Environmental Protection Agency

Office of Environmental Information

Public Meeting on the Electronic Record-Keeping Provisions

Of the Cross Media Electronic Reporting and

Record-Keeping Proposed Rule

Thursday, January 17, 2002

Washington, D.C.

\[Tape 1 of 3\]

Robin Roberts: \...of CROMERRR, the Cross Media Electronic Reporting and
Record-Keeping Rule. Just to get a sense of who\'s come from out of
town, can I just see a show of hands to see who\'s traveled for this
meeting? Wow. So most of you have traveled. We appreciate that. We\'ll
try to make this meeting as productive as possible.

I\'m Robin Roberts, I\'m a mediator with RESOLVE. I\'m not an employee
of EPA, nor do I advocate for any of their policies. I\'m here to ensure
that the agenda\'s honored, that we keep on time and on track.

The purpose of this meeting is to provide you, the interested public,
with an opportunity to supplement your formal written comments to EPA
with oral comments, and to seek clarification on the electronic
record-keeping provisions of CROMERRR, Subpart C. The proposed rule was
published on August 31 of last year. The public comment period
originally ended on November 29 of last year. It\'s since been extended
twice, currently until February 27 of this year. Written comments must
be submitted to the docket by that time. Instructions for submitting the
comments are in the FRN notice, which is available at the front desk if
you don\'t have it.

There have been two meetings on CROMERRR. We had both of them last year
in October, in D.C., and in November in Chicago. While the focus of
those meetings were the entire rule, this one is, just to reiterate,
about Subpart C, the electronic record-keeping provisions.

At this time, I\'d like to introduce the staff from EPA\'s Office of
Environmental Information and Office of General Counsel. Why don\'t we
just start with you, Michael.

Michael LeDesma: My name is Michael LeDesma. I\'m an attorney in the
Office of General Counsel.

Evi Huffer: Evi Huffer, Office of Environmental Information.

Joe Retzer: I\'m Joe Retzer, I\'m director of the Collection Services
Division in the Office of Environmental Information.

David Schwarz: I\'m David Schwarz, also in OEI and one of the co-chairs
of the CROMERRR work group.

Robin Roberts: In the audience planted among you are other EPA
operatives, such as Valerie Brecher-Kovacevic and Connie Dwyer, the
chief of the Central Receiving Branch. So if you\'ll turn to the blue
sheet, your agenda, I would just like to go over that quickly. In the
course of conversations with some of you last month, it became clear
that more than hearing from EPA you wanted to engage the agency in a
discussion of your concerns about the electronic record-keeping
provisions of the rule. This agenda is intended to meet your request.
After each brief EPA overview of particular areas of the proposed rule,
you\'ll have an opportunity to share your concerns with the EPA
panelists.

To foster your discussion, my colleague, Jeff Citrin, and I will have a
couple of wireless microphones. Valerie may also be doing this. We\'re
going to do the Phil Donohue routine where you have a question, we\'ll
try to get a mike to you, and I encourage you to speak up into the mike
so that your comments do make it onto the record. All comments made into
the mike are being recorded. A transcript will be part of the docket for
this meeting, for your review. We\'ll take as many comments as the
discussion period allows. I\'ll try to be flexible with the agenda. If
it looks like we\'re in danger of running over into another discussion
area, maybe we can have you jot down your comments and we\'ll return to
them at the end of the meeting if we have any extra time.

Let\'s just briefly go over the groundrules. When you do speak, please
state your name and affiliation, again, for the record. If you could
offer your comment on the topic that\'s being discussed during the time
slots indicated on the agenda. Also, just a note for some of you who may
not have done this, please sign in at the front desk. I\'d like to have
a complete record of everyone that showed here. If you have questions
about the legibility of your handwriting, leave a business card.

So without further ado, I just would like to turn to David Schwarz to
begin the first EPA overview on the scope of the electronic
record-keeping provisions.

David Schwarz: Good morning. Let me add my thanks to Robin\'s for your
being with us here today, particularly for those of you who have
traveled from distant places. We really appreciate your taking the time
to help us with this rule. What I\'d like to do for about the next
fifteen minutes is just go over CROMERRR, focusing in on the part that I
think we\'ll be talking about today; highlight what we understand to be
some general issues, and I hope that will launch the discussion.

Later on in the morning, Evi will present some more granular issues to
do with the record-keeping criteria in particular. Again, the purpose of
that is just to help move the discussion along.

I want to start with some general background on CROMERRR. Most of you
are familiar with this, but some of you may not be. Then I want to focus
in on an overview of the electronic record-keeping part of the rule,
which I should say is Subpart C, not D, as we -- sorry about that. Then
I want to frame what we understand to be some of the general issues.

CROMERRR is meant to cover pretty much the full range of electronic
reporting and record-keeping under EPA regulations. This involves a
broad range of reports and records under more than ten different
statutory programs. It involves a broad range of record retention
periods and requirements, from three to perhaps more than thirty years.
In addition, as I\'m sure most of you know, most of the implementation
of our programs is in fact carried out by state or more local agencies.
EPA may be one of the first agencies to address the issue of electronic
government, where there are implementations by authorized, more local
agencies.

Why do we need a rule? Well, we think we need a rule because to actually
offer electronic reporting under the Government Paperwork Elimination
Act, agencies generally have to do something affirmative. They have to
set the standards and parameters under which we accept electronic
reports. Perhaps, although this may not be as clear, it may be that we
have to set the standards and parameters under which we allow electronic
record-keeping. We feel that we want to do this by way of rule-making,
so that the standards that we do set and that we think are important are
enforceable and clear and consistent across our programs and across the
country. That\'s why we are engaging in this rule-making exercise.

In terms of applicability, the rule, both the reporting and
record-keeping side of it, applies to regulated companies reporting to
EPA. It will apply to regulated companies reporting under EPA regs but
to state or local agencies. It will apply to regulated companies
maintaining compliance records and it will apply to states that are
implementing electronic reporting and record-keeping under an authorized
or delegated program. One thing that it doesn\'t apply to, it doesn\'t
apply to transactions under administrative agreements between states or
local governments and EPA. It really addresses the interactions, the
electronic interactions, between the regulated companies, the regulated
community, and government agencies.

In terms of core provisions, the rule does more or less the following.
To the extent that there are obstacles in the CFR that prevent
electronic reporting and record-keeping, the rule is intended to remove
those. In terms of electronic reporting, the approach is to require
electronic reports be submitted to EPA systems or EPA-approved systems.
In terms of obligations on regulated companies reporting, the
requirements really are not much more detailed than that. It does,
addressing the states and local agencies, set performance-based criteria
for state electronic reporting programs. So most of the detail on the
electronic reporting side is really addressed to state or local agencies
that are implementing our programs. They aren\'t really addressed to
regulated companies directly.

On the record-keeping side, the rule sets standards for electronic
record-keeping. It ties the approval of state electronic record-keeping
and reporting initiatives to the general structure of EPA state primacy
regs that govern the way that we authorize state and local programs. So
that, in a rather large nutshell, is what the rule does.

In terms of structure, it\'s laid out as follows. Subpart A is the
general provisions. Subpart B focuses on electronic reporting,
\[inaudible\] whether reports are submitted directly to EPA. Subpart C,
which is where I think we\'ll focus most of our discussion today,
focuses on electronic reporting criteria or standards for companies
maintaining electronic records under EPA regs. Subpart D addresses the
state or local government dimension and deals primarily with what states
or local governments have to do to be able to offer electronic reporting
or electronic record-keeping. So that\'s more or less the structure of
the rule. As I said, we\'re going to focus probably mostly on Subpart C.

So let\'s move on to electronic record-keeping. I\'m not going to --
sorry, I skipped ahead myself here. In terms of goals, the goals of our
electronic record-keeping rule are to allow industry to maintain
electronic records in lieu of paper records, and for EPA the sort of
corresponding goal is to ensure that the electronic records that are
maintained by the regulated community are as reliable and trustworthy as
the corresponding paper, so that there\'s no loss in integrity or
enforceability as we move from the paper to the electronic environment.

In terms of scope and approach, the scope is very broad. It\'s meant to
address record-keeping by regulated companies and other entities under
pretty much all EPA and EPA-authorized state programs, although there is
room in the proposal to list exceptions or exemptions. That\'s something
that if we continue down that road, we may end up identifying certain
programs to be exempt or excerpted from the CROMERRR requirements.

In terms of the approach, the approach is, what we hope or intend it to
be, general function-based criteria for electronic records that would
ensure integrity and authenticity of the records being maintained but
would not dictate necessarily particular technologies.

We hoped that our record-keeping criteria would be consistent with
existing compliance practices and existing electronic record-keeping
regulations and statutes to the extent that they exist. As some of you
may know, the models that we were most cognizant of and that are echoed
in the proposal are the Food and Drug Administration electronic
reporting and record-keeping regs and our own good automated laboratory
practices guidance documents. That seems to be the two predecessors that
we were most aware of and tried to stay consistent with.

In terms of the provisions, the general provision is that we allow
electronic record-keeping under any EPA program once EPA or the
particular EPA program announces that it\'s ready to accept or allow
electronic record-keeping under the regulations that it has authority
over. So for example, in RCRA record-keeping it would be the Office of
Solid Waste that might make the announcement that they\'re ready to
allow electronic records under their regulations. The point of that was
simply that we didn\'t want the publication of CROMERRR, either on the
reporting or record-keeping side, to be like the opening of a floodgate
and force the hand of programs that might not be ready to deal with
whatever issues had to be dealt with. That\'s one of the provisions.

Beyond that, so long as -- once a program or once EPA announce that
electronic record-keeping was allowed, so long as the electronic record
retention system met the criteria in Subpart C, it would be in
compliance with CROMERRR. It would be an acceptable electronic record.
So that\'s sort of the general provision.

There are a couple of definitions that I imagine we\'ll be interested in
and come back to in the course of the discussion. One is electronic
record, which I believe we took over from the Food and Drug
Administration regs. I won\'t read it to you, but it is very broad, as
has been pointed out to us. It may indeed be true that any record that
at any point in its lifecycle has passed through a computer may in fact
fall under this definition. That\'s something we can talk about, may be
one of the issues. There\'s also a definition of electronic record
retention systems and there\'s a definition of electronic signatures,
and you have those in your handouts and also of course in the rule
proposal itself.

Let\'s sort of focus in a little bit more on Subpart C and get a little
closer to the issues. Just in terms of the overview of requirements,
Subpart C has three main subsections. Subsection A gives the criteria
for an acceptable electronic record retention system. Subpart B
addresses the issue of availability of the system and controls and
documentation for inspection. Subpart C adds some special requirements
in cases where electronic records involve electronic signatures as a
part of the record being maintained.

All of this has raised some general issues, which I\'ll try to
characterize, although you\'re certainly free in the discussion to
recharacterize the issues as you see fit. There seems to be a general
issue about current electronic record-keeping by companies and its
relationship to CROMERRR. One of the questions, obviously, is do or
could companies\' current electronic records, electronic record-keeping
practices, satisfy current EPA record-keeping requirements. That is,
absent CROMERRR and just looking at the record-keeping provisions that
are now on the books, do electronic records satisfy those? This may be a
question one can ask.

Similarly, on the state level, the corresponding question is do
companies\' current electronic records satisfy current state program
requirements. Then of course, perhaps the most interesting question is
how will CROMERRR change the status of current electronic records. So I
think those are questions that we will no doubt want to talk about.

A second set of issues goes to the scope of CROMERRR. Given the
definitions, particularly the definitions of electronic record, will
CROMERRR apply to most or all records kept for EPA? Our intention when
we wrote the proposal was that CROMERRR would apply only to records kept
in an electronic record-keeping system. The perception, and I should say
that the fact that I call it a perception doesn\'t mean that it\'s
necessarily mistaken, but the perception is that CROMERRR will apply to
any record that involves computers in its lifecycle, even if it is now
maintained on paper. To the extent that this is true, this is a very
troubling result and, again, one that we\'d like to explore how to
somehow escape. Hopefully you can give us some help on that.

A third general issue area is, is CROMERRR voluntary, somewhat related
to the previous two questions. The general question is, will companies
be able to choose not to comply with CROMERRR standards? Again, our
intention when we wrote the rule is that the CROMERRR standards be
voluntary in the sense that companies would have a clear and meaningful
ability to opt in or opt out of electronic record-keeping, as we defined
it.

The perception, and perhaps the true perception, is that it may not be
voluntary, because given the definition of electronic records, choosing
not to do electronic record-keeping may mean choosing not to use
computers at all in conjunction with those records. That just may not be
a realistic alternative for most companies. So that clearly is an
important issue too.

I guess the last set of issues or discussion points I would throw out to
you before we turn things around and hopefully hear from you all, is
just the scope of electronic record-keeping. There are a number of ways
to get at this. I guess we\'re interested in what kind of electronic
records companies currently keep to satisfy EPA regulatory requirements,
and how prevalent current electronic record-keeping is. We\'re certainly
very interested in the kinds of systems that are used to keep those
records. And of course, we\'re very interested in whether there are
important distinctions to be made among the kinds of records that are
kept electronically or might be, for example, between the storage of raw
data and other sorts of records that involve the information later on in
the process.

I\'m going to sort of break it there in terms of my remarks, and turn
the discussion over to you.

Robin Roberts: Thank you, David. With these questions in mind, which are
meant more as prods to encourage the discussion here but by no means to
limit it, I\'d like to take questions from you here in the audience.
What kinds of records do companies currently keep electronically to
satisfy EPA regulatory requirements? There may be some of you that
interested in responding to that or have concerns about that, as well as
how prevalent are the e-record-keeping provisions and what kinds of
systems are used to keep these records. Questions?

