Election season is approaching, and mail voting has again become a target of unsubstantiated fraud claims from the Trump administration—including a March 2026 executive order seeking new federal restrictions on mail ballots, which Colorado joined 22 other states in challenging in court. Here’s how Colorado’s election system actually works, and why officials say it’s built to catch and fix mistakes.
Every ballot cast in Colorado exists twice: once as a paper record a voter can see and touch, and once as a digital tally. That built-in redundancy is intentional, the product of more than a decade of state law, and it’s the reason election officials can prove that results are accurate.
Every vote starts as paper
Colorado law requires that any voting system used in the state produce a “voter-verified paper record” of each ballot cast, a mandate written into statute in 2005 (C.R.S. 1-5-801). In practice, that means every one of the state’s 64 counties counts hand-marked paper ballots on optical scanners. Voters with disabilities who can’t mark a paper ballot by hand instead use an accessible ballot-marking device—a touchscreen with audio and tactical controls—which still prints out a paper ballot for view before it’s cast and counted the same way as everyone else’s. That paper is what makes everything else possible, because a paper record can always be counted by hand and checked against what a machine reports.
Colorado has been an all-mail-ballot-state since 2013, when then-Gov. John Hickenlooper signed the Voter Access and Modernized Elections Act, sending every active registered voter a ballot automatically.
That change shifted election security away from checking a voter’s identity at a polling place, and toward tracking the ballot itself, every step of the way.
What that looks like: officials check the signature on your returned ballot against your signature on file. Whether you drop it in the mail or at a drop box, a bipartisan team—one Democrat, one Republican—collects it, seals it in a locked bag, and signs a “chain of custody” log recording the date, time and location, which later becomes public record. Drop boxes themselves are bolted to the ground and under 24/7 video surveillance, and bipartisan teams empty them at least once a day. Voters who want to follow their own ballot through this process can sign up for a free statewide tracking service called BallotTrax.
A math check on every election
The centerpiece of Colorado’s system is the risk-limiting audit, a statistical check the state pioneered. Colorado was the first state in the country to require one after every election, running its first statewide audit in November 2017 under a law passed in 2009 (C.R.S. 1-7-515, via Verified Voting).
The process is public and, by design, unpredictable. After ballots are counted, officials hold an open meeting where they roll physical dice—20 of them, each with 10 sides, in 2024—to generate a random number. That number seeds a computer program that randomly selects individual paper ballots for officials to pull, hand-count, and compare against what the machines reported. Bipartisan county audit boards do the checking, and the Colorado Secretary of State’s office says the audit has never once found a discrepancy caused by voting equipment malfunctioning since the practice began.
If an audit round turns up too many mismatches between the hand count and machine count, state rules require officials to check more ballots — expanding the audit sample and, if necessary, moving to a full hand count of every ballot in that race.
Machines that can’t reach the internet
Colorado’s voting equipment—mostly Dominion Democracy Suite systems, with Douglas and Garfield counties using Clear Ballot’s ClearVote—must be certified by the state before use and is never connected to the internet. New software is installed only from physical media—think flash drives—that a limited number of background-checked state staff are permitted to handle, according to the Secretary of State’s certification materials.
Before every election, bipartisan testing boards, made up of one Democrat and one Republican, run public “logic and accuracy” tests on every machine, a step required by law (C.R.S. 1-7-509).
When the system was tested
Colorado’s rules were rewritten after a real breach. In 2021, then-Mesa County Clerk Tina Peters let an unauthorized person copy county voting system hard drives and disabled security cameras during the process, according to trial testimony. She was convicted in 2024 and initially sentenced to nine years in prison. A state appeals court upheld her conviction this April, but ordered her resentenced, and Democratic Gov. Jared Polis commuted her sentence in May, drawing bipartisan criticism, including from his own attorney general, who called the move “mind-boggling and wrong.”
The Peters case directly prompted new law. A 2022 measure made it a felony to access voting equipment without authorization or to publish voting-system passwords, and it required key-card access and video surveillance anywhere equipment is stored (SB22-153). That law was tested again in 2024, when the Secretary of State’s own office accidentally posted a spreadsheeting containing partial equipment passwords online for months. An independent investigation later attributed the leak to a data-migration error rather than an intrusion, and the subsequent statewide audit confirmed that ballots were counted the way voters intended and that tabulating equipment worked correctly, according to the Secretary of State’s own fact sheet on the incident.
What’s changed for 2026
This June, Polis signed a new elections law that, starting with this November’s election, requires mail ballots to be sent out earlier and drop boxes to open earlier than in past cycles. The law also extends the buffer zone where voter intimidation is criminally prohibited to within 100 feet of a drop box or voting center, and adds new chain-of-custody rules for election offices in the event of a law enforcement search — a provision written with Georgia’s 2020 election-office disputes in mind.
Separately, the state is working to fill a gap left by the federal government’s 2025 decision to end its main election-cybersecurity information-sharing support, which Secretary of State Jena Griswold’s office says it’s still assessing how to replace.
