to programming, downloading copying election files to memory cards or flash media, uploading copying election files from memory cards or flash media, adjudicating ballots, tallying results, and results reporting.
(2)	All areas used for processing ballots, including but not limited to areas used for Signature Verification, ballot opening, tabulation, or storage of voted ballots beginning at least 35 days before election day and continuing through at least 30 days after election day, unless there is a recount or contest. If a recount or contest occurs, the recording must continue through the conclusion of all related activity.
(3)	The storage area for all voting equipment.
(b)	If the county has fewer than 50,000 registered voters then the county must maintain a log and make video security surveillance recordings of all areas in which election management software is used, including but not limited to programming, downloading copying election files to memory cards or flash media, uploading copying election files from memory cards or flash media, adjudicating ballots, tallying results, and results reporting.
(c)	The county must adequately light the area(s) areas subject to video surveillance to provide visibility for video recording.
Amendments to Rules 20.8 and 20.9 concerning county security procedures: 
20.8 20.9	Equipment maintenance procedures. In addition to the requirements for voting systems inventory specified in Rule 11.2, the county must adhere to the following minimum standards:
20.8.1 20.9.1	The county must store all equipment throughout the year with seals over the memory card slots data ports for each device. The county must maintain a log of the seals used for each device consistent to the logs used for tracking Election Day seals.
20.8.2 20.9.2	For equipment being sent to the vendor for offsite repairs/replacements, the county must keep a maintenance log for the device that must contain the following: the model number, serial number, and the type of device; the firmware version; the software version, as applicable; the printed name and signature of the person sending the equipment; and the date of submission to the vendor; and the date the equipment is returned.
20.8.3 20.9.3	An employee must escort the vendor’s representative at all times while on-site. At no time may the voting system vendor have access to any component of the voting system without supervision by an employee. [Section 24-72-305.6, C.R.S.]
20.8.4 20.9.4	Upon completion of any vendor maintenance, the county must verify or reinstate request reinstallation of the trusted build and conduct a full acceptance test of equipment that must, at a minimum, include the hardware diagnostics test, as indicated in Rule 11, and a mock election in which an employee(s) must cast a minimum of five ballots on the device to ensure tabulation of votes is working correctly in accordance with this Rule. The county must maintain all documentation of the results of the acceptance testing on file with the specific device.
(a)	If the maintenance was performed on a BMD, that BMD must be used to generate five ballots for use in the acceptance testing.
(b)	If the maintenance was performed on a ballot scanner then at least five ballots (a combination of BMD-generated ballots and non-BMD-generated ballots – at least one of each) must be tabulated on the scanner.
(c)	If the maintenance was performed on a DRE, a minimum of five ballots must be cast on the device. 
20.8.5 20.9.5	The Secretary of State will may annually inspect county maintenance and chain-of-custody records and verify the integrity of trusted build on a randomly selected basis. county documents and equipment, including:
(a)	County maintenance records;
(B)	Chain of custody logs;
(C)	Trusted build integrity; 
(D)	Wireless status;
(E)	Virus protection status;
(F)	Password status (Bios, operating system, and applications); and
(g)	access logs.
20.9 20.10	Transportation of equipment, memory cards, ballot boxes, and ballots
20.9.1 20.10.1	The county must submit detailed plans to the Secretary of State before an election regarding the transportation of equipment and ballots both to remote voting sites and back to the central elections office or storage facility. If there is any evidence of possible tampering with a seal, or if the serial seal numbers do not match those listed in the chain-of-custody log, the county clerk must be immediately notified and must follow the procedures specific to the incident as described in Rule 20.13 20.14. While the method of transportation of equipment may vary, the following standards apply:
(a)	Transportation by county personnel. County personnel must at all times display identification provided by the County. Two employee signatures and date are required at the departure location verifying that the equipment, including memory card or cartridge, is sealed to prevent detect tampering. Upon delivery of equipment, at least two election officials must verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact and that the serial seal numbers on the seals match the logged serial seal numbers.
(b)	Transportation by election judges. Election officials that are receiving equipment must inspect all components of voting devices and verify the specific seal numbers by signature and date on the chain-of-custody log for the device.
(c)	Transportation by contract. If a county contracts for the delivery of equipment to remote voting locations, each individual delivering equipment must successfully pass a criminal background check. Any person who has been convicted of an election offense or an offense with an element of fraud is prohibited from handling or delivering voting equipment. Two election officials must verify the specific seal numbers by device, sign, and date the chain-of-custody log upon release of the equipment to the individual(s) individuals delivering the equipment.
20.9.220.10.2	Standards for transporting voting equipment to and from the voting location:
[No changes to Current Rule 20.9.2(a)]
(b)	Required procedures if devices are delivered with memory cards/cartridges intact:
(1)	Two election officials must verify that all seals are intact at the close of polls. Election judges must sign and date the chain-of-custody log with such indication.
(2)	At least two election officials must accompany the secured equipment to the drop-off location. The person receiving the equipment must verify the seals and sign and date the logs.
(3)	Upon confirmation that the seals are intact and bear the correct numbers, election officials must remove and upload the memory cards/cartridges into the central count system.
(4)	To secure the equipment, election officials must place a tamper-evident seal over the memory card slot and update the chain-of-custody log to reflect the new seal number(s) numbers.
[No changes to Current Rules 20.9.3 and 20.9.4 other than renumbering to Rules 20.10.3 and 20.10.4]
[Not shown: renumbering Current Rule 20.10 to Rule 20.11]
Amendments to Current Rule 20.11: 
20.11 20.12	Procedures for voter verifiable paper record (VVPAT). The following requirements apply only to DREs with a VVPAT.
20.11.1 20.12.1	Security. The VVPAT record is considered an official record of the election, in accordance with section 1-5-802, C.R.S.
(a)	The housing unit for any VVPAT record to be used in the election must be sealed and secured before any votes are cast for the election. Election officials must attest to the VVPAT record having no votes included on the paper record before the start of voting, and before the installation or replacement of a new VVPAT record. Documentation of the seal number(s) numbers must be maintained before voting and at the conclusion of voting.
(b)	If a DRE with VVPAT is used at a voter service and polling center, the seal number(s) numbers must be recorded at the beginning and end of each voting day.
(c)	At the close of the polls, the VVPAT records will be transferred to the election office in the same manner as any paper ballots. In the absence of paper ballots, the VVPAT records will be transferred to the election office in the same manner as memory cards.
(d)	If the DRE’s trusted build is not capable of verification by reference to the hash value (MD5 or SHA-1) of the firmware or software, the county must secure the printer port on the DRE with tamper-evident seals when the VVPAT is not connected to the DRE’s printer port.
20.11.2 20.12.2	Anonymity. The designated election official must implement measures to protect the anonymity of voters choosing to vote on DREs
(a)	Measures to protect anonymity include:
(1)	The county may not keep any record indicating the order in which people voted on the DRE, or which VVPAT record is associated with the voter.
(2)	When more than one DRE is available at a voting location, the county must, to the extent practicable, allow the voter to choose the DRE he or she wishes they wish to vote on.