Evi Huffer: Robin? I would just let people talk about what they want to
talk about within this topic.

Robin Roberts: Yeah, Evi\'s just reiterating that these questions
aren\'t the only things here to discuss. They\'re just meant to prod the
discussion.

Frank Miller: Hi, my name is Frank Miller from Rohm-Haas Company. Been
with Rohm-Haas for eighteen years, variety of capacities, manufacturing,
engineering and information technology. I thought I\'d open this up with
just sharing with you two thoughts that are issues that are developing.
We\'re studying this with a cross-functional team internally.

I guess the first issue is the issue of the breadth of impact on
companies like ours. We use a variety of electronic record-keeping
systems and electronic systems to do our compliance across all the
various media, air, water, waste and so on, to do our compliance
analysis reporting and so on. When you multiply that diversity of
systems by the number of sites that we have, that causes us some pain in
terms of making sure that we could come into compliance with the
criteria that\'s shown here.

My own personal assessment is that there would definitely be some gaps
internally between our current system\'s capabilities and the criteria
that have been shown here. So that\'s one aspect of this, just the
breadth of impact across the company.

Then there\'s the sort of depth area. That\'s the number of systems that
data passes through before you can do environmental compliance. So we
have factory floor systems, those systems communicate then to various
other systems for data logging and so on. Those things potentially get
passed to business systems. Eventually somewhere up there, in and around
the data analysis layer, environmentalists within the company get
information from various sources, put that together with business logic
and create the analysis and eventually reports.

I can\'t think of many instances where we\'re not using electronic
systems and record-keeping systems to develop our reports. Potentially
the report might be paper-based when it\'s delivered, and/or electronic,
but internally a variety of systems and data sources are being used to
do the reporting.

The challenge for us is, where do you draw that line? What is really the
electronic record-keeping system? So you can perceive that if you\'re
monitoring the opacity of something going up a stack that all the
systems that that information passes through potentially are electronic
records. So that is a source of concern for us, how deep do we go. So I
wanted to share those two aspects of this.

Kathleen Roberts: Good morning, my name is Kathleen Roberts. I\'m with
the American Chemistry Council. Just to give some sort of explanation or
overview, ACC has developed a document that we refer to as the
Regulatory Records Retention Requirements document. We finished it and
we\'ve published it.

In retrospect, however, we recognize that a number of regulations are
missing from this document. For example, \[Federal Insecticide,
Fungicide and Rodenticide Act\] was not included. Some of the Clean
Air-NESHAP requirements were not included. Title V was not included.

Notwithstanding, there are almost 130 separate regulations that require
records to be retained. Again, as Frank had pointed out, under the
perception or interpretation of CROMERRR, all the data points that
supported the reporting for those 130 regulatory requirements
potentially would also have to be retained. So a copy of this will be
delivered to EPA. I think we might have left a draft copy with EPA at
the last workshop. But we do have a list of the requirements as well. So
it is quite huge.

Bruce Adler: Bruce Adler, General Electric Company. GE is a global
company with 350,000 employees. To manage our environmental health and
safety requirements, we have to use electronic record-keeping. Just as
one example, one of the items that we track is regulatory-required
training, of which there were over a million units delivered in 2001.
That has to be done electronically. Why? Because it\'s the only way we
can efficiently and effectively and reliably track the information. If
we reverted to a paperwork system to track those requirements, it would
collapse. We would collapse, we\'d be wasting time and money, and it
wouldn\'t be as reliable.

The whole issue that I\'m concerned with with this rule is that by
virtue of the requirements you\'re imposing, to make it like --
allegedly like -- paperwork you\'re destroying the one element of
electronic record-keeping that is so useful, which is its reliability.
You\'re making it more like paper than like electronic record-keeping.
We could say that if we were looking for 100 percent reliability, so
that you could have a perfect audit trail, that we could etch all of our
training requirements when they\'re conducted in stone. That way we\'d
know if anybody tried to change them. Obviously, we\'re not going to do
that. That\'s going back to the past, to a less reliable, less effective
system. The virtue of electronic record-keeping of any form is its
effectiveness, is its speed, is its reliability.

What we\'re doing here, what it seems like you\'re trying to do here, is
to torque the system to catch that infinitesimally small percentage of
those electronic records which might be collected or preserved in a
fraudulent way. And to do that, you\'re imposing on the billions of
other records that are collected, a system that makes it a less
effective and less useful system.

Robin Roberts: If there are any comments here to any particular concerns
you hear voiced, please speak up.

David Keyes: I\'m David Keyes with the Environmental Technology Council.
We\'re the trade association for the commercial hazardous waste
industry. I\'m still not clear, and it\'s probably just because I
haven\'t gotten up to speed enough, on your intended applicability of
this proposed regulation. David, rather than my kind of just making a
general comment, I\'m actually going to ask a specific question and see
if I can get an answer that helps clarify the applicability of the
regulation.

If you think of a typical commercial hazardous waste facility, a
landfill or an incinerator, I think of kind of three tiers of electronic
record-keeping that goes on at that facility. One is, as described by
some of the other commenters, electronic data collection that is
ultimately assembled into a report that is filed either electronically
or on paper, but has that electronic data collection trail behind it.
Perhaps some of the requirements you\'ve suggested would be easier to
apply at that very high level of collection.

Secondly, there are a variety of regulation-required records, like
personnel training records, as this gentleman described, where it\'s all
recorded and maintained electronically, subject to frequent change as
training is upgraded and new employees are added and so forth.

Then there is the layer of almost minute-by-minute electronic recording
of information. For example, when a drum comes in the gate it has a bar
code and that drum is tracked through the entire processing at the
facility, in its storage, in its treatment, in its ultimate disposal.
The drum itself, when it\'s empty, it\'s eventual discarding is all
tracked electronically, because by EPA or state regulation we have to be
able to show at that facility where that drum is at any point in time in
its processing.

Similar to that are just various monitoring results that are recorded
electronically. An incinerator has a literally second by second
recording of all its various emissions. Of course, it\'s really not
practical to keep that on paper, or to even produce it on paper. When
EPA inspects those records, it typically looks at the electronic
records. In fact, a lot of the monitoring data is tied right into EPA
computers. They can track the data in their offices, in the EPA regional
offices or state offices.

So we\'re just completely unclear at which layer do these record-keeping
requirements apply. If they apply all the way down to the most minute
data that\'s collected in enormous, enormous volumes, that obviously is
going to impose tremendous problems for us in trying to comply with all
those requirements.

So could you answer -- I guess, not to go on for too long, but just as
another idea. Your paper says, when EPA announces it\'s ready for
electronic record-keeping, this rule will apply. EPA hasn\'t announced
anything but we\'re keeping all these records electronically. So I\'m
not sure what that means either.

Thanks. Sorry for the long question.

Robin Roberts: Would you like a reply to that now?

David Schwarz: Let me do my best and if I mess up maybe my colleagues
can help me. You really asked two questions. One is, what was our
intention in terms of the applicability of our electronic record-keeping
requirements. Let me start to answer that by posing a kind of conundrum
to you, which is that we did not, in CROMERRR, actually define the term
\"record.\" The reason that we didn\'t do that is because our intention
was that we wanted CROMERRR to apply to records as defined and specified
in the range of so-called predicate regulations in the CFR.

So a record may mean one thing under a particular \[inaudible\] regs, it
may mean something else in terms of Clean Water Act, for example,
National Pollutant Discharge Elimination System regs, and so on and so
forth. I couldn\'t sit here today and tell you exactly what record means
under each of those regs, because I don\'t know enough about all the
details of all the different programs.

I think that perhaps creates a problem for us, because our intention was
that we wanted CROMERRR to apply to those records, as these were
specified in the various regulations, when and to the extent that those
particular records were kept in an electronic record-keeping system. I
don\'t know, to be perfectly honest, whether that intention as I\'ve
articulated it is one that is a particularly clear one, although I think
it\'s only become clear to us as a result of some of these discussions
that there is this problem. Record may mean many different things.

We certainly did not mean to encompass all possible records or anything
that might be meant by a record, but what exactly we do mean may require
that we go back and do more work looking specifically at particular
program regs. I don\'t know if that answers your question, but at least
shares our sense of the problem.

In terms of the idea that individual EPA programs would announce that
electronic record-keeping was turned on, again, all I can do is sort of
explain to you the assumptions under which we were working when we wrote
that, which turn out not to be valid. Which is that we assumed that
generally, except for rather specific, a handful of programs where
electronic record-keeping had been specifically provided for, our
assumption was that companies were not generally keeping the records
required under the program regs, however those are defined.

Our assumption is that those records were not being maintained
electronically. What you all have been telling us here today and at
previous meetings is that assumption is not true. So clearly, that
provision of CROMERRR will have to be changed or dropped.

It looks as though electronic record-keeping generally, and this is
where my Office of General Counsel colleague may want to jump in, but it
looks as though in general electronic record-keeping is not clearly
prohibited by existing regulations, except maybe in some special cases
where there are specific references to paper or paper-related things. If
that\'s the case, as it may well be, then we\'re starting at a different
point in the evolution of the transition than we thought we were and
we\'ll have to say different things.

Michael LeDesma: I can just add a little bit to that. I think -- one of
the questions we\'ve heard often is why do you even need a rule to allow
electronic record-keeping when it\'s clear that under many of your
programs, in fact, electronic record-keeping is currently being allowed.
I think that when we look at this rule, like many of the other rules
that the agency promulgates, there\'re really two components.

One is an interpretive component and then there\'s a legislative
component. For some programs in the agency, the agency has, as a matter
of just fact, accomplished that interpretive step through guidance. But
in most instances it hasn\'t. So there is an interpretive step that
needs to be made before electronic record-keeping is \"turned on.\" In
addition, and what\'s creating a great deal of the controversy, are the
legislative elements, the provisions that we see in Section 3.100 of the
rule.

So there are really those two components. I think the intention of this
rule is not to speak to current record-keeping, but to make clear that
we are doing this interpretive step and, in addition, this legislative
step, so that it\'s clear for everybody what the rules of the game are
going forward.

Rich Lysakowski: I\'m Rich Lysakowski from two organizations, actually,
the Collaborative Electronic Notebook Systems Association and the Global
Electronic Records Association. I\'ve been studying this problem since
about 1991, and what it takes to replace paper notebooks and notebook
systems with electronic records. We\'ve come to some basic conclusions
that computer systems are not record-keeping systems, they\'re data
systems.

Data is not equivalent to a record, and you have to be pretty formal
about how you define what is a record. That is, a record is something
that is converted to a preservation format that will outlive the
computer systems of today, and set aside under the duty of care of a
custodian who has accountability and responsibility for preservation of
that record.

CENSA, Collaborative Electronic Notebook Systems Association focuses on
two things; one is regulatory compliance, because notebooks are used for
regulatory record-keeping. The second is intellectual property
protection, which is an even more stringent -- when it comes to
litigation, the litigation is a free-for-all. It\'s not a well-ordered
type of litigation you encounter with the Environmental Protection
Agency. It is a total free-for-all, going for the throat, this is my
intellectual property and I\'m going to get it no matter what. So
that\'s a different kind of record-keeping, requires an even higher
level of integrity in the whole process, from beginning to end.

The way the rule is written now, I implore you to define a record as a
record, not the way it\'s defined here as anything created by a computer
system. That is, first of all focus on converting it to a preservation
format, something that will outlive the current computer system that you
bought tomorrow, which was obsolete yesterday.

First and foremost; this is critical. Do not equate computer systems to
records retention systems. Do not equate people who create data to a
records manager or an archivist, that is, someone with the duty of care
for records to be retained for as long as they\'re needed by the
business.

We found this -- in CENSA we have a lot of pharmaceutical companies, we
have tons of money to pour into the \[Federal Drug Administration\] Part
11 legislation. We have some of your companies represented in CENSA as
well, if you\'re a chemical company. We found that it just takes a lot
of time and money to bring any system into compliance. It\'s not just
the hardware and software, it\'s your whole program of people, policies,
education, training and all of those things.

If you don\'t start upfront with using the right definitions, given the
way computer systems have been designed, they\'re not designed to be
records retention systems. They\'re used for just capturing and
processing information and data. And data and information are not the
same as a record. If you look at the most formal definition, that is,
one used by the archival community, it\'s something converted to a
preservation format and set aside for the purpose of preservation for as
long as needed by the business. So there\'s some fundamentals that ought
to be put in here.

If you\'re going to keep the rule the way it is, I suggest you change
the name to Electronic Evidence Rule. Because this is indeed the heart
of the matter, that yes, the way you\'ve defined electronic records is
anything coming from a computer system. The way that evidentiary
discovery is done is anything from any computer system. Correct? It\'s
all evidence, no matter where it is, no matter what form. So include in
there electronic evidentiary discovery aspects of it.

Don\'t call it just records, call it evidence, because that\'s where we
got a lot of confusion in trying to comply with Part 11 from the
\[Federal Drug Administration\]. The \[Federal Drug Administration\]\'s
rule was not about records, it was not about things created, converted
to a preservation format and set aside under the duty of care with
somebody who knows how to do that. It was really about evidence,
anywhere and everywhere, and going after that evidence for the purpose
of criminal prosecution, for the purpose of demonstrating fraud. That\'s
really what this rule, that\'s one of the things this rule is intended
to do is to cover evidentiary discovery for prosecution.

