Establishment of Electronic Reporting; Electronic Records

FederalRegulations

Ask Donna

How this section applies to your facts.

Federal Register › Vol. 66 › 66 FR 46162

This text was captured on Aug 14, 2026. It is a snapshot, not a live feed, so check the official code before relying on it.

Text

ENVIRONMENTAL PROTECTION AGENCY 40 CFR Parts 3, 51, 60, 63, 70, 123, 142, 145, 162, 233, 257, 258, 271, 281, 403, 501, 745 and 763 [FRL-7045-5] RIN 2025-AA07 Establishment of Electronic Reporting; Electronic Records AGENCY:

Environmental Protection Agency.

ACTION:

Proposed rule.

SUMMARY:

EPA is proposing to allow electronic reporting to EPA by permitting the use of electronic document receiving systems to receive electronic documents in satisfaction of certain document submission requirements in EPA's regulations. The proposal also sets forth the conditions under which EPA will allow an electronic record to satisfy federal environmental recordkeeping requirements in EPA's regulations. In addition, under today's proposal, States and tribes will be able to seek EPA approval to accept electronic documents or allow the maintenance of electronic records to satisfy reporting and recordkeeping requirements under authorized or delegated environmental programs that they administer. The proposal includes criteria against which a State's or tribe's electronic document receiving system will be evaluated before EPA can approve changes to the authorized program to allow electronic reporting. Similarly, the proposal includes criteria against which EPA will evaluate a State's or tribe's provisions for electronic recordkeeping.

Under today's proposal, electronic document submission or electronic recordkeeping will be totally voluntary; EPA will not require the submission of electronic documents or maintenance of electronic records in lieu of paper documents or records. EPA will only begin to accept direct submission of an electronic document once EPA has provided public notice that its electronic document receiving system is prepared to receive the document in electronic form. Similarly, EPA will only begin to allow electronic records to satisfy a specific EPA recordkeeping requirement once EPA has provided public notice stating that electronic records will satisfy the identified requirement

direct submission of an electronic document once EPA has provided public notice that its electronic document receiving system is prepared to receive the document in electronic form. Similarly, EPA will only begin to allow electronic records to satisfy a specific EPA recordkeeping requirement once EPA has provided public notice stating that electronic records will satisfy the identified requirement.

DATES:

In order to be considered, comments must be received on or before November 29, 2001. Comments provided electronically will be considered timely if they are submitted by 11:59 p.m. (Eastern time) November 29, 2001.

ADDRESSES:

Comments should be addressed to the United States Environmental Protection Agency, Enforcement and Compliance Docket and Information Center, (Mail Code 2201A), Attn: Docket Number EC-2000-007, 1200 Pennsylvania Avenue NW., Washington, DC, 20460. Commenters are also requested to submit an original and 3 copies of their written comments as well as an original and 3 copies of any attachments, enclosures, or other documents referenced in the comments. Commenters who would like EPA to acknowledge receipt of their comments should include a self-addressed, stamped envelope. All comments must be postmarked or delivered by hand by November 29, 2001. No facsimiles (faxes) will be accepted. Public comments and supporting materials are available for viewing in the Enforcement and Compliance Docket and Information Center, located at 1200 Pennsylvania Avenue, NW., (Ariel Rios Building), 2nd Floor, Room 2213, Washington, DC 20460. The documents are available for viewing from 9 a.m. to 4 p.m., Monday through Friday, excluding federal holidays. To review docket materials, it is recommended that the public make an appointment by calling (202) 564-2614 or (202) 564-2119. The public may copy a maximum of 266 pages from any regulatory document at no cost. Additional copies cost $0.15 per page

oor, Room 2213, Washington, DC 20460. The documents are available for viewing from 9 a.m. to 4 p.m., Monday through Friday, excluding federal holidays. To review docket materials, it is recommended that the public make an appointment by calling (202) 564-2614 or (202) 564-2119. The public may copy a maximum of 266 pages from any regulatory document at no cost. Additional copies cost $0.15 per page. The rule and some supporting materials are also available electronically on the Internet for public review, using a www browser type, at http://www.epa.gov/.

EPA will also accept comments electronically. Comments should be addressed to the following Internet address: docket.oeca@epa.gov. Electronic comments must be submitted as an ASCII, WordPerfect 5.1/6.1/8 format file and avoid the use of special characters or any form of encryption. Comments in electronic format should also be identified by the docket number EC-2000-007. Electronic comments will be transferred into a paper version for the official record. EPA will attempt to clarify electronic comments if there is an apparent error in transmission. Comments provided electronically will be considered timely if they are submitted electronically by 11:59 p.m. (Eastern time) November 29, 2001.

FOR FURTHER INFORMATION CONTACT:

For general information on this proposed rule, contact the docket above. For more detailed information on specific aspects of this rulemaking, contact David Schwarz (2823), Office of Environmental Information, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20460, (202) 260-2710, schwarz.david@epa.gov, or Evi Huffer (2823), Office of Environmental Information, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460, (202) 260-8791, huffer.evi@epa.gov.

SUPPLEMENTARY INFORMATION:

Affected Entities

fice of Environmental Information, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW, Washington, DC 20460, (202) 260-2710, schwarz.david@epa.gov, or Evi Huffer (2823), Office of Environmental Information, U.S. Environmental Protection Agency, 1200 Pennsylvania Avenue NW., Washington, DC 20460, (202) 260-8791, huffer.evi@epa.gov.

SUPPLEMENTARY INFORMATION:

Affected Entities. This rule will potentially affect State and local governments which have been authorized or which seek authorization to administer a federal environmental program under Title 40 of the Code of Federal Regulations. The rule will also potentially affect private parties subject to any requirements in Title 40 of the Code of Federal Regulations that a document be created, submitted, or retained. Affected Entities include:

Category Examples of affected entities Local government Publicly Owned Treatment Works, owners and operators of treatment works treating domestic sewage, local and regional air boards, local and regional waste management authorities, municipal and other drinking water authorities. Private Industry owners and operators, waste transporters, privately owned treatment works or other treatment works treating domestic sewage, privately owned water works, small businesses of various kinds, sponsors such as laboratories that submit or initiate/support studies, and testing facilities that both initiate and conducts studies. State government States or Tribes that manage any federal environmental programs authorized/approved by EPA under Title 40 of the Code of Federal Regulations. Federal government Federally owned treatment works and industrial dischargers; federal facilities subject to hazardous waste regulation. This table is not intended to be exhaustive, but rather provides a guide for readers regarding entities likely to be affected by this action. This table lists the types of entities that EPA is now aware can potentially be affected by this action

eral Regulations. Federal government Federally owned treatment works and industrial dischargers; federal facilities subject to hazardous waste regulation. This table is not intended to be exhaustive, but rather provides a guide for readers regarding entities likely to be affected by this action. This table lists the types of entities that EPA is now aware can potentially be affected by this action. Other types of entities not listed in the table can also be affected. Note that while this proposal will affect entities involved with hazardous waste management, it does not apply to the Hazardous Waste Manifest, which EPA is addressing in a separate electronic reporting rule. If you have questions regarding the applicability of this action to a particular entity, consult the person listed in the preceding FOR FURTHER INFORMATION CONTACT section.

Information in the preamble is organized as follows:

I. Overview A. Why does the Agency want to allow electronic reporting and record-keeping? B. What will the proposed regulations do? II. Background A. What is EPA's current electronic reporting policy? B. How will today's proposal change EPA's current electronic reporting policy? C. Why is EPA proposing these changes in electronic reporting policy? D. What is EPA's approach to electronic record-keeping? E. What information is EPA seeking about electronic reporting and record-keeping proposals? F. How were stakeholders consulted in developing today's proposal? III. Scope of Today's Proposal A. Who may submit electronic documents and maintain electronic records? B. How does today's proposal relate to the new E-SIGN legislation? C. Which documents can be filed electronically? D. Which records can be maintained electronically? E. How will today's proposal implement electronic reporting and record-keeping? IV. The Requirements in Today's Proposal A. What are the proposed requirements for electronic reporting to EPA? B. What requirements must electronically maintained records satisfy? 1. General approach. 2

SIGN legislation? C. Which documents can be filed electronically? D. Which records can be maintained electronically? E. How will today's proposal implement electronic reporting and record-keeping? IV. The Requirements in Today's Proposal A. What are the proposed requirements for electronic reporting to EPA? B. What requirements must electronically maintained records satisfy? 1. General approach. 2. EPA's proposed criteria for electronic record-retention systems. 3. Electronic records associated with electronic signatures. 4. The relation of these requirements to Food and Drug Administration (FDA) criteria under 21 CFR part 11. 5. Storage media issues. 6. Additional options. C. What is the process that EPA will use to certify State systems as functionally equivalent to the CDX? D. What criteria are EPA proposing that State electronic report receiving systems must satisfy? 1. General system-security requirements. 2. Electronic signature method. 3. Submitter registration process. 4. Electronic signature/certification scenario. 5. Transaction record. 6. System archives. E. What are the costs and benefits associated with today's proposal? V. The Central Data Exchange (CDX) A. What is EPA's concept of the CDX? B. What are the CDX building blocks? 1. Public key infrastructure (PKI)-based digital signatures. 2. The CDX registration process. 3. The CDX architecture. 4. Electronic data interchange (EDI) standards. 5. The transaction environment. VI. Regulatory Requirements A. Executive Order 12866 B. Executive Order 13132 C. Paperwork Reduction Act D. Regulatory Flexibility Act E. Unfunded Mandates Reform Act F. National Technology Transfer and Advancement Act G. Executive Order 13045 H. Executive Order 13175 I. Executive Order 13211 (Energy Effects) I. Overview

ctronic data interchange (EDI) standards. 5. The transaction environment. VI. Regulatory Requirements A. Executive Order 12866 B. Executive Order 13132 C. Paperwork Reduction Act D. Regulatory Flexibility Act E. Unfunded Mandates Reform Act F. National Technology Transfer and Advancement Act G. Executive Order 13045 H. Executive Order 13175 I. Executive Order 13211 (Energy Effects) I. Overview

A. Why Does the Agency Want To Allow Electronic Reporting and Record-Keeping?

More than ten years ago, EPA published a notice entitled: “Electronic Reporting at EPA: Policy on Electronic Reporting,” (FRL-3815-4) announcing the goal of making electronic reporting available under EPA regulatory programs. We gave as reasons for this goal our expectation that enabling the submission and storage of electronic documents in lieu of paper documents can:

• Reduce the cost for both sender and recipient,

• Improve data quality by automating quality control functions and eliminating rekeying, and

• Greatly improve the speed and ease with which the data can be accessed by all who needed to use it.

Electronic reporting and record-keeping have a strong mandate in federal policy and law. As stated in the March, 1996, Reinventing Environmental Information Report, electronic reporting supports the President's overall regulatory re-invention goals of reducing the burden of compliance and streamlining regulatory reporting. In addition, the Government Paperwork Elimination Act (GPEA) of 1998, Public Law 105-277, requires that agencies be prepared to allow electronic reporting and recordkeeping under their regulatory programs by October 21, 2003. Given the enormous strides in data transfer and management technologies since 1990—particularly in connection with the Internet—replacing paper with electronic data transfer now promises increased productivity across almost all facets of business and government.

quires that agencies be prepared to allow electronic reporting and recordkeeping under their regulatory programs by October 21, 2003. Given the enormous strides in data transfer and management technologies since 1990—particularly in connection with the Internet—replacing paper with electronic data transfer now promises increased productivity across almost all facets of business and government.

B. What Will the Proposed Regulations Do?

The proposed rule will remove existing regulatory obstacles to electronic reporting and record-keeping across a broad spectrum of EPA programs, and establish requirements to assure that electronic documents and electronic records are—for all purposes—as valid and authentic as their paper counterparts. These proposed requirements will apply to regulated entities that choose to submit electronic documents and/or keep electronic records, and under today's proposal, the choice of using electronic rather than paper for future reports and records will remain purely voluntary. Today's proposal will not amend compliance requirements under existing regulations and statutes and will not affect whether a document must be created, submitted, or retained under the existing provisions of Title 40 of the Code of Federal Regulations. Similarly, today's proposal will not affect the period of required record-retention, whether the stored electronic document must be signed, who is entitled to receive copies of the record, the number of copies that must be maintained, or any other requirements imposed by the underlying EPA, State, tribal or local program regulations. Public access to environmental compliance information will not be adversely affected by today's proposal. Electronic reporting and record-keeping provisions in this proposal will provide for continued public access to electronic documents equivalent to that provided for paper records under existing law

ny other requirements imposed by the underlying EPA, State, tribal or local program regulations. Public access to environmental compliance information will not be adversely affected by today's proposal. Electronic reporting and record-keeping provisions in this proposal will provide for continued public access to electronic documents equivalent to that provided for paper records under existing law.

For purposes of this proposal, EPA is using the term “electronic reporting” in a sense that excludes submission of a report via magnetic media, for example via diskette, compact disk, or tape; we are also excluding transmission via hard copy facsimile or “fax”. Likewise, our use of the term “electronic document” throughout this Notice refers exclusively to documents that are transmitted via a telecommunications network, excluding hard copy facsimile. However, this proposal's exclusion of magnetic media submissions in no way indicates EPA's rejection of this technology as a valid approach to paperless reporting; we believe that in many cases magnetic media submission fulfills the goals of the Government Paperwork Elimination Act (GPEA). Many EPA programs have successfully used magnetic media submissions to implement their regulatory reporting,

For regulated entities that choose to submit electronic documents directly to EPA, today's proposal will require that these documents be submitted to a centralized Agency-wide electronic document receiving system, called the ‘Central Data Exchange’ (CDX), or to alternative systems designated by the Administrator. Regulated entities that wish to submit electronic documents directly to EPA will satisfy the requirements in today's proposal by successfully submitting their reports to the CDX. While we do not intend to codify any of the details of how CDX operates or how it is constructed, EPA does solicit comments on the characteristics of the CDX and the submission scenarios described in this preamble

trator. Regulated entities that wish to submit electronic documents directly to EPA will satisfy the requirements in today's proposal by successfully submitting their reports to the CDX. While we do not intend to codify any of the details of how CDX operates or how it is constructed, EPA does solicit comments on the characteristics of the CDX and the submission scenarios described in this preamble. In addition, the CDX design specifications will be included as a part of this rulemaking docket. For regulated entities that choose to keep records electronically, today's proposal requires the adoption of best practices for electronic records management. Importantly, today's proposal will not authorize the conversion of existing paper documents to an electronic format for record-retention purposes because no mechanism currently exists that can be relied upon in all cases to preserve the forensic data in an existing paper document when it is converted to an electronic form. However, today's proposal does not prohibit such conversions at the Administrator's discretion on a case-by-case basis.