(b)	The county clerk may not release a report generated from SCORE that includes a date and time stamp that could potentially identify a voter who cast a specific ballot.
(c)	At no time may an election official simultaneously access a VVPAT and the list of voters. If the VVPAT record requires inspection, at least two election officials must conduct the examination.
(d)	The county must arrange voter service and polling center DREs in a manner that prevents election officials and other voters from observing how a DRE voter marks or casts his or her their ballot.
20.11.3 20.12.3	Storage. The storage of the VVPAT records must be consistent with storage of paper ballots under section 1-7-802, C.R.S.
(a)	Individual spools containing VVPAT records must contain the following catalog information affixed to the spool:
(1)	Date and name of election;
(2)	Name of voting location;
(3)	Date(s) Dates and time(s) times of voting;
(4)	Machine serial number of DRE associated with the record; and
(5)	Number of spools associated with this machine for this election (i.e. “Spool 1 of 1”, or “Spool 1 of 2”, etc.).
(b)	Light sensitive storage containers must be used for the 25 month storage period to ensure the integrity of the VVPAT paper record. Containers must be sealed, with record of the seal numbers maintained on file and signed by two election officials.
[Not shown: renumbering all of Current Rule 20.12 to Rule 20.13]
Amendments to Current Rule 20.12.2 concerning security training for election officials:
20.12.2 20.13.2	Security training must include the following components:
(a)	Proper application and verification of seals and chain-of-custody logs;
(b)	How to detect tampering with voting equipment, memory cards/cartridges, or election data on the part of anyone coming in contact with voting equipment, including election officials, vendor personnel, or voters;
(c)	Ensuring privacy in voting booths;
(d)	VVPAT requirements;
(e)	Chain-of-custody requirements for voting equipment, memory cards/cartridges, and other election materials;
(f)	Ballot security;
(g)	Voter anonymity; and
(h)	Recognition and reporting of security incidents.
Amendments to Rules 20.13 through 20.15:
20.13 20.14	Remedies
20.13.1 20.14.1	If a seal is broken, or there is another discrepancy, the election official must immediately notify the county, who must remedy the discrepancy as follows:
(a)	The county or Secretary of State must reinstate or must verify the trusted build or the Secretary of State must reinstall trusted build. For instances where the county can display, verify, or print the hash value (MD5 or SHA-1) of the firmware or software, the election official must document and verify that the hash value matches the documented alphanumeric string associated with the trusted build for the software or firmware of that device.
(b)	If the evidence indicates that the discrepancy occurred before the start of voting:
(1)	The election officials must seal the device and securely deliver it to the county.
(2)	The county must verify the trusted build or the Secretary of State must reinstall trusted build. Where the county can display, verify, or print the hash value (MD5 or SHA-1) of the firmware or software, the county must document and verify that the hash value matches the documented alphanumeric string associated with the trusted build for the software or firmware of that device. 
(2) (3)	The county or the Secretary of State must install a new, secure memory card into must reinstall the election programming into the device, conduct a hardware diagnostics test as prescribed in Rule 11, and conduct an acceptance test on the machine in full election mode, casting according to Rule 20.8.4, except that the device must be in full election mode, if applicable, and instead of casting or printing five ballots, the county must cast or print at least 25 ballots on the device. The county must maintain on file all documentation of testing and chain-of-custody for each specific device.
(3) (4)	The county must complete the necessary seal process and documentation to re-establish the chain-of-custody for the device and new memory card.
(4) (5)	The county must set the machine to election mode ready for a zero report.
(c)	If the evidence indicates that the discrepancy occurred after votes were cast or printed on the device:
(1)	The county may not continue to use the machine until verification or reinstallation of trusted build and acceptance testing is complete. The county must set the machine to election mode ready for a zero report before resuming voting on the device.(2)	The election officials must seal the device and securely deliver it to the county.
(3)	If the device is a DRE or ballot scanner:
(3) (i)	The county must close the election on that device, and perform a complete manual verification of the paper ballots (or VVPAT records) to the summary tape printed on the device that represents the record of votes on the memory card.
(4) (ii)	If the totals do not match then only the paper record will be accepted as the official results for that device. The county must re-seal and secure the device and immediately report the discrepancy to the Secretary of State. The county must not use the device for the remainder of the election unless the trusted build is reinstated.
(5) (iii)	If the totals match, the county may upload the memory card into the election management software at the close of polls.
(6) (iv)	After verifying the totals, the county must secure the paper records and memory card with seals and a chain-of-custody log.
(4)	The county must verify the trusted build or the Secretary of State must reinstall trusted build. Where the county can display, verify, or print the hash value (MD5 or SHA-1) of the firmware or software, the county must document and verify that the hash value matches the documented alphanumeric string associated with the trusted build for the software or firmware of that device.
(7) (5)	The county must complete the necessary seal process and documentation to establish the chain-of-custody for the device and memory card.
(6)	The county must set the machine to election mode ready for a zero report before resuming voting on the device. 
(8) (7)	Before certifying election results, the county must conduct a full (all contests) random audit on the device under Rule 25.3 and report results to the Secretary of State. This requirement is in addition to the post-election audit required by Rule 25.2 or 25.3.
20.13.2 20.14.2	The county must make all documentation related to the voting system and for every device used in the election available for Secretary of State inspection.
20.14 20.15	Amendments and review of security plans
20.14.1	If no changes have occurred since the last security plan was filed then the county must file a statement to that effect.
20.14.2	The county must clearly identify and describe any revisions to a previously filed security plan.
20.14.3	The A county may change the amend its security plan within 60 days of an election as a result of an emergency situation or other unforeseen circumstance. The county must document the changes and file the revisions with the Secretary of State within five days of the change.
20.15 20.16	Lease, loan, or rental of election equipment. Nothing in this Rule requires a county to lease, loan, or rent any election equipment to any municipality, special district or other local jurisdiction.
20.15.1 20.16.1	A county that chooses to lease, loan, or rent any certified election equipment to a municipality, special district, or other local jurisdiction for use in their elections must maintain or reestablish an acceptable chain-of-custody and appropriate documentation in accordance with Rule 20.2.
20.15.2 20.16.2	Upon return of the voting equipment to the county, if the documentation and chain-of-custody does not support the proper maintenance of the trusted build software then the county must reinstate or verify or request reinstallation of the trusted build before using the equipment.
20.15.3 20.16.3	To reinstate or verify maintain the trusted build, the county must implement one of the following procedures:
(a)	The county clerk must:
(1)	Deliver the equipment to the jurisdiction;
(2)	Witness and document the installation of the memory card(s) or cartridge(s) election programming used by the jurisdiction;
(3)	Place one or more secure and numbered seals on the voting equipment in accordance with Rule 20.3. If during the course of the jurisdiction’s election, the designated election official requires removal of a memory card or cartridge flash media as a function of the election process, the county clerk must witness and document the removal and proper resealing of the memory card or cartridge flash media; and
(4)	Upon return of the equipment to the county, the county must verify, and indicate by signing and dating the chain-of-custody log, that all seals are intact. If any seal is damaged or removed, the county must reinstate or verify or request the Secretary of State reinstate the trusted build.; or
(b)	The county must designate and station deputized county staff with the loaned equipment at all times while the equipment is under control of the designated election official. The deputized county staff must maintain physical custody of the equipment at all times to ensure that no unauthorized access occurs.; or
(c)	In accordance with section 1-5-605.5, C.R.S., the county must appoint the designated election official as a deputy for the purposes of supervising the voting equipment. The designated election official must:
(1)	Sign and submit to the county an affirmation that he or she will ensure the security and integrity of the voting equipment at all times;
(2)	Affirm that the use of the voting equipment is conducted in accordance with this Rule 20 the specific Conditions for Use of the voting equipment; and
(3)	Agree to maintain all chain-of-custody logs for the voting device(s) devices.