So that should be made clear too, that this is about electronic
evidence, it\'s not about electronic records. It\'s not only about
electronic records. It\'s about reporting to the EPA, it\'s about taking
records from computer systems and putting them into record-keeping
systems or records retention systems. It\'s about permitting EPA to come
in and do evidentiary discovery for purpose of prosecution. But a few
fundamental changes, and one even includes somewhere in the name the
word \"evidence,\" not --

\[End of Tape 1, Side A; Side B begins\]

\-- or information. I\'m not really quite sure, because I can\'t get a
straight answer from my records manager or someone like that, someone
qualified. So this issue of duty of care for preservation comes in. That
needs to be really clear in the rule. With a few fundamental changes,
you can set expectations properly as to what it will take to comply with
the rule. It\'s a much bigger issue than you really understand at this
time. It\'s taken us almost ten years now to really fully understand the
implications of trying to throw away paper for high-consequence and
high-value records. It\'s not about the name, it\'s about the processes
of evidentiary discovery, that we found that are critical.

There\'s attorneys sitting in this room who will never move away from
paper until they have the same kind of comfort and confidence in
\"computer systems,\" that they\'re equal to record-keeping systems,
because they\'re not, not the way computer systems are designed today. I
can\'t read Microsoft Word Version 2 files with Microsoft Office 2000.
It\'s simply unavailable as a converter today. So the software and the
formats are also a critical issue.

Jonnie Martin: My name\'s Jonnie Martin, I work for a downstream oil
company that you\'ve probably never heard of, but it\'s a Shell-Texaco
joint venture called Equilon and Motiva. I work for Equiva Services,
which is the central EHS organization. We manage environmental
regulations for nine refineries, over a hundred petroleum distribution
terminals, several thousand service stations and thousands of miles of
pipeline. In our company, everyone has a computer, everyone.

This rule would have a significant impact on us for a couple of reasons.
One, because my office is in Houston and we have severe air problems in
Houston, as most of you know, companies there are being encouraged
strongly to go to telecommuting. My company is fixing to institute a
strong telecommuting policy which would allow us to work from home
three, possibly four days a week, and only come into downtown Houston,
which would be a blessing, once a week.

To do that, we\'re spending several hundred thousand dollars, perhaps
millions, I don\'t know the total cost, but I know it is significant,
with our Intranet web site. The company aims that that web site will be
used by all of us to do our work from home. So therefore all the
environmental information has to be in the computer and has to be
accessible to every employee who\'s working from home, to every
refinery, to every terminal, to every pipeline operator.

The rule, as it is now written would cost us significant amounts of
money, if we could even comply with it, and quite frankly, we don\'t
think we can. So I would very much agree with the gentleman over there.
Your definition of electronic record is so broad that it captures
everything we do now. I would urge you to reconsider this one.

Howard Krueger: My name is Howard Krueger from Procter & Gamble Company
in Cincinnati. I have worked in the regulatory affairs field for
twenty-eight years and have worked in the legislative arena, the
regulatory arena. I\'ve been before Congress, regulatory agencies and
the courts. I\'m very familiar with definitions and how they\'re
interpreted.

The brief comment that I have really for Joe, I want to play back the
comment that Joe made where he said that they, meaning the EPA, had not
provided a definition of record. What I\'d like to alert you to is the
very high likelihood that in fact you have. I\'ll explain it. You have
clearly defined an electronic record, and if you take off the word
electronic and if you remove the last four words, which are \"by a
computer system,\" you have in fact defined a record, and I\'ll read it
to you. It\'s right here in your definition. \"A record is any
combination of text, graphics, data, audio, pictorial or other
information that is created, modified, maintained, archived, retrieved
or distributed.\" The only thing that makes it electronic, putting the
word electronic at the beginning, are the last four words that say \"by
a computer.\" So I would just caution you in thinking that you haven\'t
defined a record, just because the word record doesn\'t appear by
itself. I would say that you have. Then when you define electronic
record of course you use the big four words, \"by a computer system.\"

Jim Scialabba: I\'m Jim Scialabba with Marathon Oil Company. One issue
with this proposed regulation that I have not heard brought up yet in
any public forum or in any correspondence I\'ve seen is the implications
on this rule-making for the relationship that we, the regulated
community, would have with all government entities because a lot of the
information that\'s gathered is gathered by our field people, our
technicians, our managers, who aren\'t environmental professionals. They
gather information also that is passed on to or which we need to submit
to, for instance, OSHA and Department of Labor, U.S. Fish and Wildlife
Service, Bureau of Land Management, MMS, Army Corps of Engineers, U.S.
Coast Guard, National Marines Fishery Service and\[the National Oceanic
and Atmospheric Administration\], in addition to state agencies that are
environmental agencies or analogues of federal agencies.

A concern we have is that this rule-making is going to set a standard
that\'s going to change the relationships, reporting relationships, with
all of these agencies. Because we\'re not going to create, for instance,
us, who like everyone else in the room is heavily dependent on
electronic management of information now, we\'re not going to set up a
system that\'s only going to comply with EPA. We\'re going to have
\[inaudible\] set a standard that will work across the company because
our people want to use a single system, as we\'ve gone to a single word
processing standard in the company.

I really think EPA needs to consider this. If you haven\'t talked with
your colleagues in the other government agencies, I really urge you to
sit down and have a discussion about this very broad implication.

James VanHorn: I am Jim VanHorn with Smurfit-Stone Container
Corporation. The question was, how is this going to affect and how much
record-keeping do we have being covered by this. In our company, there
is a definite push to get all the records. It includes such things as
our financial records, quality records, production records, human
resource records, our purchasing sales and of course environmental. An
awful lot of these indirectly are the initial sources where data is
collected. It ends up in a report.

As an example of how this is going to affect us in our company audit,
today it is rather easy to get money and material to store in electronic
record-keeping. But if you ask for a new file cabinet, they look at you
like something that\'s crazy. So it has a tremendous effect on us, it
can affect practically everything we do, is that we\'re totally going
towards the electronic record-keeping, documentation, everything we do.
So it will affect everything that we do in the whole corporation.

Maria Angelo: I\'m Maria Angelo, I work for DuPont. I\'m in our
corporate solid waste consulting group. I\'d like to thank you for the
opportunity to talk this morning and discuss these issues. I\'d just
like to reiterate the comments that other folks from industry have been
saying with respect to the prevalence of the use of electronic records
today. Even if you try and narrow your definition to focus only on
records as they apply to specific programs, they\'re still used
extensively to support permits, to support records.

Just to reiterate what this gentleman said with respect to the origin of
the systems, I know at one facility in the United States I counted -- in
ten minutes I was able to come up with over three dozen different
systems that are used to support the collection of information for
environmental compliance. That doesn\'t cross into some of the other
program areas that have been mentioned or some of the other business
programs that have been mentioned, and that\'s only one facility.
Certainly each facility does a lot of hybridization and uses different
systems, so the scope is just massive.

Mark Duvall: My name is Mark Duvall with the Dow Chemical Company. The
initial question was, what kinds of records are kept electronically by
our companies and what kinds of systems are used. Dow, like the other
companies that have been mentioned, uses many kinds of electronic
systems for many different purposes. For our compliance with EPA
record-keeping, virtually everything we do is at some point electronic.
Sometimes things are printed out, but to a large degree they are not.
Virtually nothing that we do is not at some point electronic.

It\'s interesting to note that the cost-benefit analysis that was done
for this rule suggested that annually 428 facilities in the United
States would choose to subject themselves to this rule. That suggests
that there\'s a fundamental misperception here, that electronic
record-keeping is at the dawn of its use in the American economy. It\'s
obviously not the case. At one Dow facility, for example, over a million
data points are collected annually. Air emissions, water emissions,
these are data that can only be collected by computers, can only be
stored by computers, can only be manipulated by computers. The idea that
we would even choose ever to print them out is not only inefficient, but
we wouldn\'t know what to do with the paper, because we couldn\'t use
the data other than in electronic format. Electronic record-keeping is
the norm, it is pervasive, it is throughout Dow and I would suggest
throughout all facilities that are regulated by EPA.

How do we keep electronic records? The answer is, in lots of different
ways. There is no standard way that we use electronic records. Our
agricultural chemical subsidiary, for instance, uses some 180 different
systems to collect electronic data for laboratory and field studies. We
have over ten thousand laboratory instruments, many of which are
stand-alones. Our R&D function has a diverse computing architecture that
has almost every kind of proprietary system out there being utilized. So
we have Windows and we have UNIX and inhouse systems. There is no
standardization, and frankly that sometimes gets in the way as we try
and move data from one system to another system.

But if the question that EPA is asking is, is there a way that records
are kept one way or a few ways that records are kept such that a rule
could be tailored to address those systems, the answer is no. There are
many, many different systems used today and there is no standardization
to them. A few things that could be said about those systems, however,
is that they were not designed with the CROMERRR record-keeping
requirements in mind, so that for example, an audit trail capability
will sometimes be found in these systems but generally will not be.

One reason for that is that the functionality is not needed, it\'s not a
business need. You don\'t want to pay for a feature that you didn\'t
need. As a result, all of the infrastructures that we have lack the
capability of meeting the CROMERRR requirements.

In addition, the whole point of electronic record-keeping, the whole
point of using computers, is to increase efficiency. To the extent that
the kinds of data that EPA would like to see retained in the form of
audit trails, what the effect of that would be a tremendous increase in
the memory requirements, because so many more data points would need to
be saved.

Memory is expensive. It is one of the single most expensive aspects of
the computer system. When, as Dow has, you have very large systems with
very large quantities of data, to have to exponentially increase the
amount of data kept and then keep it for considerable periods of time,
the memory costs themselves are a very significant aspect of the cost of
meeting the CROMERRR electronic record-keeping provisions.

Pat McConnell: I\'m Pat McConnell from DuPont. I just wanted to add one
additional piece to what this gentleman just said. The most impossible
piece of this is you were talking about individual applications that do
audit trails. Almost all of our companies don\'t use one application to
get data from Point A to Point B. Lots of times the data collection
system doesn\'t do the analysis, doesn\'t do the reporting.

One thing that is not possible, that we cannot force the vendors to do,
is to create the means by which to produce audit trails between the
systems and interfaces between the systems that provide or meet the
guidelines in CROMERRR.

Patricia Runge: I\'m Patricia Runge and I work at Experimental Pathology
Laboratories in Virginia. We\'re not involved in a lot of the larger
scale applications that CROMERRR would bring to our industry. We\'re
toxicologic pathology. But a lot of the same applications apply with the
electronic record-keeping and electronic generation of data. But one
thing that I don\'t get from anybody, either from EPA or from \[Federal
Drug Administration\], is how hybrid systems are going to be considered
in this application.

For many smaller companies, that includes environmental as well as
toxicological companies, a lot of their data is not generated by a
computer but it does go through a computer system for reporting purposes
and for data retention purposes. There are not enough guidelines as how
this type of application needs to be addressed.

Austin Perez: Austin Perez from the U.S. Small Business
Administration\'s Office of Advocacy. The gentleman from General Counsel
earlier addressed I guess the need for the rule and I wanted to address
this question to you. I\'ve been told, and I\'m hearing over and over
again, that electronic record-keeping is widespread. I believe you were
making a legal distinction that the fact that it\'s being allowed was
allowed through guidance rather than through a change of the law. I
guess I\'m curious. I guess what you\'re suggesting is that if you
don\'t do this rule, I guess to turn on the ability to record-keep is a
problem. I would like to know, what are the consequences if this rule
does not go into effect, in all those situations where electronic
record-keeping is allowed today?

Michael LeDesma: I guess there\'s probably -- I\'m not sure what the
programmatic consequences are, although I suspect that what you\'d end
up with if the agency were to proceed in the absence of a rule like
CROMERRR is that each program would design its own set of -- each EPA
program, in fact each federal agency program that somehow affects a
regulated entity, would develop its own electronic record-keeping
requirements, that they would require through guidance. Then, of course,
companies such as yourselves would be or the companies represented here
would be in the position of having to comply with that multiplicity of
different systems. So I think one of the motivations behind CROMERRR was
to create a unified set of record-keeping requirements.

As a legal matter, I\'m not going to speak to what the -- I\'m not going
to speak generally to ongoing record-keeping practices throughout the
agency. I don\'t know about them in sufficient detail to speak one way
or the other. But I will say as a general matter that the agency can
allow electronic record-keeping, in fact there are several regulations
that the agency has where it says that the agency, the administrator can
designate an electronic record-keeping system. So we can. The fact of
the matter is that we haven\'t done so in any sort of widespread,
coherent sort of way. So that was the intent of this rule.

Howard Krueger: Howard Krueger, Procter & Gamble. I wanted to respond
with some more examples of specific records. I think it is helpful to
really come to grips with exactly what\'s involved. I have this in text
form and I\'ll give it to you at the break. Under the broad definition
of an electronic record, our company cannot identify a single instance
where some aspect of the compliance records creation or modification,
maintenance, archiving, retrieval, distribution, does not involve a
computer system.

We currently keep hundreds of thousands of electronic records each year
under \[the Federal Insecticide, Fungicide, and Rodenticide Act, Toxic
Substances Control Act\], Clean Water \[Act\], Clean Air \[Act\],
\[Comprehensive Environmental Response, Compensation and Liability Act\]
and \[Resource Conservation and Recovery Act\]. Specific examples of the
kinds of records, which was the question that was originally asked,
include analytical data and summaries, product performance data and
summaries, testing protocols, animal and human subjects testing and
summaries -- speak to the point made over here. \[Good Laboratory
Practices\]-GCP compliance information, production records, raw material
receipt and usage, \[Quality Assurance\] records, production data,
training records, import and export compliance records; entire databases
of miscellaneous information which are subsequently used to conduct and
support compliance assessments; domestic shipping information and many
other hundreds of thousands of records.