Many facilities do not submit documents directly to EPA, but rather to States, tribes or local governments that are approved, authorized or delegated to administer a federal environmental program on EPA's behalf or to administer a state environmental program in lieu of the federal regulatory program in that State. We will refer to these as “authorized State and tribal programs.” This proposal will allow for EPA approval of changes to authorized State and tribal programs to provide for electronic reporting, and EPA approval will be based largely on an assessment of the State's or tribe's “electronic document receiving system” that will be used to implement the electronic reporting provisions. For this purpose, today's proposal includes detailed criteria that EPA will use to determine that an electronic document receiving system is acceptable

te and tribal programs to provide for electronic reporting, and EPA approval will be based largely on an assessment of the State's or tribe's “electronic document receiving system” that will be used to implement the electronic reporting provisions. For this purpose, today's proposal includes detailed criteria that EPA will use to determine that an electronic document receiving system is acceptable. These criteria address such issues as system security, the approach to electronic signature and certification, chain-of-custody and archiving, including provisions that address how a State, tribe or local government manages electronic records that are directly associated with its electronic document receiving system, as well as certain data transfers between this system and regulated entities. Beyond this, today's proposal does not address State, tribal or local government electronic recordkeeping or data transfers carried out to administer their authorized programs. Today's proposal does not address any data transfers between EPA and States or tribes as a part of administrative arrangements to share data. Finally, it is worth noting that EPA can approve changes to authorized State or tribal programs that involve the use of CDX to receive data submissions from their regulated communities. CDX has been designed with the goal of fully satisfying the criteria that this proposal specifies for assessing State or tribal electronic document receiving systems; similarly, EPA will ensure that other systems the Administrator designates to receive electronic submissions will satisfy the criteria as well. In view of this, EPA is exploring opportunities to leverage CDX resources for use by States, tribes and local environmental agencies.

ria as well. In view of this, EPA is exploring opportunities to leverage CDX resources for use by States, tribes and local environmental agencies.

Similarly, many facilities maintain records to satisfy the requirements of authorized State and tribal programs. This proposal will also allow for EPA approval of changes to authorized State and tribal programs to provide for electronic record-keeping. EPA approval in this case will be based on a determination that the State's or tribe's program will require best practices for electronic records management, corresponding to EPA's provisions for electronic records maintained to satisfy EPA recordkeeping requirements.

For both document submission and record-keeping, the point of the proposed requirements is primarily to ensure that the authenticity and integrity of these documents and records are preserved as they are created, submitted, and/or maintained electronically, so that they continue to provide strong evidence of what was intended by the individuals who created and/or signed and certified them. Among other things, today's proposal is intended to ensure that the federal laws regarding the falsification of information submitted to the government still apply to any and all electronic transactions, and that fraudulent electronic submissions or record-keeping can be prosecuted to the fullest extent of the law. In establishing clear requirements for electronic reporting systems and electronic records, this proposed rule will help to minimize fraud by assuring that the responsible individuals can be readily identified.

While today's proposal will remove regulatory obstacles to electronic reporting and record-keeping, EPA will make electronic submission available as an option for specific reports or other documents only as the systems become available to receive them. Similarly, EPA will make electronic recordkeeping available as an option for specific record-keeping requirements only as programs become ready to adopt this change

posal will remove regulatory obstacles to electronic reporting and record-keeping, EPA will make electronic submission available as an option for specific reports or other documents only as the systems become available to receive them. Similarly, EPA will make electronic recordkeeping available as an option for specific record-keeping requirements only as programs become ready to adopt this change. In the case of electronic reporting, EPA plans to move aggressively toward implementation of CDX for high volume environmental reports submitted directly to EPA. EPA will publish announcements in the Federal Register as CDX and other systems become available for particular environmental reports and as programs become ready to make electronic recordkeeping an option. These points are discussed in more detail in Section III.C and D of this Preamble. To implement electronic reporting and recordkeeping under authorized State and tribal programs, EPA also plans to work with interested States and tribes to approve the necessary program changes as quickly and expeditiously as possible.

II. Background

A. What Is EPA's Current Electronic Reporting Policy?

On September 4, 1996, EPA published a document entitled “Notice of Agency's General Policy for Accepting Filing of Environmental Reports via Electronic Data Interchange (EDI)” (61 FR 46684) (hereinafter referred to as “the 1996 Policy”), where “EDI” generally refers to the transmission, in a standard syntax, of unambiguous information between computers of organizations that may be completely external to each other (61 FR at 46685). This notice announced our basic policy for accepting electronically submitted environmental reports, and its scope was intended to include any regulatory, compliance, or informational (voluntary) reporting to EPA via EDI.

In the context of EDI, the “syntax” of the computer-to-computer transmissions may be thought of as the structure or format of the transmitted data files

other (61 FR at 46685). This notice announced our basic policy for accepting electronically submitted environmental reports, and its scope was intended to include any regulatory, compliance, or informational (voluntary) reporting to EPA via EDI.

In the context of EDI, the “syntax” of the computer-to-computer transmissions may be thought of as the structure or format of the transmitted data files. And, “format” here refers to such things as the ordering and labeling of the individual elements of data, the symbol used to separate elements, the way that related elements are grouped together, and so on. For example, for a file consisting of people's names, a simple

For purposes of the 1996 policy, the standard transmission formats used by EPA were to be based on the EDI standards developed and maintained by the American National Standards Institute (ANSI) Accredited Standards Committee (ASC) X12. By linking our approach to the ANSI X12 standards, we hoped to take advantage of the robust ANSI-based EDI infrastructure already in place for commercial transactions, including a wide array of commercial off-the-shelf (COTS) software packages and communications network services, and a growing industry community of EDI experts available both to EPA and to the regulated community. At the time EPA was writing this policy, ANSI-based EDI was arguably the dominant mode of electronic commerce across almost all business sectors, from aerospace to wood products, at least in the United States. EDI was also widely used in the Federal Government, most notably at the Department of Defense, but also, increasingly, at other agencies, including the Social Security Administration, the General Services Administration, the Department of Transportation, the Health Care and Finance Administration, and the Department of Housing and Urban Development, and the Department of Health and Human Services

EDI was also widely used in the Federal Government, most notably at the Department of Defense, but also, increasingly, at other agencies, including the Social Security Administration, the General Services Administration, the Department of Transportation, the Health Care and Finance Administration, and the Department of Housing and Urban Development, and the Department of Health and Human Services.

However, as the 1996 policy made clear, no specific EPA reporting requirement can be satisfied via EDI until the Agency develops the corresponding program-specific implementation guidance (61 FR 46686). This guidance generally needs to do at least three things. First, it needs to address such procedural matters as the interactions with the communications network (for EDI purposes, usually stipulated as a controlled-access, “value-added network” or “VAN”), schedule for submissions and acknowledgments, transaction records to be maintained, and so on. Second, it needs to stipulate the specific ANSI X12 standard transmission formats—referred to as “transaction sets”—to be used for the specified reports. This stipulation is essential, since ANSI provides hundreds of different transaction sets, each corresponding to a distinct type of commercial document, e.g . invoices, purchase orders, shipping notices, product specifications, reports of test results, and so on. Third, the guidance also needs to say how the stipulated transactions sets are to be interpreted. X12 transaction sets are generally designed to be somewhat generic—they typically leave a number of their components as “optional”, and use data-element specifications that are open to multiple interpretations

rchase orders, shipping notices, product specifications, reports of test results, and so on. Third, the guidance also needs to say how the stipulated transactions sets are to be interpreted. X12 transaction sets are generally designed to be somewhat generic—they typically leave a number of their components as “optional”, and use data-element specifications that are open to multiple interpretations. (For a more detailed explanation of EDI and these implementation guidance documents, see section V.B.4 of this preamble.)

Given a public notice that the applicable implementation guidance is ready, the September, 1996, policy allows facilities to submit required reports electronically using EDI once they enter into a Terms and Conditions Agreement (TCA) with the Agency (61 FR 46685). Where the report in question requires a responsible individual at a facility to certify to the truthfulness of the submitted data, the TCA must provide for the use of a Personal Identification Number (PIN) as a form of electronic signature. Under the policy, the individual entering into the TCA is required to use a PIN assigned by EPA for this purpose (61 FR 46685). Finally, under the TCA, the facility is required to adhere to security and audit requirements as described in the notice (61 FR 46687).

Finally, the 1996 policy also explained that the various programs may require additional security procedures on a program-by-program basis (61 FR 46684). Such procedures may be covered in the program-specific implementation guidance, or can be provided through rule-making.

B. How Would Today's Proposal Change EPA's Current Electronic Reporting Policy?

fic implementation guidance, or can be provided through rule-making.

B. How Would Today's Proposal Change EPA's Current Electronic Reporting Policy?

For practical purposes, the most important changes that today's proposal makes to current policy is in our technical approach to electronic reporting. Generally, we propose to greatly broaden the options available for electronic submission of data. For example, while we will continue to support data transfer via standards-based EDI (as explained in section V.B.4 of this preamble), we will also provide options involving user-friendly “smart” electronic forms to be filled out on-line, on the Internet, or downloaded for completion off-line at the user's personal computer. In addition, we propose to support data transfers through the Internet, via email, or via on-line interactions with Web sites, in a variety of common application-based formats, such as those output by spreadsheet packages. In terms of electronic signature technology, while we may continue to allow PIN-based approaches, our plan is to emphasize digital signatures based on “public key infrastructure” (PKI) certificates, given the increasing support for—and acceptance of—PKI for commercial purposes. (For an explanation of PKI, see Section V.B.1 of this preamble.) And, we plan to consider and allow for other signature technologies as they become viable for our applications.

This proposal also represents some important changes in EPA's regulatory strategy as well. To begin with, we are proposing to abandon any attempt to use regulations or formal policies to place technology-specific or procedural requirements on regulated entities submitting electronic documents. In place of the technology-specific/procedural provisions, our regulation will require that electronic submissions be made to designated EPA systems, or to State, tribal or local government systems that are determined to satisfy a certain set of function-based criteria

or formal policies to place technology-specific or procedural requirements on regulated entities submitting electronic documents. In place of the technology-specific/procedural provisions, our regulation will require that electronic submissions be made to designated EPA systems, or to State, tribal or local government systems that are determined to satisfy a certain set of function-based criteria. Thus, as a rulemaking, today's proposal will govern electronic reporting by placing requirements on the systems that receive the electronic documents—rather than on the regulated entities submitting them—and by specifying these requirement in terms of technology-neutral functionality.

This new regulatory strategy does not mean that we are proposing to abandon any control over how electronic documents are submitted. We are proposing instead to require the use of the “Central Data Exchange” (CDX) system or other EPA designated systems for submissions to EPA. While the rule may be technology-neutral, CDX itself will incorporate a suite of very specific technologies, including digital signatures based on “public key infrastructure” (PKI) certificates, described in detail below. In addition, while the rule itself will not require more than the use of CDX for electronic submissions to EPA, using CDX will—as a practical matter—impose a very well-determined set of requirements on the reporting process for those who choose electronic submission instead of paper when reporting directly to EPA. Section V of this preamble will describe these requirements in some detail.

These changes in strategy are significant. They represent a decision that the mechanics of electronically submitting data should not be reflected in specific regulatory provisions. In addition, these changes give EPA the flexibility to adapt our electronic reporting systems to evolving technologies without having to amend our regulations with each technological innovation. That is, CDX or other

hese changes in strategy are significant. They represent a decision that the mechanics of electronically submitting data should not be reflected in specific regulatory provisions. In addition, these changes give EPA the flexibility to adapt our electronic reporting systems to evolving technologies without having to amend our regulations with each technological innovation. That is, CDX or other

C. Why Is EPA Proposing These Changes in Electronic Reporting Policy?

EPA is proposing these changes for three reasons. First, and most important, the technology environment has changed substantially since the September, 1996, policy was written. Web-based electronic commerce and Public Key Infrastructure (PKI) provide two obvious examples. While both were available and in use for some purposes in 1996, they had not yet achieved the level of acceptance and use that they enjoy today. We could not have anticipated in1996 that this evolution would occur as rapidly as it has. Clearly, these developments require that we extend our approach to electronic reporting beyond EDI and PINs. In addition, they teach us that it is generally unwise to base regulatory requirements on the existing information technology environment or on assumptions about the speed and direction of technological evolution.

Second, we believe that technology-specific provisions would, of necessity, be very complex and unwieldy. The resulting regulation would likely place unacceptable burdens on regulated entities trying to understand and comply with it, and might also be difficult for EPA to administer and enforce.

ted entities trying to understand and comply with it, and might also be difficult for EPA to administer and enforce.

Third, and finally, an electronic reporting architecture that makes a centralized EPA, State or tribal system the platform for such functions as electronic signature/certification is now quite viable—and quite consistent with the standard practices of Web-based electronic commerce. In many ways, regulated entities' electronic transactions with the “Central Data Exchange” (CDX) will be similar to doing business with an on-line travel agency, book store, or brokerage, and with a similar client-server architecture. Given the state of technology five years ago, we could not have considered this approach in the September, 1996, policy.

D. What Is EPA's Approach to Electronic Record-Keeping?

Today's proposal sets forth the criteria under which the Agency considers electronic records to be trustworthy, reliable, and generally equivalent to paper records in satisfying regulatory requirements. The intended effect of this proposed rule is to permit use of electronic technologies in a manner that is consistent with EPA's overall mission and that preserves the integrity of the Agency's enforcement activities.