[Not shown: renumbering all of Current Rules 20.16 and 20.17 to Rules 20.17 and 20.18]
Amendments to Rule 20.17.5 concerning voting system conditions for use:
20.17.5 20.18.5	Optical ballot scanners:
(a)	When issuing ballots, the county must provide in-person voters with a secrecy sleeve sufficient to conceal a voter’s marked ballot from others in the polling location, including election officials.
(b)	The county must record the optical ballot scanner serial number on all chain-of-custody logs and reports generated by the device.
(c)	Each optical ballot scanner must have a backup battery, or be connected to an uninterruptible power supply sufficient to sustain continuous operation for a minimum of two hours in the event of power loss.
(d)	The county must maintain logs indicating administrator function use.
(e)	The county must program each optical ballot scanner to permit an election judge to override rejection of overvoted ballots that cannot be duplicated in accordance with Rule 18.
[Not shown: renumbering all of Current Rule 20.18 to Rule 20.19]
Amendments to Rule 20.18.3 concerning ES&S voting system conditions:
20.18.3 20.19.3	For optical ballot scanners with a zip disk drive, the county must save the cast vote records for each batch of tabulated ballots to a zip disk. A batch of tabulated ballots may consist of one or more SCORE absentee ballot batches.
[Not shown: renumbering all of Current Rule 20.19 to Rule 20.20]
Current Rule 20.20 is repealed:
20.20	Sequoia DRE conditions
20.20.1	The county must add clarifying text to the display screen during the VVPAT review process that instructs the voter to review his or her ballot choices.
20.20.2	The county must lock the activate button to prevent its use during an election.
20.20.3	A county may not modify the screen display using an override.ini file without approval from the Secretary of State.
Amendments to Rule 21.3.6 regarding voting system standards for certification, specifically application procedure:
21.3.6	The voting system provider must coordinate with the Secretary of State for the establishment of the trusted build. The voting system provider must submit all documentation and instructions necessary for the creation and guided installation of files contained in the trusted build which will be created at the start of functional testing and will be the model tested. At a minimum, the trusted build must include a compilation of files placed on write-once or removable media, and an established hash file distributed from a VSTL or the National Software Reference Library to compare federally certified versions. The trusted build disks should all be labeled with identification of the voting system provider’s name and release version.
Amendments to Rules 21.4.4 and 21.4.5 concerning voting system standards:
21.4.4	Independent Analysis. Before completion of functional testing, all voting system providers submitting a voting system must complete an independent analysis of the system, which includes:
(a)	An application penetration test conducted to analyze the system for potential vulnerabilities that may result from poor or improper system configuration, known or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. The test must involve active exploitation of security vulnerabilities of the voting system according to a penetration test plan approved by the Secretary of State, whether or not the vulnerabilities can be mitigated through compensating controls.
(b)	A source code evaluation conducted in accordance with Software Design and Coding Standards of the 2002 Voting System Standard or the most current version of the Voluntary Voting System Guidelines approved after January 1, 2008.
(c)	A complete report detailing all findings and recommended compensating controls for vulnerabilities and deficiencies identified.
(d)	The voting system provider must use at least one of the following to perform the independent analysis:
(1)	An EAC approved VSTL;
(2)	An independent testing organization approved by the Secretary of State; or
(2) (3)	Testing conducted in another state; or.
(3)	Some combination of such VSTL and state testing that meets the requirements of this Rule.
(e)	The Secretary of State or VSTL will conduct a quality review of all work under this section. The review may include an examination of the testing records, interviews of the individuals who performed the work, or both. Review of testing records may be conducted at the VSTL, the state in which the testing was conducted, or at the site of any contractor or subcontractor utilized by another state to conduct the testing.
(f)	The Secretary of State may reject any evaluation if not satisfied with the work product and to require additional analysis to meet the requirements of section 1-5-608.5, C.R.S., and this Rule.
21.4.5	Functional Requirements
(a)	Functional requirements must address all detailed operations of the voting system related to the management and controls required to successfully conduct an election.
(b)	The voting system must provide for appropriately authorized users to:
(1)	Set up and prepare ballots for an election;
(2)	Lock and unlock system to prevent or allow changes to ballot design;
(3)	Conduct hardware diagnostic testing;
(4)	Conduct logic and accuracy testing;
(5)	Conduct an election and meet requirements as identified in this Rule 21 for procedures for voting, auditing information, inventory control where applicable, counting ballots, opening and closing polls, recounts, reporting and accumulating results;
(6)	Conduct the post-election risk-limiting audit; and
(7)	Preserve the system for future election use.
(c)	The voting system must integrate election day voting results with mail and provisional ballot results.
(d)	The election management system must provide authorized users with the capability to produce electronic files including election results in either ASCII (both comma-delimited and fixed-width) or web-based format. The software must provide authorized users with the ability to generate these files on an “on-demand” basis. After creating such files, the authorized users must have the capability to copy the files to diskette, tape, CD-ROM or other removable media type.
(1)	Exports necessary for the Secretary of State must conform to a format approved by the Secretary of State. The format must be compatible with a commercially available data management program such as a spreadsheet, database, or report generator.
(e)	The voting system must include hardware or software to enable the closing of all vote tabulation devices at polling locations to allow for the following:
(1)	Printout of the time the voting system was closed.
(2)	Printout of the public counter and protective counter upon closing the ballot casting functionality.
(3)	Ability to print a report which must contain:
(A)	Names of the offices;
(B)	Names of the candidates and party, when applicable;
(C)	A tabulation of votes from ballots of different political parties at the same voting location in a primary election;
(D)	Ballot titles;
(E)	Submission clauses of all initiated, referred or other ballot issues or questions;
(F)	The number of votes counted for or against each candidate or ballot issue;
(G)	Date of election (day, month and year);
(H)	Precinct number (ten digit format);
(I)	County or jurisdiction name;
(J)	“State of Colorado”;
(K)	Count of votes for each contest; and
(L)	An election judge’s certificate with an area for judges’ signatures with the words similar to: “Certified by us”, and “Election Judges”. Space must allow for a minimum of two signatures.
(4)	Votes counted by a summary of the voting location and by individual precincts.
(5)	Ability to produce multiple copies of the unofficial results at the close of the election.
(f) (e)	The election management system must ensure that an election setup record may not be changed once ballots are printed and/or election media devices are downloaded without proper authorization and acknowledgement by the application administrative account. The application and database audit transaction logs must accurately reflect the name of the system operator making the change(s) changes and the date and time of the change(s) changes. The application and database audit transaction logs must support user’s ability to examine the “old” and “new” values of the change(s) changes.