In addition, examples of the electronic records specifically created and
maintained at our manufacturing facilities include emission or surrogate
emission data from a distributed control system, and that is a sensor
combined with a computer that automatically records the data. Continuous
emission monitor data, computer-generated documents and spreadsheets
used to calculate and document emissions data. Chemical use inventory,
records under \[the Toxic Substances Control Act\]-IUR, which are taken
from electronic materials management systems. Environmental logs are
created from instrument data, which is often averaged over a compliance
period and recorded on an electronic log.

So in summary, virtually all of our records are in fact electronic
records. We cannot identify how the CROMERRR rule would not impact this
entire universe of our electronic record-keeping system and the records
that we have.

Charles Reese: Charles Reese with BASF Corporation. I just agree with
Mr. Krueger of Procter & Gamble and several of the other people here
that the kinds of records that companies currently keep, virtually we
keep all records electronically or they pass through some sort of
electronic record-keeping system at some point of their life. If you
were to look at just Part 160, there are 57 required records inside of
simply Part 160 under Title XL. Companies like to use computers and
electronic records extensively to take advantage of efficiencies
wherever that\'s possible. Examples of these types of records that are
ideal for maintaining electronically could be anything from standard
operating procedures, personnel training records, master study
schedules, draft reports, calculation reports. Even raw data can be
generated and maintained electronically under the provisions of the Good
Laboratory Practice Standards.

BASF is a large, multinational company. We have many diversified
business groups that have different applications and responsibilities
under EPA\'s Title XL environmental regulations. We recognize the need
for regulations and guidance around these practices concerning
electronic reporting and record-keeping. At this time, though, we feel
that the record-keeping portion of the proposed rule should be
withdrawn. The reasons for this opinion are four statements. I\'m going
to give you this text at the break.

As it\'s written, the CROMERRR proposed rule is not voluntary. It would
be mandatory for any EPA-regulated entity that currently generates an
electronic record. The number of entities affected and the cost to
develop compliance procedures are grossly underestimated. Estimates run
as high as 1.2 million entities affected immediately, and could have an
effect on the economy ranging from anywhere from \$48 billion, and then
we\'ve heard as high as \$1.8 trillion. This differs greatly from the
400 average number of facilities per year and the \$40,000 average per
facility cost to comply.

Third, there\'s no differentiation between types of electronic records,
but rather a one-size-fits-all approach for all of the electronic record
criteria. This approach gives no consideration to the vastly different
types of systems currently in use to adhere to Title XL. Finally, the
rapid changes in technology force a huge burden on maintaining an
electronic record for a long record retention period, which in some
cases can last, as you said, decades, up to thirty years or more. In
this case, would actually be indefinite.

Robin Roberts: If possible, we have set aside a time on the agenda to
talk to this whole issue of decoupling Subpart C. I would just beg your
indulgence and try withholding comments on that until we get to that
section.

Kathleen Roberts: Kathleen Roberts, American Chemistry Council. David,
perhaps you can help me with this. A couple slides back you talk about
the scope of CROMERRR and the intention was CROMERRR would apply only to
records kept in an electronic record-keeping system, and then the
perception, which is the one that we\'ve all reiterated here, that in
fact we\'re reading it to mean every piece of data collected in order to
comply.

I\'d like, and beg my indulgence if you would, can you redefine
electronic record-keeping system? Because the way that it\'s written
right now, quite frankly, I just don\'t get it. The way it\'s written
right now says, \"any set of apparatus, procedure, software, records or
documentation used to retain exact electronic copies of electronic
records.\" Electronic and record is repeated a couple of times in there,
so I\'m just not really sure what it is exactly that means.

David Schwarz: I don\'t think I want to try to redefine this on the fly.
I think this was also something that we borrowed from \[the Federal Drug
Administration\]. Let me ask you, is there --

Kathleen Roberts: I guess what I\'m wondering is, when you guys talk
about record-keeping systems and whether they are or are not allowed by
EPA, and obviously many people here are keeping records electronically
and so we\'re all kind of at angst going, what exactly does this mean?
When you say EPA may allow electronic records, do you mean electronic
copies of the reports? Is that what we\'re referring to?

David Schwarz: No, no. I think I can answer this question. Under most
EPA regs that involve some sort of informational requirement, there\'s
pretty standardly a distinction between data you actually have to submit
to EPA, that\'s the report, and things that you have to maintain at your
facility, which you may never have to submit but you might for example
need to make available if an inspector calls. The record-keeping
requirements are meant to pertain to those things that you have to
maintain at your facility.

There is, I suppose, an overlap in the sense that very often one of the
records you have to maintain is a copy of the report that you submitted,
although not always. So there\'s that overlap. But the record-keeping is
meant to focus on what you keep at your facility and don\'t submit to
us.

Kathleen Roberts: So those records that you are required to maintain for
EPA.

David Schwarz: Right. What they are really varies widely from program to
program, as you know, I\'m sure.

Kathleen Roberts: Agreed. Okay, then I guess, as has been stated many
times, I think we need to reiterate what the definition of record is and
if it requires a separate definition for each regulation, maybe that is
something to consider.

Henry Bartholomew: Henry Bartholomew of the Edison Electric Institute.
Just to speak to the issue on the table at the moment, I would also say
that for electric utilities, electronic record-keeping is very pervasive
and we\'re certainly affected by many of the programs EPA administers
and a lot of our company monitoring and reporting is done
electronically. I think, although I know you want to sort of divide this
into little subpieces, as I listen to the discussion this morning and
your presentation and I\'ve read the preamble to the rule while I\'m
sitting here, it\'s about trying to have trustworthy data-keeping.

When companies file reports, they\'re required to file, or if they have
an inspector on site taking a look at what\'s happening on a particular
site, the issue of trustworthiness is inherent in the filing of the
report, when they sign off on that report, whether you have a paper
trail behind it or an electronic data-keeping system. With things like
the U.S. Sentencing Commission guidelines and EPA pronouncements in the
various program areas, most of our companies have very advanced
environmental compliance systems in place that a part of which is the
electronic record-keeping, but it\'s just a part of it. This feels like
that tail trying to wag the dog.

If EPA has identified specific concerns that it wants to address, rather
than trying to revamp the entire electronic record-keeping system that
many companies have been putting in place at many hundreds of thousands
of dollars over the past couple of decades since computer technology
really became available, let\'s look at what are those specific concern
areas and let\'s address those much more individually. Individually may
mean if you have a bad actor company, you may deal with it directly in
that case by imposing some restrictions on that company. But as a
general matter in terms of major U.S. industries in the U.S. economy, it
seems like this is a very upside-down approach to trying to deal with
that issue of reliability and so forth. When a company files a report
and signs off on it, it\'s standing behind that, presumably. That\'s
just an observation, thanks.

Kathy Barrowclough: Kathy Barrowclough, DuPont. I\'d like to go back to
what Ms. Roberts was just saying around the exact electronic copies in
electronic record-keeping systems. That\'s been a question of mine. The
electronic records requirements that you spell out, the different ones
that you have for audit trail and that sort of thing, according to the
rule apply to those records that are maintained in an electronic
record-keeping system. Then if you go back and look at the definition of
an electronic record-keeping system, it refers to records that are exact
copies of data. When in reality a lot of our record-keeping systems are
the original raw data, they are not copies. So the question is, what are
we applying to? Are we applying to all of those data collection systems
or are we only applying the electronic record-keeping portion or rules
to those systems that we have set up to maintain in an ongoing way those
copies of those original records or original data points?

Robin Roberts: We\'re going to take one last question and then there\'s
been a request for a quick break after this question. I\'d like to have
you back here in ten minutes. The doors will be locked at that time.

Bruce Adler: I want to return to the issue that Mr. LeDesma addressed
earlier, and that has to do with the present status of electronic
records. I\'m certainly in favor of consistency between the programs as
to how they approach electronic record-keeping. But the thrust of your
words implied that without CROMERRR and without guidance from the
various program offices, there\'s some sort of impediment to electronic
record-keeping. I\'m not sure that\'s the case.

Absent a specific prohibition on tracking records electronically, I
don\'t think that the agency can say we can\'t do that. Just like the
agency\'s rules do not currently distinguish between keeping records
with a pencil or a pen or a manual typewriter or an electric typewriter
or a word processor, there\'s no prohibition on keeping them
electronically. So the implication that absent CROMERRR and absent
guidance from the program offices that electronic records can\'t be
used, I think is just wrong.

Robin Roberts: Great. With that comment then, we\'ll break now before we
take up the overview on the general criteria for the record-keeping
provisions. So I could have you back here in ten minutes, that\'s 11:35.

\[Break\]

David Schwarz: I want to sort of drill down to the specific criteria in
this part of the discussion. These are the nine criteria. I\'m not going
to go through all of them in detail, I think probably you\'re pretty
familiar with them. For whatever it\'s worth, I guess my feeling is that
some of them are reasonably straightforward and perhaps not quite so
controversial. For example, the first one, \"generate and maintain
accurate, complete records in a form that cannot be altered without
detection.\" That may or may not be something that\'s easy to comply
with, but the general idea that one should maintain accurate records and
that there should be a way to detect if they\'ve been messed with or
doctored, is I think reasonably straightforward.

Some of the others I know are more controversial. We are going to focus
on the archiving and the audit trail criteria specifically this
afternoon.

There have been, in past meetings and comments, a considerable amount of
focus on those, and so we do want to devote some time specifically to
them.

In the case of records with electronic signatures, there are some
additional criteria. We feel that where the signature is present there
should be some information to allow someone reading the record to
determine what the signature meant, whose signature it is, date and
time, things like that. And there should be a way to link the electronic
signature to the electronic record in a way that ensures that it\'s
bound and cannot be pulled apart, it cannot be excised or that ideally
what\'s signed can\'t be changed without in some way invalidating the
signature. That\'s pretty much the criteria. I\'m sure we\'ll talk about
some of these points in more detail.

Just one last slide in terms of discussion. Some of the questions, but
by no means all of them, that we like to have talked about here are,
first of all, which criteria are the most difficult to satisfy with
existing systems. I guess to the extent that people can be specific
about what in particular causes the problem I think would be very
helpful to us. Similarly, if some criteria pose particular problems for
certain kinds of records, I think that would be useful.

People have pointed out this morning and in other sessions that there is
a problem with a one-size-fits-all approach, and if you can tell us
where in fact this one size does not fit, again, I think the specifics
would be very useful.

I think a third question is, if in fact these criteria are not ones that
you currently adopt and satisfy, we would be interested in knowing how
you currently do assure yourself and other people who are interested
that your electronic records are in fact accurate and reliable and have
integrity. We\'re very interested in alternative sets of standards to
these things, if you could propose them. Then I guess if there are
unique issues that you see associated with electronic signatures that
form a part of electronic records, we\'d certainly like to hear that as
well.

So that\'s at least some of the questions that we hope you\'ll respond
to. Of course, any others that you are interested in talking about.

Robin Roberts: Good, so this is a little more narrowly focused section.
We\'ve gotten to the depth and the breadth of a lot of the issues here
associated with record-keeping and also with record retention. If in
this section we could try and be a little more focused on particular
general criteria, that would be great, and it\'s also a chance for you
to let EPA hear about how you manage your record-keeping systems and
what are some of the problems you\'ve encountered that would inform your
development of a realistic rule.

Mark Greenwood: My name is Mark Greenwood and I\'m with the law firm
Robson Gray. I represent something called the Coalition for Effective
Environmental Information. Actually, I\'m afraid I\'ll divert a little
bit from the specific question point if I could, because I think in
listening to the discussion this morning, I think following this
rule-making, I think we\'re struggling with the difficulty of trying to
sort through three different constructs for what the agency is trying to
achieve. If I could just go through that I think it might be helpful, at
least it organizes things for me, if it doesn\'t for others.

I think the agency is in some sense trying to, really under the
authority of \[the Government Paperwork Elimination Act\], which is the
statute which is supposed to allow and permit record-keeping and
reporting to be electronic, to somehow do something that makes it clear
that that\'s allowed. I heard Michael saying that there was this
interpretive function to make clear in a rule that things that people
have been doing for many years are okay. I think that is a function that
they\'re trying to deal with here, and I think that is a separate issue
from two others.

The other theme I\'m hearing here is they\'re concerned about fraud in
how documents are prepared and perhaps modified over time. I would
suggest that\'s a very different problem, and I think there\'s a lot of
folks who have strong feelings about what is the nature of that problem,
whether it is a problem, and so on. I think it\'s very important to
focus initially on what is the nature of that issue, if there is one,
because it drives everything related to solutions and obviously paths
forward for the rule.

The third one, which is this issue of long-term record retention, which
I think people recognize is an issue. How you manage it, frankly it\'s a
problem not just for the private sector, for the government as well. It
relays a lot of questions about what are the records and why do we
retain them for such a long period of time. Again, a distinct set of
issues and problems that I think should be thought through on separate
tracks.

So while I know, I suspect we\'ll have a very open discussion about many
of these issues here, I think it\'s helpful for us all to keep in mind
that we have three different problems that will define both what is the
issue, what is the solution and what is the path forward as we go
through today.

Robin Roberts: Great. Any organizational scheme for all these ideas that
are flowing is a good idea. Are there any questions on the general
criteria of the rule that you\'d like to speak to? Any experience with
record-keeping in your corporations that you\'d like to share?

Frank Miller: Frank Miller again, from Rohm-Haas Company. Just to give
you ideas for some comments back on the various criteria.