E. What Information Is EPA Seeking About Electronic Reporting and Record-Keeping Proposals?

In proposing to allow regulated entities to submit electronic documents and maintain electronic records, EPA has, at least, the following three goals:

• To reduce the cost and burden of data transfer and maintenance for all parties to the data exchanges;

• To improve the data—and the various business processes associated with its use—in ways that may not be reflected directly in cost-reductions, e.g. through improvements in data quality, and the speed and convenience with which data may be transferred and used; and

• To maintain or improve the level of corporate and individual responsibility and accountability for electronic reports and records that currently exists in the paper environment

processes associated with its use—in ways that may not be reflected directly in cost-reductions, e.g. through improvements in data quality, and the speed and convenience with which data may be transferred and used; and

• To maintain or improve the level of corporate and individual responsibility and accountability for electronic reports and records that currently exists in the paper environment.

EPA is seeking comment and information on how well today's proposed regulatory provisions and the associated Central Data Exchange infrastructure will serve to fulfill these three goals. Concerning the first—addressing cost and burden—EPA is particularly interested in and seeks comment on whether today's proposal will make electronic reporting and record-keeping a practical and attractive option for smaller regulated entities, especially small businesses. Concerning the second—addressing the data and the associated business process—we are especially interested in comments on how our proposed approach to electronic reporting and record-keeping will affect third parties, for example State and local agencies that may collect and/or use the data in implementing EPA programs as well as members of the public who have an interest in the data as concerned citizens.

Concerning our third goal, it is essential that we continue to ensure sufficient personal and corporate responsibility and accountability in the submission of electronic reports and the maintenance of electronic records; otherwise we place at risk the continuing viability of self-monitoring and self-reporting that provides the framework for compliance under most of our environmental programs. Therefore, EPA is especially interested in any concerns or issues that commenters may wish to raise about the effect that moving from paper to the electronic medium may have on this compliance structure—as well as assessments of the approaches EPA is proposing to address these concerns.

ring and self-reporting that provides the framework for compliance under most of our environmental programs. Therefore, EPA is especially interested in any concerns or issues that commenters may wish to raise about the effect that moving from paper to the electronic medium may have on this compliance structure—as well as assessments of the approaches EPA is proposing to address these concerns.

F. How Were Stakeholders Consulted in Developing Today's Proposal?

Today's proposal reflects more than eight years of interaction with stakeholders—including State and local governments, industry groups, the legal community, environmental non-government organizations, ANSI ASC X12 sub-committees, and other federal agencies. Many of our most significant interactions involved electronic reporting pilot projects conducted with State agency partners, including the States of Pennsylvania, New York, Arizona, and several others. In addition, over a two-year period beginning in May, 1997, EPA worked together with approximately 35 States on the State Electronic Commerce/Electronic Data Interchange Steering Committee (SEES) convened by the National Governors' Association (NGA) Center for Best Practices (CBP). The product of the SEES effort was a document entitled, “A State Guide for Electronic Reporting of Environmental Data,” available in the docket for this rulemaking, along with reports on some of the more recent state/EPA electronic reporting pilots. Information on SEES is also available at: www.nga.org/CBP/Activities/EnviroReporting.asp . Today's proposal has benefitted greatly from the SEES discussions, and EPA believes that the proposal is generally consistent with the SEES “State Guide”.

Beginning in June, 1999, EPA also sponsored a series of conferences and meetings with the explicit purpose of seeking stakeholder advice on today's rulemaking

ation on SEES is also available at: www.nga.org/CBP/Activities/EnviroReporting.asp . Today's proposal has benefitted greatly from the SEES discussions, and EPA believes that the proposal is generally consistent with the SEES “State Guide”.

Beginning in June, 1999, EPA also sponsored a series of conferences and meetings with the explicit purpose of seeking stakeholder advice on today's rulemaking. These included:

• The Symposium on Legal Implications of Environmental Electronic Reporting, June 23-25, 1999, convened by the Environmental Law Institute;

• Two NGA-convened State meetings, held in Cleveland, April 11-12, 2000, and in Phoenix, June 1-2, 2000; and

• Two public meetings, held in Chicago, June 6, 2000, and in Washington, D.C., July 11, 2000.

Reports of these conferences and meetings are also available in the rulemaking docket.

III. Scope of Today's Proposal

A. Who May Submit Electronic Documents and Maintain Electronic Records?

Any regulated company or other entity that submits documents addressed by today's proposal (see section III.B., below) directly to EPA can submit them electronically as soon as EPA announces that the Central Data Exchange or a designated alternative system is ready to receive these reports. Any regulated company or other entity that maintains records addressed by today's proposal (see section III.C., below) under EPA regulations can store them in an electronic form subject to the proposed criteria for electronic record-keeping as soon as EPA announces that the specified records may be kept electronically. As noted in section I.B of this preamble, the rule will not authorize the conversion of existing paper records to an electronic format

cords addressed by today's proposal (see section III.C., below) under EPA regulations can store them in an electronic form subject to the proposed criteria for electronic record-keeping as soon as EPA announces that the specified records may be kept electronically. As noted in section I.B of this preamble, the rule will not authorize the conversion of existing paper records to an electronic format. Regulated companies or other entities that submit documents or maintain records under authorized State or tribal programs may submit or maintain them electronically as soon as EPA approves the changes to the authorized programs that are necessary to implement the State's or tribe's provisions for electronic reporting or recordkeeping.

Under today's proposal, the entities that can use electronic reporting and record-keeping will not be required to do so; they can still use the medium of paper for document submissions and records if they choose. Nonetheless, nothing in this proposal will prohibit State, tribal or local authorities from requiring electronic reporting or record-keeping under applicable State, tribal and local law.

B. How Does Today's Proposal Relate to the New E-SIGN Legislation?

The environmental reports and records that are the subject of this rule are generally not subject to the recently enacted “Electronic Signatures in Global and National Commerce Act of 2000” (“E-SIGN” or “the Act”), Public Law 106-229, because most of these governmentally-mandated documents are not amongst the “transactions” to which E-SIGN applies. However, the EPA has authority to permit electronic reporting under the statutes it administers and under the Government Paperwork Elimination Act (GPEA) of 1998, Public Law 105-277, http://ec.fed.gove/gpedoc.htm

onal Commerce Act of 2000” (“E-SIGN” or “the Act”), Public Law 106-229, because most of these governmentally-mandated documents are not amongst the “transactions” to which E-SIGN applies. However, the EPA has authority to permit electronic reporting under the statutes it administers and under the Government Paperwork Elimination Act (GPEA) of 1998, Public Law 105-277, http://ec.fed.gove/gpedoc.htm. E-SIGN, establishes the legal equivalence between: (1) Contracts written on paper and contracts in electronic form; (2) pen-and-ink signatures and electronic signatures; and (3) other legally-required written documents (termed “records” in the statute) and the same information in electronic form. As a general rule, if parties to a transaction in interstate commerce choose to use electronic signatures and records, E-SIGN grants legal recognition to those methods. E-SIGN provides that no contract, signature, or record relating to such a transaction shall be denied legal effect solely because it is in electronic form, nor may such a document be denied legal effect solely because an electronic signature or record was used in its formation. GPEA also provides such language for government filings covered by this rule and provides similar legal validity for associated electronic signatures. When E-SIGN takes effect on October 1, 2000, statutes or agency rules containing paper-based requirements that might otherwise deny effect to electronic signatures and records in consumer, commercial or business transactions between two or more parties will be superseded. E-SIGN does, however, permit federal and State agencies to set technology-neutral standards and formats for the submission and retention of electronic documents.

E-SIGN applies broadly to commercial, consumer, and business transactions in or affecting interstate or foreign commerce, including transactions regulated by both federal and State government

ween two or more parties will be superseded. E-SIGN does, however, permit federal and State agencies to set technology-neutral standards and formats for the submission and retention of electronic documents.

E-SIGN applies broadly to commercial, consumer, and business transactions in or affecting interstate or foreign commerce, including transactions regulated by both federal and State government. However, the conferees who drafted this legislation specifically excluded “governmental transactions” from the definition of transactions that are subject to E-SIGN; accordingly, E-SIGN does not cover transactions that are uniquely governmental, such as the transmission of a compliance report to a federal or State agency. Nonetheless, E-SIGN does cover documents that are created in a commercial, consumer, or business transaction, even if those documents are also submitted to a governmental agency or retained by the regulated community for governmental purposes. For example, an insurance contract that is commemorated in an electronic document will be covered by the provisions of E-SIGN, even if EPA or an authorized State requires that the policy-holder maintain proof of insurance as part of a federal or State environmental program. In order to ensure that these documents will meet governmental needs, the Act permits the government to set technology-neutral standards and formats for such records. In order that governmental agencies have time to promulgate these standards and formats, E-SIGN has a delayed effective date for its record-retention provisions of March 1, 2001. If a federal or State regulatory agency has proposed a standard or format for document retention by March 1, 2001, the Act will take effect with respect to those records on June 1, 2001.

and formats for such records. In order that governmental agencies have time to promulgate these standards and formats, E-SIGN has a delayed effective date for its record-retention provisions of March 1, 2001. If a federal or State regulatory agency has proposed a standard or format for document retention by March 1, 2001, the Act will take effect with respect to those records on June 1, 2001.

C. Which Documents Could Be Filed Electronically?

With the exception of the Hazardous Waste Manifest (which EPA is addressing in a separate electronic reporting rule), today's proposal addresses document submissions required by or permitted under any EPA or authorized State, tribal or local program governed by EPA's regulations in Title 40 of the Code of Federal Regulations (CFR). Nonetheless, EPA will need time to develop the hardware and software components required for each individual type of document. Similarly, EPA will need time to evaluate State, tribal, and local electronic document receiving systems to ensure that they meet the criteria articulated in today's proposal. Accordingly, once this rule takes effect, documents subject to this rule submitted directly to EPA can only be submitted electronically after EPA announces in the Federal Register that the Central Data Exchange (CDX) or an alternative system is ready to receive them. Documents subject to this rule submitted under an authorized State or tribal program can only be submitted electronically once EPA has approved the necessary changes to the authorized program.

bmitted electronically once EPA has approved the necessary changes to the authorized program.

Both in developing the CDX, and in approving changes to authorized State and tribal programs related to electronic reporting, EPA plans to give priority to receipt of the relatively high volume environmental compliance reports that do not involve the submission of confidential business information (CBI). EPA believes that receipt of electronically transmitted CBI requires considerably stronger security measures than the initial version of CDX may be able to support, including provisions for encryption. While EPA does plan to enhance CDX to accommodate CBI, we will first want to gain experience implementing CDX in the non-CBI arena and also take the time to explore CBI security issues with companies that submit confidential data. EPA seeks comments and advice on priorities for electronic reporting implementation. EPA also seeks comments on this proposal's global approach, and whether specific exclusions should be added to the rule.

D. Which Records Can Be Maintained Electronically and Which Can Not?

Today's proposal addresses records that EPA or authorized State, tribal or local programs require regulated entities to maintain under any of the environmental programs governed by Title 40 of the CFR or related State, tribal and local laws and regulations. Nonetheless, individual EPA programs may need additional time to consider more specific provisions for administering the maintenance of electronic records under their regulations. Similarly, EPA will need time to evaluate State, tribal, and local programs' provisions for administering electronic records maintenance to ensure that such records will meet the criteria articulated in today's proposal

Nonetheless, individual EPA programs may need additional time to consider more specific provisions for administering the maintenance of electronic records under their regulations. Similarly, EPA will need time to evaluate State, tribal, and local programs' provisions for administering electronic records maintenance to ensure that such records will meet the criteria articulated in today's proposal.

Accordingly, once this rule takes effect, any records subject to this rule submitted directly to EPA can only be maintained electronically after EPA announces in the Federal Register that EPA is ready to allow electronic records maintenance to satisfy the specified record-keeping requirements. Records subject to this rule maintained under an authorized State or tribal program can only be maintained electronically once EPA has approved the necessary changes to the authorized program. For electronic records specified in such Federal Register announcements or authorized program changes, they can be maintained in lieu of paper records so long as they meet the requirements in this proposal, unless paper records are specifically required in regulations promulgated on or after promulgation of this final rule. However, today's proposal will not apply to paper records that are already in existence—whether these are maintained under EPA programs or under authorized State, tribal or local programs—and will not provide that any of these paper records can be converted to an electronic format. In addition, today's proposal does not address contracts, grants, or financial management regulations contained in Title 48 of the CFR. EPA is addressing such procurement-related activities separately. Accordingly, today's proposal does not apply to records maintained under these Title 48 regulations, whether this record-keeping was administered by EPA or by a State, tribal or local program under EPA authorization.

roposal does not address contracts, grants, or financial management regulations contained in Title 48 of the CFR. EPA is addressing such procurement-related activities separately. Accordingly, today's proposal does not apply to records maintained under these Title 48 regulations, whether this record-keeping was administered by EPA or by a State, tribal or local program under EPA authorization.

E. How Would Today's Proposal Implement Electronic Reporting and Record-Keeping?

EPA proposes our overall policy and requirements for electronic reporting and record-keeping as a new 40 CFR part 3, which consists of four (4) Subparts. Subpart A provides that any reporting requirement in Title 40 can be satisfied with an electronic submission to EPA that meets certain conditions (specified in Subpart B) once EPA publishes a notice that electronic document submission is available for this requirement. Similarly, Subpart A provides that any record-keeping requirement in Title 40 can be satisfied with electronic records that meet certain conditions (specified in Subpart C) once EPA publishes a notice that electronic record-keeping is available for this requirement. Subpart A also provides that electronic reporting and record-keeping can be made available under EPA-authorized State, tribal or local environmental programs as soon as EPA approves the necessary changes to these authorized programs (in accordance with Subpart D). In addition, subpart A makes clear: (1) That electronic document submission or record-keeping, while permissible under the terms of this part, will not be required; and (2) that this regulation will confer no right or privilege to submit data electronically and will not obligate EPA or State, tribal or local agencies to accept electronic data except as provided under this regulation.

