Amendments Adopted May 30, 2007
COLORADO SECRETARY OF STATE
8 CCR 1505-1
ELECTION RULES

New Rule 2.9 is adopted as follows:
2.9	Registration of Homeless Voters.
2.9.1	For the purpose of voter registration residence a homeless voter may identify a specific location within a precinct that the voter considers his home base to which the voter returns regularly and manifests an intent to remain, and a place from which he or she can receive messages and be contacted.  A home base may include a homeless shelter, a homeless provider, a park, a campground, a vacant lot, a business address, or any other physical location.
2.9.2	If the home base does not include a mailing address, then the homeless voter must provide a mailing address pursuant to section 1-2-204(2)(f), C.R.S.
2.9.3	A post office box or general delivery at a post office shall not be deemed a home base.

Rule 10.4 is amended to read as follows:
10.4	Candidates whose names are listed on a ballot must provide an audio recording of the pronunciation of their name to the Secretary of State prior to the election for offices that are voted on by the electors of the entire state, or of a congressional district, or for the offices of members of the general assembly or district attorney or a district office of state concern.  
10.4.1	For candidates designated by a major or minor party, such audio recording shall be provided no later than the last day upon which the candidate acceptance may be filed with the Secretary of State in accordance with Article 4 of title 1, C.R.S.
10.4.2	For candidates nominated by petition, such audio recording shall be provided no later than the last day upon which the petition of nomination and candidate acceptance may be filed with the Secretary of State in accordance with Article 4 of title 1, C.R.S.
10.4.3	For unaffiliated candidates for president who seek placement on the General Election ballot by submitting a candidate’s statement of intent and a filing fee to the Secretary of State in accordance with section 1-4-303(1), C.R.S,, such audio recording shall be provided no later than the last day upon which the candidate’s statement of intent may be.
10.4.4	For district and county judges seeking retention, such audio recording shall be provided no later than the date upon which the declaration of intent to run for retention in a judicial office may be filed with the secretary of State in accordance with Article VI, Section 25 of the Colorado Constitution.

New Rule 11.5.4.3 is adopted as follows:
11.5.4.3	Pursuant to section 1-7-514, only devices used in the election shall be selected for the audit.
Succeeding sections of Rule 11.5.4 are renumbered accordingly.

Rule 11.6.3 is amended to read as follows:
11.6.3	Storage
11.6.3.1	The storage of the V-VPAT records must be consistent with storage of Paper Ballots pursuant to section 1-7-802.
11.6.3.2	Individual spools containing V-VPAT records must contain the following catalog information affixed to the spool:
(a)	Date and Name of Election;
(b)	Name of Voting Location;
(c)	Date(s) and Time(s) of Voting;
(d)	Machine Serial Number of DRE Associated with the Record; and
(e)	Number of spools associated with this machine for this election (i.e. “Spool 1 of 1”, or “Spool 1 of 2”, etc.).
11.6.3.3	Light sensitive storage containers shall be used for the 25 month storage period to ensure the integrity of the V-VPAT paper record.  Containers shall be sealed, with record of the seal numbers maintained on file and signed by two elections officials.
11.6.3.4	A master catalog shall be maintained for the election containing the complete total number of V-VPAT spools used in the election.

Rule 12.1 is amended to read as follows:
12.1	Definitions.
12.1.1	A secrecy sleeve or secrecy envelope shall be sealed or closed on at least two sides, one of which shall be the bottom of the sleeve.
12.1.1.1	The secrecy sleeve or secrecy envelope shall be uniform within each type of absentee or mail ballot voting system used in the State of Colorado.  Each secrecy sleeve or secrecy envelope used in the State of Colorado in any mail ballot or absentee ballot election shall contain the following required language, approved by the Secretary of State, regarding identification requirements of voters who have registered by mail:
(a)	“First Time Voters Who Register By Mail”
	If you registered in your county by mail, and did not provide identification with your registration application, a copy of one of the forms of identification listed in Rule 2.7 is required with your mail ballot or your absentee ballot.