(g) (f)	All DRE or BMD voting devices must use technology providing visual or auditory ballot display and selection methods used by people with disabilities.
(h) (g)	All electronic voting devices supplied by the voting system provider and used at voter service and polling centers must have the capability to continue all normal voting operations and provide continuous device availability during a 2-hour period of electrical outage without any loss of election data.
(i)	The voting system must provide capabilities to protect the anonymity of ballot choices.
(1)	All optical scanners, associated ballot boxes, and VVPAT storage devices must provide physical locks and procedures during and after the vote casting operation.
(2)	All DRE devices must provide randomization of all voter choices and stored electronic ballot information during and after storage of the voters’ ballot selections.
Amendments to Rule 21.4.7(e) concerning ballot definition subsystem:
(e)	Data management applications that collect, convert, manage or export election definition information in one or more format(s) formats suitable for import into the election management system, are an essential component of, and must be integrated with and operate in the same user interface and on the same server or workstation, as the election management system.
Amendments to Rule 21.4.9:
21.4.9	Audit Capacity
(a)	The voting system must track and maintain read-only audit information of the following election management system events:
(1)	Log on and log off activity;
(2)	Application start and stop;
(3)	Printing activity, where applicable;
(4)	Election events –set for election, unset for election, open polls, close polls, end election, upload devices, download devices, create ballots, create precincts, create districts, create voter service and polling centers, initialize devices, backup devices, and voting activity; and
(5)	Hardware events – add hardware, remove hardware, initialize hardware, and change hardware properties.
(b)	All tabulation devices must display the unit serial number(s) both physically and within any applicable software, logs or reports.
(c)	Vote tabulation devices must allow for an alternate method of transfer of audit records if the device or a memory storage device is damaged or destroyed.
(d) (b)	All transaction audit records of the election databases must be maintained in a file outside of or separate from the database in a read-only format.
Amendments to Rule 21.10(d)(3) concerning voting systems operating system security requirements: 
(3)	The voting system provider must use a virus protection/prevention application on the election management server(s) server/workstations which must be capable of manual updates without the use of direct connection to the internet.
Rules 21.4.11 and 21.4.12 are repealed:
21.4.11	Telecommunications requirements
(a)	Telecommunications includes all components of the system that transmit data outside of the closed network as defined in this Rule.
(b)	All electronic transmissions from a voting system must meet the 2002 Voting System Standards.
(c)	Line of sight infrared technology may only be used in a closed environment where the transmission and reception is shielded from external infrared signals and can only accept infrared signals generated from within the system.
(d)	All systems that transmit data over public telecommunications networks must maintain an audit trail when election results are transmitted.
(e)	Voting systems that transmit data through any telecommunications medium must be able to recover, either automatically or with manual intervention, from incomplete or failed transmission sessions and resume transmissions when telecommunications are reestablished.
(1)	Recovery of transmissions must include notations of the interrupted transmission session and the resumed transmission session in the system and application transaction logs.
(2)	Failure and recovery of transmissions must not cause any error in data transmitted from the voter service and polling centers to the central election site during a recovered transmission session.
21.4.12	Voter-verifiable paper record requirements
(a)	Existing systems that are retrofitted to comply with section 1-5-802(1), C.R.S., must be examined for certification by the Secretary of State. Any retrofitted voting system must comply with the process and application for certification as identified by this Rule.
(b)	The VVPAT must include the following components:
(1)	A paper audit trail writer or printer that must be attached, built into or used in conjunction with the DRE or BMD, and must duplicate a voter’s selections from the DRE or BMD onto a paper record;
(2)	A paper record display unit or area that must allow a voter to view his or her paper record; and
(3)	A paper record storage unit that must store cast and spoiled paper record copies securely.
(c)	The VVPAT must meet the following functional requirements:
(1)	The printer may only communicate with the voting device to which it is connected;
(2)	The printer must function only as a printer, and not perform any other non-printer related services;
(3)	Produce a paper record for every corresponding electronic voting record;
(4)	Provide a “low supply” warning to the election official to add paper, ink, toner, ribbon or other like supplies. In the event that an election official is required to change supplies during the process of voting, the voter must be allowed to reprint and review the paper record without having to mark his or her ballot. The device must prevent the election official from seeing a voter’s ballot.
(5)	Stop all operations if the printer is not working as designed.
(6)	Allow a voter to spoil his or her paper record no more than two times.
(7)	Allow a voter to modify and verify selections on the DRE or BMD without having to reselect all of his or her choices.
(8)	Before the voter causes a third and final record to be printed the VVPAT must present the voter with a warning notice that the selections made on screen shall be final and the voter may see and verify a printout of his or her vote, but must not be given additional opportunities to change their vote.
(9)	When VVPAT components are integrated into a previously certified voting system the new configuration of the voting system must comply with existing state testing and auditing requirements.
(10)	Print a barcode with each record that contains the human readable contents of the paper record. The voting system provider must include documentation of the barcode type, protocol, and/or description of barcode and the method of reading the barcode as applicable to the voting system.
(11)	If used for provisional ballots, the VVPAT must be able to mark paper records as a provisional ballot through the use of human readable text and optionally printing barcode and/or serial number information, which must provide for mapping the record back to the electronic record and the provisional voter for processing after verification in accordance with Article 8.5 of Title 1, C.R.S.
(d)	The VVPAT must meet the following design requirements:
(1)	Allow every voter to review and accept or reject his/her paper record in as private and independent manner as possible regardless of whether the voter has a disability.
(2)	Print at a font size no less than 14-point sans-serif Arial.
(3)	Allow each voter to verify his or her vote on a paper record in the same language that they voted in on the DRE or BMD.
(4)	Prevent tampering with unique keys or seals for the compartment that stores the paper record.
(5)	Print and store paper record copies of at least 75 voted ballots without requiring the paper supply source, ink or toner supply, or any other similar consumable supply to be changed, assuming a fully printed double sided 18 inch ballot with a minimum of 20 contests.
(6)	The printed information on the paper record must contain at least the following items:
(A)	Name or header information of race, question or issue;
(B)	Voter’s selections for the race information;
(C)	Write-in candidate’s names if selected;
(D)	Undervote information;
(E)	Ability to optionally produce a unique serial number (randomized to protect privacy); and
(F)	Identification that the ballot was cancelled or cast.
(7)	Prohibit the voter from leaving the voting area with the paper record.
(8)	The voting system provider must provide documentation describing how to investigate and resolve malfunctions including, but not limited to the following:
(A)	Misreporting votes;
(B)	Unreadable paper records;
(C)	Paper jams;
(D)	Low-ink;
(E)	Misfeeds;
(F)	Lost votes; and
(G)	Power failures.
