A decade-and-a-half before the Washington Post called Colorado the “safest” place to cast a ballot — a compliment echoed by nonpartisan election experts — Neal McBurnett of Boulder spent the evening of Nov. 5, 2002 as an election judge.
He did not like what he saw. Not one bit.
"I was nervous,” McBurnett said from his north Boulder living room on a sunny October afternoon. “They were using computers to count and report our votes. And I saw no one paying attention to the paper ballots that people had marked their choices on."
In the wake of the 2000 election, Congress passed the Help America Vote Act. That, among other outcomes, pushed some states and counties to move to electronic voting machines.
McBurnett, a computer scientist who sports an impressively bushy red beard, knew their limitations. Voter-marked ballots that only existed in a digital format couldn’t be trusted when it came time to audit results, McBurnett thought. So as the early 2000s wore on, he and others persuaded the Boulder County clerk and recorder to keep paper ballots.
Paper is critical McBurnett said, “in order to allow us to look at the evidence for each individual election and see if the evidence of the paper ballots actually matches what the computers produce as the outcome of the election."
It was an unusual move at a time in which other municipalities were ditching paper.
"I think Boulder, as a high-tech hub, had a lot of geeks, a lot of people that understood the security issues,” he said. “I think we also had a lot of civically-minded people.”
That these civically-minded Boulderites were thinking about election security more than a decade before the 2016 vote — when public concern grew because of statements made by then-candidate Donald Trump and Russia’s attack on Colorado’s and other states’ election systems — is an important reason why Colorado is now held up as an example for the rest of the country.
“It was a perfect storm in the best possible sense,” Mark Lindeman, senior science and technology policy officer at Verified Voting. “Colorado was blessed with very intelligent advocates for evidence-based elections, who were willing to work very hard, and crucially, were willing to collaborate with election officials. And on the other side of that equation, they found willing partners. I don't think that election officials or advocates on their own could have done very much.”
Low Confidence Across The Country
Colorado’s election system, strong as it may be, exists in a political climate skeptical toward election integrity. Joshua Adams, a coach at Guild Education in downtown Denver, said he’s seen YouTube videos and Facebook posts that have convinced him that the Russian government can change U.S. votes as they wish.
“That's scary,” Adams said as he took a mid-afternoon break along Denver’s 16th Street Mall. "All those people that used to wear the tinfoil hats, it makes you question if are they right.”
Though there’s no publicly available evidence that Russian hackers changed any votes, Adams isn’t alone. An NPR/Marist Poll found that one in three American adults think a foreign country is likely to change vote tallies and results. It also found that 47 percent of respondents said they “think it is either likely or very likely that not all votes will actually be counted in November.”
"On a whole this is a pretty lousy report card on the state of American elections," Dr. Lee Miringoff, director of the Marist College Institute for Public Opinion, told NPR.
When Colorado Secretary of State Wayne Williams, a Republican, meets skeptical voters, he invites them to get involved and observe the system at work.
“We're in an age now where there isn't just an automatic respect for government because government says,” said Williams, who's currently running for re-election against Democrat Jena Griswold. “You have to be able to show and prove."
Asked whether statements made by the national head of his party, President Trump, have made his goal of building trust more difficult, Williams demurred, before finally conceding that they do cause challenges.
"It's been an interesting time to be secretary of state,” he said. “Do I wish everybody would say things that were correct all the time? Yeah. That would make my life a whole lot easier.”
Colorado runs all mail-in elections and some 3 million ballots were sent out to voters in advance the November 2018 election. Here’s what we know about the most important security measures in place meant to protect the process, and a bit about how some of them came to be:
Statewide Database
Back in the 2000s, counties sent reports with changes to the voter rolls to the secretary of state’s office on a monthly basis. Then-Secretary of State Donetta Davidson said it wasn’t often enough as she was “always behind.”
So, Davidson beefed up the state’s voter database and required counties to upload information daily. That system, known as SCORE, made Colorado’s current mail-in ballot system possible, Davidson said. SCORE has a copy of every voters’ signature, which is checked against the signature on each ballot’s envelope; it’s also used to note when a voter has sent in a ballot, so they can’t go to a neighboring county to try to cast another.
None of that was on Davidson’s mind back then, she said.
“It was a blessing in disguise,” she said. “Really, now, that is very important with the process we have in the state. We can track every voter."
That centralized database, while a convenience, is also a target. The secretary of state’s office says it’s protected with multi-factor authentication; so in addition to usernames and passwords, county workers need codes distributed by the secretary of state’s office on physical cards to access the system. County officials also participate in security “war games” to brush up on their security bona fides.
Before The Vote
County staff check with the state’s database and the U.S. Post Service to ensure ballots go to the right people at the right addresses. Election workers, including judges, go through Colorado Bureau of Investigation background checks. Voting equipment, and in-person voting machines, are tested in public.
“At different points in the election, we are ensuring the validity and that everything is working the way it should be,” said Pam Anderson, a former Jefferson County clerk and recorder, and president of the Colorado Clerks Association.
Counting The Ballots
After voters fill out their ballots (check here for CPR’s election guide), they must put them in a provided envelope and sign it. They can then return their ballot, either by the mail, at a drop-off box, or at a voter service and polling center.
Ballots are delivered to counties’ processing centers — which themselves are under camera surveillance and behind locked doors — in signed, sealed, and tracked boxes. These boxes are opened by bipartisan teams, and sorted into trays. Election judges of both parties compare envelope signatures to those in the SCORE database (in some counties, computers take a first pass at this). Non-matches are set aside; counties ask voters to “cure” their rejected ballots within eight days of Election Day, and any ballots that aren’t cured are referred to the local district attorney for further investigation.
Accepted ballots are tabulated on computer systems that are never connected to the internet. Results are transferred from the offline system via a secure USB drive to another workstation that then sends them via an encrypted connection to the secretary of state’s office.
Sometimes, Anderson said, high traffic can take a county’s or the secretary of state’s results webpage offline. But such an incident, “does not impact the results or the outcome of the election,” she said.
Post-Election Audits
The physical security measures and ballot tracking systems are vital to maintain the integrity of the paper ballots. And that’s important because officials use a random sample of ballots to check election results.
This process is called a “risk-limiting audit,” a relatively new method of verification that Colorado has piloted at a statewide level. The goal is to limit the risk that a wrong outcome goes uncorrected. Officials use statistical methods to calculate the sample size needed to verify a correct outcome — the closer the race, the more ballots are needed.
The sample ballots are compared to the vote record stored by voting equipment. If the results line up, officials can be relatively certain that the election results are correct without checking every single ballot.
The fact that Colorado uses and carefully tracks individual paper ballots makes all of this possible, said Lindeman with Verified Voting.
"Most voting systems in the United States provide totals for batches of ballots,” he said. “There's no easy way to match a particular ballot to how it was interpreted."
Secretary of State Wayne Williams said it’s Colorado’s mix of transparency and verifiability that gives him the authority to say that no votes were changed in the 2016 election.
"If people do not believe the legitimacy of election results, then they deny the legitimacy of the government,” he said. “That's not the type of chaos we want in Colorado, or the United States. And I don't think we will get there. I think states like Colorado are showing a way out of that morass."
While Colorado has worked toward a system that seems to be working well, Lindeman cautioned it is not bullet proof. The all-mail system makes him nervous because he thinks there are more opportunities for intimidation and ballots to get misplaced (Williams opposed it as well, when he was the El Paso County Clerk). Others worry ballots sent electronically by overseas voters could be a point of weakness. The key, Lindeman said, is to continually work to make everything work better.
“There is no such thing as a perfect system,” he said.
