Committee approves stricter security standards for voting systems; debate focuses on air-gapping and continuous video

Senate Bill 10-37, as amended, sets a range of security requirements for election equipment: prohibition of hardware that supports direct or indirect Internet connectivity, unique user credentials and audit logging, restrictions on physical ports, chain-of-custody procedures for removable storage, and a requirement for continuous video recording at accounting centers to be posted online.

Staff explained that the Calden amendment broadened the bill to apply explicitly to election management systems as well as tabulation machines and clarified definitions of "indirect Internet connectivity." The amendment also removed a requirement that equipment be configured to specific U.S. Department of Homeland Security standards and narrowed criminal penalty language to negligent violations.

Representative Collinan—sponsor of a tightening amendment—argued the state must prevent even indirect Internet connectivity because many facilities are not truly air-gapped. "In this day and age where we have AI systems spontaneously hacking their way out of controlled environments, we probably don't even want to take the risk of an indirect connection to the Internet," the sponsor said.

Members asked technical questions about ports, endpoint forensic auditing, and whether continuous video recording is feasible in all counties. The committee adopted the amendment and gave the amended bill a due-pass recommendation (4 ayes, 2 nays, 1 absent).

Next steps: Counties will need to evaluate equipment and processes for compliance; sponsors suggested additional technical consultation before floor action.