Amendments to Rules 21.4.13-21.4.16:
21.4.13 21.4.11	Documentation Requirements
(a)	The Secretary of State may rely upon the testing of a voting system performed by a VSTL or by another state upon satisfaction of the following conditions:
(1)	The Secretary of State has access to any documentation, data, reports or similar information upon which the VSTL or another state relied in performing its tests and will make such information available to the public subject to any redaction required by law; and
(2)	The Secretary of State has determined that the tests were conducted in accordance with appropriate engineering standards, and the extent to which the tests satisfy the requirements of sections 1-5-615 and 1-5-616, C.R.S., and all Rules promulgated under those sections.
(b)	In addition to other documentation requirements in this Rule, the voting system provider must provide the following documents:
(1)	Standard issue users/operator manual;
(2)	System administrator’s/application administration manual;
(3)	Training manual and related materials;
(4)	Election definition programming and diagnostics manuals; and
(5)	A list of minimum services needed for the successful, secure and hardened operation of all components of the voting system.
(c)	The voting system provider must provide documentation concerning the use of touch screen or other display and selection technology including:
(1)	Technical documentation describing the nature and sensitivity of the tactile device, if the system uses touch screen technology; and
(2)	Technical documentation describing the nature and sensitivity of any other technology used.
(d) (c)	For the review of VSTL or other state testing in Rule 21.4.12(a) copies of all VSTL or state qualification reports, test logs and technical data packages must be provided to the Secretary of State.
(1)	The voting system provider must execute and submit any necessary releases for the applicable VSTL, state or EAC to discuss any and all procedures and findings relevant to the voting system with the Secretary of State and allow the review by the Secretary of State of any documentation, data, reports, or similar information upon which the VSTL or other state relied in performing its testing. The voting system provider must provide a copy of the documentation to the Secretary of State.
(2)	The voting system provider, the VSTL, the state or the EAC will identify to the Secretary of State any specific sections of documents for which they assert a legal requirement for redaction.
(e) (d)	The voting system provider must provide documentation specifying the steps and times required for charging batteries, and the time of battery operation for each type of device they provide, assuming continuous use of the devices by voters during an interruption of normal electrical power.
(f) (e)	The Secretary of State will review submitted documentation to determine the extent to which the voting system has been tested to federal standards.
(g) (f)	Failure by the voting system provider to provide any documentation will delay processing the application and may be cause for denial of certification.
(h) (g)	The voting system must include detailed documentation, which includes the location and a description of the content of the of audit trail information throughout the system. The audit information applies to:
(1)	Operating Systems (workstation, server, optical ballot scanner, BDM, and DRE);
(2)	Election management system; and
(3)	Election Tabulation Devices – optical scan ballot scanner and DRE.
(i) (h)	The voting system provider must provide documentation detailing voting system security. The documentation must contain configurations, properties and procedures to prevent, detect, and log changes to system capabilities for:
(1)	Defining ballot formats;
(2)	Casting and recording votes;
(3)	Calculating vote totals consistent with defined ballot formats;
(4)	Reporting vote totals;
(5)	Altering of voting system audit records;
(6)	Changing or preventing the recording of a vote;
(7)	Introducing data for a vote not cast by a registered voter;
(8)	Changing calculated vote totals;
(9)	Preventing access to vote data, including individual votes and vote totals, to unauthorized individuals; and
(10)	Preventing access to voter identification data and data for votes cast by the voter such that an individual can determine the content of specific votes cast by the voter.
(j) (i)	The voting system provider must provide documentation detailing the security measures it has in place for all systems, software, devices that act as connectors (upload, download, and other programming devices) and any additional recommended security measures.
(k)	The voting system provider must provide procedures and documentation for the use of the VVPAT.
(l) (j)	For the purpose of evaluating software, the voting system provider must provide detailed information as to the type of hardware required to execute the software.
(m) (k)	The documentation supplied by the voting system must include a statement of all requirements and restrictions regarding environmental protection, electrical service, telecommunications service and any other facility or resource required for the installation, operation and storage of the voting system.
(n)	The voting system provider must provide any available data on problems caused for persons who experience epileptic seizures due to the DRE voting device's screen refresh rate.
(o)	The voting system provider must deliver to the Secretary of State documentation detailing estimated time of battery operation for each type of device submitted for certification, assuming continuous use of the devices by voters during an interruption of normal electrical power.
(p)	The voting system provider must deliver to the Secretary of State documentation specifying the steps and times required for charging batteries for each type of device submitted for certification.
(q) (l)	The voting system provider must submit documentation containing a list of minimum equipment, services, and executables required to run the election management system.
21.4.14 21.4.12	Ballot-level Cast Vote Records and Exports. All voting systems certified by the Secretary of State for use in Colorado on or after January 1, 2016 must meet the following requirements for ballot-level cast vote records and exports on or before December 31, 2016:
(a)	The voting system must capture a ballot-level cast vote record (CVR).
(b)	The voting system must be able to aggregate in a single file and export all CVRs in comma-separated value (CSV) text format.
(c)	The CVR export must contain the following fields, with values or data populated by the voting system:
(1)	CVR Number. A sequential number from one to the number of CVRs in the export file. This can be used as an alternate method to identify each CVR.
(2)	Batch ID. Identifies the batch in which the paper ballot corresponding to the CVR is located.
(3)	Ballot Position. Identifies the position of the paper ballot corresponding to the CVR within the batch.
(4)	Imprinted ID. If the scanner model supports imprinting a unique character string on the ballot during the scanning process, the voting system must populate this field with the unique character string.
(5)	Ballot Style. Indicates the ballot style or type of the paper ballot corresponding to the CVR.
(6)	Device or tabulator ID. Identifies the scanning device by model, serial number, and/or scanning station identifier device or tabulator ID.
(7)	Contest and Choice Names. Each contest and choice on any ballot in the election must have its own field so that voters’ choices in all contests can be easily and independently tabulated after the CVR export is imported into a spreadsheet application.
(8)	Number of Valid Choices. The number of valid choices (e.g., “Vote for 3”) for each contest.
(d)	The header or field names in the CVR export must unambiguously correspond to names of the contests and choices on the paper ballots.
(e)	The contests and choices must be listed in the same order as they appear on the ballots.
(f)	A vote for a choice must be indicated by a “1”. No vote for a choice or an overvoted condition must be indicated by a “0”. Choices that are not applicable to the CVR must be left blank.
21.4.15 21.4.13	Election Night Reporting data and exports. All voting systems certified by the Secretary of State for use in Colorado on or after January 1, 2016 must meet the following requirements for Election Night Reporting data and exports by December 31, 2016:
(a)	The voting system must be able to generate and export results data suitable for use in the Secretary of State’s Election Night Reporting (ENR) system, as specified in the remaining subsections of this Rule.
(b)	The ENR export file must be in a tabular format that uses comma-separated value (CSV) format, or a format based on a range of character positions within a line.
(c)	The ENR export file must contain a header line that defines all of the fields contained in the export file.
(1)	The header names need not exactly correspond to the field names specified subsection (d) of this Rule, but must unambiguously identify the content of each field.
(2)	The order of the fields within the export file may deviate from the order specified in subsection (d) of this Rule.
(3)	Additional fields contained in the ENR export file but not specified or addressed in subsection (d) of this Rule must not contain only alphanumeric characters.
