On February 14, 2012, Colorado Secretary of State Scott Gessler held a hearing on proposed changes to existing regulations governing county procedures for the security of ballots, voting equipment, and other election materials. The public was invited to comment. Verified Voting reviewed the proposed rules changes (which can be found here) and made the following comment, highlighting concerns about changes to chain procedures of custody of ballots and equipment. Submitted February 21, 2012
Thank you for this opportunity to comment upon proposed revisions to Colorado Election Rules governing county procedures for securing election equipment and materials. Verified Voting is a national nonpartisan organization working to safeguard elections in the digital age. We seek to promote the deployment of election systems and practices that vouchsafe the accessibility, reliability, and transparency of public elections. We believe that the proposed revision contains several positive changes, as well as some that cause concern, or call for more clarity.
We begin by noting several laudable provisions in the proposed changes:
Continued ban on voting system connection to the Internet
The draft changes to Rule 43 continue Colorado’s wise policy of prohibiting election administrators from connecting voting system components to the Internet. In the past decade, Colorado joined a number of States, including California, Texas, New York, and Ohio, in recognizing that connecting any component of a voting system to the Internet creates unacceptable security risks. This provision should eliminate the insecure practice of using the Internet for the transmission of voted ballots. (We feel compelled to note here the disparity between this Rule and the present debate over whether to fund an Internet pilot project for Colorado’s military and overseas voters. Claims that Internet voting systems now being proffered for use are fundamentally safe from the risks of the Internet ring hollow; as experts have noted, the security problems with Internet voting are largely intrinsic to the Internet itself rather than to a given system or vendor.)
Required annual updates of county security plans
The draft Rule 43 would establish a requirement that counties update their security plans annually, in contrast to the previous Rule, which did not require regular updates. We believe this change is useful and could help Colorado election administrators more effectively manage election materials.
The draft changes also include language that we believe calls for clarification or revision, in the following areas:
Safeguarding stored, voted ballots
Regarding the safeguarding of voted ballots, the draft language governing the use of security cameras and other surveillance describes “areas used for processing mail-in ballots, including but not limited to areas used for Signature Verification, tabulation, or storage of voted ballots beginning at least thirty-five (35) days prior to the election and continuing through at least thirty (30) days after the election, unless there is a recount or contest.” Beyond this language, there is no mention of the security surveillance of voted ballots that are not mail-in ballots, and it is unclear if such non-mail-in ballots are also covered by the same security surveillance provisions. We respectfully suggest that Rule 43 clearly require video surveillance of the storage of all voted ballots, each of which is not less critical to the integrity of the election than another.
Standards for video surveillance
Though it may seem that it should go without saying, the draft Rule should require that the area being recorded be well-lit enough to provide adequate video recording. Additionally, we believe that the standard of one frame per minute required of digital video recording device capture when triggered by a motion sensor is an unacceptably low standard and well below the capacity of commercially available security systems. Once motion is detected and recording triggered, a frequency of multiple frames per second – not minute – would be needed to obtain data that would be useful.
Multiple ballot pickups during voting
The draft Rule 43.2.7(d) allows counties to pick up ballots from remote polling location “as often as needed on election day.” We respectfully disagree that this provision increases the security of elections. Increasing the complexity of the chain of custody by creating, moving and safeguarding multiple batches of ballots from a single polling location, rather than one batch, kept together and moved once, seems an unnecessary logistical burden.
Clarifying “secure physical location”
Draft Rule 43.7.C(2) would require ballot boxes containing voted ballots to be accompanied by two election judges except when the ballots are in “a vault or other secure physical location.” However, there is no definition of a “secure physical location” in the draft Rule. We suggest that the Rule language provide clarification or point to where such a definition can be found. It may also be appropriate to require two election judges (see next point, below) to accompany all ballot boxes containing voted ballots until personnel in the county clerk’s office have received and secured those ballots, and that no one person have sole access to them until they are placed in storage and subject to continuous surveillance.
Clarifying requirement for “two election judges”
It appears that the Rule language requiring that two judges execute a number of different functions (e.g., transporting/handling voted ballots) is derived from or inspired by Colorado law requiring election judges to be of different political affiliations in various circumstances. In the event the draft Rule language is not governed by statutes that further clarify the two-judges requirement, we suggest that the Rule should require that judges be of different political affiliations.
Incident reporting requirements
Draft rule 43.11(d) requires county Clerks to investigate broken seals and discrepancies in chain-of-custody logs, and file an internal incident report. If the Clerk cannot determine why a seal was broken, or why a discrepancy in the chain of-custody log exists, the Clerk must file an incident report with the Secretary of State. We suggest that the Rule require the Clerk to inform the county canvass board of all internal incident reports filed pursuant to the Rule, report investigatory findings to the canvass board, and make public those findings.
We again thank the Secretary of State and staff for soliciting comment on this critical aspect of Colorado’s electoral process, and are at your service as you have questions or thoughts about this comment.