Rule 12.3 is amended to read as follows:
12.3	Notice of elections.
12.3.1	Call and notice.
(a)	Notice of the election is to be sent to the clerk and recorder of the county in which the election is to be held.  The notice is to include the date by which the list of registered electors is to be submitted to the political subdivision.
(b)	For multi-county political subdivisions, the notice sent to each clerk and recorder shall also include the names of all other counties in which the election will be held.
12.3.2	As soon as possible, but no later than 55 days prior to an election, a written plan must be submitted to the Secretary of State which includes the following:
(a)	Date of the election;
(b)	Type and name of jurisdiction involved in the election;
(c)	Description of the type of election to be conducted;
(d)	Citation of the statute or home rule charter provisions authorizing the election;
(e)	Estimated number of eligible electors;
(f)	Name of the designated election official who will be responsible for all aspects of the election;
(g)	Indication of whether the county clerk and recorder will assist in the election for the entity other than by providing a list of registered electors and other information required by statute;
(h)	Total number of “places of deposit”.  For security reasons, unmonitored freestanding places of deposit located outside will not be allowed;
(i)	For elections coordinated by the county clerk and recorder, the total number of walk-in voting locations;
(j)	Number of accessible voting machines anticipated being used for walk-in voting locations in elections coordinated by the county clerk and recorder;
(k)	Length of time accessible voting machines will be available for walk-in voting in elections coordinated by the county clerk and recorder;
(l)	Written timetable for the conduct of the election in accordance with the statute;
(m)	Indication of how postage will be handled for ballot packets returned as undeliverable (e.g. “return postage guaranteed”);
(n)	Indication of procedures to be followed to ensure compliance with statutes and rules, including persons responsible for each stage;
(o)	Description of procedures to be used to ensure ballot security at all stages of the process;
(p)	Description of procedures for maintaining privacy and security of accessible voting machines to be used in an election coordinated by the county clerk and recorder;
(q) Description of procedures to be used for signature verification;
(r)	Description of procedures to ensure privacy by use of a secrecy sleeve or secrecy envelope so receiving judges cannot tell how the elector voted;.
(s)	Description of procedures to be used to reconcile ballots issued, ballots received, defective ballots and substitute ballots; and
(t)	An actual sample of the secrecy sleeve or secrecy envelope to be used in the mail ballot election.
12.3.3		For elections coordinated by the county clerk and recorder, a security plan shall be submitted in accordance with Rule 43 in addition to the mail ballot plan submitted in accordance with this Rule.
12.3.4	Written timetable specifications:
(a)	The designated election official shall prepare a written timetable for conducting the mail ballot election with specific dates or range of dates when each activity is to be completed;
(b)	The timetable shall include the following dates:
(1)	Copy of written plan to governing body;
(2)	Date of approval of election by governing body;
(3)	Date of submission of written plan to Secretary of State’s office;
(4)	Anticipated date of approval by Secretary of State;
(5)	Date of publication of notice of election;
(6)	Date of notice of election to the county clerk;
(7)	Date of notice of election to the county assessor, if property owners are eligible to vote in the election;
(8)	Date of close of registration;
(9)	Date by which the county clerk and recorder must submit the list of eligible electors to the political subdivision and, if property owners are eligible to vote in the election, the date by which the county assessor must submit the list of property owners;
(10)	For elections coordinated by the county clerk and recorder, date notice will be given to voters of walk-in voting and accessible voting options;
(11)	Date ballots will be mailed;
(12)	Date verification and counting of ballots will begin; and
(13)	Date of the election.

Rule 12.9 is amended to read as follows:
12.9	Ballots Delivered in Person.
12.9.1	All “places of deposit” shall be accessible to disabled electors.
12.9.2	All “places of deposit” and any walk-in voting locations shall be located within the political subdivision where feasible.  If a political subdivision desires to establish a “place of deposit” or a site for walk-in voting outside of the county, municipality or district, permission must be obtained from the Secretary of State.  
(a)	The designated election official shall state the reasons 	for requesting such exception in the mail ballot plan 	submitted to the Secretary of State for approval.
(b)	The alternate location proposed by the designated election official shall be within reasonable proximity to the political subdivision or the majority of the electors of the political subdivision. 
12.9.3	Any eligible elector may deliver in person to the designated or coordinated election official’s office no more than 5 voted mail ballots from members of his or her household. 

Rule 12.10.4 is amended to read as follows:
12.10.4	The election judge issuing a replacement ballot shall indicate on the outside of the return envelope whether a sworn statement must be returned with the voted ballot.  No replacement ballot shall be counted until it has been determined that an affidavit has been completed by the voter and has been received on or before election day by the election official.

New Rule 12.11 is adopted as follows:
12.11	Surrender of Mail Ballot
12.11.1	In an election coordinated by the county clerk and recorder, any voter may surrender a mail ballot to the designated election official and vote in-person on the accessible device provided for the election as required by section 1-5-705 C.R.S.
12.11.2	The election judge receiving the surrendered ballot shall indicate on the outside envelope that the ballot is cancelled.  The voter’s record shall be updated to give the voter credit for voting in a manner that maintains the secrecy of the ballot.
12.11.3	Any accessible device used in accordance with this rule shall be subject to the privacy, security and accuracy standards set forth in the Election Rules and Title 1, C.R.S.  
Succeeding subsections of Rule 12 are renumbered accordingly.

Rule 12.12 is amended to read as follows:
12.13	Judges Duties.
12.13.1	The judges shall record the results of the election on the judges’ certificate and statement.
12.13.2	The judges shall deliver the results of the election to the designated election official along with all election materials.
12.13.3	The judges shall deliver all election materials bound separately as follows:
(a)	Ballots which were counted;
(b)	Ballots which were defective, as defined in 1-7-309(4);
(c)	Additional ballot pages returned after the voter cast his/her ballot that were appropriately marked and not counted in accordance with rule 12.4.1;
(d)	Ballots/ return envelopes which may be challenged;
(e)	Return envelopes with ballots removed;
(f)	Defective return envelopes with ballots inside;
(g)	Ballot packets which were returned as undeliverable.