(d)	The ENR export file must include the following items or fields:
(1)	Precinct Name. If the county defines the election to report results by precinct, an alphanumeric string consisting of a 10-digit precinct code.
(2)	Ballot Style Name. If the county defines the election to report results by ballot style or district, a unique, alphanumeric string for each ballot style.
(3)	Precinct ID. If the county defines the election to report results by precinct, a unique integer for each precinct or precinct split.
(4)	Registered Voters. The number of registered voters eligible to vote each unique ballot style, or in each precinct or precinct split, as applicable.
(5)	Ballots counted. The number of ballots counted for each unique ballot style, or each precinct or precinct split, as applicable.
(6)	Contest Name. The contest name as it appears on the ballots. If the contest name contains a carriage return(s) return for ballot formatting purposes, then the carriage return(s) return must not appear in the export.
(7)	Contest ID. A unique integer for each contest.
(8)	Contest Sequence Number. A unique integer that defines the sequence of contests as they appear on the ballots.
(9)	Votes Allowed. The maximum number of choices that a voter may select in each contest (e.g., “Vote for 2”).
(10)	Choice Name. The choice name as it appears on the ballots. Party affiliation may not be included in the choice name.
(11)	Choice ID. A unique integer for each choice within a contest.
(12)	Party Code. An indicator of party affiliation for each choice, if applicable.
(13)	Vote Count. The total number of votes for each choice.
(14)	Reporting Flag. The reporting flag field must contain a value of “0”.
(15)	Precinct Sequence Number. A unique integer that defines the sequence of precincts.
(16)	Choice Sequence Number. A unique integer that defines the sequence of candidates as they appear on the ballot.
21.4.16 21.4.14	Central Ballot Counting Functionality. All voting systems certified for use in Colorado by the Secretary of State on or after January 1, 2016, must meet the following functional requirements for centrally counting ballots:
(a)	Digital Ballot Adjudication: The voting system must include a digital ballot adjudication software application, enabling election judges to resolve, adjudicate, and duplicate ballots with marginal or ambiguous voter markings digitally rather than manually.
(b)	Ballot Scanners. The voting system must include central count ballot scanners equipped with automatic document feeders, enabling election judges to scan multiple ballots rather than a single ballot at a time.
21.5	Testing preparation procedures
21.5.1	Voting system provider demonstration
(a)	The voting system provider must demonstrate the submitted voting system to the Secretary of State prior to any functional testing.
(b)	The demonstration period does not have a predetermined agenda for the voting system provider to follow; however, presentations should be prepared to address and demonstrate the following items as they pertain to each area and use within the voting system, if applicable:
(1)	System overview;
(2)	Verification of complete system matching EAC certification;
(3)	Ballot definition creation;
(4)	Printing ballots on demand;
(5)	Hardware diagnostic testing;
(6)	Programming election media devices for various counting methods including:
(A)	Mail ballots;
(B)	In-person ballots; and
(C)	Provisional ballots;
(7)	Sealing and securing system devices;
(8)	Logic and accuracy testing;
(9)	Processing ballots;
(10)	Accessible use;
(11)	Accumulating results;
(12)	Post-election audit;
(13)	Canvass process handling;
(14)	Audit steps and procedures throughout all processes;
(15)	Certification of results; and
(16)	Troubleshooting.
(c)	The voting system provider will have access to the demonstration room for one day prior to the start of the demonstration to provide time for setup of the voting system.
(d)	A maximum of one business day is normally allowed for the demonstration. If the voting system provider requests more time for the demonstration or, if the Secretary of State finds that the complexity of the system is such that more time is needed for a demonstration, more time may be granted.
(e)	The demonstration will be open to representatives of the press and the public to the extent allowable. The Secretary of State may limit the number of representatives from each group to accommodate space.
(f)	The Secretary of State will post notice of the fact that the demonstration will take place in the designated public place for posting such notices for at least seven days prior to the demonstration. The notice must indicate the general time frame during which the demonstration may take place and the manner in which members of the public may obtain specific information about the time and place of the test.
21.5.2	Certification testing
(g) (a)	The voting system provider must provide the same class of workstation and/or server for testing the voting system as the normal production environment for the State of Colorado.
(h) (b)	Based upon the review of VSTL or other state reports and test records, the Secretary of State will prepare a test plan. The test plan will be designed to test for any requirements specific to Colorado law which were not addressed in prior testing and for any federal or Colorado requirements which were not addressed to the satisfaction of the Secretary of State in the reports and records from prior testing.
(i) (c)	The test plan must include the election definitions to be used in testing and specifications for test ballots. Test ballots and election definitions must generally follow all requirements for election definitions, ballot layout and printing to verify the system’s ability to meet those requirements. Some election definitions and ballots may depart from the requirements in order to test specific functions.
(j) (d)	For each system tested, a requirements matrix must be prepared to identify those requirements satisfied by the review of VSTL or other state reports and test data and how those requirements not satisfied are to be tested or otherwise satisfied. If during test planning or testing one of the requirements in the voting systems standards or in this Rule are determined to be not applicable to the system under test, the reason for the determination will be documented.
(k) (e)	The voting system provider must submit for testing the specific system configuration that will be offered to jurisdictions including the components with which the voting system provider recommends the system be used.
(l) (f)	The voting system provider is not required to have a representative present during the functional testing, but must provide a point of contact for technical support. After the delivery, unpacking, and initial inspection of the equipment for shipping damage and missing components, a vendor representative will only be allowed to operate or touch the equipment when approved by the Secretary of State. All such activity by a vendor representative must be documented on video or in writing.
(m) (g)	The proprietary software must be installed on the workstation/server and all applicable voting system components by the Secretary of State or the VSTL using the trusted build following the installation procedures provided by the voting system provider. After installation, hash values for the software and firmware must be compared to any published hash values of the trusted build. Any mismatches in hash values will be investigated and resolved before proceeding with testing.
(n) (h)	All equipment must be hardened using the voting system provider’s procedures and specifications.
(o) (i)	Testing must be performed with test election definitions and test ballots as required in the test plan.
(p) (j)	The results of all testing must be recorded in the requirements matrix. The requirements matrix will be the primary record describing which requirements were met and specifying which were not. It must be supplemented as necessary to support the findings with test team notes and system reports. Supplemental information may include photographs and audio or video recordings.
(q) (k)	Functional testing must be completed according to the phases identified in Rule 21.2.3.
(r) (l)	The Secretary of State or the VSTL must conduct functional testing on the voting system based on this Rule.
(s) (m)	The voting system must receive a pass, fail or not applicable for each requirement with appropriate notation in the requirements matrix.
(t) (n)	The Secretary of State will maintain records of the test procedures in accordance with Rule 21.3.7. The records must identify the system and all components by voting system provider name, make, model, serial number, software version, firmware version, date tested, test number, test plan, requirements matrix, test team notes, and other supplemental information, and results of test. The test environment conditions must be described.
(u) (o)	In the event that a deviation from the test plan is required, it must be documented in a test team note. The note must provide a description of the deviation, the reason for the deviation and effect of the deviation on testing and determining compliance with requirements.
