Frequently Asked Questions
I just heard that some election equipment passwords were inadvertently posted on the Colorado Secretary of State’s website. Should I be worried about my vote or the accuracy of this election?
In June, the Colorado Secretary of State’s Office unintentionally posted voting system passwords to the public-facing website. State officials were notified of the issue on Oct. 24 and subsequently notified federal authorities. County clerks were made aware of this issue today, Oct. 29. These system passwords allow access to the underlying software and firmware of a computer.
It is important to note that these passwords cannot be used to access the systems remotely. The only way these system passwords can be used is by physical access to the equipment. Physical security is a priority for all election equipment. Here are the additional security measures that ensure physical access is limited:
All voting equipment is stored in a room with strict access control.
All employees authorized to access the equipment have background checks conducted on them.
Colorado requires all voting equipment to be under 24/7 camera surveillance.
In addition to these equipment security protocols, every Colorado voter votes a paper ballot. This means there is a hardcopy record of how each voter filled out their ballot that is audited at the end of each election. Discrepancies between the hard copy ballot and electronic record would be caught during an audit.
Why is decertification and recertification of this election unnecessary given the reported issue with passwords?
Recently, calls for decertification of election equipment used in the current election have been made due to the exposure of passwords related to some election equipment by the Colorado Secretary of State’s Office. This is a serious issue that required immediate remedy that is complete with the reset of passwords on specific pieces of voting equipment in impacted counties, as well as ensuring that no modifications had been made to the computer. While these actions are happening out of an abundance of caution, Colorado county clerks are confident in election results without decertification and recertification because there is no single point of security failure for our voting systems. These systems were built to require multiple points of failure before they can be breeched by bad actors. Here are the multiple layers that protect the sanctity of each voter’s ballot.
• Physical access is needed: The use of any password for voting-related equipment requires physical access. A bad actor must be physically sitting at the computer to log in.
• Equipment access is strictly controlled: All election equipment is under strict access control in each county with only a few individuals who receive background checks able to enter the rooms where they are held.
• Equipment can’t be remotely accessed: No election tabulating equipment is connected to the internet. In most counties, election tabulation equipment does not have hardware necessary to connect to the internet. In only 12 counties, while this hardware is present, it has been disabled so remote access is impossible.
• Equipment is under 24/7 video monitoring: All voting equipment is required to be under 24-hour, seven day video surveillance by law. An individual trying to gain physical access to this equipment would have to evade these cameras.
• We test equipment before each election and the results are public: Before each election, county clerks carry out a logic and accuracy test which shows that voting tabulation equipment is accurately recording the votes made on paper ballots. Results of those tests are public.
• Coloradans vote on paper ballots: Every eligible voter votes on a paper ballot, a hard copy record of their intent. If the digital tally registered by the voting equipment does not match the hard copy of the vote, the discrepancy would be clear.
• We publicly audit election results: After each election, every county clerk conducts a public audit of the election results, matching the digital record to the hardcopy ballots on a randomly selected number of candidate contests and issues. These results are available to the public for review.
How are undeliverable ballots handled by the post office and our elections system? And what should an individual do if they receive a ballot at their home that is not addressed to a current resident?
Undeliverable ballots are handled with the same security that all ballots receive. Here’s the process:
All mail ballots are securely delivered to mail facilities for delivery to voters
Ballots deemed undeliverable by the mail facility are returned to county elections offices and scanned through the system where they are noted as undeliverable. These ballots are voided and can no longer be cast
If the individual to whom the ballot could not be delivered has taken no action to update their registration, that individual is put on an inactive voter list and is not delivered future ballots until they take action
If you live at a residence that received a ballot that doesn’t belong to anyone living at the residence, there are two things you can do to help.
If you know the voter to whom the ballot was sent – they are a family member or friend no longer living with you – you should contact the voter and tell them to go to GoVoteColorado.Gov and cancel or update their voter registration.
If you do not know the voter to whom the ballot was mailed, you should write on the envelope “return to sender, this person does not live here” and put it back in your mailbox for return.
Is there any evidence that many undelivered ballots might have gone missing?
The simple answer is, no. This claim is based on research that compared the number of undelivered ballots that were rescanned through county systems to the amount charged that county for returned mail. They asserted that because the amount of unreturned mail noted by the USPS did not match the numbers of undeliverable ballots rescanned by the county, ballots went missing. First, these researchers were told by many county offices that those numbers do not match because the USPS charges for all returned mail, not just ballots. Second, their implication that somehow a “lost” ballot could be voted is inaccurate. The individual with the ballot would also need the accurate signature of the individual to whom the ballot was issued.