Succeeding subsections of Rule 12 are renumbered accordingly.

Rule 14.6 is amended to read as follows:
14.6	Counting of Ballots - Recount
14.6.1	All voting equipment to be used in the recount must be tested prior to the recount, utilizing the procedures set forth in this section.  Prior to the recount, the canvass board shall choose at random and test Voting Devices and precinct(s) to be utilized as a test deck for purposes of section 1-10.5-102.  The purpose of a test deck is to assure the tabulation machines are counting properly.  The devices chosen shall contain at least five (5) ballots cast.  A hand tally shall be conducted of the selected devices pursuant to section 1-10.5-102(3)(a).  The totals of the recounted contest obtained from the test devices and precinct(s) reports from close of polls shall be compared to the hand-tallied total.
14.6.2	The canvass board shall choose at random five percent (5%) of voting devices containing votes from the election, which are affected by the recount, for the test.
(a)	Prior to the start of the test, the canvass board shall verify that devices randomly chosen were not used in the audit conducted pursuant to section 1-7-514 (1)(b).
(b)	The proportion of Optical Scan devices to DRE/electronic voting devices selected for the test shall match the proportion of machines used in the election by the designated election official.
(c)	At least one device selected for the test shall be a central count/absentee ballot scanner.
14.6.3	For testing central count/absentee scanners the canvass board shall randomly select one percent (1%) or fifty (50) ballots, whichever is greatest.  A blank prom cartridge, rom cartridge or memory card shall be utilized for the test.  The ballots selected shall be processed through the central count/absentee scanner and compared to the hand-tallied total.
14.6.4	If the test deck totals differ from the hand count totals, and the discrepancy cannot be accounted for by voter error, all ballots containing the recounted contest shall be tallied by hand following procedures for paper ballot recounts.  If the test deck totals are exactly the same, the recount tabulation shall be conducted in the same manner as the original ballot count in accordance with section 1-10.5-102(3)(b).

Succeeding subsections of Rule 14.6 are renumbered accordingly.

Rule 14.7 is amended to read as follows:
14.7	Counting of Ballots Using the “Ballot Now” Voting System
14.7.1	In the case of a recount, the designated election official shall identify all precincts with the contest(s) designated for a recount using the following procedures:
(a)	Using the Ballot Now Scanned Ballots by Precinct report from the original election database, locate the batches containing any ballot type (Election, Absentee, and Provisional) for the recount.
(b)	Remove ballots from each batch and label them as “Recount”.
14.7.2	Required scanner testing shall be performed using a test deck from at least three (3) randomly chosen precinct(s) with at least 150 ballots total as prescribed by statute, following testing procedures outlined in the State of Colorado Procedures for the use of the Ballot Now Voting System.  A Recount Test spreadsheet shall be created based on the chosen precinct in the same fashion as the ballot options test spreadsheet.	

Rule 32.2 is amended to read as follows:
32.2  Signature requirements
32.2.1	For petitions to recall school district directors the petition must be signed by the eligible electors of the director’s district equal in number to at least 40% of the ballots cast in the district in the last preceding election at which the director to be recalled was elected as indicated by the pollbook or abstract for the election. See section 1-12-105, C.R.S.
32.2.2   When determining the number of required valid signatures for an elected office for which electors were allowed to vote for more than one candidate in a single race, the signature requirements shall be based on the number of ballots cast for that race as indicated by the pollbook or abstract for the election.