Amendments to Rule 21.5.2(d), (e), and (h): 
21.5.2 21.5.3	General testing procedures and instructions
(d)	For mark-sense or optical scan ballot scanner devices, the Secretary of State or the VSTL will prepare 100 or more test ballots with marking devices of various color, weight and consistency to determine the range of marks that can be read and the range and consistency of reading marginal marks.
(e)	Ballots must be cast and counted in all applicable counter types (or counter groups) as necessary based on the parts included in the voting system. These are, at a minimum, in-person, mail, and provisional ballots. Ballots may be run through components more than one time depending on components and counter group being tested to achieve a minimum number of ballots counted as follows for each group:
(1)	Polling location / OS = 1,000;
(2) (1)	Polling location / DRE or BMD = 500;
(3) (2)	Mail = 1, 500; and
(4) (3)	Provisional = 500.
(h)	The public must be allowed to view all functional testing conducted by the Secretary of State. However, legal limitations may require that certain testing, including but not limited to proprietary information and system security, be done outside the view of the public. If the functional testing is outsourced to a testing lab VSTL or contractor, public viewing is subject to limitations set forth by the testing lab VSTL or contractor.
Amendments to Rule 21.6:
21.6	Temporary use
21.6.1	If a voting system provider has a system that has not yet been approved for certification through the Secretary of State, the voting system provider or the designated election official may apply to the Secretary of State for temporary approval of the system to be used for up to one year.
[Current Rule 21.6.3 is renumbered as Rule 21.6.2; subsequent rule is also renumbered]
21.6.3 21.6.2	Temporary use does not supersede the certification requirements or process, and may be revoked at any time at the discretion of the Secretary of State.
21.6.2 21.6.3	Upon approval of temporary use, a jurisdiction may use the voting system, or enter into a contract to rent or lease the voting system for a specific election upon receiving written notice from the Secretary of State’s office. At no time may a jurisdiction enter into a contract to purchase a voting system that has been approved for temporary use.
Amendments to Rule 21.10.12:
21.10.12	Copies of electronic media and supporting documentation for escrow within the Secretary of State will be sent to:
Colorado Secretary of State
Attn: Voting Systems Specialist
1700 Broadway – Suite 200
Denver, CO 80290
Amendments to Rule 25.2.2(a) concerning risk limiting audit:
25.2.2	Preparing for the audit
(a)	Risk limit. No later than 32 days before election day, the Secretary of State will establish and publish on the Audit Center the risk limit(s) limits that will apply in RLAs for that election. The Secretary of State may establish different risk limits for comparison audits and ballot polling audits, and for audits of statewide and countywide contests. In comparison audits the risk limit will not exceed five percent for statewide contests, and ten percent for countywide contests.
New Rule 26 concerning ranked voting:
Rule 26. Ranked Voting Method
26.1	Definitions. As used in this Rule, unless stated otherwise:
26.1.1	“Continuing candidate” means a candidate who has not been eliminated but is not a winning candidate.
26.1.2	“Duplicate ranking” means a voter marked more than one ranking for a candidate.
26.1.3	“Overvote” means a voter marked more than one candidate with the same ranking.
26.1.4	“Ranking” means the voter’s assigned number or the numeric position for a candidate to express the voter’s preference for that candidate. Ranking number one is the highest rank, ranking number two is the next-highest rank, and so on.
26.1.5	“Skipped ranking” means a voter did not rank candidates in numerical order (e.g., voter ranks top candidate with a “1” and second candidate with a “3”, or leaves a ranking blank).
26.1.6	“Surplus votes” means the votes cast for a winning candidate in excess of the winning threshold that may be transferred to a continuing candidate.
26.1.7	“Surplus fraction” means a fraction calculated by dividing the surplus votes by the total votes cast for the winning candidate, calculated to four decimal places, ignoring any remainder. Surplus fraction = (surplus votes of a winning candidate)/(total votes cast for winning candidate), calculated to four decimal places, ignoring any remainder.
26.1.8	“Transfer” means assigning the vote of an eliminated candidate or the surplus vote of a winning candidate to the next-highest-ranked continuing candidate.
26.1.9	“Transfer value” means the fraction of a vote that a transferred ballot will contribute to the next ranked continuing candidate on that ballot. The transfer value of a vote cast for a winning candidate is limited to four decimal places, ignoring any remainder.
26.1.10	“Winning candidate” means a candidate who is elected after receiving at least 50 percent plus one vote in an instant-run-off election, or after reaching the winning threshold required in a single-transferrable-vote election, or because the number of continuing candidates and other winning candidates is less than or equal to the number of seats to be filled.
26.1.11	“Winning threshold” means the number of votes sufficient for a candidate to be elected. In any given election, the winning threshold equals the total votes counted in the first round of tabulation, divided by the sum of one plus the number of offices to be filled, then adding one, disregarding any fractions. Winning threshold = ((Total votes cast)/(Seats to be elected + 1)) +1, with any fraction disregarded.
26.2	A local government may only conduct a ranked voting election if there are three or more candidates who have qualified for the ballot for that contest, or when there is a combination of at least two candidates who have qualified for the ballot for that contest plus at least one qualified write-in candidate.
26.3	A local government conducting a ranked voting election that is coordinating with the county clerk must give notice to the county clerk no later than 100 days before the election. If the county’s voting system is not capable of conducting a ranked voting election, the county clerk is not required to coordinate.
26.4	The designated election official of a jurisdiction that will conduct an election using a ranked voting method must provide voter instructions.
26.4.1	The voter instructions must include, at a minimum:
(a)	a brief explanation of ranked voting;
(b)	instructions on how to properly mark a ballot;
(c)	a description of how ballots will be counted;
(d)	an example of a properly marked paper ballot;
(e)	for instructions that will be posted at a polling location, an example of how to properly vote an in-person ballot; and
(f)	contact information for the designated election official of the election.
26.4.2	In a coordinated election, the county clerk must include the instructions in the county’s mail ballot plan.
26.5	The designated election official of a jurisdiction conducting a ranked voting election must include instructions on the ballot showing how to properly mark the ballot. For elections in which ranked voting is not the only voting method used, the designated election official must place the ranked voting races on a separate ballot card and report results of ranked voting races by precinct.
26.6	Tabulation of instant-run-off elections
26.6.1	In any ranked voting election in which only one candidate will be elected to office, the designated election official must follow the tabulation procedures described in this rule.
26.6.2	During the first round of tabulation, the designated election official must tabulate the first-choice ranks on each ballot.
(a)	A candidate who receives over 50 percent of the first-choice ranks on each ballot is the winning candidate and no further rounds of tabulation will take place.
(b)	If no candidate receives over 50 percent of the first-choice ranks on each ballot, the designated election official must continue to the next round.
26.6.3	During the second round of tabulation, the candidate with the fewest first-choice ranks in the first round is eliminated and the eliminated candidate’s votes are transferred to each ballot’s next-ranked continuing candidate.
(a)	If, after receiving the transferred votes, a continuing candidate receives over 50 percent of the votes cast, that candidate is the winning candidate and no further rounds will take place.
(b)	If no candidate has over 50 percent of the votes cast after the second round, the designated election official must repeat additional rounds as described in this Rule, until there is a winning candidate.