Subpart B sets forth the general requirements for acceptable electronic documents submitted to EPA

eeping, while permissible under the terms of this part, will not be required; and (2) that this regulation will confer no right or privilege to submit data electronically and will not obligate EPA or State, tribal or local agencies to accept electronic data except as provided under this regulation.

Subpart B sets forth the general requirements for acceptable electronic documents submitted to EPA. It provides that electronic documents must be submitted either to EPA's Central Data Exchange (CDX) or other EPA designated systems. It also includes general requirements for electronic signatures. Subpart C sets forth requirements that regulated entities must satisfy if they wish to maintain their electronic records in satisfaction of EPA record-keeping requirements. Finally, subpart D sets forth the process and criteria for EPA approval of changes to authorized State, tribal and local environmental programs to allow electronic document submissions or record-keeping to satisfy requirements under these programs. With respect to electronic document submissions, subpart D includes detailed criteria for acceptable State, tribal or local agency electronic document receiving systems against which EPA will assess authorized program implementations of electronic reporting.

The table below describes the applicability of each of these proposed new subparts.

Subpart Applicability A. General Provisions Companies and other entities regulated under Title 40 of the Code of Federal Regulations, and State, tribal and local agencies with electronic document receiving systems used to receive documents under their authorized programs. B. Electronic Reporting to EPA Companies and other entities regulated under Title 40 of the Code of Federal Regulations. C. Electronic Record-keeping under EPA Programs Companies and other entities regulated under Title 40 of the Code of Federal Regulations. D

and State, tribal and local agencies with electronic document receiving systems used to receive documents under their authorized programs. B. Electronic Reporting to EPA Companies and other entities regulated under Title 40 of the Code of Federal Regulations. C. Electronic Record-keeping under EPA Programs Companies and other entities regulated under Title 40 of the Code of Federal Regulations. D. Approval of Electronic Reporting and Record-keeping under State Programs State, tribal and local agencies with electronic document receiving systems or electronic record-keeping programs for which EPA approval is required. Given the proposed provisions of Subpart A, a regulated entity wishing to determine whether electronic reporting or record-keeping was available under some specific regulation will have to verify that EPA has published a Federal Register notice announcing their availability and will have to locate any additional provisions or instructions governing the electronic option for the particular reporting or record-keeping requirements. EPA seeks comments on whether the new Part 3 should include specific cross-references to such announcements and instructions to the extent that these are codified elsewhere in Title 40. The cross references could be organized by CFR subparts of Title 40, and could provide a simple listing of program-specific regulations for which EPA has implemented electronic reporting or record-keeping under the provisions of today's proposal. EPA invites suggestions on the most helpful cross-referencing scheme.

IV. The Requirements in Today's Proposal

are codified elsewhere in Title 40. The cross references could be organized by CFR subparts of Title 40, and could provide a simple listing of program-specific regulations for which EPA has implemented electronic reporting or record-keeping under the provisions of today's proposal. EPA invites suggestions on the most helpful cross-referencing scheme.

IV. The Requirements in Today's Proposal

A. What Are the Proposed Requirements for Electronic Reporting to EPA?

Today's proposal specifies just two requirements for electronic reporting to

It should be noted that the second requirement, concerning signatures, will apply only where the document would have to bear a signature were it to be submitted on paper, either because this is stipulated in regulations or guidance, or because a signature is required to complete the paper form. Today's proposal is not intended to require additional signatures on documents when they are migrated from paper to electronic submission. The EPA electronic document receiving system will indicate to the submitter whether a signature is required to complete submission of an electronic document—although the presence or absence of this indication will not affect whether or not a signature is required for a document to have legal effect.

Beyond these two requirements, the proposed rule does not specify any required hardware or software. Accordingly, the proposed rule text does not include any detail about CDX per se or about what will be required of regulated entities who wish to use it. Nonetheless, in publishing today's proposal, one of EPA's goals is to share our plans for the CDX and to invite comments on the technical approaches that it represents. Therefore, section V, below, explains the details of CDX as it is currently planned—including CDX technical approaches to satisfying our proposed functional criteria, and what use of CDX to submit electronic documents will require of the users

in publishing today's proposal, one of EPA's goals is to share our plans for the CDX and to invite comments on the technical approaches that it represents. Therefore, section V, below, explains the details of CDX as it is currently planned—including CDX technical approaches to satisfying our proposed functional criteria, and what use of CDX to submit electronic documents will require of the users. We are also including the draft CDX design specifications in the docket for today's proposed rule. In reviewing these materials, however, the reader should bear in mind that the details of CDX that they specify have not been finalized, and may be affected by the comments received on today's proposal. In the preamble to the notice of final rulemaking for today's proposal, EPA will describe the details of CDX as it will actually be implemented, and will highlight any significant changes from the design as described in this proposal.

Of course, even after the current CDX design is finalized and implemented, the system may change—to take advantage of opportunities offered by evolving technologies, as well as to correct any deficiencies that operational experience reveals. Our proposed regulatory strategy—avoiding the codification of technology-specific/procedural provisions—is meant to accommodate such changes without requiring that we amend our regulations. Nonetheless, EPA recognizes that such changes can be disruptive to regulated entities that participate in electronic reporting; therefore, we are adding provisions that commit EPA to provide adequate public notice where a contemplated change may have this impact

cation of technology-specific/procedural provisions—is meant to accommodate such changes without requiring that we amend our regulations. Nonetheless, EPA recognizes that such changes can be disruptive to regulated entities that participate in electronic reporting; therefore, we are adding provisions that commit EPA to provide adequate public notice where a contemplated change may have this impact. In general, we foresee four kinds of cases:

• Major changes that can be disruptive to regulated entities; these will likely affect the kinds of hardware or software required to submit electronic reports—examples may include required changes to the file formats CDX will accept, or to the required electronic signature technology, but will not generally include optional upgrades to software, the provision of additional formatting (or other technical) options, or changes to CDX that simply reflect changes to the regulatory reporting requirements that the system is supporting;

• Minor changes that will likely not be disruptive; these will affect the user interface but without affecting the hardware or software required to submit electronic reports—examples may include changes to screen layouts, or sequencing of user prompts;

• Transparent changes that will affect CDX operation without any apparent change in interaction with submitters—an example may be a change to the CDX archiving process; and

• Emergency changes necessary to protect the security or operational integrity of CDX—an example may be an upgrade to the system firewall protection.

firewall protection.

Our approach will then be to provide public notice and seek comment on major changes at least a year in advance of contemplated implementation. For minor changes we will provide public notice at least 60 days in advance of implementation. For transparent changes and emergency changes we will make decisions on whether and when to provide public notice on a case-by-case basis. EPA seeks comment on this approach, including the kinds of cases we distinguish and the proposed time-frames for notice. We are especially interested in views on the appropriateness of the time-frame for notice of major changes—and specifically on whether a shorter time-frame, e.g. 9 months or 6 months, would provide adequate notice while giving EPA greater flexibility to make timely responses to changes in the technological environment. We also seek comment on the more general question of whether it is in the best interests of EPA and our regulated entities to codify these public notice provisions at all, or whether they may place at risk our ability to be sufficiently responsive to the changing needs of our user community. We are also interested in the question of whether the different kinds of cases are or can be defined with sufficient precision to form the basis for workable regulatory provisions, and we welcome any suggestions for alternative regulatory language.

B. What Requirements Must Electronically Maintained Records Satisfy?

1. General Approach. In today's proposed rule, EPA is proposing a set of criteria that will have to be met by regulated entities that maintain electronic records in lieu of paper records, to satisfy record-keeping requirements under EPA regulations in Title 40 of the CFR. The proposed criteria address the minimal functional capabilities that an electronic record-retention system must possess in order for an electronic record or document to meet a federal environmental record-keeping requirement

be met by regulated entities that maintain electronic records in lieu of paper records, to satisfy record-keeping requirements under EPA regulations in Title 40 of the CFR. The proposed criteria address the minimal functional capabilities that an electronic record-retention system must possess in order for an electronic record or document to meet a federal environmental record-keeping requirement. Regulated entities that use electronic systems to create, modify, maintain, or transmit electronic records will need to employ procedures and controls designed to meet the minimum criteria in today's rule. These criteria are designed to insure that electronic records are trustworthy and reliable, available to EPA and other agencies and their authorized representatives in accordance with applicable federal law, and admissible as evidence in a court of law to the same extent as a corresponding paper record.

2. EPA's Proposed Criteria for Electronic Record-Retention Systems. In general, EPA believes that for electronic records to be trustworthy and reliable,

3. Electronic Records with Electronic Signatures. Where electronic records involve or incorporate electronic signatures meeting the requirements under Subpart C of this proposal, EPA will consider the electronic signatures to be equivalent to hand-written signatures. EPA believes the criteria described in paragraph B.2. above address the conditions for cases of electronic records involving signatures, such as: first, a signed electronic record must contain information associated with the signing that clearly indicates the name of the signer, the date and time when the electronic record was signed, and, the meaning associated with the signature (such as review, approval, responsibility, authorship, etc.); second, electronic signatures must be linked to their respective electronic records to ensure that the signatures cannot be excised, copied or otherwise transferred so as to falsify an electronic record by ordinary means; third, this information will be subject to

ctronic record was signed, and, the meaning associated with the signature (such as review, approval, responsibility, authorship, etc.); second, electronic signatures must be linked to their respective electronic records to ensure that the signatures cannot be excised, copied or otherwise transferred so as to falsify an electronic record by ordinary means; third, this information will be subject to the same controls as those for electronic records and must be included as part of any human readable form of the electronic record (such as electronic display or printout). EPA seeks comment on whether these criteria are appropriate and whether—taken together with the general criteria—they are sufficient to ensure that signatures associated with records fulfill their purpose. EPA also seeks comment on whether these criteria are appropriate for the maintenance of electronic records containing digital signatures. (For an explanation of digital signatures, and their role in CDX, see Section V.B.1 of this preamble.) The special issues involved in maintaining digitally signed records are discussed in Section IV.D.6 of this preamble—in connection with archiving requirements for electronic document receiving systems—and EPA is interested in views on whether these issues need to be more explicitly addressed by the criteria for electronic record-retention systems discussed here, especially the criterion provided in § 3.100(5), which addresses the maintenance of the electronic signature as a part of the electronic record. EPA seeks comment on whether this provision should be expanded to accommodate some of possible procedures for archiving digital signatures referred to at the end of Section IV.D.6.

4. The Relation of These Requirements to Food and Drug Administration (FDA) Criteria

he criterion provided in § 3.100(5), which addresses the maintenance of the electronic signature as a part of the electronic record. EPA seeks comment on whether this provision should be expanded to accommodate some of possible procedures for archiving digital signatures referred to at the end of Section IV.D.6.

4. The Relation of These Requirements to Food and Drug Administration (FDA) Criteria. The criteria set forth in today's proposed rule—both the general and those specific to records with associated signatures—are intended to be consistent with criteria set forth for electronic document systems in other relevant regulations, such as FDA's criteria in 21 CFR part 11. EPA seeks comment on whether today's proposed requirements achieve this consistency, and whether this consistency is an appropriate goal for this rulemaking.

5. Storage Media Issues. Given the fast-paced evolution of technology, it is realistic to expect that electronic records will be transferred from one media format to another during the required period of record retention. While EPA allows for such transfers in today's propose rule, any such transfer must occur in a fashion that ensures that the entire electronic record is preserved without modification. As noted earlier, the electronic record will include not only the electronic document itself, but also the required information regarding time of receipt, date of receipt, etc. Any method of migrating electronic records from one electronic storage medium to another that fails to meet this criterion will not produce records that meet federal environmental record-retention requirements. For example, a CD-ROM version of a record originally stored on electromagnetic tape will not satisfy federal record-keeping requirements unless the method for transferring the record from one medium to the other employs error-checking software to ensure that the data is completely and faithfully transcribed

ion will not produce records that meet federal environmental record-retention requirements. For example, a CD-ROM version of a record originally stored on electromagnetic tape will not satisfy federal record-keeping requirements unless the method for transferring the record from one medium to the other employs error-checking software to ensure that the data is completely and faithfully transcribed. EPA seeks comment on whether this criterion is sufficient to ensure that the integrity and authenticity of the electronic record is maintained throughout its required record retention period.

6. Additional Options. In addition to the criteria discussed above, EPA is currently evaluating the need for additional controls for electronic records under this rule. Over the course of the next five (5) months, EPA plans to conduct additional analysis, and based on the results of this analysis and the public comments received on the electronic record provisions contained in today's proposal, EPA may determine that additional provisions are required for electronic records. If such a determination is made, prior to proposal of the final rule, EPA will publish a supplemental notice detailing any additional electronic record provisions to be included in the final rule. We realize that the electronic records criteria in today's rule are not as detailed as that contained in FDA's 21 CFR part 11 and seeks comments on whether our proposed criteria are sufficient to ensure the authenticity, integrity, and non-repudiation of electronic records maintained by regulated facilities in fulfillment of their compliance obligations

provisions to be included in the final rule. We realize that the electronic records criteria in today's rule are not as detailed as that contained in FDA's 21 CFR part 11 and seeks comments on whether our proposed criteria are sufficient to ensure the authenticity, integrity, and non-repudiation of electronic records maintained by regulated facilities in fulfillment of their compliance obligations. EPA is considering whether or not to include e.g., terminal) checks to determine the validity of the source of data input or operational instruction; (4) use of additional measures such as document encryption and use of appropriate digital signature standards to ensure, record authenticity, integrity, and non-repudiation; (5) routine and documented validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records; (6) establishment and implementation of written policies governing education and training of personal and certification that persons who develop, maintain, or use electronic record signature systems have the education, training, and experience to perform their assigned tasks. EPA is also seeking comment on the general feasibility of converting existing paper documents—including litigation-sensitive records—to electronic documents, as well as comments on the strengths and weakness of existing technologies available for this purpose.

C. What Is the Process That EPA Will Use To Approve Changes To Authorized State and Tribal Programs Related to Electronic Reporting and Record-Keeping?

logies available for this purpose.