Rule 43 is amended to read as follows:
Rule 43.  County Security Procedures
43.1	Definitions
43.1.1	“Chain of custody log” shall, for the purposes of this rule mean a written record that shows that the equipment and all associated data are secured according to these procedures and in the documented control of an employee or deputized election judge through the entire time of ownership by the jurisdiction.
43.1.2	“Continuous video security surveillance recording” shall, for the purposes of this rule, mean video monitoring by a device which continuously records a designated location.  Alternatively, this definition may be met by the use of a “non-continuous” recording, provided that a device is used which samples the functionality of the video recorder without interruption, evaluates the detector response at least once every 15 seconds, and computes and records the average value at least every 60 seconds, except during allowable periods of calibration.
43.1.3	“DRE” means a direct recording electronic voting device.  A DRE is a voting device that records votes by means of a ballot display provided with mechanical or electro-optical components or an audio ballot that can be activated by the voter; that processes data by means of a computer program; and that records voting data and ballot images in memory components or other media.  The device may produce a tabulation of the voting data stored in a removable memory component and as printed copy. The device may also provide a means for transmitting individual ballots or vote totals to a central location for consolidating and reporting results from remote sites to the central location. 
43.1.4	“Employee” shall, for the purposes of this rule, mean all full-time, part-time, permanent and contract employees of the county who have had a criminal history check conducted in accordance with Rule 11.2 and are deputized by the county clerk and recorder to prepare or maintain the voting system or election setup materials, staff the counting center and who have any access to the electromechanical voting systems or electronic vote tabulating equipment.
43.1.5	“Removable card or cartridge” shall, for the purposes of this rule, mean all programming cards or cartridges except voter activation cards that store firmware, software or data.
43.1.6	“Trusted Build” means the write-once installation disk or disks for software and firmware for which the Secretary of State or his/her agent has established the chain of evidence to the building of a disk, which is then used to establish and/or re-establish the chain of custody of any component of the voting system which contains firmware or software.  The trusted build is the origin of the chain of evidence for any software and firmware component of the voting system.
43.2	Pursuant to section 1-5-616(5), C.R.S., each county shall file with the Secretary of State a security plan that meets or exceeds the standards set forth in this rule.  The plan filed with the Secretary of State in accordance with this rule shall provide a point by point detailed response with a proposed solution to each of the requirements set forth in this rule.
43.3	The county shall file security procedures annually no later than sixty (60) days prior to the first election in which the procedures will be used.  
43.4	If no changes have occurred since the last security procedures filed, the county shall file a statement to that effect.
43.5	Revisions to previously filed security procedures shall clearly state which part of the procedures previously filed have been revised. 
43.6	Each designated election official may change the security procedures within sixty (60) days of an election as a result of an emergency situation or other unforeseen circumstance, and document any changes.  The designated election official shall file any revisions with the Secretary of State within five (5) days of the change.
43.7	If, pursuant to section 1-5-616(5)(b), C.R.S., the Secretary of State is unable to complete its review, the procedures or revisions shall be temporarily approved until such time as the review is completed.  The Secretary of State shall notify the county of temporary approval. 
43.8	Security Procedures shall at a minimum include, if applicable:
43.8.1	General Requirements:
a.	At all times removable memory cards and cartridges shall be handled in a secure manner as follows.  When not sealed in voting machines, all removable cards and cartridges shall be transferred and stored in secure containers with at least one tamper-evident seal with printed serial numbers.  The integrity and serial number of each seal shall be verified by election judges or county personnel at shipping and receiving locations.
b.	All documentation of seals, chain of custody, and other documents related to the transfer of equipment between parties shall be maintained on file by the county clerk and recorder and is subject to inspection by the Secretary of State.
c.	The chain of custody for each voting device must be maintained and documented throughout ownership or leasing of the device by the county clerk and recorder.
d.	Only deputized clerks, election judges, or canvass board members sworn under oath are allowed to handle ballots, which include V-VPAT records.
e.	No additional or modified software developed by the Vendor that is not specifically listed on the Secretary of State’s certificate and verified against the state trusted build shall be installed on any component of the voting system.  Nothing in this rule shall preclude the use of commercial off-the-shelf-software, provided that the COTS software is included in the certified list of services and executables for the certified voting systems.
f.	Any form or log containing “date” means to note the month, calendar day, year, hour, minute, and whether the time is a.m. or p.m.
43.8.2	Physical Locking Mechanisms and Seals
a.	DREs. all DRE voting devices shall have industry standard, commercial off the shelf tamper-evident seals with printed, unique serial numbers affixed as follows:
i.	A seal shall be placed over any removable card or cartridge that is inserted into the unit, or over the slot or door covering the card or cartridge.
ii.		A seal is to be placed over any removable card or cartridge slot when no card or cartridge is inserted into the unit.
iii.	Tamper-evident, numbered seals shall be affixed across the seam at which the two sides of the case of the electronic components of the voting unit join, with at least one seal for each of the four sides of the device.
iv.	If the voting device contains one or more slots for a flash memory card, a seal shall be affixed over each flash card or each flash card slot, door, or access panel.
v.	These same procedures also apply to the Judge’s Booth Controller (JBC) unit for the Hart InterCivic System.
vi.	All seals are to be verified by two employees or election judges.