So four comments. On the systems that we have in general, whether
they\'re used for compliance and/or business systems and so on, in
general the first point, being able to absolutely detect any times that
data could be altered, most systems aren\'t really designed that way.
They\'re secured and there\'s various roles of who can do what and
role-based security as systems have evolved, but to absolutely detect
when any changes are made and so on and that records haven\'t been
altered, most of our systems aren\'t really designed that way. So
that\'s the first aspect. There\'s definitely a gap between maybe what
your ultimate disciplined intentions are here and what we could probably
do today.

The second area is around audit trails, time and date stamping and so
on. Some systems have those, many business systems have it so that
you\'re not really changing the exact information, you\'re doing
incremental changes to it and have some kind of time and date stamping.
But by and large, most of the environmental systems don\'t have too much
of that, and/or if they use business systems, they inherit some of that.
But in general, most systems weren\'t designed that way and that\'s not
usually there, so we\'d have to find a way of bringing, again, coming
into compliance. So that\'s point six and seven.

Point eight, around searching and retrieving. Probably most systems
today are starting to adopt knowledge management-type principles where
you want to be able to find things easily and fastly and have keyword
criteria and various ways to get at information. But again, not too many
systems are there yet, so again there\'s a gap. It\'ll take us a while
to come into compliance.

Then around the archiving in electronic form, there\'s two parts to
that. The storage media itself, so there\'s storage media obsolescence.
There\'s the challenge of always being able to have it on the right
media so that you have that equipment to be able to bring it back if
someone needed to see it.

Then the application obsolescence \-- that\'s being able to have it on a
platform where you have people who know how to run that platform and
know how to understand the application, understand business logic and
could actually run the application ten years later to be able to
understand how that record was actually generated.

So again, those things are a challenge for us today. We don\'t have real
good answers for those. The storage media, we do bring things forward
and so on, but there\'s always the issue of the first recording of data
and how do you -- you can validate data as you move it, you can validate
applications as you move it, but there\'s always the issue of now
you\'ve moved beyond the first --

\[End of Tape 1, Side A\]

\[Tape 2 of 3\]

\-- those are some feedback on those criteria.

Rich Lysakowski: If I look at the list of -- I would assume these are
functional criteria for electronic records retention system. You\'ve got
nine commandments there. Going back to biblical terms, there\'s usually
ten. If you could just add one, and that is, convert records to a
documentary record form that permits facile -- in quotes, I have facile
means low cost -- migration of records before the underlying technology
becomes obsolete. Then you would have a complete system for records
retention. The things that he\'s talking about are programmatic elements
that are people, policies, procedures, not technology functional
requirements.

So adding a tenth part to that, convert records to a documentary record
form that permits low-cost migration of records before the underlying
technology becomes obsolete, would give you a complete functional
description of the system, at least from the technology point of view.
That\'s the real issue around retention, is the rapid obsolescence.

Today that\'s by design, so that you are forced to upgrade to the next
version of software. Vendors really make that difficult for you to do
facile conversion to some preservation format that makes migration easy.
That\'s where your real cost comes in over long periods of time with
electronic records systems, is because vendors make that difficult on
purpose.

Unidentified Male Speaker: Or maybe it\'s really Bill Gates that makes
that difficult.

Pat McConnell: I\'d like to add just one dispute to that, and I\'m not
sure if I\'m crossing over into this afternoon. But long term, thirty
years from now, do you know how many versions of how many systems of how
many instruments of how many software, and if they have to be converted
I won\'t have to do it, I\'ll be retired by then. But if every form of
that has to be converted, that becomes massive in itself.

Charles Reese: I just want to add a comment to the gentleman from the
computer notebooks. This is the \[Good Laboratory Practices\] consensus
document, the application to the principles of \[Good Laboratory
Practices\] to computerized systems, by the \[Organization for Economic
Cooperation and Development\], series on principles of \[Good Laboratory
Practices\] and compliance monitoring. In this document, they actually
give commandment number ten, \"where system obsolescence forces a need
to transfer electronic raw data from one system to another, then the
process must be well-documented and its integrity verified. Where such
migration is not practical, then the raw data must be transferred to
another medium\" -- medium being a key word here -- \"and this verified
as an exact copy prior to any destruction of the original electronic
records.\"

The tenth commandment needs to be a medium. A medium doesn\'t have to be
paper. It could be paper. It doesn\'t have to be a computer format. It
could be a computer format. But the key is medium. When something is
electronic, we\'re trying to store it as a record, and it becomes
obsolescent, we need to have the ability to move that record to some
medium. Our choice in \[Federal Insecticide, Fungicide and Rodenticide
Act\], up until this point, had been paper. The way we see these
definitions of electronic records is going to make our paper systems --
we will no longer be able to say that our original raw data is the paper
printout, because the electronic record is first.

So my question here is actually to the panel, is more the issue of
fraud. I see here in this list of the nine commandments things that seem
to point to how to maintain these records with integrity over periods of
time, but there\'s nothing there to say that how the records were
generated in the first place. Were they -- is the record accurate or is
it maintained properly. So I guess the issue here is validation. So how
is CROMERRR going to address the fraud -- is there some sort of feeling
that without CROMERRR that the ability to perpetuate fraud is greater or
less? I wonder how you plan to address these things and how come we\'re
not addressing whether or not the data is actually accurate versus how
long we maintain it, or how we maintain it. Just open to the panel.

Unidentified Male Speaker: I guess I\'d say two things about it. One is,
the first one does say generate and maintain accurate records. I think
the other thing is again, we\'re looking at the underlying program
requirements to describe what record you have to generate and how it can
be generated. Whether it says you can use a CEM or whatever it is.
Usually the underlying program records requirements describe that. So
that\'s why we didn\'t address the generation, the initial generation of
the record here, other than the more general statement that you have to
generate accurate records.

Unidentified Male Speaker: Does that answer your question?

Charles Reese: Yeah. So you\'re saying that the individual programs here
have their own requirements for generating, the way they generate an
accurate record, but if we\'re all generating electronic records, are
the programs then going to have to address individually how to generate
an accurate electronic record versus -- then we have to rely on CROMERRR
to how we maintain and migrate that electronic record. So wouldn\'t it
seem prevalent to have some sort of validation concept in the CROMERRR?
Because you\'re right back to what it seemed like you were trying to
avoid, having the individual programs create their own systems for how
you generate an electronic record accurately.

If everybody has to come up with their own validation scheme, then
you\'ve got a whole set of programs going this is the right way to
validate, this is the right way to validate, this is the right way to
validate, but everybody has to follow CROMERRR to maintain. Just
something to point out.

Barbara Foy: My name is Barbara Foy, I\'m from Monsanto Company. I
wanted to make a comment about the first couple of points up on the
screen about the various criteria and their impact on business. While I
think there are issues around most of the criteria, by far and away one
of the most troubling ones for us in the way we do business is number
nine, the archival issue. Archiving these records we would see as a
major, major change in the way we do business, a major expense for the
way we do business. I just want to make a comment about our current
practice, which is paper-intensive at this point.

So just to echo some of the comments that have been made just before
mine, I\'d like to reinforce and go on the record as agreeing with those
comments, with the hurdles that the archiving portion of the CROMERRR
requirements would cause for a business like ours. Particularly the
requirement that requires these records to be preserved with their
context, meta data, in the exact electronic form that they were created
for years and years and years into the future would present a huge
problem and a huge expense.

John Chellen: I\'m John Chellen from HRI. I didn\'t get the gentleman\'s
name sitting at the table up here, but I thought he put his finger on
one of the key aspects of this issue. I think it\'s especially important
because it clearly appears that there\'s a consensus that EPA is
certainly overreaching, perhaps inadvertently so, in trying to freeze an
incredible amount of data that\'s upstream of what\'s the most critical
information and clearly downstream of where it all begins.

It seems that we should perhaps separate this into two subsidiary
questions. The first is, the most important transaction that occurs, the
most important record, is the one that\'s delivered to EPA. How is that
legitimized, how do we verify that the person who sent it is the person
who said they are, and is it accurate. Once EPA has received a record of
that nature, EPA has it. It seems that we can shift the burden of
retention of that record to EPA. Through the legal principle of
estoppel, that if it is made public, if that transaction is turned
around to the original respondent, the respondent can be put in the
position of either agreeing or disagreeing that this is the transaction
that occurred. End of discussion at that point, if there is a certain
time period for them to agree. I submitted this, it is accurate, and
after a period of time they are given no further opportunity to question
that transaction.

Nobody except EPA needs to maintain that record any further, except in
the following circumstance, which I think this other gentleman pointed
out. Was this reflective of the primary business activity and who was
responsible for the generation of that record, accurately or not? It
seems that we do not need to keep every single intermediate transaction
or intermediate record that is used to create that final record, but we
need to maintain the original source data. We need to maintain an
accurate statement of the process by which that transaction and that
record was created.

If we can get back to the original source data, if we can get back to
inventory information and the like, with a paper document if you need it
or a paper description of how the final transaction was generated, that
satisfies all of EPA\'s criteria here. The rest of the criteria for the
maintenance, for the long-term longevity of all the other electronic
records the company maintains is beside the point.

I\'ll offer that as a suggestion to at least analyze this framework. At
least subdivide these into the two questions. One, validity of the final
transaction submitted to EPA and being able to safeguard that through
estoppel, and the second, how do we maintain an adequate audit
mechanism, whether it\'s automated or not, to verify the creation of
that final electronic transaction. Thank you.

Howard Krueger: I just wanted to briefly input on the concept of EPA\'s
allowing each program office to decide whether they want to opt into
CROMERRR or opt out. The caution that I\'d like to put forth is that a
given point of data or electronic capture of information does not
necessarily go to only one program office. So it would be an absolute
horror story if one program office took one position and data that would
be reported to that given program office was also needed for a
compliance record in another program office, which took a direct
opposite point of view regarding CROMERRR. That is advanced water
torture and certainly nobody wants that.

Mark Duvall: The purpose of today\'s meeting is to come up with good
ideas to help EPA achieve what it needs to achieve. One of the
difficulties that we\'re having is that what\'s in the Federal Register
is so broad. It applies to all EPA programs, all EPA records, one size
fits all. Obviously, there are many areas where the CROMERRR
requirements don\'t fit well.

It would be very helpful for us to help you if we had a better sense of
what you need to accomplish. Following up on what Mark Greenwood
suggested, there are at least two different things that you\'re trying
to accomplish it strikes me. The first thing that you\'re trying to
accomplish is under the Government Paperwork Elimination Act to fulfill
the obligation to make electronic record-keeping an option, to remove
obstacles. There are certain things that EPA has to do that the rest of
us don\'t have to do in order to achieve that. Since most EPA
record-keeping requirements are media-neutral or at least have no
obvious reason why records could not be kept electronically, what EPA
needs to do is to draft a provision, which addresses the very limited
number of circumstances where existing record-keeping requirements do
have an impediment. Primarily, they would be ones which have wording
that talks about paper or that involve a handwritten signature.

I would suggest that this could be handled through two mechanisms.
First, to have a general statement in Part Three that says wherever any
record requirement in 40 CFR refers to paper, it is hereby deemed to
also allow electronic record-keeping. Secondly, by having an electronic
signatures piece, which is in the proposal, that says essentially
whenever a 40 CFR requirement talks about a handwritten signature, that
can be satisfied by an electronic signature if the following twelve
things happen. I would suggest that those are both actions that EPA can
do independent of what industry has in the way of its systems or
doesn\'t have in the way of its systems.

The second goal that EPA has, which is quite apart and distinct from the
goals of the Government Paperwork Elimination Act, is prevention of
fraud in electronic records. There are many kinds of electronic records,
many different circumstances under which electronic records are kept,
and any particular kind of anti-fraud provisions that would work well
perhaps in one context might well not work well in another context, and
certainly seem not to be appropriate for application across the board.

It would be very helpful if EPA could put into the record an explanation
of where it perceives the fraud problems to be occurring. If we\'ve
established so far that electronic record-keeping is commonplace today
and has been for a number of years, then presumably EPA has gathered
experience with fraud in electronic record-keeping through enforcement
activity. Certainly we are aware that there have been fraud cases
brought. My understanding is that to the extent EPA is aware of fraud in
connection with record-keeping, it is primarily in the laboratory
context, particularly environmental analytical laboratories. In contrast
to that, I\'m not aware that there\'s been fraud in connection with
electronic record-keeping in areas such as discharge monitoring, air
emissions monitoring, \[Toxic Release Inventory\] reporting, etc.

If the need for anti-fraud provisions can be identified as being most
applicable to a particular program area or a particular context, then it
may well be that you can or we can suggest mechanisms that address that
need. But in the absence of a context, when we\'re stuck with a -- I
won\'t say one size fits all, but when we\'re stuck with all
record-keeping requirements under 40 CFR, we can\'t even count them,
much less address each different circumstance.

So it strikes me that the agency can help everybody reach a solution to
determine what mechanisms are appropriate to deter fraud, to detect
fraud in electronic record-keeping by identifying where the problems are
occurring and what kinds of deficiencies have been identified. For
example, if laboratory fraud is occurring, is it because of electronic
records that are being manipulated electronically or is it because
samples have been tampered with so that the subsequent electronic
records that are created are faithful representations of electronic
analysis of tampered samples? If the latter, then electronic
record-keeping anti-fraud provisions would be irrelevant to addressing
that kind of fraud. In fact, my understanding is that certainly the bulk
of such fraud as is found in the laboratory context has to do with
manual operations, such as preparation of samples, rather than with
someone going into a computer file and changing numbers. It might exist
in theory, it might happen occasionally in practice, but if the bulk of
the problem is manual then CROMERRR-type anti-fraud provisions would not
be appropriate.

