* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
Colorado Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Center for American Progress State by State Voting System Report
See State Grade Below
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
Colorado earned high marks in the three most important categories, but the fact that it allows electronic absentee voting undermines these practices in certain respects. Colorado receives kudos for being the first state in the nation to carry out mandatory risk-limiting audits. But even though Colorado’s post-election audit procedures are “good,” the fact that the state allows some electronic absentee voting undermines the overall effectiveness of these audits. Voted ballots that are submitted electronically via email, for example, cannot be properly audited because there is a low degree of confidence in electronically submitted ballots, as they are vulnerable to manipulation. In addition to carrying out its elections with paper ballots, post-election audits, and adherence to a number of minimum cybersecurity best practices related to voter registration systems, Colorado earned points for requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines prior to being purchased and used in the state. The fact that the state requires election officials to carry out pre-election logic and accuracy testing on all machines that will be used in an upcoming election is also commendable.
To improve its overall election security, Colorado should require that backup paper voter registration lists be made available at vote centers that use electronic poll books on Election Day in case of emergency. While we were told that many counties do this in practice, a statewide requirement would ensure uniformity and compliance. Colorado uses vote centers, where a person can vote at any site in the state, and has same day registration, voter access modernization policies that CAP supports. These provisions may require specially designed procedures for providing paper backup voter registration lists at places using electronic poll books as failsafes, should electronic poll books become inaccessible. Finally, Colorado should prohibit voters stationed or living overseas from returning voted ballots electronically. Regardless of the state’s secure ballot return system for electronically voted ballots, we recommend that all voted ballots be returned by mail or delivered in person.
Minimum cybersecurity standards for voter registration system: Fair
The state’s voter registration system has been updated within the past 10 years.
The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.
The state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
The state performs regular vulnerability assessments and penetration testing on its voter registration system.
The state has enlisted DHS to help assess and identify potential threats to its voter registration system.
All election administrators—at the state, local, and municipal levels—receive cybersecurity training prior to using the state’s voter registration system and receive ongoing training quarterly.
A single electronic poll book, which is built into the state’s voter registration database, is used at all vote centers in Colorado and is tested prior to each election. Paper voter registration lists are not required to be made available at vote centers on Election Day. Many counties do provide backup paper lists in practice, but there is no requirement that they do so. Colorado has established contingency plans in case of emergency; In the event of an electronic poll book failure, all voters would shift to provisional ballots, which would be checked against the voter registration system once it is restored.
Voter-verified paper audit trail: Good
The state is a vote-by-mail state, meaning that most votes are cast using paper ballots.261 The state’s vote centers house a limited number of DRE machines with VVPR.
Post-election audits: Good
The state conducts mandatory post-election audits.
The state’s post-election audits are conducted through manual hand count.
The state was the first in the nation to carry out mandatory risk-limiting audits, beginning in 2017. The number of ballots included in the audit is determined by a statistical formula based on the likelihood that a change in the outcome of a race would lead to a new winner.
The ballots included in the audit are randomly selected.
All categories of ballots—regular, early voting, absentee, provisional, and UOCAVA—are eligible for auditing.
If discrepancies are discovered in an initial audit, the audit escalates to include a fresh set of ballots that are subjected to testing.269 If discrepancies continue and are significant enough that they could lead to a potential change in outcome, a full hand count of ballots is conducted.
Audits are open to public observance and the results are made publicly available.
Audits, which may take several days to complete, begin 13 days after a primary election and 17 days after all other elections, prior to certification.
An audit can reverse the preliminary outcome of an audited contest if an error is detected.
* Although Colorado’s post-election audit procedures are good, the state’s allowance of electronic absentee voting undermines the audits’ overall effectiveness.
Ballot accounting and reconciliation: Fair
Because the state is a vote-by-mail state, it is not necessary that all ballots be accounted for at the precinct level, specifically. There is a precinct-level accounting of all ballots by counties, conducted on a central count rather than a precinct count.
Because the state is a vote-by-mail state, it is not necessary that the number of ballots be compared to the number of voters at the precinct level, specifically. Vote centers do not reconcile by precinct. Instead, county offices reconcile the number of ballots with the number of voters who signed in at the polling place for each vote center.
Central count centers are required to compare and reconcile vote center totals with countywide results to ensure that they add up to the correct amount.
Central count centers are required to review and account for all voting machine memory cards and flash drives to ensure that they have been properly loaded onto the tally server.
The state requires that all election results and reconciliation procedures be made public.
Paper absentee ballots: Unsatisfactory
The state permits UOCAVA voters to submit completed ballots electronically, via email or fax. Colorado’s secure ballot return portal allows eligible voters stationed or living overseas to upload their voted ballots onto the portal, after which time county officials log on to retrieve the ballots. We are told that only 0.006 percent of ballots are received electronically.
Voting machine certification requirements: Fair
Before being purchased and used for any election in the state, all voting machines must undergo testing by a federally accredited laboratory.
Two counties in Colorado still use voting machines that were purchased more than a decade ago. However, both counties are scheduled to purchase new equipment for use in the 2020 elections.
Pre-election logic and accuracy testing: Fair
Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.
Testing is open to the public.
Testing is carried out at least 18 days before an election.