b.	V-VPATs. all V-VPAT units shall be sealed upon verification of no votes having been cast on the paper record prior to being attached to a specific voting device.  Seals must be verified as being intact by at least two election judges prior to the start of voting, and at the close of voting.  V-VPAT records shall either remain in the V-VPAT canister, or be sealed and secured in a suitable device for protecting privacy or as described in Election Rule 11.
c.	Remote or Central-count Optical Scanners. Optical scanners used in a remote or central tabulating location shall have tamper-evident seals as follows:
i.	A seal is to be placed over each card or cartridge inserted into the unit, or over any door or slot containing the card or cartridge.
ii.	A seal is to be placed over each empty card or cartridge slot or door covering the area where the card or cartridge is inserted.
ii. 	Prior to the start of voting and after the close of voting, all seals are to be verified as being intact by two employees or election judges.
d.	Memory Cards/Cartridges. Each removable card or cartridge shall have a permanent serial number assigned and securely affixed to it.  The manufacturer assigned serial number may be utilized for this purpose.
e.	The county clerk and recorder shall maintain a written or electronic log that records which card or cartridge and which seal number is assigned to each voting unit.  Any breach of control over a card/cartridge or door or slot for a card/cartridge before an election shall require that the county clerk and recorder be notified and follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
43.8.3	Individuals With Access to Keys, Door Codes, and Vault Combinations
43.8.3.1	Counties are required to state the positions and dates of CBI background check for employees with access to the areas addressed in this Rule 43.8.3.    
43.8.3.2	For all counties, use of keypad door codes or locks, vault combinations, computer and server passwords, encryption key codes, and administrator passwords shall be changed at least once per calendar year prior to the first election of the year.  Only employees may be given access to such codes, combinations, passwords, and encryption keys, pursuant to the following limitations.  Counties may request a variance from the Secretary of State for the requirements set forth in this Rule 43.8.3 only in extreme circumstances.
43.8.3.3	The requirements for an employee to be given access to a code, combination, password, or encryption key are as follows:
a. 	Access to the storage area for voting equipment and the absentee ballot counting areas shall be restricted to employees as defined in Rule 43.1.4.
b.		Access to the absentee ballot storage area and counting room or tabulation workstations shall be restricted to ten (10) employees as defined in Rule 43.1.4.
c.		Except for emergency personnel, no other individuals shall be present in these locations unless supervised by one or more employees as defined in Rule 43.1.4.
i.	Each individual who has access to the central election management system or central tabulator shall have their own unique username and password.  No individual shall use any other individual’s username or password.  Shared accounts shall be prohibited.
ii.	The county shall maintain a log of each person who enters the ballot storage room, including the person’s name, signature, and date and time of entry.  If access to the ballot storage room is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.	 
43.8.3.4	Computer room access shall be limited to employees and election judges only, and the delivery of ballots between the preparation room and computer room shall be performed by messengers or runners wearing distinguishing identification.
43.8.4	Temperature-controlled Storage
43.8.4.1	Counties shall attest to the temperature-control settings used with the following components of a voting system.  Information submitted to the Secretary of State shall indicate the specifics for each type of component, as well as the specific environment used, which may include, but is not limited to controlled offices, controlled vaults, and controlled warehouses.  The settings for temperature control must be at least the following:
a.	Servers and Workstations. Servers and workstations shall be maintained in a temperature-controlled environment.  Maximum temperature shall at no time exceed 90 degrees fahrenheit.
b.	DREs. DREs shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 60 degrees fahrenheit and a maximum of 90 degrees fahrenheit.
c.	Optical Scanners. Optical scanners shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 50 degrees fahrenheit and a maximum of 90 degrees fahrenheit.
d.	V-VPAT Records. In addition to the requirements set forth in Rule 11, V-VPAT records shall be maintained in a temperature-controlled environment.  The temperature settings shall be maintained at a minimum of 50 degrees fahrenheit and a maximum of 80 degrees fahrenheit.  V-VPAT records shall also be maintained in a dry environment, with storage at least 4 inches above the finished floor, for a period of 25 months following the election.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  V-VPAT records shall be stored in a manner that prevents exposure to light, except as necessary during recounts and audits.
e.	Paper Ballots. Paper ballots shall be maintained in a dry, humidity-controlled environment.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  Additionally, paper ballots shall be stored at least 4 inches above the finished floor, for a period of twenty-five (25) months following the election.
f.	Video Data Records. Video data records shall be maintained in a dry, temperature-controlled environment.  The humidity of the environment shall not exceed 80% humidity for a period of more than 24 hours.  Temperature settings shall be maintained at a minimum of 40 degrees fahrenheit and a maximum of 80 degrees fahrenheit.  Additionally, video data records shall be stored at least 4 inches above the finished floor, for a period of twenty-five (25) months following the election.
43.8.5	Security Cameras or Other Surveillance
43.8.5.1	Unless otherwise instructed, continuous video security surveillance recordings of specified areas shall be made beginning at least sixty (60) days prior to the election and continuing through at least thirty (30) days after the election, unless there is a recount or contest.  If a recount or contest occurs, the recording shall continue through the conclusion of all such activity.  The following are the specific minimum requirements: 
a.	Counties over 50,000 registered voters shall make continuous video security surveillance recordings of the following areas:
i.	All areas in which election software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
ii.	All areas used for processing absentee ballots, including but not limited to areas used for Signature Verification, tabulation, or storage of voted ballots beginning at least thirty-five (35) days prior to the election and continuing through at least thirty (30) days after the election, unless there is a recount or contest.  If a recount or contest occurs, the recording shall continue through the conclusion of all such activity.
iii.	The storage area for all voting equipment.