Until we know what the context is, we can\'t give you good suggestions
on how to design a CROMERRR program.

Kathy Barrowclough: This is just specifically to your points under the
criteria for electronic record retention systems. Number two, which says
\"maintain electronic records without alteration for required retention
period,\" seems to totally contradict number six, which says that you
can have an audit trail because that indicates that you\'re going to
have changes to these electronic records. I just quite frankly don\'t
understand why you\'d have a requirement that says don\'t change this
record, and then you say but have an audit trail whenever you change it.

Pat McConnell: Just offer up as a suggestion, the criteria for the
e-record retention systems seems to have been written or built upon the
current paper record systems. One suggestion would be that allow each
program office to set a different retention period for electronic
records versus what is currently in practice today for paper records.
Based on what the gentleman from the electronic notebooks said that the
system you buy tomorrow was obsolete yesterday, would allow us to better
manage that. The audits on the actual original electronic records can
only go back X amount of time.

Austin Perez: I guess I\'ve been thinking as people have been speaking
about an alternative. I guess I want to lay out the alternative and the
reasoning behind it. I know I\'m skipping ahead a little bit, please
bear with me. I guess I\'d like to get your initial reactions to this
option.

Suppose for a moment that there are program offices today, prior to
CROMERRR, that are currently allowing electronic record-keeping. So that
means that they must have taken the legal steps necessary in order to
make that legal. Whatever that may be, whether that\'s guidance, law,
however they\'re doing it.

I guess the question is, or at least one option would be in these
circumstances where these folks have already turned on the electronic
record-keeping, why would they have to do anything at all under
CROMERRR? I suppose that there would be a situation or there could be
situations where there are, I guess, program offices where electronic
record-keeping is not allowed legally, there is a legal barrier to it.
In those instances where there\'s a legal barrier, those program offices
could opt into CROMERRR in order to address that legal barrier. But in
those instances where they don\'t see or they have taken steps in order
to climb that barrier, I guess one alternative would be, why do they
have to do anything at all? When CROMERRR goes into place tomorrow, why
can\'t they just remain silent and why couldn\'t the current program
that they have in place remain in effect? I want to lay out that
alternative and I guess I\'d like to get your initial reactions.

Robin Roberts: If possible, as you pointed out, there is a point on the
agenda dedicated specifically to alternatives to e-records. If the
panelists would care to respond to the question now that\'s great, but I
would just like to have that question out there for everyone\'s
consideration and we can come back to it, perhaps as the lead question
when we get to that section on the agenda. Because we are at lunch and I
never like to get between people and their lunch.

\[Lunch break\]

Robin Roberts: \...your agendas, you\'ll see that the discussion we
began before lunch we were just going to continue after lunch. Before we
do that, David just had a few words he wanted to say in response to some
of the comments he heard earlier.

David Schwarz: Mark Duvall asked me if we could give some examples of
fraud-related concerns that might provide a context. I don\'t want to do
this in a sense that would be interpreted as at all global. We don\'t
have our enforcement people here today and I don\'t want to speak on
their behalf. But I thought I\'d give you an example anyway which I
think is pretty straightforward and might sort of help frame the
problem, or at least a problem in some cases. It\'s actually an example
from the world of paper, but I think that when I give it to you you\'ll
see what we\'re looking for as an electronic counterpart.

There have, as I understand it, been a number of fraud cases involved
with laboratories that have been prosecuted over the last ten years or
so. In conjunction with those, in at least once case, maybe more, as a
part of discovery the enforcement people were very glad to get their
hands on the lab notes that recorded original observations. One of the
things that was really interesting to them is that in at least one case
the lab notes had whiteout and then writ\[ing\] over on top of \[the\]
whiteout for some of the values noted. Of course, that raised a red
flag. It doesn\'t automatically mean that this is fraud, but it
certainly raised the question of clearly these were changed. That helped
them with the investigation.

If you think about the transfer of that to the electronic environment, I
think one of the problems, or one of the goals that is sometimes set for
us is that we would like to make sure that the electronic system
provides something that corresponds to the whiteout, that provides a
corresponding forensic -- we\'re not going to have whiteout clearly, but
on paper it is very often, not always but sometimes or often, possible
to determine that things have been changed. There\'s all sorts of rules
about how you keep a lab notebook and you can sometimes tell if those
have been violated.

So again, I think that one of the things we\'re looking for, and I
don\'t know whether we\'ve gotten there or not, but one of the things
that we\'re looking for is a way to give us the corresponding
information in the electronic environment. We\'d like to see the
electronic whiteout or something like that that would give us a forensic
where we need it, where in fact there is a question of fraud that has to
be pursued. So that\'s one example, it\'s clearly not the only kind of
case, it\'s not the only kind of concern. But I throw that out for your
consideration and if people have ideas about ways that we could solve
that problem we\'d be very interested in hearing that.

Mark Duvall: The laboratory example is also the example that comes to my
mind. I think there are a number of tools already in place that do
address that. They\'re mainly in the good laboratory practice
requirements. Obviously not all lab studies are done under \[Good
Laboratory Practices\], but the point is that EPA in addressing
laboratory fraud has already addressed it. There are a number of
provisions in place to require reliability of records. For example,
there is an audit trail requirement in the \[Good Laboratory Practices\]
requirements, Section 130(e). There\'s a requirement that electronic
equipment, like other equipment, be calibrated and be appropriate, and
the \[Good Laboratory Practices\] enforcement people have interpreted
that equipment calibration requirement very aggressively to require
certain steps to be taken.

So there are a number of ways to assure quality, to assure reliability
in the laboratory context. Another example, not limited to the \[Good
Laboratory Practices\] context, is EPA methods, where typically EPA
methods have a number of steps in there that are designed specifically
to address reliability of the results.

So to the extent that laboratories are the main issue, it\'s helpful to
deal with it in those terms, because there are a number of
laboratory-specific approaches which have been implemented and
conceivably could additionally be implemented that would be appropriate
for laboratories but which might not be appropriate for other contexts.
One example of a point that EPA has proposed is an amendment to the good
laboratory practice regulations that would talk about the need for
security provisions that would be applicable to electronic as well as
paper records.

It\'s interesting that in that proposed rule, which I understand is sort
of hanging fire because CROMERRR came along, in that proposed rule EPA
considered it to be sufficient to have a provision that said security
provisions, without detailing what those security provisions might be.
They didn\'t say audit trail and preservation of records and this and
that, they made it a performance standard to require -- and again, this
is just a proposed rule -- but to do what was appropriate under the
circumstances.

That might be an approach that EPA could consider, a performance
standard that says under these circumstances do what is appropriate and
we can give you some suggestions. But not require specific things in all
program areas which might well not be appropriate.

Mark Greenwood: On the fraud issue, I think it\'s useful to, since
we\'re kind of on this topic, to ask you to also think more broadly
about the set of factors that you should think about that go beyond the
one that you were just describing. The electronic audit trail concept
and how that fits in with a whole set of factors that frankly push back
against the likelihood of fraud. In other words, I think there\'s some
other things to think about.

Mark was alluding to the fact that if you\'re going to commit fraud in
the entry of data, audit trails don\'t help you. But there are several
other factors as well. In some ways, what we have today as we look
towards moving with electronic sensors and monitors that are connected
directly to the electronic data systems, frankly you are reducing the
probability that humans are going to get in there and change the data. I
would submit that the trend we\'re on with electronic reporting and
record-keeping is anti-fraud in many ways.

Another factor to consider is, for many of the records we\'re talking
about here, they are also business records. So for example, a \[Toxic
Substance Control Act\] requirement may need to know the production data
you have. There are all number of reasons why you\'re not going to go
falsify your production information. That\'s fairly useful business
information. That pushes far against anything you do for an EPA
requirement.

Then I think institutionally, \[inaudible\] recognize that falsification
of information, depending on the context, can be a criminal act. I would
not minimize to any great degree how significant that is in the minds of
an employee of a company. The electronic media reinforces that in the
following sense. Electronic systems tend to facilitate the sharing of
data, so if a bunch of people have access to data and you want to
falsify something, you suddenly have to sort of muster a conspiracy of
people to try to make sure that that data is changed and it stays that
way to actually make this come off.

That\'s highly improbable in the world in which we work today. So I
think there is a set of these factors that need to be weighed and looked
at as you look at the overall question of fraud.

Bruce Adler: I want to just add to what the two Marks have just said.
That is, if you step back a little bit and think, let\'s use air
monitoring as a particular example. If you\'ve got an air monitor with a
readout and somebody, a worker, an employee, goes over and takes the
reading off of that air monitor, writes it down, and you compare that to
a continuous emissions monitor which feeds it directly into a tracking
system, the latter program of the electronic record-keeping is much less
likely to be susceptible to fraud than the transcribing. If you\'re
looking at decreasing the likelihood of fraud, you do that by
encouraging electronic record-keeping. You don\'t have to get into the
audit trail picture. It\'s not relevant.

If your objective is to reduce the likelihood of fraud, using and making
it easy to use electronic record-keeping accomplishes that objective.
But if you\'re trying to add more onto it by let\'s say making fraud
impossible, then you set an unreasonable goal for yourselves and you\'re
going to create an unworkable system. So I really encourage you to step
back and say, is this system, is an electronic system less susceptible
to fraud than a handwritten system, a paper record system. If the answer
is yes, then you\'ve achieved your objective.

Carolyn Greenwood: Carolyn Greenwood, I\'m from Environmental Systems
Corporation. No relation to Mark Greenwood that I know of. We are a data
systems vendor, which sounds like a dirty word in this room, if I
remember earlier. We do not require upgrades on purpose. But my real
point, what I wanted to say is, we do mostly air monitoring
applications, almost exclusively. We have a lot of utilities that are
our customers and a number of state agencies. Most state air pollution
agencies use our software.

I just want to say, adding an audit trail can be quite expensive. It\'s
not a simple thing for us to do. We have done that to our programs, most
of our programs have them. But I can\'t speak for the other media, the
other vendors. I don\'t know if they would have them. I\'m guessing a
number of people would need to have their software changed to add an
audit trail and that\'s not a trivial thing. So keep that in mind as
you\'re considering that.

Robin Roberts: Any more questions on general criteria of the rule and
technical aspects of implementing it, problems? Seeing no hands raised,
one last hand and then we\'ll move on.

Unidentified Male Speaker: I\'ll just make a comment to follow up what
this young lady said. One of the things that has been pointed out to me
by the \[information technology\] people at my company is that yes, we
buy standard packaged software from vendors. But regrettably, we don\'t
implement it in a standard way. We customize everything. One of the
things I\'ve learned from talking with many of my colleagues is, I
won\'t say everyone, but the large majority of companies customize these
standard packages. So that even if you create a solution to the
off-the-shelf product that you buy, you still have to generate hundreds
of different implementation scenarios for that one package that you buy.

Charles Reese: One thing we haven\'t touched on today is how to deal
with electronic records in, say, a sponsor-contract facility
relationship. This creates a very difficult problem for us, if a sponsor
company were to go and hire a contract facility and that facility has
electronic record-keeping systems. Those systems may have some sort of
compatibility or no compatibility whatsoever with the sponsor systems.

Now we purchase work, the work is done, completed. At that point, how do
we address maintaining electronic records that we may have no way to
read or no way to handle because they were generated on a completely
alien system to us? Is it going to be the contract facility\'s
responsibility to maintain that electronic record for the life? Or are
they going to charge us to maintain that system? Are they going to
transfer it to us like they do the paper records now and say, you paid
us your money, we did the work, we\'re done, now it\'s your
responsibility. If that\'s the case, we could end up with a giant set of
files that we literally can do nothing with but maybe maintain.

So what do we do in those situations? How we handle this contract
situation is going to be a very big question for any kind of managing
electronic records. This relationship goes on with any company out there
who outsources any kind of work. Those are big general criteria to think
about.

Kathy Barrowclough: While we\'ve talked about this and sort of touched
on it with several of the different comments made, I don\'t think we\'ve
really identified the considerable issue with the idea of legacy
systems. It was sort of touched on by the vendor there in saying how
difficult it is to add an audit trail, but in essence once CROMERRR is
implemented companies would be obligated to review all of their existing
systems to see whether or not they meet the CROMERRR criteria, in order
to ensure that they do meet those criteria.

The cost of doing that is really great. First you\'ve got to inventory
all of your systems, look at each of those systems and see whether or
not it has audit trail capability or function, whether it has all of
these security features that the nine points raise in the record-keeping
part. Then you have to get a plan in place for what you are going to do
with that, so that when the enforcement arm does come around you can say
what\'s happening. There\'s a considerable cost and resource drain in
order to do that for all of those legacy systems.

Robin Roberts: Any last questions? Thank you for your comments on that.
Before we move on to the alternative approaches, to e-records standards,
David had a word he wanted to say. Then also the audience, Ms. Roberts
here would have something to say after David\'s comments.

David Schwarz: Just as we begin to talk about alternatives to the
current proposal, I just think it\'s important to remind ourselves that
the rule-making process is an agency-wide process. The decision as to
what we actually come up with as a final rule is not just up to the
people who are seated here.

So I know in some cases it may be disappointing or frustrating that you
give us this great alternatives, we don\'t just nod our heads in unison
and say oh yes, we\'ll do that. But we can\'t say that, because we
really -- what we can do as appropriate is we can give you feedback in
terms of what we might think of it individually in some cases. But the
truth is, for all the ideas that we hear today, we\'ll be willing to
take them back to our colleagues at the agency, to the workgroup, and
consider them together.