26.6.4	In any round, two or more candidates may be eliminated simultaneously if those candidates’ combined votes in that round are less than the number of votes for the candidate with the next-highest number of votes.
26.6.5	In any round, if two or more candidates tie for the lowest number of votes, the eliminated candidate must be chosen by lot, unless the candidates may be eliminated simultaneously under Rule 26.6.4. 
26.6.6	If only two continuing candidates remain after a round and they have the same number of votes, the winning candidate must be chosen by lot. 
26.6.7	The designated election official need not begin a second round of tabulation until the ninth day after the election. 
26.7	Tabulation of ranked voting elections using the single-transferable-vote method
26.7.1	In any ranked voting election where more than one candidate will be elected to an office, the designated election official must follow the tabulation procedures described in this rule.
26.7.2	During the first round of tabulation, the designated election official must tabulate the first-choice ranks on each ballot.
(a)	If the number of winning candidates is equal to the number of seats to be filled, then no further rounds will take place.
(b)	If the number of winning candidates is less than the number of seats to be filled, the designated election official continues to the next round.
26.7.3	During the second round, the continuing candidate who received the fewest first-choice votes in the first round is eliminated and that candidate’s votes are transferred to each ballot’s next-highest-ranked continuing candidate.
(a)	After the votes are transferred, if the number of winning candidates is equal to the number of seats to be filled, no further rounds will take place.
(b)	After the votes are transferred, if the number of winning candidates is less than the number of seats to be filled, the designated election official must calculate each winning candidate’s surplus votes, as described in Rule 26.7.4, and transfer those votes proportionately to any continuing candidates.
(c)	After each winning candidate’s surplus votes are transferred, if the number of winning candidates is equal to the number of seats to be filled, no further rounds will take place.
(d)	After each winning candidate’s surplus votes are transferred, if the number of winning candidates is less than the number of seats to be filled, the designated election official must conduct additional rounds until all seats are filled.
26.7.4	To calculate a winning candidate’s surplus votes in any round, the designated election official must:
(a)	Determine which winning candidate received the most votes in any round. 
(1)	In the first round, this will only include first-choice votes cast for the winning candidate. 
(2)	In subsequent rounds, this will include first-choice votes cast for the winning candidate, votes transferred from eliminated candidates, and surplus votes from other winning candidates.
(3)	If two or more winning candidates tie for the most votes in any round, the designated election official must first count the surplus votes of the candidate chosen by lot.
(b)	After determining which winning candidate received the most votes in any round, calculate that candidate’s surplus fraction.
(c)	After calculating a winning candidate’s surplus fraction, tabulate the number of votes cast for the next-highest-ranked continuing candidate on every ballot cast for the winning candidate. Then multiply each of those votes cast by the winning candidate’s surplus fraction and add the resulting transfer value to any continuing candidate’s total as described in Rule 26.7.3(b).
(d)	In any round with more than one winning candidate, repeat this process for each winning candidate in the order of highest votes received.
26.7.5	In any round, if two or more candidates tie for the lowest number of votes, the designated election official must determine the eliminated candidate by lot. 
26.7.6	The designated election official may not begin tabulation until the ninth day after the election. 
26.8	After determining voter intent in accordance with the Secretary of State’s Voter Intent Guide, the designated election official must count improperly marked ballots as follows:
26.8.1	An overvote invalidates the overvoted rankings and all lower rankings marked for that contest on the ballot.
26.8.2	A skipped ranking and any lower ranking must be ignored, except that if the voting system is capable of detecting that the voter has ranked all remaining candidates after a skipped ranking, the remaining rankings must be counted.
26.8.3	A candidate who receives a duplicate ranking on a single ballot is credited with the highest ranking marked by the voter. All other rankings for that candidate must be ignored. 
26.9	Reporting results of a ranked voting election
26.9.1	The designated election official must ensure anonymity of a voter’s rankings in the ballot image report required by section 1-7-1003 (7)(a)(II), C.R.S. In precincts with ten or fewer voters, the ballot image reports must be combined with another precinct.
26.9.2	The comprehensive report required by section 1-7-1003 (7)(a)(III), C.R.S., must include results in the summary report by precinct.
26.9.3	The designated election official must submit the final reports required by section 1-7-1003 (7)(a), C.R.S., to the Secretary of State no later than the twenty-second day after the election.
26.10	Auditing a ranked voting election or race. The designated election official must audit each ranked voting race in accordance with this Rule before the canvass board certifies official election results.
26.10.1	In a coordinated election, if all winning candidates are determined in the first round of tabulation, the county clerk must conduct a risk-limiting audit under Rule 25.2. In all other cases, the audit board must verify the accuracy of the voting system’s tabulation of the ranked voting contest by hand counting the votes in at least one precinct, or in one percent of all precincts in which the ranked voting contest appeared on the ballot, whichever is greater.
26.10.2	No later than 15 days before election day, the designated election official must appoint an audit board.
(a)	In a coordinated election, the audit board must consist of electors nominated by the major political party county chairpersons, except as otherwise provided by an intergovernmental agreement.
(b)	In any other election, the members of the audit board must be nominated and appointed as provided by applicable law or ordinance.
(c)	At least two members of the canvass board must observe the audit, and members of the canvass board may serve as members of the audit board.
(d)	The designated election official, members of their staff, and other duly appointed election judges may assist the audit board in conducting the audit.
26.10.3	The designated election official must convene a public meeting on the tenth date after election day to randomly select by lot the precinct or precincts to be audited. The designated election official must post notice of the public meeting at least seven calendar days in advance. The notice must include a description of the random selection lot method. The designated election official must give notice of and submit to the Secretary of State a list of the precincts randomly selected for audit by 5:00 p.m. on the tenth day after election day.
26.10.4	Conducting the audit.
(a)	The audit board must locate and retrieve all ballot cards containing the ranked voting contest for the randomly selected precincts from their storage containers, and verify and maintain documented chain-of-custody of all voted ballots.
(b)	The audit board must first confirm that the number of ballot cards located and retrieved for the audit equals the number of ballot cards with the ranked voting contest tabulated in each randomly selected precinct.
(c)	For each ranked voting contest, the audit board must hand count the ballots cast, following the counting method set forth in Rule 26.6 for instant-runoff-voting contests, and in Rule 26.7 for single- transferable-voting contests. 
26.10.5	The designated election official must report the results of the audit to the Secretary of State by mail, fax, or email by 5:00 p.m. on the last day to canvass. The audit report must contain:
(a)	The number of ballots audited for each ranked voting contest; 
(b)	The voting system’s tabulation of the ranked voting contests for the randomly selected precincts;
(c)	The audit board’s hand count of the ranked voting contests for the randomly selected precincts; 
(d)	The audit board’s statement that its hand count confirmed the voting system’s tabulation or an explanation for any discrepancies identified; and
(e)	The signatures of the audit board, the canvass board members who observed the audit, and the designated election official.
26.10.6	The designated election official must segregate and seal and preserve as election records all materials used during the ranked voting audit, including all tabulation reports, the audited ballots, and the audit report.