Are cameras required to be filming election equipment at all times?
Pursuant to Colorado Election Rule 20.9.3(a)(1), cameras are required to record all areas where the election management software system is used from at least 60 days before Election Day to at least 30 days after Election Day.
For counties with 50,000 or more registered voters, cameras are also required to records all areas used for signature verification, ballot opening tabulation, and storage of voted ballots at least 35 days before Election Day through at least 30 days after Election Day. Many counties have their cameras recording year-round.
Is Colorado an all-paper ballot state?
Yes. All Colorado voters, with the exception of some UOCAVA voters (overseas and military voters), cast a paper ballot, whether they vote their mail ballot or vote in-person. In-person voters may use a touch screen ballot marking device (BMD). However, the BMD ultimately prints a paper ballot that the voter checks for accuracy and then casts.
Are Colorado’s elections secure and accurate?
Absolutely, yes. Colorado conducts extensive tests and audits before, during, and after each election to ensure systems and processes are secure and functioning properly. All counties conduct a public voting systems test before each election. Colorado's post-election Risk Limiting Audit, where ballot tabulations are checked by bipartisan citizen audit boards, provide a statisitcal certainty that the election outcomes are correct.
Why do I hear so much about voter fraud and stolen elections?
Reckless and baseless claims of fraud and stolen elections are not new. But these claims were amplified after the 2020 General Election in a way not seen before. In Colorado, our elections are secure and produce accurate results and have for a long time. Colorado is a national leader in election security and accuracy. In 2018, the Washington Post reported that Colorado is the safest state to cast a vote.
Are voting devices safe from tampering?
Yes. As with any computer system, there are vulnerabilities. However, those vulnerabilities are mitigated through different layers of physical security, testing, and auditing. They are never connected to the internet. This is verified as a part of the Trusted Build process and many counties will demonstrate these verifications during public testing. System updates are tested by federally certified testing labs before installation. In 2017, the federal government designated election infrastructure as critical infrastructure, meaning election infrastructure will be a priority for federal security assistance and protections.
Can’t county clerks hand recount ballots if there is a dispute?
Yes. Any clerk can hand recount ballots after any election they conduct and can do so at any time. While generally less accurate than system counts, the results from hand recounts historically come close to the results of a system count. Hand counts can also be very expensive as well. Earlier this year, Elbert County conducted a hand recount of the 2020 Presidential race. The hand-count came within three votes of the system count. The three ballot difference was due to a difference in human interpretation when the system could not determine the voter’s intent on the ballot.
Isn’t it more accurate to do a hand count of ballots rather than let computers do the counting?
No. Conducting hand counts is a far less accurate method of tabulating election results. Multiple studies have confirmed this. Simply stated, people pushing for hand counts are actually pushing for less accurate elections.
Rice University conducted a study in 2012 and found that hand counting may have up to a 2 percent error rate. A county in Arizona conducted a hand cout experiment in June 2023. The experiment included a test deck of 850 ballots with approximately 36 races per ballot. The county chose a “dream team” of experienced staff to count the ballots. The test took three days to complete. There was a counting error on 46 ballots, or 5.41% of the ballots.
Let’s apply these same results to El Paso County’s 2020 General Election Results. El Paso County’s turnout for that election was 383,204. A 5.41% error rate equates to counting issues on 20,731 ballots.
By the way, the maximum error rate for a voting system to pass federal testing is .00001% per ballot position.
This statistical analysis does not take into account the cost and time to complete a hand count during a live election. For a county like El Paso County, the cost would climb into the millions of dollars and likely take multiple weeks, all to arrive at a result that is far ess accurate than already delivered by the county’s voting system. It also does not address the likelihood of decreasing accuracy as the number of people needed to participate greatly expands, as well as the security concerns that would arise from hand counting ballots, especially at remote locations, as some are calling for.
How are the election results checked after the votes are tallied?
After each Election Day, but before election results are certified, all Colorado counties conduct a Risk Limiting Audit to verify that the tabulation system counted ballots correctly. This audit includes bipartisan citizen audit boards comparing randomly selected voter-marked paper ballots against the electronic record of how the system counted those ballots. Colorado was the first state to conduct a statewide Risk Limiting Audit in 2017. These audits are now considered national best practices for ensuring voting system accuracy. You can read more about these audits here.
Once the audit is complete, clerks convene a canvas board made up of citizens from their county to check the results and validate voter turnout. These canvass meetings are open to the public.