So I just don\'t want people to feel that because we\'re not going to
give you, say yea or nay, as you make suggestions, we\'re certainly
going to consider them, and we\'re very grateful to have your thoughts.
You will see us respond to them but the response may not become apparent
until the final rule is published or until some notice is published that
indicates an action. So I just want people to be clear about that.

Robin Roberts: We had a question before we broke that anticipated this
discussion. That gentleman has left the room but Ms. Roberts is going to
tell us about it.

Kathleen Roberts: Remind me to thank Austin for posing this question and
then leaving. As I recall, the question was, if there were some programs
that had already legally implemented the ability for companies to use
electronic record-keeping, I guess essentially would those be
grandfathered in under CROMERRR. Would CROMERRR have to apply to those
programs or could they forever opt out of CROMERRR? If I restated the
question incorrectly, certainly someone let Robin know.

Jamie Conrad: Jamie Conrad with the American Chemistry Council. He
talked a little bit about it. What he was suggesting was since it
appears as though in virtually -- it seems to be hard for any of us to
come up with an example where existing EPA regulations would seem to
prevent electronic record-keeping, then why not just state that all
current forms of electronic record-keeping are okay. And if there are
any that anybody\'s aware of out there, any instances where people are
keeping paper records and wish they could go electronically, those
people could opt into CROMERRR. But it would only exist as an option for
those people that wanted to pursue it, and that otherwise electronic
record-keeping could be sort of authorized kind of by fiat, the way it
is now.

Unidentified Male Speaker: The response is we could do that. I think
that\'s an option that we\'re prepared to consider.

Howard Krueger: A caution on the issue of grandfathering is if you
grandfather everything that you\'re doing now and say we\'re only going
to do things in the future, based on the profile of burgeoning
regulation in the past ten years and even more in the last five years,
it certainly isn\'t going down. That will still place a huge burden for
all new, yet to be defined, regulations. So that\'s one caution.

But even more importantly I think is, if you were to grandfather
existing systems, then what about eighteen months later when there is an
upgrade to an existing system, so you now have a new system. Suddenly,
your current way of doing records, which was nicely grandfathered, no
longer maintains that shield and protection because of the new system
that came in.

As we all know, technology, there\'s some rule that every eighteen
months everything is changed. So the grandfathering is only good for
eighteen months, and then suddenly it\'s back to ground zero again. So I
am very hesitant about thinking -- let\'s say I don\'t understand how
grandfathering would work. If there is some creative solution that would
be wonderful, but I just don\'t understand how that could work.

Mark Duvall: Thinking about alternatives to CROMERRR as it\'s structured
now, it strikes me that --

\[End of Tape 2, Side A; Side B begins\]

\-- need to be addressed, because timing is very important here, as we
decide what needs to be addressed now, what can be addressed later. The
one pressing time-driven provision is that of the Government Paperwork
Elimination Act. That requires EPA to make electronic record-keeping
available as an option by October 2003. That piece of rule-making --

Unidentified Speaker: Reporting.

Mark Duvall: Both of them. Both options, both reporting and signatures
and record-keeping need to be made available by October 2003 according
to the legislation. So what EPA needs to do by that time is to the
extent that there are any obstacles to electronic record-keeping, those
need to be removed through rule-making. To me, the only obstacles that
could be available would be those that call for a handwritten signature.
That can be addressed through a fairly straightforward prophylactic
electronic record-keeping provision. That\'s the only time-driven piece.

The bulk of what\'s in the record-keeping provisions in CROMERRR are not
addressed to that aspect, but rather are addressed to the anti-fraud
concerns. Those are appropriate public policy concerns that need to be
addressed in an appropriate forum. Rule-making is an appropriate forum.
But keep in mind that the timing for those provisions is quite different
from the timing for the \[Government Paperwork Elimination Act\]-driven
provisions.

The current CROMERRR provisions obviously are causing a lot of
consternation. They are probably not the right approach for addressing
the fraud provisions, for a couple of reasons. The main reason being
that they\'re not addressed to the particular concerns, the particular
problems with fraud. \[Office of Management and Budget\], in issuing
guidance to agencies under the \[Government Paperwork Elimination Act\],
urged agencies to conduct a risk assessment, to find out where the
concerns are with fraud, address the high, medium and low areas, and
address the security provisions according to the results of that risk
assessment. Most agencies have done that and have reported to \[Office
of Management and Budget\] where their biggest concerns are. A lot of
times those have had to do with reporting, as opposed to record-keeping,
but the same requirement applies to record-keeping.

It strikes me that what would be appropriate for EPA to do would be to
do a risk assessment, find out the areas where there is a high concern
with fraud in electronic record-keeping, and devise proposed anti-fraud
provisions that would be appropriate for those contexts, one or more.
Industry would be glad to participate in a focused discussion as to what
would be appropriate for particular contexts. From what we heard this
morning, quite possibly the laboratory context might be one such area.
In fact, anti-fraud provisions have been a main topic of discussion in
connection with the \[Good Laboratory Practices\] regulations ever since
their inception, because much of what the \[Good Laboratory Practices
regulations\] are for is prevention of fraud.

The timing on this focused anti-fraud discussion -- there is no
particular time constraint to that. Accordingly, it\'s appropriate for
EPA to do the ground work of the risk assessment that \[Office of
Management and Budget\] called for to identify the high-priority areas
and then to contemplate particular, appropriate, media-specific,
context-specific, proposed controls that could then be debated in an
appropriate manner. But that would mean that the record-keeping
provisions of CROMERRR would need to be decoupled from the electronic
signatures and the electronic record-keeping provisions. Otherwise, that
anti-fraud discussion will slow down the promulgation of the signatures
and reporting provisions, which have the time deadline.

So my suggestion as an alternative to what has been proposed in the
Federal Register is to decouple them, have EPA do the risk assessment,
draft appropriate provisions and then repropose.

Robin Roberts: Mark has broached a subject that we had discussed as
something that should be on the agenda. This was the particular
discussion where we wanted to hear your thoughts about this notion of
decoupling Subpart C from the rest of the rule.

Henry Bartholomew: I think to follow on the comments that were just
offered and Mark Greenwood\'s comments earlier about the hierarchy, a
unifying theme for how EPA might approach each of these categories, the
issue of making electronic record-keeping and reporting generally
available -- a separate issue, is there a problem with reliability and
being able to track the reliability and fraud issues. Third, the
archiving and long-term retention issue. I agree to break these up if
these are three separate themes. A unifying theme would be, is anything
broken.

Let\'s start with the electronic record-keeping and reporting. You\'re
hearing from folks in this room that the vast majority of large
businesses and industries in this country are using electronic
record-keeping and to some extent reporting to comply with EPA
monitoring and reporting requirements. So that suggests to me that for
the primary program areas the EPA is involved in -- air, water, that I
know of for sure, and others, solid waste -- there may not be a huge
problem in companies being able to do it. Fact is, they\'re doing it.
There may yet be, on the other hand, some areas for improvement. It may
be that EPA can do some things to make reporting more easily available
electronically than is currently the case.

My suggestion would be, if you want to step back and take a fresh look
at this in light of all the negative feedback you\'re getting on what\'s
been proposed, put out a notice of inquiry on the electronic
record-keeping and reporting issue and say, are there areas where you,
industry, are having problems being able to do this under EPA\'s current
regulations, the statutes and our guidelines and policies. See what
feedback you get.

The answer may be, not very many, and it goes to the point just raised.
What you need to do by October 2003, presumably, is help to address
those specific issues. So focus on that. You may find that there\'s not
a lot that needs fixing and you may not need this sort of global
approach to fix those sorts of problems. So that would be a
recommendation.

Then if you want to step to the fraud issue, same question. There I
think the experience of your enforcement staff is pertinent. The
question again is, are you finding things are broken.

I liked the suggestion that came up sort of tangentially earlier, of
require people to document the system that they\'ve got in use from 1995
to 1999 before they adopt a new system and what the \[inaudible\] of
reliability of that system are. Keep that so that if a question later
arises within an enforcement or audit timeframe they have that as the
\[inaudible\] of reliability as to the information that was provided to
EPA. Don\'t necessarily require them to track through an auditable
signature hand-off approach every data element that comes out of an
automatic monitoring system and is handled by multiple computers and
software processes and so forth, ad infinitum, with the costs that
you\'re hearing about. Make them document what the system is and provide
that as the \[inaudible\] of reliability. So a couple of thoughts.

Maria Angelo: DuPont supports the proposal to decouple the reporting and
e-signature from the record-keeping, and very strongly supports the
concept of the risk evaluation assessment and setting priorities around
the anti-fraud. However, that\'s not to say that we support the proposed
rule with respect to the reporting and e-signatures. We have some
specific concerns around why the proposal goes farther, in our mind,
than the e-sign legislation and the reporting rules itself with respect
to registration for submitting reports electronically, the concept of
validation and the number of registrants per facility, delegation of
authority, those sorts of things. So I think that part of the rule,
while it may be able to be decoupled, I think still has some
opportunities to make it a little bit more workable.

Jim Scialabba: In line with some of the comments that have come out
about the decoupling, as regards the record-keeping, something that the
EPA has done in other programmatic areas to improve the workability of
regulations has been to move more to performance standards and away from
prescription.

I believe that that\'s one of the problems that we\'re all tripping over
in our review of the record-keeping requirements here is that it\'s too
prescriptive. One thing about prescription, and particularly as relates
to information technologies, is too much prescription inhibits
innovation. I think as the regulations are currently written, that it
would inhibit the kind of innovation you all would be looking for that
would improve reliability, and for us in the regulated community would
find opportunities to reduce the cost and the burden, yet improve our
compliance profile.

With all that said, a for instance of what the EPA has done that we have
found beneficial is encouraging companies to implement environmental
management systems, because it\'s the linkage between all of the
activities in organizations that aren\'t put in place or aren\'t
efficient that have been found to be inhibitive to improved compliance.

So I believe the record-keeping requirement, if it would step back from
-- be less prescriptive and more encouraging, performance standard-based
around a record-keeping management system, that it would be more
palatable. Industries or companies would find ways to comply with a
performance standard that should satisfy a lot of the record-keeping
requirements that the EPA rightly should require for validation, for
information that\'s turned over to the agency.

Frank Miller: In the spirit of brainstorming, again just share some
ideas about alternative approaches. Some other things that maybe you
could focus on in the spirit of e-records is sort of around transaction
standards, that area, making it easier to conduct the business of
reporting. Focus on the standardization of the various government or
agency systems that we have to report to, to again help minimize the
effort to do reporting. It\'s been said a couple times already, around
either performance-oriented standards or guidance or perhaps even
phased-in standards from sort of what\'s minimal or what\'s reasonably
achievable in today\'s environment with an eye towards maximum or highly
disciplined approach to this, giving software vendors or our staffs time
to figure out innovative ways to close those gaps.

I\'ve heard a lot of good things today in terms of record creation,
analysis, data capture. It\'s very prevalent and it\'s a smart way to do
things. Is there anything that we can do in terms of moving forward in
some sort of partnership way, beyond just sort of this commenting
approach to the rule? Is there any better way for us to collaborate
together on achieving this?

I guess lastly, perhaps we could have an alternative goal, or an
additional goal, and maybe that goal could be drive toward minimizing
the effort to report compliance and to receive what we\'re reporting,
such that we both and we all benefit from that, so that we can focus
more on the source reduction, the sustainability and so on. If we can
take the cost and the effort down there, that can serve a greater
purpose. So in the spirit of brainstorming, those are some ideas.

Mike Penders: Mike Penders, Environmental Protection International. The
more I consider this, and as you know we\'ve considered this together
for some time, the more I really come to the opinion that the
record-keeping has to be decoupled from the electronic reporting to
facilitate this. Otherwise, you set up a dichotomy, just focused on ways
to minimize fraud, where all the potential for fraud currently exists
with the electronic record-keeping that occurs now and could continue as
long as someone prints it out and submits it to the agency. But you\'re
setting up conditions for those who would electronically report that do
not apply to those who submit on paper now. So first, it\'s not
effective to address fraud.

Secondly, it presents obstacles to electronic reporting, which provides
a whole range of other benefits to the enforcement and compliance
function and may be even of greater benefit in detecting fraud in the
first instance by keeping the obstacles low to facilitating more
electronic reporting, which allows a timeframe of bringing information
together from other sources that allows the government to detect fraud
in the first place.

So I think it\'s really fundamentally unfair to require companies as a
condition of electronic reporting and against the thrust of a lot of the
paperwork elimination laws and policies and the e-commerce law signed by
President Clinton, to require a standard that\'s not now required under
law or regulation of those who rely on electronic reporting, just by
virtue of the fact that a company chooses to avail itself of an
electronic reporting option. And then address the considered
opportunities for fraud and record-keeping requirements that may combat
that, program by program, where those problems with fraud have
manifested themselves, such as in the laboratory context.

But taking part of the criminal investigations into the laboratory
fraud, such as some of the cases have been publicized, it would have
made no difference to that investigation if that had been electronically
reported. In fact, it would have provided greater opportunities for the
government to investigate if it had been electronically reported than
having to go through all the paper submissions and then compare that
back to the electronic record-keeping that was in place and trying to
reconcile that.

So in considering this, I really think that it makes a lot of sense to
decouple and consider the record-keeping requirements in part of other
programs.