b.   	Counties under 50,000 registered voters shall make continuous video security surveillance recordings of the following areas:
i.	All areas in which election software is used, including but not limited to programming, downloading memory cards, uploading memory cards, tallying results, and results reporting.
43.8.6.	Equipment Maintenance Procedures
43.8.6.1	In addition to the requirements for voting systems specified in Rule 11, the following minimum standards shall be adhered to:
a.	All equipment shall be stored throughout the year with serially-numbered, tamper-evident seals over the memory card slots for each device.  The county shall maintain a log of the seals used for each device consistent to the logs used for tracking Election Day seals.
b.	For equipment being sent to the vendor for offsite repairs/replacements, the county must maintain a log file for the device that shall contain the following:  the model number, serial number, and the type of device; the firmware version; the software version (as applicable); date of submission to the vendor.
c.	For equipment receiving maintenance on-site by the vendor, the county shall verify that a CBI background check has been conducted on all vendor personnel with access to any component of the voting system.  CBI information shall be updated and maintained on file annually.  Additionally, the vendor’s representative shall be escorted at all times by an employee while on-site.  At no time shall the voting system vendor have access to any component of the voting system without supervision by an employee.
d.	Upon completion of any maintenance, the county shall verify or reinstate the trusted build and conduct a full acceptance test of equipment that shall, at a minimum, include the Hardware Diagnostics test, as indicated in Rule 11, and conduct a mock election in which an employee shall cast a minimum of ten (10) ballots on the device to ensure tabulation of votes is working correctly.  All documentation of results of the acceptance testing shall be maintained on file with the specific device.
e.	The Secretary of State shall be required to inspect the counties’ maintenance records on a randomly selected one percent (1%) of all voting devices in possession of the counties throughout the state in even-numbered years, and to inspect the maintenance records on a randomly selected five percent (5%) of all voting devices in possession of the counties throughout the state in odd-numbered years.
43.8.7.	Transportation of Equipment, Ballot Boxes, and Ballots
43.8.7.1	Counties are required to submit detailed plans to the Secretary of State prior to an election regarding the transportation of equipment and ballots both to remote voting sites and back to the central elections office or storage facility.  While transportation of equipment may be handled in a multitude of methods, the following standards shall be followed when transporting voting equipment to the voting location:
a.		Transportation by County Personnel. County personnel shall at all times display a badge or other identification provided by the County.  Two (2) signatures and date of employees shall be required at the departure location verifying that the equipment, including memory card or cartridge, is sealed to prevent tampering.  Upon delivery of equipment, at least two (2) employees or election judges shall verify that all seals are intact and that the serial numbers on the seals agree with those on the seal-tracking log, and sign and date the seal-tracking log.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
  b.	Transportation by Election Judges. Election judges that are receiving equipment from county personnel shall inspect all components of voting devices and verify the specific numbers by signature and date on the seal-tracking log for the device.  The election judge receiving the equipment shall request two (2) election judges at the voting location to inspect the devices and to sign and date the seal-tracking log indicating that all seals are intact and that the serial numbers on the seals agree with those on the seal-tracking log.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
c.		Transportation by Contract. Counties electing to contract the delivery of equipment to remote voting locations shall perform CBI background checks on the specific individuals who will be delivering the equipment.  Two (2) employees or election judges shall verify, sign, and date the seal-tracking log upon release of the equipment and two other employees or election judges shall verify, sign, and date the seal-tracking log upon acceptance of the equipment at the delivery point.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
43.8.7.2	The following standards shall be followed when transporting voting equipment from the voting location:
a.		If memory cards or cartridges are to be removed from voting devices at remote voting locations, the following procedures are to be followed:
i.	Before removing a memory card or cartridge, two (2) election judges shall inspect and verify that all seals on the device are intact and that the serial numbers on the seals agree with those listed on the seal-tracking log.  Both election judges shall sign and date the seal-tracking log prior to breaking the seal.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
ii.	Election judges shall place the memory cards or cartridges in a sealable transfer case that shall be sealed with at least one (1) seal.  Additional seal logs shall be maintained for the transfer case of the memory cards or cartridges.
iii.	Election judges shall place new seals over the empty memory card/cartridge slot and/or door and document the seal numbers used.
iv.	At least two (2) county personnel or election judges shall accompany the transfer case containing the memory card/cartridge to the drop off location. Seal integrity and serial numbers will be verified, and logs will be signed and dated by election judges receiving the equipment.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, the county personnel or election judges shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this rule.
v.	County personnel or election judges transporting secured voting equipment must maintain chain of custody logs and seal-tracking logs.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this rule.
b.		If devices are to be delivered with memory cards/cartridges intact, the following procedures shall be followed:
i.	Two (2) county personnel or election judges shall verify that all seals are intact at the close of polls.  Election judges shall sign the seal-tracking log with such indication.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule.
ii.	At least two (2) county personnel or election judges shall accompany the secured equipment to the drop-off location.  Seals will be verified, and logs will be signed and dated by the county election official receiving the equipment.  If there is any evidence of possible tampering with a seal, or if the serial numbers do not agree, they shall immediately notify the county clerk and recorder who shall follow the procedures specific to the incident as described in section 43.8.11 of this Rule. 