C. What Is the Process That EPA Will Use To Approve Changes To Authorized State and Tribal Programs Related to Electronic Reporting and Record-Keeping?

EPA expects that States, tribes and local agencies that administer EPA-authorized environmental programs will wish to implement electronic reporting and recordkeeping at least as quickly and extensively as EPA. Therefore, in overseeing these programs, EPA wishes to balance multiple objectives of minimizing administrative burden on States, providing State flexibility for varying State approaches, and ensuring that State systems are robust enough to meet the demands of a strong enforcement capability. EPA considered several options for meeting these needs, including program-by-program approval processes—in each case under applicable EPA program-specific regulations—State self-certifications, and a centralized approval process. This proposal provides for State flexibility by specifying performance criteria rather than requiring specific technologies, and balances other objectives though use of a hybrid process for approving changes to authorized State and tribal programs.

Under this process, EPA will provide a single set of substantive performance criteria, listed in today's proposal, that will apply to any authorized program where EPA determines that electronic reporting and record-keeping will involve substantive changes to the program that will require EPA approval. Today's proposal contains language that would make compliance with these Part 3 criteria an element of all authorized State, tribal, or local programs that wish to accept electronic reports or allow electronic recordkeeping, although the language does not change the procedural requirements for modifications to any of these program

y systems to receive reports on their behalf, where these systems are operated or owned by commercial or not-for-profit organizations. Today's proposal will allow this on the condition that the electronic document receiving system employed by the State, tribal or local agency satisfy the substantive performance criteria that we specify, and authorization approvals are obtained where necessary.

D. What Criteria Are EPA Proposing That State Electronic Report Receiving Systems Must Satisfy?

In today's proposed rule, EPA is providing a set of criteria that will have to be met by any system that is used to receive electronic documents submitted to satisfy electronic document submission requirements under any EPA-authorized State, tribal, or local environmental program. The proposed criteria address the functional capabilities that EPA believes a State's, tribe's or local government's “electronic document receiving system” must have if it is to ensure the authenticity and non-repudiation of these electronic documents. EPA has developed these criteria to ensure that any electronic document has the same legal dependability as its paper counterparts. EPA does not intend to imply that information or documents derived from electronic reporting or record-keeping systems that do not meet all of EPA's criteria, or from transactions that were not in compliance with all applicable requirements and agreements, could not be introduced as evidence at trial, would not constitute admissions, or would not constitute records required by, or used for compliance with, applicable statutes ( e.g., Clean Water Act section 309(c)(4), Resource Conservation and Recovery Act section 3008(d)(3)). EPA's criteria are intended to result in systems and records that will provide the best evidence for use by plaintiffs and prosecutors in enforcement actions, and to facilitate the success of such enforcement actions

constitute records required by, or used for compliance with, applicable statutes ( e.g., Clean Water Act section 309(c)(4), Resource Conservation and Recovery Act section 3008(d)(3)). EPA's criteria are intended to result in systems and records that will provide the best evidence for use by plaintiffs and prosecutors in enforcement actions, and to facilitate the success of such enforcement actions.

These criteria are designed to ensure any electronic document used as evidence in the course of prosecuting an environmental crime or civil violation will have the same or better evidentiary value as its paper equivalent. For example, the criteria are designed to ensure that in prosecuting the crime of deliberate falsification of compliance data, the identity of the person who signed a falsified document can be established beyond a reasonable doubt. One of the criteria, entitled “Validity of Data,” and proposed in section 3.2000(b), addresses this standard directly. In general, a system that is used to receive electronic documents must be capable of reliably generating proof for use in private litigation, enforcement proceedings, and criminal proceedings in which the standard for conviction is proof beyond a reasonable doubt that the electronic document was actually submitted by the signatory and that the data it contains was not submitted in error.

To satisfy this general criterion, an electronic document receiving system must establish: (1) That an electronic document was sent (or not sent), (2) when the document was sent, (3) by whom the document was sent, including both individual and the identity of any entity the individual is authorized to represent, (4) when the

t, (3) by whom the document was sent, including both individual and the identity of any entity the individual is authorized to represent, (4) when the

It should be noted that many of these criteria will not apply, or not apply in full, where the electronic document receiving system will not be used to receive documents bearing signatures or documents used in litigation or enforcement proceedings. Generally, documents not requiring signature are less likely to play a role in criminal prosecutions; therefore, the criterion that refers to “Validity of Data” might not apply to systems that receive such documents. In addition, the specifications of “electronic signature method,” and “electronic signature/certification scenario” will be inapplicable, along with any provision connected with “system security requirements,” “registration process,” “transaction record,” and “system archives” that refers to signature. EPA invites comment on the exclusion of these criteria in cases where systems will not receive signed documents or documents used in litigation or enforcement and criminal proceedings. EPA will consider the possibility of developing a set of criteria explicitly addressing electronic document receiving systems that will not receive electronically signed documents if it appears that States, tribes or local governments want to implement such systems for their authorized environmental programs. Such systems might be appropriate, for example, in the cases where agencies wished to accept electronic submissions of data but continued to require that associated certification statements be signed and submitted on paper. EPA invites comment on whether it would be worth developing the alternative set of criteria for systems that exclude electronic signatures.

1. General System-Security Requirements

systems might be appropriate, for example, in the cases where agencies wished to accept electronic submissions of data but continued to require that associated certification statements be signed and submitted on paper. EPA invites comment on whether it would be worth developing the alternative set of criteria for systems that exclude electronic signatures.

1. General System-Security Requirements. Proposed section 3.2000(a) requires every system used to receive electronic documents to (1) have robust protections against unauthorized access to the system; (2) have robust protections against the unauthorized use of any electronic signature on documents received; (3) provide for the detection of unauthorized access or attempted access to the system and unauthorized use or attempted use of any electronic signature on documents received; (4) provide safeguards to prevent the modification of an electronic report once an electronic signature has been affixed; (5) ensure that every electronic record is protected from modification or deletion; (6) provide safeguards to ensure that the system clock is accurate and protected from tampering or other compromise; and (7) provide safeguards to prevent any other corruption or compromise of the system.

We believe each of the seven proposed requirements is important to maintain the overall security of an electronic document receiving system. We seek comment on whether—taken together—they are sufficient to ensure that the system can maintain the integrity and authenticity of the electronic documents it receives and maintains.

2. Electronic Signature Method

rruption or compromise of the system.

2. Electronic Signature Method. To support the goals articulated under proposed section 3.2000(b) as the “Validity of Data” criterion, proposed section 3.2000(c) stipulates that an electronic document receiving system must validate only those electronic signatures that are created by a method that (1) Involves a registration process that identifies the bearer of an electronic signature; (2) includes all elements of an adequate signature/certification scenario (described in paragraph 4, below); (3) provides safeguards to prevent excise, modification, or appropriation of an affixed electronic signature; (4) provides safeguards to prevent use of an electronic signature by anyone other than the individual to whom it has been issued; and (5) ensures that it is impossible to modify an electronic document without detection once the electronic signature has been affixed. This last proposed requirement is sometimes expressed by saying that the signature must be “bound” to the contents of the report. We seek comment on whether these conditions are appropriate, and whether—taken together—they suffice to ensure that electronic signatures affixed to electronic documents will have the same or better evidentiary value as handwritten signatures on paper documents for purposes of prosecuting an environmental crime or civil violation.

3. Submitter Registration Process

to the contents of the report. We seek comment on whether these conditions are appropriate, and whether—taken together—they suffice to ensure that electronic signatures affixed to electronic documents will have the same or better evidentiary value as handwritten signatures on paper documents for purposes of prosecuting an environmental crime or civil violation.

3. Submitter Registration Process. In order to link a digital signature to the bearer of that signature, proposed section 3.2000(d) requires that an electronic document receiving system validate only those electronic signatures that are established through a process which registers identified individuals both as system users and as signature holders. EPA also proposes to require that an individual may not complete this registration process without first executing an agreement with the administering agency to properly use and protect the electronic signature.

Of course, the registration process must also establish the identity of the registering individual and any entity that the individual is authorized to represent. Given the general “Validity of Data” criterion under section 3.2000(b), the process must establish the registrant's identity with information that will be sufficient to prove that this individual was the signature holder for purposes of private litigation, enforcement proceedings, and criminal proceedings. This requires at least that the registrant provide evidence of identity which can be verified by information sources that are independent of this individual and the regulated entity with which he or she is associated.

As noted above, the rule requires that a registrant sign an agreement to properly use and protect his or her electronic signature

enforcement proceedings, and criminal proceedings. This requires at least that the registrant provide evidence of identity which can be verified by information sources that are independent of this individual and the regulated entity with which he or she is associated.

As noted above, the rule requires that a registrant sign an agreement to properly use and protect his or her electronic signature. EPA proposes that the terms in any such agreement include, at a minimum, a commitment to: (1) Protect the electronic signature from unauthorized use; (2) be as legally-bound by use of the electronic signature as by hand-written signature; (3) where the signature device is based on a secret, e.g., a code, to maintain the secrecy of the electronic signature device; (4) immediately report any evidence that the electronic signature has been compromised; and (5) where the assistance of third parties may be required to protect a signature from unauthorized use—such as the assistance of system administrators in ensuring computer security, to secure such assistance. EPA believes that this agreement is important to ensure that the holder of an electronic signature understands how to properly use and protect the electronic signature. It is also important to ensure that the signature holder understand the legal effect of affixing the electronic signature to an electronic document. A proof that an individual's registered electronic signature was affixed to a document will establish a permissive inference that the individual who was issued that signature affixed the signature and did so with the intent to sign the document. To achieve these goals, EPA believes that the signature agreement should

“In accepting the electronic signature issued by [specify name of issuing agency or organization] to sign electronic documents submitted to [specify the name of the electronic document receiving system] on behalf of [specify the name of regulated entity the signature-holder represents], I, [name of electronic signature holder],

hieve these goals, EPA believes that the signature agreement should

(1) Agree to protect the signature from use by anyone except me, and to confirm system security with third parties where necessary. Specifically, I agree to [specify procedures appropriate to the form of electronic signature, for example, to maintain the secrecy of the code where the signature is based on a secret code];

(2) Understand and agree that I will be held as legally bound, obligated, or responsible by my use of my electronic signature as I would be using my hand-written signature, and that legal action can be taken against me based on my use of my electronic signature in submitting an electronic document to [specify the name of the receiving agency];

(3) Agree never to delegate the use of my electronic signature or make my signature available for use by anyone else;

(4) Understand that whenever I electronically sign and submit an electronic document to [specify the name of the electronic document receiving system], acknowledgments and a copy of my submission as received will be made available to me;

(5) Agree to review the acknowledgments and copies of documents I electronically sign and submit to [specify the name of the electronic document receiving system];

(6) Agree to report to [specify the agency or organization to be reported to], within twenty-four (24) hours of discovery, any evidence of the loss, theft, or other compromise of any component of my electronic signature;

ble to me;

(5) Agree to review the acknowledgments and copies of documents I electronically sign and submit to [specify the name of the electronic document receiving system];

(7) Agree to report to [specify the agency or organization to be reported to], within twenty-four (24) hours of discovery, any evidence of discrepancy between an electronic document I have signed and submitted and what [specify the name of the electronic document receiving system] has received from me;

(8) Agree to notify [specify the agency or organization to be reported to] if I cease to represent [specify the name of regulated entity the signature-holder represents] as signatory of that organization's electronic submissions to [specify the name of the electronic document receiving system] as soon as this change in relationship occurs and to sign a surrender certification at that time.”

In addition, given the importance of this agreement, EPA is also proposing that the registration process require that the agreement be renewed periodically, with the Administrator to determine the frequency of and the exact terms of the renewal statement, as well as whether a wet ink signature will be required. In making these determinations, EPA is proposing that the Administrator ensure that electronic reporting meets the overall goals of security and validity of data—articulated under proposed sections 3.2000(a) and 3.2000(b)—while taking into account the importance of keeping EPA practices consistent with marketplace standards for issuance and use of electronic signature devices in commerce

required. In making these determinations, EPA is proposing that the Administrator ensure that electronic reporting meets the overall goals of security and validity of data—articulated under proposed sections 3.2000(a) and 3.2000(b)—while taking into account the importance of keeping EPA practices consistent with marketplace standards for issuance and use of electronic signature devices in commerce. Given that both the technologies and marketplace practices surrounding electronic signatures are still evolving rapidly, EPA believes that the Administrator may need to revisit these determinations more than once, the proposed provision for these renewal agreements is intended to provide this flexibility.

In terms of frequency of renewal, likely candidates for the Administrator to consider are once every two years or three years, but he or she may certainly set a longer renewal cycle (either in general or with regard to a particular State, tribal or local government system) if less frequent renewal better corresponds to marketplace standards and can be determined to still meet security and validity of data goals. EPA seeks comment on the various alternatives for renewal frequency—including one year and longer than three years—considering both marketplace standards and the goals of security and validity of data. EPA also seeks comment on whether any of the candidate renewal cycles would raise any administrative issues for State, tribal or local governments, and whether the Administrator's ability to revisit this determination—with the implied potential for a change in system requirements—poses any problems for systems planning or management.

for a change in system requirements—poses any problems for systems planning or management.