The CCCA is in the process of exploring more in depth signature verification audits as well. For more information about this, please click here.
If I have concerns about the system, how can I learn more?
First and foremost, the best thing you can do is speak to the trusted expert in your community, your county clerk and recorder. Another great option to learn about the election process and serve your community is to sign up to be an election judge. Citizen election judges participate in all aspects of the election, from working in voter service and polling centers to processing ballots, and serving on ballot security teams. For more information about how to sign up to be an election judge, please contact your county clerk and recorder.
You may also volunteer to be a poll watcher. Depending on the type of election, political parties, candidates, or issue committees may appoint poll watchers. By serving as an election judge or poll watcher, you will learn so much about the process and any questions you have will be answered.
DETAILED QUESTIONS
Why won’t you allow a third-party forensic analysis of the voting system?
Colorado’s new election rule does not permit a third-party audit of voting systems in Colorado. Furthermore, there is incontrovertible evidence that ballots cast were counted accurately in all Colorado counties. Logic and Accuracy Testing before the election confirmed the voting systems were operating correctly going into the 2020 General Election. The Risk Limiting Audit, which is now considered the best practice for tabulation audits across the country, validated that the tabulated outcomes were correct. Beyond that, Elbert County conducted a hand recount of the 2020 presidential race in the spring of 2021. That hand count confirmed the machine count. El Paso County ran their 2020 ballot images through Clear Ballot’s Clear Audit program, which again confirmed the machine count. Many other Colorado counties publish their ballot images and Cast Vote Records on-line for free. Despite disinformation to the contrary, ballots in Colorado were tabulated correctly and free of interference.
What is the Trusted Build?
Trusted builds are the software and firmware updates for voting systems certified for use in Colorado. The Trusted Build is tested by a federally accredited voting system testing lab. If the software and firmware updates pass testing, the state of Colorado will then certify that build for use in Colorado. Chain of custody is established as a part of this process to ensure the software and firmware has not been tampered with.
How often is the Trusted Build done?
Updates to the voting systems are done as system and/or security requirements dictate.
Does the Trusted Build violate federal and state election retention laws?
By design, the Trusted Build process installs the new files and removes files related to the old build. This is not a violation of federal or state election retention laws. The state retains a copy of the old Trusted Build and counties retain backups of their election projects from the voting system. Furthermore, each county retains the voted paper ballots from each election for 25 months after each election as required by Colorado law. Those three components allow a county to recreate the election, recount ballots again if necessary, and audit the accuracy of the system in tabulating the ballots, which ensures compliance with federal and state law. Logs from the computer operating system, outside of the voting system, are not considered election records and do not need to be retained.
Here in Colorado, a judge ruled on this question as well. In an opinion in Kirkwood vs Colorado, dated Sept.13, 2023, Denver District Court Judge David Goldberg says on page 7 that “As the AO and the VSS itself states, the only records required to be kept are all “records and papers that came into [election administrators’] possession relating to an application, registration, payment of poll tax, or other requisite to vote.” There is no direct mention of “log files” in the VSS regulations.“
To review, logs from the computer operating system, outside of the voting system, are not considered election records and do not need to be retained.
Was the testing lab used by Colorado to test the Trusted Build decertified by the federal Election Assistance Commission?
It was not. Colorado uses a Voting Systems Testing Lab (VSTL) called PRO V & V. Pro V & V received their accreditation as a VSTL in 2015 from the Election Assistance Commission (EAC) and that accreditation has never been revoked. To see more information about this, please visit the Pro V & V page on the EAC website.
How can a lab lose federal accreditation?
Per the Election Assistance Commission, a Voting Systems Testing Lab can only lose their accreditation by a vote of the Election Assistance Commissioners.
Are voting machines hackable?
The voting systems Colorado clerks use are not connected to the internet. This is confirmed through the Trust Build process. Counties can also validate this on their own. Every computer system has vulnerabilities. However, vulnerabilities do not equal exposure or nefarious activity. Chain of custody for each system is established and tightly supervised in every county. Clerks employ multiple safeguards to ensure systems are not tampered with.
What are the Conditions of Use for voting systems?
The Conditions for Use are a set of rules that are specific to each voting system certified for use in Colorado. The conditions are set up to ensure the system is secure and produces accurate results.
Have foreign governments hacked our voter registration system?
No. Nefarious actors have tried to access the Colorado Voter Registration system and have been unsuccessful in doing so. The National Intelligence Council issued a report in March 2021 and found “no indications that any foreign actor attempted to alter any technical aspect of the voting process.” To read this report, please click here.