iii.	Upon confirmation that the seals are intact and bear the correct numbers, the memory card or cartridge shall be removed and uploaded into the central count system.
iv.	Election judges shall secure the equipment by placing a tamper-evident seal over the memory card slot and by updating the documentation to reflect the new seal numbers.
43.8.8.	Emergency Contingency Plans for Voting Equipment and Voting Locations
43.8.8.1	All remote devices used in an election shall have sufficient battery backup for at least two (2) hours of use.  If this requirement is met by reliance on the internal battery of the voting device, then the county clerk and recorder shall verify that all batteries are fully charged and in working order prior to the opening of polls at the voting location.  This requirement also can be met with the purchase of third-party battery backup systems.
43.8.8.2	In the event of a serious or catastrophic equipment failure or equipment being removed from service at one or more polling locations, or there is not adequate backup equipment to meet the requirements of Section 1-5-501, C.R.S., the county clerk and recorder shall contact the Secretary of State for authorization to use provisional ballots or absentee ballots as an emergency voting method.
43.8.9.	Internal Controls for the Voting System
43.8.9.1	In addition to the access controls discussed in section 43.8.3 of this Rule, counties are required to change all passwords and limit access to the following areas:
a.		Software. All software passwords shall be changed once per calendar year prior to the first election.  This includes any boot or startup passwords in use, as well as any administrator and user passwords and remote device passwords.
b.		Hardware. All hardware passwords shall be changed once per calendar year prior to the first election.  This includes any encryption keys, key card tools, supervisor codes, poll worker passwords on smart cards, USB keys, tokens, and voting devices themselves as it applies to the specific system.
c.		Password Management. Access to the administrative passwords to the election management software shall be limited to two (2) employees.  Access to passwords for all components of the election software and hardware shall be limited to two (2) employees.  An additional ten (10) employees may have access to the administrative passwords for the software components and an additional ten (10) employees may have access to the administrative passwords for the hardware components of the voting system.
d. 	Internet Access. At no time shall any component of the voting system be connected, directly or indirectly, to the Internet.  
e.		Modem Transmission. At no time shall any component of the voting system be connected to another device except for the vote tally software, directly or indirectly, by modem as allowable by the certification of the specific device. 
f.		Remote sites may use modem functions of optical scanners and DREs only for the purpose of transmitting unofficial results, as permitted by the Secretary of State’s certification documents for the specific systems.  Counties using modem devices to transmit results shall meet the following requirements:
i.	Transmissions may be used only for sending test data or unofficial results; after all other steps have been taken to close the polls.  All summary tapes shall be printed before connecting any of the machines to a modem or telephone line.
ii.	Modems shall not be used for any programming, setup, or individual ballot-casting transmissions.
iii.	The receiving telephone number for the modem transmission shall be changed at least once per calendar year prior to the first election.
iv.	A maximum of six (6) employees shall have access to the telephone number receiving the transmission.  Counties shall not publish or print the receiving telephone number for any election judge.  To the extent possible, the telephone number shall be programmed into the device and used by the device in a way that is hidden from election judges and voters from seeing the display of the number at any time.
g.		Authorized Employees. Counties shall include in their security plans the positions and dates of CBI background checks for employees with access to any of the areas or equipment set forth in this Rule.  Each county shall maintain a storage-facility access log that details employee name, date, and time of access to the storage facility in which the software, hardware, or components of any voting system are maintained.  If access to the storage facility is controlled by use of key card or similar door access system that is capable of producing a printed paper log including the person’s name and date and time of entry, such a log shall meet the requirements of this rule.
43.8.10.	Security Training for Election Judges
43.8.10.1	Counties shall include in their security plan the details of their security training for their election judges, which shall include the anticipated time of training, location of training, and number of election judges receiving the security training, as it applies to the following requirements:
a.		The county shall conduct a separate training module for field technicians and election judges who will be responsible for overseeing the transportation and use of the voting systems, picking up supplies, and troubleshooting device problems throughout the Election Day.
b. 	Security training shall include the following components:
i.	Proper application and verification of seals and seal-tracking logs;
ii.	How to detect tampering with voting equipment, memory cards/cartridges, or election data on the part of anyone coming in contact with voting equipment, including employees, other election judges, vendor personnel, or voters;
iii.	Ensuring privacy in voting booths;
iv.	The nature of and reasons for the steps taken to mitigate the security vulnerabilities of voting systems;
v.	V-VPAT requirements;
vi.	Chain-of-custody requirements for voting equipment, memory cards/cartridges, and other election materials;
vii.	Ballot security;
viii. 	Voter anonymity.; and
ix.	Recognition and reporting of security incidents.
43.8.11	Remedies 
43.8.11.1	If it is detected that the seal has been broken or if there is a discrepancy between the log and the serial number of either a voting device, or a memory card or cartridge, the condition must be confirmed by one or more of the remaining election judges for the location.  The election judges shall immediately notify the county clerk and recorder, who shall investigate, report the incident to the Secretary of State, and follow the appropriate remedy as indicated in this rule or as directed by the Secretary of State.
43.8.11.2	If a seal has been broken or removed under the following conditions:
a.		During either the transportation, setup, opening polls, or closing polls for the device; 
b.		Two election judges can verify the breaking or removing of the seal; and
c.		The chain of custody has not been broken, meaning the device has been within ownership of election judges or employees only during this time;