Concerning the terms of the renewal agreement, EPA believes that in the interest of supporting the goals of security and validity of data, the Administrator is likely to require the holder of the electronic signature to attest to compliance with the terms of the prior agreement since the time it was signed. To accomplish this, the Administrator may require that the signature-holder sign a statement that consists of at least the following:

“In continuing to use the electronic signature issued by [specify name of issuing agency or organization] to sign electronic documents submitted to [specify the name of the electronic document receiving system] on behalf of [specify the name of regulated entity the signature-holder represents], I, [name of electronic signature holder] continue to,

(1) Agree to protect the signature from use by anyone except me, specifically, to [specify procedures appropriate to the form of electronic signature, for example, to maintain the secrecy of the code where the signature is based on a secret code];

(2) Understand and agree that I will be held as legally bound, obligated, or responsible by my use of my electronic signature as I would be by using my hand-written signature, and that legal action can be taken against me based on my use of my electronic signature in submitting an electronic document to [specify the name of the receiving agency];

(3) Agree never to delegate the use of my electronic signature or make my signature available for use by anyone else;

(5) Agree to review the acknowledgments and copies of documents I electronically sign and submit to [specify the name of the electronic document receiving system];

Understand that whenever I electronically sign and submit an electronic document to [specify the name of the electronic document receiving system], acknowledgments and a copy of my submission as received will be made available to me;

(5) Agree to review the acknowledgments and copies of documents I electronically sign and submit to [specify the name of the electronic document receiving system];

“Moreover, I certify that I have complied with the terms of the signature registration agreement I signed on [insert date of prior agreement], and

EPA seeks comment on all of these proposed registration agreement and renewal statement provisions, including the proposed provision for administrative determination of the frequency and terms of the renewal agreements. Given the purpose of these agreements and renewal statements, EPA is particularly interested in comment on whether all of them are necessary, particularly considering requirements for the on-screen certification described under Electronic Signature/Certification, in the next section of this preamble (Section IV.D.4)

administrative determination of the frequency and terms of the renewal agreements. Given the purpose of these agreements and renewal statements, EPA is particularly interested in comment on whether all of them are necessary, particularly considering requirements for the on-screen certification described under Electronic Signature/Certification, in the next section of this preamble (Section IV.D.4). To the extent that all these agreements and renewals are necessary, EPA also seeks comment on whether the specific language suggested for each provision is adequate or necessary. It should be noted that EPA is currently not proposing to codify the specific language for these certifications and statements in the rule, and EPA seeks comments on the question of codification. It should also be noted that the proposed rule specifies that the signature agreement be signed on paper or in other media that EPA may designate. While EPA will initially require signature agreements to be signed on paper—and the Administrator may initially require this of renewals as well—EPA has the flexibility to allow electronic signatures in the future, as circumstances may warrant, and when EPA believes that electronic signatures can effectively substitute for hand-written signatures on paper for these electronic signature agreements and renewals. EPA seeks comment on whether any or all of these agreements and statements should be signed on paper.

EPA also seeks comment on a possible additional certification statement, required to be signed when a signature holder surrenders the signature for whatever reason—e.g., change of jobs or retirement—although this requirement is not included as a provision in today's proposal. In this surrender certification, the signature holder would be required to truthfully attest to compliance with the terms of the agreement since the most recent agreement was signed

ion statement, required to be signed when a signature holder surrenders the signature for whatever reason—e.g., change of jobs or retirement—although this requirement is not included as a provision in today's proposal. In this surrender certification, the signature holder would be required to truthfully attest to compliance with the terms of the agreement since the most recent agreement was signed. If such a requirement is added, then EPA believes that the surrender certification signed by the signature holder should consist of at least the following:

“I certify that, since the time that I was first issued the electronic signature by [specify name of issuing agency or organization] to sign electronic documents submitted to [specify the name of the electronic document receiving system] on behalf of [specify the name of regulated entity the signature-holder represents], I have complied with the terms of agreement to which I then subscribed, and specifically that I have:

(1) Protected the signature from use by anyone except me. Specifically, I have [specify procedures appropriate to the form of electronic signature, for example, maintained the secrecy of the code where the signature is based on a secret code];

(2) Understood that I am held as legally bound, obligated, or responsible by my use of my electronic signature as I would be using my hand-written signature and that legal action can be taken against me based on my use of my electronic signature in submitting an electronic document to [specify the name of the receiving agency];

(3) Never delegated the use of my electronic signature or made my signature available for use by anyone else;

(4) Understood that whenever I electronically signed and submitted an electronic document to [specify the name of the electronic document receiving system], acknowledgments and a copy of my submission as received were made available to me;

o [specify the name of the receiving agency];

(3) Never delegated the use of my electronic signature or made my signature available for use by anyone else;

(5) Reviewed the acknowledgments and copies of documents I electronically signed and submitted to [specify the name of the electronic document receiving system];

(6) Reported to [specify the agency or organization to be reported to], within twenty-four (24) hours of discovery, if I ever had any evidence of the loss, theft, or other compromise of any component of my electronic signature;

(7) Reported to [specify the agency or organization to be reported to], within twenty-four (24) hours of discovery, if I ever had any evidence of discrepancy between an electronic document I signed and submitted and what [specify the name of the electronic document receiving system] had received from me.

“Moreover, I certify that I have complied with the terms of the signature registration agreement I signed on [insert date of the agreement signed when electronic signature was first issued], and since that date I have reviewed, signed and submitted all the electronic documents submitted with my electronic signature to [specify the name of the electronic document receiving system] on behalf of [specify the name of regulated entity the signature-holder represents].”

submitted with my electronic signature to [specify the name of the electronic document receiving system] on behalf of [specify the name of regulated entity the signature-holder represents].”

Finally, EPA also solicits comment on whether some other mechanism is needed, in lieu of the registration agreement, to ensure that holders of electronic signatures properly use and protect their signatures. Specifically, EPA seeks comment on the possible alternative of adding a provision paralleling 21 CFR section 11.100(c)(2) (under the Food and Drug Administration's electronic signature rule) requiring that signature holders, upon request, “provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer's handwritten signature.” EPA seeks comment on whether codifying such a provision would provide a better method of ensuring the proper use and protection of signatures than the agreements, renewals and related certification statements that we are currently proposing.

EPA also proposes to require that an electronic document receiving system have a mechanism to automatically revoke an electronic signature whenever 1) there is any evidence the submitter has violated the registration agreement; 2) there is any evidence the electronic signature has been compromised; or 3) there is notification from an entity that the holder of an electronic signature previously authorized to represent that entity is no longer authorized to represent the entity. Revocation of a signature would not necessarily mean that the signature holder cannot be held accountable for previous uses of that signature, but it might lead the agency involved to require that particular materials be resubmitted. EPA seeks comment on whether there are other circumstances that should result in automatic invalidation of an electronic signature

authorized to represent the entity. Revocation of a signature would not necessarily mean that the signature holder cannot be held accountable for previous uses of that signature, but it might lead the agency involved to require that particular materials be resubmitted. EPA seeks comment on whether there are other circumstances that should result in automatic invalidation of an electronic signature.

It should be added that EPA proposes to require registration of any individual who submits electronic documents to an electronic document receiving system on behalf of an entity, regardless of whether the individual is issued an electronic signature, because EPA believes that registration strengthens system security and data integrity. Accordingly, the registration process for an individual who is not being issued an electronic signature will simply omit the signature-specific requirements. EPA seeks comment on this more general registration requirement.

4. Electronic Signature/Certification Scenario. In order for electronic document receiving systems to provide the same functionality as existing paper-based systems, the act of affixing an

EPA proposes to require than an electronic document receiving system must validate only electronic signatures that have been affixed after: (1) The submitter has scrolled through on-screen pages that present all the data to be certified in a familiar, human-readable format (§ 3.2000(e)(1)(i)); (2) the screen displays a certification statement that is similar or identical to the certifying language required on the corresponding paper submissions of the report, this display occurring just above the place on the screen where the submitter is prompted to initiate the signing process (§ 3.2000(e)(1)(ii)); and (3) the submitter has seen a warning—prominently displayed together with the certification statement described in (2)—that by initiating the signing process the submitter agrees that he or she is using the signature in compliance with the signature agreement that was signed whe

t above the place on the screen where the submitter is prompted to initiate the signing process (§ 3.2000(e)(1)(ii)); and (3) the submitter has seen a warning—prominently displayed together with the certification statement described in (2)—that by initiating the signing process the submitter agrees that he or she is using the signature in compliance with the signature agreement that was signed when the signature device was issued (§ 3.2000(e)(1)(ii)).

The point of the first proposed condition is to ensure that the submitter reviews that data being submitted as a part of the signing process. Accordingly, an acceptable system must display the data in a format that clearly associates each data element with the name or label of the corresponding data field and also allow the submitter to carefully review all the data without time constraint. The point of the third proposed condition is to make certain the submitter fully understands that by activating the signature, he or she is taking a step with the same legal implications as signing and sending a report on paper. EPA is proposing this condition because of many environmental programs under which signing and certifying a false report—whether on paper or electronically—may subject the signatory to criminal prosecution. At least for those cases where the “click of a mouse” may create the potential for criminal liability, then, EPA believes it is important to ensure that the submitter understands what the consequences of the act might be. For this purpose, EPA believes that this warning statement should consist of at least the following:

“WARNING: By signing this report, you agree that you are [name of authorized signature holder], have protected the security of your electronic signature as required by the electronic signature agreement which you signed on [date of most recent signing], and are otherwise using your electronic signature in accordance with that agreement.”

—Although we are not proposing to codify this language in the rule

: By signing this report, you agree that you are [name of authorized signature holder], have protected the security of your electronic signature as required by the electronic signature agreement which you signed on [date of most recent signing], and are otherwise using your electronic signature in accordance with that agreement.”

—Although we are not proposing to codify this language in the rule. EPA seeks comments on whether this language should be codified, and, more generally, on whether the three conditions to be satisfied prior to signing are necessary and sufficient to establish that the signature was affixed with the requisite intent. EPA also seeks comment on three alternative versions of this third proposed condition that would replace the “together with a prominently displayed warning. * * *.” language of (§ 3.2000(e)(1)(ii)) with a separate provision to be inserted just before (§ 3.2000(e)(1)(ii)). The simplest version would read:

A more robust version would read:

“The signatory attests to a statement that he or she is the authorized registrant—referred to by name—to whom the signature was issued, has taken reasonable steps to protect the signature, and does not have any reason to think that the signature has been used by anyone else; and * * *”

is the authorized registrant to whom the signature was issued; and * * *”.

A more robust version would read:

The most robust version would read:

“The signatory attests to compliance with an electronic signature agreement that is presented on-screen, refers to the signatory by name, and includes an acknowledgment that the signatory is the authorized registrant to whom the signature was issued, has not in the past authorized any other person to sign on his or her behalf, has not at any time compromised the electronic signature, has reviewed all automatic acknowledgments for past submissions as described in paragraph (e)(2) of this section, and has no evidence that the signatory's electronic signature or any other feature of the electronic submission mechanism has been compromised; and * * *”

Corresponding to the three versions of the proposed regulatory provision, the suggested (but not proposed to be codified) language would be, starting with the simplest:

“(1) I, [name of signatory], am the authorized holder of the electronic signature I am about to use;

(2) I understand and agree that I will be held as legally bound, obligated, or responsible by my use of my electronic signature as I would by using my hand-written signature.”

next, the more robust: “(1) I, [name of signatory], am the authorized holder of the electronic signature I am about to use;

(2) I have taken reasonable steps to protect my signature;

(3) To the best of my knowledge, my signature has never been used by anyone else.”

and, finally, the most robust: “(1) I, [name of signatory], am the authorized holder of the electronic signature I am about to use;

(2) I have taken reasonable steps to protect my signature;

ized holder of the electronic signature I am about to use;

(2) I have taken reasonable steps to protect my signature;

(3) To the best of my knowledge, my signature has never been used by anyone else.”

and, finally, the most robust: “(1) I, [name of signatory], am the authorized holder of the electronic signature I am about to use;

(2) I have taken reasonable steps to protect my signature;

(3) To the best of my knowledge, my signature has never been used by anyone else;

(4) I have no other evidence that any component of my electronic signature has been lost, stolen or compromised in any way;

(5) I have reviewed all the acknowledgments and copies of my previous submissions to [specify the name of the electronic document receiving system].”

EPA seeks comment on the appropriateness of these variant alternatives to the proposed ‘warning’ provision—and their corresponding suggested statements—for purposes of establishing the intent with which the signature was applied, helping to show that the signatory was in fact the authorized signature holder, and preventing signature compromise or repudiation. EPA is especially interested in the question of whether any of these provisions might tend to discourage regulated entities from choosing to submit environmental reports electronically. EPA is also interested in comments on the need for

In addition, we are proposing that, once the electronic signature is affixed, and the electronic document submitted, the signature/certification scenario must include two responses from the electronic document receiving system. The first is simply an automatic acknowledgment that the report has been received and any affixed electronic signature validated, with the time and date of receipt. The purpose of this acknowledgment is, at least in part, to alert the registered holder of an electronic signature if someone has appropriated the registered electronic signature and used it to submit spurious electronic documents

tem. The first is simply an automatic acknowledgment that the report has been received and any affixed electronic signature validated, with the time and date of receipt. The purpose of this acknowledgment is, at least in part, to alert the registered holder of an electronic signature if someone has appropriated the registered electronic signature and used it to submit spurious electronic documents. As noted above, the registered holder of the electronic signature will not be allowed to sign another electronic document once aware that it has been compromised.

EPA also proposes to require that the automatic acknowledgment be sent to an address that does not share the same access control—for example, that is not protected by the same passwords or confidential log-in procedures—as the system from which the electronic report was signed and sent. The intent of this requirement is to frustrate unauthorized use of an electronic signature without detection. To elude detection, the intruder will have to compromise not only the signature protections, but also the additional system's access controls. The additional address could be electronic or could be a United States Postal Service address. In any event, the feature of the electronic document receiving system should aid in the detection of compromised electronic signatures and reduce the frequency and strength of false claims that an electronic signature has been appropriated without the knowledge of the registered holder of the electronic signature.

The second response is what we are calling the ‘copy of record’, also automatically created and made available to the submitter. The copy of record must include the complete electronic document that was submitted. The copy of record must be complete in the sense that it must accurately associate all of the information provided by the submitter with the descriptions or labeling of the information being requested

ponse is what we are calling the ‘copy of record’, also automatically created and made available to the submitter. The copy of record must include the complete electronic document that was submitted. The copy of record must be complete in the sense that it must accurately associate all of the information provided by the submitter with the descriptions or labeling of the information being requested. In addition, to be complete, the copy of record must include all the warnings, instructions and certification statements presented to the submitter as a part of the signature/certification scenario. Finally, this copy of record must: (1) Be viewable on-screen in a human-readable format that makes clear the association between each of the information elements provided by the submitter and the descriptions or labels in terms of which these elements were requested; (2) include the date and time of receipt; and (3) be signed with a secure, immutable agency electronic signature that is “bound” to this electronic document. As the name would suggest, the copy of record must be archived by the agency system, made available to the submitter for viewing and downloading, and protected from unauthorized access.

The proposed copy of record requirement is intended to detect spurious or compromised submissions, enabling timely disavowal of unintended submissions and reducing the frequency and strength of claims that an electronic document has been modified in transmission or unintentionally submitted. Under the signature/certification scenario in today's proposed rule, the copy of record will be—strictly speaking—made available to the registered holder of the electronic signature. If the signature has somehow been compromised—or if the data is somehow different from what was intended to be submitted—this copy of record, together with the acknowledgments discussed above, will give the signature-holder an opportunity to alert the agency to the compromise of his/her signature and/or his/her data

ctly speaking—made available to the registered holder of the electronic signature. If the signature has somehow been compromised—or if the data is somehow different from what was intended to be submitted—this copy of record, together with the acknowledgments discussed above, will give the signature-holder an opportunity to alert the agency to the compromise of his/her signature and/or his/her data. This proposed requirement is also intended to protect the agency from attempts to falsely repudiate a submission.

EPA seeks comment on whether the number and type of responses from the electronic document receiving system adequately address the issue of spurious or compromised submissions. Specifically, we seek comment on the requirements placed on the automatic acknowledgments. In addition, we are interested in views on whether it will be generally feasible for electronic document receiving systems to create copies of record with all the attributes we are proposing that they have, and whether all of these attributes are necessary for the copy of record to fulfill its intended purpose.

5. Transaction Record. To help settle potential disputes over whether certain submissions were made, when they were made, what they contained, or who made them, an electronic document receiving system must create a transaction record for every submission of an electronic document. EPA will require that this record be created automatically, and include the precise routing of the signed electronic document from the submitter's computer to the receiving system and the copy of record described above. In addition, based on the receiving system's clock, this transaction record must include the precise date and time of: (1) The initial receipt of the reported data; (2) the receipt of the submitter's signed certification of the data (where this step is subsequent to the initial data transfer); (3) the sending of the acknowledgment notice; and (4) the creation of the copy of record

described above. In addition, based on the receiving system's clock, this transaction record must include the precise date and time of: (1) The initial receipt of the reported data; (2) the receipt of the submitter's signed certification of the data (where this step is subsequent to the initial data transfer); (3) the sending of the acknowledgment notice; and (4) the creation of the copy of record. These details may be regarded as providing the “chain of custody” for the submitted report, and help to establish its authenticity. EPA seeks comment on whether this transaction record specification is sufficiently robust to provide for “chain of custody”.

6. System Archives. EPA also proposes to require that electronic document receiving systems maintain the contents of the transaction record described above—including the copy of record—for as long as they may be needed for enforcement or other programmatic purposes. In addition we are also proposing that the system must maintain records that show, for any given electronic submission not only what information was displayed to the user during the submission process—including the instructions, prompts, data labels, etc. captured in the copy of record—but also how this information was displayed, including the sequencing, functioning and overall appearance of these interface elements. The reason is that it may be difficult to interpret what some of the submission's data elements mean if we do not know the context within which they were provided— e.g., to what on-screen display or query a “yes” was responding. Depending on exactly how the signing process is implemented, at least some of this interface information may be captured within the scope of what is bound by the signature, e.g., if the signature is applied to the entire content of the screens that are reviewed by the signatory during the signature/certification scenario. To whatever extent this occurs, the archiving of the “copy of record” would contribute to this archiving of the interface

is implemented, at least some of this interface information may be captured within the scope of what is bound by the signature, e.g., if the signature is applied to the entire content of the screens that are reviewed by the signatory during the signature/certification scenario. To whatever extent this occurs, the archiving of the “copy of record” would contribute to this archiving of the interface.

The system must maintain the archived records in a way that can be shown to have preserved them without any modification since the time they were created; the system must be able to make these records available to users in a timely way as they are needed. EPA seeks comments on these archiving criteria, and especially on whether there are any issues raised by the need to maintain the copy of record—which

• The sensitivity of digital signatures to very minimal (and unavoidable) deterioration of the magnetic medium in which the records are stored—so that they no longer can be validated, even though the records remain usable in every other way;

• The possible software dependence of the validation process—so that, as the archives' systems environment evolves over long periods of time, it may become increasingly difficult to operate the validation software designed to work with the archived signatures; and

• The dependence of validation on the accessibility of a public key infrastructure (PKI) certificate that was valid when the digital signature was created—so that, over time, it may become increasingly difficult to determine the keys and identifying information associated with the signature.

EPA seeks comments on these and related difficulties that may stand in the way of validating archived digital signatures, and we welcome any advice on how these might be overcome

structure (PKI) certificate that was valid when the digital signature was created—so that, over time, it may become increasingly difficult to determine the keys and identifying information associated with the signature.

EPA seeks comments on these and related difficulties that may stand in the way of validating archived digital signatures, and we welcome any advice on how these might be overcome. If these difficulties cannot be overcome, or overcome only at great expense, then EPA would seek to revise § 3.2000(g)(2), by specifying alternatives to maintenance of the original signature and its validation as archived that would still allow users to demonstrate both the validity of the signature and the integrity of the record as a true picture of the data as it was signed. A possible approach might involve an archivists' wet-ink-on-paper certification that the digital signature was valid at the time the record was placed in the archive, together with appropriate measures to preserve the record unchanged. On another approach, the archivist might digitally resign the document at certain intervals, adding appropriate certifications about the validity of the original (or previous) signature on the document. EPA also seeks comment on such alternative approaches.

E. What Are the Costs and Benefits Associated With Today's Proposal?

EPA estimates that today's proposal could result in an average annual reduction in reporting and record-keeping costs for those information collections identified as potentially benefitting from offering an electronic reporting option. Based on this analysis, EPA estimates that CROMERRR could result in an average annual reduction in burden of $52.3 million per year for those facilities reporting, $1.2 million per year for EPA, and $1.24 million for each of the 30 states that were assumed to implement programs over the eight years of the analysis

identified as potentially benefitting from offering an electronic reporting option. Based on this analysis, EPA estimates that CROMERRR could result in an average annual reduction in burden of $52.3 million per year for those facilities reporting, $1.2 million per year for EPA, and $1.24 million for each of the 30 states that were assumed to implement programs over the eight years of the analysis. For details of this study, see the technical background document, Cross Media Electronic Reporting and Recordkeeping Rule Cost Benefit Analysis in the Docket for today's proposal. EPA requests comment on whether the underlying assumptions and the methods used in the cost benefit analysis provide a realistic estimate of the costs and benefits associated with electronic reporting and recordkeeping.

1. Scope and Method. The purposes of the analysis was to estimate the labor hour and total cost effects (either savings or increases) attributable to each of the major elements of the CROMERRR proposal and to assess, qualitatively, the environmental implications. The major elements include: the use of modern electronic technologies for the production, completion, signing, transmitting, and recording without the use of paper copies. Within the assessment of technologies we chose three forms of electronic reporting (web forms, EDI, and XML) that EPA's CDX plans to support. For those entities using web forms, the costs of reporting to EPA electronically would be negligible, as EPA intends to provide the web forms and signature capabilities needed. In the latter two approaches (EDI and XML), EPA anticipates additional up-front cost will be incurred by regulated entities to establish EDI or XML file generation capabilities, but the savings will be larger over time, as these entities can more fully automate their reporting to EPA.

In the course of establishing projected estimates of costs and savings of electronic reporting and recordkeeping, EPA had to establish a baseline of current costs

ticipates additional up-front cost will be incurred by regulated entities to establish EDI or XML file generation capabilities, but the savings will be larger over time, as these entities can more fully automate their reporting to EPA.

In the course of establishing projected estimates of costs and savings of electronic reporting and recordkeeping, EPA had to establish a baseline of current costs. The current costs of paper-based reporting to EPA and States delegated the authority to manage an EPA reporting program were based on an extensive assessment of EPA's official information collection request (ICR) submissions that would be subject to the CROMERRR rule, as well as more detailed cost estimates performed on major EPA systems. In performing the analysis, over 50 ICRs were extensively reviewed and approximately 70 other ICRs were more summarily reviewed. A list of the ICRs, and the approach used to analyze them, are contained in Appendix A of EPA's Cross Media Electronic Reporting and Recordkeeping Rule Cost Benefit Analysis. In the course of analyzing the ICR costs, reporting costs were broken into discrete functional areas (such as data entry, mailing, reconciliation, archiving and program management) and were analyzed for costs.

In addition to the ICR analysis, EPA performed analysis of the general costs and benefits of electronic reporting experienced by commercial and government agencies, as described in the EPA Electronic Reporting Benefit/Cost Justification Report (June 30, 1999). EPA also conducted in-depth analyses of business processes and associated costs for several major EPA programs. These analyses include analyses for Toxic Release Inventory (TRI), National Pollutant Discharge Elimination System (NPDES), Public Water Supply System (PWSS) and selected Clean Air Act reports

as described in the EPA Electronic Reporting Benefit/Cost Justification Report (June 30, 1999). EPA also conducted in-depth analyses of business processes and associated costs for several major EPA programs. These analyses include analyses for Toxic Release Inventory (TRI), National Pollutant Discharge Elimination System (NPDES), Public Water Supply System (PWSS) and selected Clean Air Act reports. In addition, EPA, in conjunction with State partners in the Arizona Department of Environmental Quality (ADEQ) and the Texas Natural Resources Conservation Commission (TNRCC), conducted assessments of the potential impacts and opportunities presented by environmental electronic reporting on their EPA-delegated state programs and affected regulated entities. These programmatic and state analyses are available in the CROMERRR docket. EPA also reviewed similar analyses performed for other EPA electronic reporting efforts, such as the proposed Hazardous Waste Manifest Automation Rule. EPA invites comments on the approach used for conducting the analysis and on the list of ICRs analyzed—whether this list encompasses the spectrum of EPA requirements impacted by CROMERRR and what additional information collections, if any, should be incorporated into further analysis.

Based on the combined review of the functional areas (including data entry, mailing, reconciliation, archiving and program management) of individual ICRs, EPA identified general trends in the relative distribution of costs for each of the categories. Using the analyses conducted under the more in-depth studies performed, EPA was able to

ormed, EPA was able to

EPA is also considering a second series of analyses, using an alternative form of calculating the costs and savings to the Agency. In performing this alternative analysis EPA would still break the costs for a program report into discrete functional areas (i.e., data entry, mailing, etc.), however the estimates of reduction would use “absolute” values instead of percentages. As an example, EPA program X has identified that the mailing of form B requires 10 minutes per submission. The costs for facilities choosing to submit electronically would take into account the elimination of mailing, and the costs for electronic reporting under that program would be reduced by 10 minutes for each submission. The advantage of this approach is that it offers potentially greater accuracy for estimating costs for each reporting program. A disadvantage is where the functional activity, such as program management, is only partially impacted by electronic reporting, determining an “absolute” value could involve arbitrary judgement calls on a program by program basis. EPA requests comment on ways to improve an analysis of this type as well as suggestions for other approaches that may better identify the potential costs and benefits of the proposed electronic reporting and recordkeeping rule.

As discussed further below, two sets of regulatory cost reduction (savings) estimates were projected—one for web based submissions and one for EDI/XML—based on a range of alternate assumptions regarding the national adoption rates for automation options. In both cases, it was assumed that 77 percent of all reports would be prepared, transmitted, and recorded electronically at full implementation. The implementation rates of facilities, however, will vary depending on the degree to which the facility implements electronic reporting for environmental requirements directly with EPA or with State regulatory agencies managing EPA-delegated/authorized environmental programs

assumed that 77 percent of all reports would be prepared, transmitted, and recorded electronically at full implementation. The implementation rates of facilities, however, will vary depending on the degree to which the facility implements electronic reporting for environmental requirements directly with EPA or with State regulatory agencies managing EPA-delegated/authorized environmental programs. The rates are also affected by the method (Web, EDI, or XML) the facility chooses to use in reporting to EPA or the delegated State agency. The table below describes the implementation rates for facilities under the scenarios described. The table also presents the current “As-Is” rates of paper or diskette exchange and the impacts of electronic reporting on these rates over an eight year period.

Facility Implementation Rates by Reporting Method [In percentages] Reporting method FY00 FY01 FY02 FY03 FY04 FY05 FY06 FY07 As-is: Delegated 100 100 95 89 81 73 64 56 Non-delegated 100 100 96 66 50 45 36 28 Mixed delegation 100 100 96 77 66 59 50 42 Web: 0 0 0 0 0 0 0 0 Delegated 0 0 4 8 12 18 24 30 Non-delegated 0 0 3 25 32 37 42 48 Mixed delegation 0 0 3 17 22 27 33 39 EDI: 0 0 0 0 0 0 0 0 Delegated 0 0 1 2 2 3 4 5 Non-delegated 0 0 1 4 6 6 7 8 Mixed delegation 0 0 1 3 4 5 6 6 XML: 0 0 0 0 0 0 0 0 Delegated 0 0 0 2 4 6 8 10 Non-delegated 0 0 0 4 12 12 14 16 Mixed delegation 0 0 0 3 8 9 11 13 Recordkeeping rates are not presented in the table above. However, it was also assumed that a very low number of facilities (0.5 percent) of the current regulated entities, would elect to acquire new electronic recordkeeping systems to implement the CROMERRR recordkeeping option. EPA is seeking comments on the implementation rates for reporting and recordkeeping as described in this proposed rule. For EPA, the average annual cost to implement and operate electronic reporting and record-keeping is $25.8 million, and the average annual cost savings compared to equivalent paper-based systems is $1.2 million

recordkeeping systems to implement the CROMERRR recordkeeping option. EPA is seeking comments on the implementation rates for reporting and recordkeeping as described in this proposed rule. For EPA, the average annual cost to implement and operate electronic reporting and record-keeping is $25.8 million, and the average annual cost savings compared to equivalent paper-based systems is $1.2 million. The average annual cost to implement an electronic reporting system is $1.1 million for each state, and $1,273 for each facility. The net average annual cost savings of electronic reporting compared to an equivalent paper-based submission is $1.24 million for each state, and $1,140 for each facility. The total average annual costs of implementing and reporting electronically for all facilities is $3,420 million, which presents a net average annual savings for all facilities of $52.3 million over current paper-based reporting. The average annual cost to implement a new electronic record keeping system is $40,000 for each facility, and the net average annual cost savings for operating the electronic record keeping system is $23,080.