		The county clerk and recorder shall instruct the election judges to complete a security incident report detailing the incident, replacing the seals, and updating the chain of custody log as appropriate.
		The Security incident report shall be filed with the Secretary of State during the canvass period.
  43.8.11.3	If a seal has been broken or removed outside of the situation in 43.8.11.2, Any unit involved must undergo the reinstatement or verification of the trusted build.  county clerk and recorders will be required to complete a security incident report.  The minimum Sspecific requirements on the remedy are as follows (additional requirements may be determined based on the details of the incident report):
a.		If the evidence is prior to the start of voting:
i.  	The device shall be sealed and securely delivered to the county clerk and recorder.
ii.	The county clerk and recorder or his or her designee shall remove and secure the memory card following the procedures in section 43.8.1(a).  The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device.  The county clerk and recorder or his or her designee shall install a new, secure memory card into the device, conduct a hardware diagnostics test as prescribed in Rule 11, and proceed to conduct a logic and accuracy test on the machine in full election mode, casting at least 25 ballots on the device.  All documentation of testing and chain of custody shall be maintained on file for each specific device.
iii	Complete the necessary seal process and documentation to re-establish the chain of custody for the device and new memory card.
iv.  	Set the machine to election mode ready for a zero report.
vi. 	Complete necessary reports for the Secretary of State regarding the incident as soon as practicable, but prior to the close of the canvass period for the election.
b.		If the evidence is after votes have been cast on the device but before the close of polls:
i.  	The device shall be sealed and securely delivered to the county clerk and recorder.
ii. 	The county clerk and recorder or his or her designee shall close the election on that device, and perform a complete manual verification of the paper ballots (or V-VPAT Records) to the summary tape printed on the device that represents the record of votes on the memory card. 
iii.  	If the totals do not match then only the paper record will be accepted as the official results for that device, and the device shall be re-sealed, secured and reported to the Secretary of State immediately.  The device shall not be used for the remainder of the election unless the firmware and/or software have been reformatted with the trusted build.
iv. 	If the totals match, the memory card may be uploaded into the tally software at the close of polls.  
v.  	After verifying the totals, the paper records and memory card shall be secured with seals and documented properly.
vi. 	A new secured memory card shall be placed in the device.  The county clerk and recorder or his or her designee shall follow the State instructions for installing/verifying the trusted build for the specific device.  The county clerk and recorder or his or her designee shall conduct a hardware diagnostics test as prescribed in Rule 11. All documentation of testing and chain of custody shall be maintained on file for each specific device.
vii.  	Complete the necessary seal process and documentation to establish the chain of custody for the device and memory card.
viii.  	Set the machine to election mode ready for a zero report.
ix. 	At the conclusion of the election a full (all races) post-election audit shall be conducted on the device and results reported to the Secretary of State as required by Rule 11.  This requirement is in addition to the random selection conducted by the Secretary of State.
x.  	Complete necessary reports for the Secretary of State regarding the incident as soon as practicable, but prior to the close of the canvass period for the election.
	c.	If the evidence is after the close of polls:
i.  	The device shall be sealed and securely delivered to the county clerk and recorder.
ii. 	The county clerk and recorder or his or her designee shall perform a complete manual verification of the paper ballots (or V-VPAT Records) to the summary tape printed on the device that represents the record of votes on the memory card. 
iii.  	If the totals do not match then only the paper record will be accepted as the official results for that device, and the device shall be re-sealed, secured and reported to the Secretary of State immediately.  The device shall not be used for the remainder of the election unless the firmware and/or software have been reformatted with the trusted build.
iv.  	If the totals match, the memory card may be uploaded into the tally software at the close of polls.  	
v.  	After verifying the totals, the paper records and memory card shall be secured with seals and documented properly.
vi.	The county clerk and recorder or his or he designee shall follow the State instructions for installing/verifying the trusted build for the specific device and complete the necessary seal process and documentation to establish the chain of custody for the device.
vii.	During the canvass process, a full (all races) post-election audit shall be conducted on the device and results reported to the Secretary of State as required by Rule 11.  This requirement is in addition to the random selection conducted by the Secretary of State.
viii. 	Complete necessary reports for the Secretary of State regarding the incident prior to the close of the canvass period for the election.
43.8.11.4	Prior to the submission of certified results from the county, the county clerk and recorder shall provide a written report to the Secretary of State addressing the existence or absence of any security issues related to the implementation and operation of the voting system.  All county documentation related to the voting system shall be available for inspection by the Secretary of State for all devices used in the election.
43.8.12		Any additional physical security procedures not discussed in these mandatory procedures shall be submitted to the Secretary of State for approval prior to the election.
43.9	The designated election official shall submit with the security plan sample copies of all referenced forms, schedules, logs, and checklists.  
43. 10	Included in the security procedures filed with the secretary of state shall be a section entitled “contingency plan.”  The contingency plan shall include:
(a)	Evacuation procedures for emergency situations including fire, bomb threat, civil unrest, and any other emergency situations identified by the designated election official;
(b)	Back up plans for emergency situations including fire, severe weather, bomb threat, civil unrest, electrical blackout, equipment failure, and any other emergency situations identified by the designated election official;
(c)	An emergency checklist for election judges; and
(d)	A list of emergency contact numbers provided to election judges.