These costs are based on FY 2000 dollars and include a 7.0 % annual discount rate. Therefore, our estimates indicate that implementation of electronic reporting will result in a net burden reduction for all participants, but facilities may not find it cost-effective to develop an electronic records system unless it addresses both EPA and non-EPA business purposes. The table below summarizes the total cost of the current “as is” paper system and the future “to be” electronic reporting and record-keeping costs over the next eight (8) years for EPA, States, and regulated entities

urden reduction for all participants, but facilities may not find it cost-effective to develop an electronic records system unless it addresses both EPA and non-EPA business purposes. The table below summarizes the total cost of the current “as is” paper system and the future “to be” electronic reporting and record-keeping costs over the next eight (8) years for EPA, States, and regulated entities. In preparing this

Summary As-Is Versus To-Be Costs and Cumulative Savings ($M) [In FY 2000 Dollars] Cost FY00 FY01 FY02 FY03 FY04 FY05 FY06 FY07 As-Is costs: Facilities 3,863.0 3,883.7 3,775.0 3,669.2 3,566.1 3,444.1 3,369.2 3,274.7 States 58.7 59.0 57.4 55.8 54.2 52.7 51.2 49.8 EPA 25.8 26.9 26.9 27.1 27.2 27.4 27.5 27.6 To-Be costs: Facilities 3,863.0 3883.7 3,771.3 3,629.4 3,520.8 3,357.7 3,278.7 3,197.8 States 58.7 59.0 42.3 40.1 38.4 37.5 36.2 35.0 EPA 28.4 30.7 42.3 26.9 21.5 19.6 19.3 18.4 Difference (2.6) (3.9) 3.5 55.6 66.8 109.3 113.8 101.0 It should be stressed that the facility cost and cost-savings estimates that these totals represent are averages per facility, and these averages cannot be translated into costs/cost-savings per report submitted electronically. The cost-related effects of introducing electronic reporting for a particular report may depend on circumstances that are unique to the data being reported, and these specifics are not reflected in the per facility averages. Accordingly, while the facility cost and cost-savings estimates are based in part on considering the ICRs that are likely to be affected by the proposed rule, the resulting cost/cost-savings numbers cannot be used ‘in reverse’ to calculate cost and burden reductions associated with introducing electronic reporting for any individual ICR.

In addition, the actual costs and cost-savings for implementing facilities will vary widely depending on the electronic submission approach

on considering the ICRs that are likely to be affected by the proposed rule, the resulting cost/cost-savings numbers cannot be used ‘in reverse’ to calculate cost and burden reductions associated with introducing electronic reporting for any individual ICR.

In addition, the actual costs and cost-savings for implementing facilities will vary widely depending on the electronic submission approach. Companies choosing to submit using web forms will have much lower initial investment costs, but will receive less savings than companies that choose to automate their systems to generate EDI or XML file submissions to EPA. In the latter case, EPA assumes that costs associated with the implementation of EDI or XML will result from companies configuring existing XML or EDI software to EPA prescribed formats, and companies will tend not to invest in EDI hardware or software for the singular purpose of submitting data to EPA. If the electronic commerce industry trends continue, the costs of implementing technologies will decline and the number of facilities and states implementing electronic reporting will increase, thereby increasing the overall net benefits of the rule. EPA is also continuing to research electronic record-keeping options that will improve the cost effectiveness of electronic record-keeping while meeting federal enforcement requirements. EPA is seeking comment from reviewers on alternative record keeping approaches and on EPA's assumption that facilities choosing to submit data via XML or EDI to EPA will not acquire new hardware or software.

m reviewers on alternative record keeping approaches and on EPA's assumption that facilities choosing to submit data via XML or EDI to EPA will not acquire new hardware or software.

2. Qualitative Implications. In addition to the cost savings identified through implementation of this proposal, EPA also has identified a number of qualitative benefits through implementation of an electronic system. These qualitative benefits of electronic reporting include: enhanced quality of data received and entered into our systems, faster public access to data submitted to EPA, better tracking of compliance submissions by industry and government agencies, and opportunities for re-engineering current paper processes. EPA's Cross Media Electronic Reporting and Record-keeping Rule Cost Benefit Analysis describes the qualitative aspects in more detail.

V. The Central Data Exchange (CDX)

A. What Is EPA's Concept of the CDX?

EPA's Office of Environmental Information (OEI) is currently developing the specifications for a ‘central data exchange’ that will serve as EPA's primary gateway for electronic documents received by EPA. As noted in section I.B of this preamble, CDX is being designed with the goal of fully satisfying the criteria that this proposal specifies for assessing State or tribal electronic document receiving systems; similarly, EPA will ensure that other systems the Administrator designates to receive electronic submissions satisfy the criteria as well

ary gateway for electronic documents received by EPA. As noted in section I.B of this preamble, CDX is being designed with the goal of fully satisfying the criteria that this proposal specifies for assessing State or tribal electronic document receiving systems; similarly, EPA will ensure that other systems the Administrator designates to receive electronic submissions satisfy the criteria as well. With respect to the electronic document submission process and criteria addressed by today's proposal, we intend CDX functions to include:

• Access management—allowing or denying an entity access to CDX;

• Data interchange—accepting and returning data via various of file transfer mechanisms;

• Signature/certification management—providing devices and required scenarios for individuals to sign and certify what they submit;

• Submitter and data authentication—assuring that electronic signatures are valid and data is uncorrupted;

• Transaction logging—providing date, time, and source information for data received to establish “chain of custody”;

• Acknowledgment and provision of copy of record—providing the submitter with confirmations of the data received;

• Archiving—placing files received and transmission logs into secure, long-term storage;

• Error-checking—flagging obvious errors in documents and document transactions, including duplicate documents and unauthorized submissions;

• Translation and forwarding—converting submitted documents into formats that will load to EPA databases, and forwarding them to the appropriate systems;

• Outreach—providing education and other customer services (such as user manuals, help desk) to CDX users.

r customer services (such as user manuals, help desk) to CDX users.

The idea is to eventually provide—to the greatest extent possible—one way and one place for the regulated community to exchange electronic documents with EPA. States may also choose to use CDX as a gateway for electronic data submissions from their regulated community, as a cost-effective alternative to building their own system. EPA is exploring opportunities to leverage CDX resources for use by authorized/approved state programs. CDX may also provide the platform for State-EPA data exchanges that

With respect to EPA's electronic transactions with regulated entities, our hope is that the uniformity of process and technology that CDX provides will help both EPA and regulated entities realize economies of scale from their investments in data exchange technologies. This is not to say that use of CDX to submit electronic documents will necessarily involve substantial investment; it will require little more of a submitter than access to a computer with a browser and an Internet connection. However, for organizations that have invested heavily in the computerized management of their environmental data, CDX is also being designed to support substantial automation of the data transfer processes. In addition, EPA hopes that CDX's centralization of data exchange will eventually provide the platform for greater integration or consolidation of environmental reporting.

B. What Are the CDX Building Blocks?

To support its various functions, we are designing CDX to incorporate a number of key building blocks, including:

• Digital signatures based on public key infrastructure (PKI),

• A process for registering users and managing their access to the CDX,

• A characteristic systems architecture,

• Electronic data interchange (EDI) standards, and

• A characteristic environment in which electronic reporting transactions will be conducted

esigning CDX to incorporate a number of key building blocks, including:

• Digital signatures based on public key infrastructure (PKI),

• A process for registering users and managing their access to the CDX,

• A characteristic systems architecture,

• Electronic data interchange (EDI) standards, and

• A characteristic environment in which electronic reporting transactions will be conducted.

These building blocks—as explained in detail in the following sections—are meant to ensure that CDX can perform the functions of an electronic document receiving system under the proposed rule. EPA believes that these building blocks, taken together, will satisfy the criteria in today's proposal for electronic document receiving systems, but seeks comment on this general question.

1. Public Key Infrastructure (PKI)-Based Digital Signatures

PKI-based digital signatures are the product of two concepts:

• “Asymmetric” cryptography, and

• An institutional framework for “certifying” the identity of a signature-holder, provided by PKI.

Taking these in order, “asymmetric” cryptography is based on a mathematical relationship that exists between certain pairs of numbers, for example number A and number B, such that

• If A is used to encrypt some message, B and only B can decipher it, and

• If B deciphers the message, it can only have been encrypted with A.

For purposes of a digital signature, then, A and B are uniquely assigned to individual X. (How this works is described below, in connection with explaining the “institutional framework” provided by PKI.) One of the numbers, say A, submitter X shares with no-one. This is X's “private key”. The other, B, is X's “public key”, and X shares B with anyone to whom X wishes to send a message—X may even publish B together with information that identifies him/her as X. Given his two keys, X then signs an electronic document as follows: (1) X uses a standard formula or algorithm to produce a number uniquely related to the content of the electronic document

h no-one. This is X's “private key”. The other, B, is X's “public key”, and X shares B with anyone to whom X wishes to send a message—X may even publish B together with information that identifies him/her as X. Given his two keys, X then signs an electronic document as follows: (1) X uses a standard formula or algorithm to produce a number uniquely related to the content of the electronic document. This is referred to as the “message digest” or “hash” of the document. (2) X uses A, the private key, to encrypt this hash; this encrypted hash is X's digital signature, and it is unique both to X and to the particular message it signs. (3) X attaches this digital signature to his/her message (which is otherwise not encrypted), and sends it.

When Y gets X's message, Y validates X's signature by: (1) Deriving the hash of the message, using the same standard algorithm that X used; (2) deciphering X's digital signature, using X's public key, B; and (3) comparing the hash Y derived (in step1) with the deciphered signature. The two numbers—the derived hash and the deciphered signature—should agree. If (and only if) they do, then Y knows both that the signature was produced using A (which belongs to X), and that the message has not changed since X signed it.

Because the digital signature is specific to the particular document, and is unique in each case, to say that X is a “signature-holder” in this context is to refer to A and B, the private/public key-pair. The A/B key-pair does belong to X and plays the same role in each of the many digital signatures X may create through the process described above. Accordingly, it is this key-pair—rather than the individual signatures they are used to create—that is associated with the process of certifying a signature-holder's identity that is provided by PKI.

Turning to this, PKI is a way of reliably establishing and maintaining the identity of the individual associated with a given key-pair used in producing digital signatures

e process described above. Accordingly, it is this key-pair—rather than the individual signatures they are used to create—that is associated with the process of certifying a signature-holder's identity that is provided by PKI.

Turning to this, PKI is a way of reliably establishing and maintaining the identity of the individual associated with a given key-pair used in producing digital signatures. This protocol involves the issuance of a “PKI certificate” by a “trusted” “certificate authority” (CA). The CA is “trusted” in the sense that it operates in conformance with an appropriate certificate policy, and has demonstrated this conformance through its operations across a wide range of electronic commerce applications.

Issuing a certificate for individual X typically involves the following steps: (1) X applies to the CA for a certificate; (2) the CA requests various pieces of personal information from X, and/or notarized verifications of X's personal information, and/or X to appear in person, to provide the CA with the bases for “proving” X's identity; (3) the CA provides X with a way to generate his unique key pair; (4) the CA conducts the “identity proofing” process—matching what X has provided against information about X in various commercial databases, official documents, etc.; (5) when the “identify proofing” is successfully completed, the CA creates a “certificate” for X that incorporates his public key, along with various pieces of identifying information about X; (6) the CA digitally signs the certificate to certify its authenticity, and makes it available to users through directory services. Some of these steps—especially the “identity proofing” process—may vary considerably, depending on requirements for security/certainty and the policies and practices of the particular CA. In the approach that EPA is currently planning, certificate issuance will be incorporated into a broader CDX registration process

tify its authenticity, and makes it available to users through directory services. Some of these steps—especially the “identity proofing” process—may vary considerably, depending on requirements for security/certainty and the policies and practices of the particular CA. In the approach that EPA is currently planning, certificate issuance will be incorporated into a broader CDX registration process. The discussion of registration in the next section will include some of the proposed specifics of “identity proofing” and related steps for CDX purposes.

The use of PKI-based digital signatures is itself supported by a very robust infrastructure of electronic commerce tools and practices, private- and public-sector policies and standards, as well as a very large and growing body of theoretical research into the mathematical foundations for this approach. Within the federal government, the importance of PKI is recognized not only by the ACES initiative (discussed below), but also by a standing “Federal PKI Steering Committee” with the mandate to promote and coordinate the adoption of PKI-based digital signatures for a broad range of applications across all federal http://csrc.nist.gov/fips/.

2. The CDX Registration Process

Under the system EPA is designing, to submit electronic documents to EPA you must first register with CDX, and—at least at the outset—registration will be by invitation from EPA. Generally, as CDX is readied to receive a specified report, EPA will extend registration invitations to all individuals who currently submit that report to EPA on behalf of their organizations, and are identified as having this responsibility in EPA's Facility Registry System (FRS) database. If you have this responsibility but do not receive an invitation, you will have the opportunity to notify EPA and put yourself on our invitation list

specified report, EPA will extend registration invitations to all individuals who currently submit that report to EPA on behalf of their organizations, and are identified as having this responsibility in EPA's Facility Registry System (FRS) database. If you have this responsibility but do not receive an invitation, you will have the opportunity to notify EPA and put yourself on our invitation list. However, if you submit the specified report to a State, tribal or local agency, you will not receive a CDX invitation, since your reporting transaction would be with that agency's electronic document receiving system, and not with CDX.

If you decide to accept an invitation to report electronically, you will go through a registration process that involves three steps:

• Invitation and verification,

• Certificate issuance, and

• Access and agreement.

Taking these in order, EPA will initia

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.