Kathleen Roberts: On the basis of what industry understands of EPA\'s
concerns related specifically to fraud and archiving and the rule as
proposed, \[American Chemistry Council\] believes there are no simple
modifications to the proposal or the criteria. We don\'t see any quick
fixes that can go in. So we also support the suggestion of decoupling
the record-keeping from the rest of the rule and moving forward.
Notwithstanding what might be needed in order to meet the deadline for
the \[Government Paperwork Eliminatoin Act\] requirements.

Kathy Barrowclough: What I\'d like to do is, you\'re hearing a lot of
let\'s decouple the record-keeping from the reporting. I\'d like to go
even beyond that, in that our understanding is that Office of
Environmental Information is not the enforcement arm, it\'s the
different programs. Even after, if indeed the decoupling occurs, we
believe that it would be important for EPA to set up workgroups of
regulated industry as well as internal program people from the
enforcement arm, in order to work through what some of those issues are
and come up with an acceptable record-keeping rule.

Barbara Foy: I just wanted to also support the notion that\'s been
expressed of decoupling the record-keeping portion of the rule to allow
for additional consideration of all of the various issues that have been
raised today. I think that some of the strongest reasons for that
include the fact that has been pointed out that all records don\'t seem
to be created equal, the high costs that have been estimated, to be
associated with complying with CROMERRR, and the lack of technology
available today to meet some of the requirements that are proposed by
the rule. I\'ve also heard a number of people express support for an
approach that considers maybe a tiered type of approach to
record-keeping, dividing record-keeping into different categories and
maybe setting different criteria depending on the nature of those
records, and would also want to support some further investigation of
that kind of an approach.

Mark Greenwood: Obviously you\'re hearing some fairly consistent general
advice here from I think everybody, which I certainly would support. The
one thing though, following on a comment that was just recently made, as
you look at some of these requirements that you\'d like to improve for
the future, let\'s talk about this archiving notion as an example. It is
important for you, \[Office of Environmental Information\], not to try
to do that yourself. I\'m sure you don\'t want to. But you have program
offices who have set these record-keeping time periods. These have for
the most part never really been carefully reexamined after twenty,
twenty-five years sometimes.

A very useful exercise is to be going through those individual
record-keeping requirements and the timeframes and say, why are we
making people keep these records so long, and really examine the
underlying policy reasons for doing that and try to decide whether it
makes any sense to do today. So I would urge you, as you look at at
least that piece of it, to really bring in the other program offices and
have more policy discussion on those questions.

Bill Barta: Bill Barta, FMC Corporation. I want to second the proposals
to separate record-keeping from reporting. Obviously, there are many
complex issues to be discussed that are going to take some time to
consider carefully. But I want to also suggest that we ought not to
ignore the reporting side. There are some significant problems, as I see
it, on that side. I would hope there would be some way or forum or
public meeting to address those as well.

Howard Krueger: Likewise I support the decoupling. I was going to make a
specific suggestion that was just made over here about having a meeting
such as this focused on the reporting and electronic signature side. I
think that some ideas might come out of that to provide the improvements
that would help the other part of the proposal to survive and to attain
the deadline targets that we all are aware of, October of \'03. So
again, I support decoupling and to create a data-gathering and
corrections-type session on those other two parts.

Carolyn Greenwood: If you decouple, whether you decouple or not, one
thing to keep in mind is there may be some useful corollaries, I guess,
to be gleaned from the acid rain program as well as ambient air quality
reporting under their air system. They both have, as I understand it,
after records are submitted to EPA or to the states for EPA, there are
checks that are done on the data. There\'s a lot of stuff you can do
with electronically reported data that you can\'t do with paper very
practically. So if you\'re concerned about fraud or any kind of
inaccuracies in the data, that electronic reporting step will get you
part of the way there if EPA also wants to take or the states want to
take that extra step of doing some internal checks. A lot of that can
turn up errors that are inadvertent or otherwise. So it does accomplish
a little bit of the other goal as well as getting at the fraud issue
maybe.

Doug Billings: Doug Billings from the U.S. Chamber of Commerce. The
Chamber also supports the decoupling proposal, the idea. I also want to
speak strongly in favor of what Mark Duvall proposed in terms of risk
assessment. One observation I would make in that regard is that when
this rule was originally proposed, because it was presented as voluntary
there weren\'t the various assessments that were required under \[the
Small Business Regulatory Enforcement Fairness Act\] and the regulatory
impact analysis that needs to be done under the executive order, under
unfunded mandates.

I would suggest that if this thing is decoupled and the record-keeping
aspect is looked at separately, that those analyses be done before the
rule is re-proposed, if it\'s re-proposed. I think that\'s a way to get
at the risk assessment and various other elements, in context with
working with industry. Certainly the \[Small Business Regulatory
Enforcement Fairness Act\] review panel would be another way to get
industry input on those, but I think all of those collectively, if those
analyses are done, should lead to a conclusion on what needs to be done
with the fraud issue.

Chris Hornback: Chris Hornback with the Association of Metropolitan
Sewage Agencies. I\'ve heard a lot of comments from companies, Monsanto,
Dow, Procter & Gamble. I wanted to just represent or at least give you
some thoughts from the publicly owned world, the publicly owned
treatment works. AMSA represents over 260 of the nation\'s publicly
owned treatment works. Our members treat the majority of the wastewater
generated in this country, both residential and industrial.

We present an interesting case study for this particular rule-making.
Not only are our members permittees under the \[National Pollution
Discharge Elimination System\] permit program, we collect information,
we monitor our discharges, we prepare DMRs or discharge monitoring
reports for our permit requirements. But many of our members, actually
most of our members, are also running approved pre-treatment programs,
which may in fact control a lot of you here in terms of your industrial
discharges, indirect discharges to publicly owned treatment works. In
those instances, we are also operating essentially a regulatory program.
We are control authorities and we would in fact be receiving reports
from many of you. We may be receiving electronic reports from many of
you.

Many of our members are investing thousands if not hundreds of thousands
of dollars in information management systems to receive the information
from many of you. In that case, we are not only subject to the
electronic record-keeping requirements but the electronic reporting
requirements, and in terms of the data reception, not only are we
sending the data out but we\'re receiving it as well. So our systems are
going to have to comply with those portions of the rule as well.

So we\'ve got a lot to deal with with this rule, and so we definitely
support the separation or decoupling of these proposals. We would be
interested in talking more with the agency about the reporting
requirements and the challenges that those present for our members.

Howard Krueger: This is a follow-up point on the last point, which I
thought was very good. If we were to create a meeting and schedule a
meeting to focus on the reporting parts, we all must remember, or at
least as disclosed in the economic impact analysis that the EPA had done
for it, the 62-page report by that outside company. It\'s either 80 but
I believe it\'s 90 percent of all reporting against EPA regulations goes
to states and tribes. That\'s an overwhelming amount of reports going to
this, I\'ll call it a third party, but it\'s not the EPA in Washington,
D.C. It\'s these other groups. So not to consult them as part of any
sort of review on reporting would be to miss the boat, I think, on
getting some very important information. That\'s just kind of a reminder
following up on the very valid point made here. The states have to be
brought in because they have the programs that receive the data and when
they\'re getting 90 percent of the information they\'re really the main
player.

Unidentified Male Speaker: I think that\'s a really good point, Howard,
and in fact we have sort of a separate or additional process where
we\'re consulting with states. There\'s one person here from one of
those state groups that we\'ve been talking to that we\'re working on
plans to do that.

Robin Roberts: Are there any other questions about the alternatives?
There seems to be a -- I hate to use the word consensus, but consensus
about decoupling.

Unidentified Male Speaker: In terms of addressing reliability of
electronic records, if you\'re starting with a fresh slate, as it were,
an appropriate model to think about would be the model that\'s presented
in the E-Sign Act. The electronic signatures act has a provision that
requires if a statute, regulation, etc., requires that a contract or
other record relating to a transaction affecting commerce be retained,
that requirement is met by retaining an electronic record of the
information, so long as the record accurately reflects the information
and remains accessible to all persons who are entitled to access the
statute by regulation, etc., in a form capable of being accurately
reproduced for later reference, whether by transmission, printing or
otherwise.

The e-sign legislation with those provisions is interesting for a number
of reasons. One is that it allows printing as a storage option. The
second is, it has almost no requirements other than a performance
requirement that the record accurately reflect the information. If that
kind of undetailed performance standard was considered by the Congress
of the United States to be good enough for the transactions that are
covered by the e-sign legislation, then as a matter of public policy
it\'s probably appropriate to consider them to be sufficiently stringent
for records required to be kept to meet EPA record-keeping requirements.

After all, the e-sign legislation addresses transactions that involve
thousands, millions, billions of dollars. There\'s certainly plenty of
incentive in terms of money at stake to commit fraud, and yet Congress
determined that the interest in having a free flow of electronic
commerce was such that the kinds of risks could be managed by a standard
that simply says the electronic record must accurately reflect the
information.

The e-sign legislation goes on to say that agencies can impose
appropriate limitations, but the legislative history of that provision
indicates that those conditions on acceptability are to be minimal. The
interpretive standards that the legislation talks about must be such
that they are substantively equivalent to the requirements imposed on
records that are not electronic records, so they can\'t be more
restrictive than those applicable to paper records, and they will not
impose unreasonable costs on the acceptance and use of electronic
records.

So there is a clear public policy expression here of concern about the
cost of anti-fraud provisions. Again, if these kinds of minimal
restrictions on electronic record-keeping in commerce were articulated
by Congress, for all kinds of records other than records required for
government record-keeping requirements, and that one exception was
carved out without addressing what was appropriate for government
record-keeping requirements, EPA is certainly in a position to say
what\'s good enough for everything else is also good enough for us,
unless there are very specific circumstances that would suggest that
something more is needed. That something more would need to be justified
in terms of both need and cost.

So the e-sign legislation would be a good source of inspiration for
designing an alternative to the current proposed regulations.

Lamont Silves: Lamont Silves with Computer Sciences Corporation. It
looks to me like what we\'re essentially trying to do here is to
promulgate a top-down solution. I would urge you to take a look at this
from a different perspective. That would be it\'s fairly clear that the
regulated community is already keeping electronic records. You could
work with some of the trade associations that are here today to identify
the best practices that they use currently, because that\'s what you\'re
fundamentally trying to do is find a best-practice approach to this. So
you could work with these folks to find the best practices that they\'re
using today, validate that with the requirements of the program offices
and take that approach to trying to find a workable solution.

Kathy Barrowclough: I\'d like to follow up with Mr. Duvall\'s recent
comment, where he was referring to the e-sign law. One of the other
things that I read in there is in addition to what he mentioned, he
talks about the record -- or the e-sign law talks about the record after
it was first generated in its final form. If you take that piece a
little bit further, what you can see is that perhaps you wouldn\'t need
all the audit trails on some of the draft documents that might be
created on some of the lab instruments that have integration and
reintegration but you get the final form, and that\'s where you\'ve got
your record. Just wanted to bring that point up.

George Britton: George Britton with Aventis CropScience. One of the
things in the area of electronic records and how you do things from
\[Federal Insecticide, Fungicide and Rodenticide Act\] side of the house
and particularly \[Good Laboratory Practices\] in particular,
historically our laboratory instruments integrate peaks and signals from
equipment. Early on it was on thermal paper. The agency, because that is
not a permanent record, we have photocopied that information. Because
the early integrators did not save data, they just \[inaudible\],
processed, spit it out, re-erased it and went on. Over time we\'ve gone
to other chromatographic systems. We\'ve taken the same approach, we
print the chromatograms and the information data that\'s with that, sign
and date it and save it.

Because our chromatography systems over time do evolve between the same
vendor, between different vendors, in mergers, you get all kinds of
things that are totally incompatible and you never can get the pieces
together no matter how hard you try to get it readable, much less
functional. So what we\'ve done is over time we\'re now taking the paper
for a limited period of time of a period of three to four years, five
years, periods, these systems are operational. You could go back within
a reasonable audit period, go back to the systems and verify that the
paper is exactly what comes from the electronic record.

You can do that over and over again. But as that system becomes unusable
or technology out of date, you\'ve still got the paper record captured
image of it.

So at the end of this day, we are in the process of imaging it to an
electronic medium. In order to have the information available to whoever
needs to see it, if the agency comes in to handle it, let me see the raw
data for this thing, we can actually handle it and manipulate it back.
We\'ve still got the paper stored offsite somewhere. The electronic
version or image capture of it is, as the gentleman talked earlier about
the formatting -- long-term storage problem, that you can see as a
snapshot. You can go back and view, if you\'re trying to detect fraud,
does what was reported match what\'s in the files, you can go back and
compare the two.

With that you have gotten sort of the best of both worlds. In our
particular case is a particular paper system, but it does give you the
ability to do electronically, submit electronically and find the stuff
in there. It also gives you things like for the archiving or information
that is required under \[Good Laboratory Practices\], that you have to
be able to find the stuff quickly when the agency comes in and wants to
view the stuff. Yes, we have it on paper or have it somewhere. But if we
have an information retrieval scenario where you say, this study is
located in this place or on this CD, you\'re protecting the information,
you\'re trying to do both.

The functionality of the long-term storage is the real, at least for the
\[Good Laboratory Practice\] side of the house, is the real key. You
have problems, policies and procedures in place to ensure the security
and integrity of the information. But keeping it functional
electronically over time is the big point.

Charles Reese: I just wanted to add a comment to that, that since we
currently take on \[Federal Insecticide, Fungicide and Rodenticide Act\]
side of things the paper printout to be the acceptable raw data -- and I
want to make a note here that that is considered an acceptable practice
by the agency currently, which is essentially a snapshot of what is
going on in that electronic record. We print that paper out; that is
saved in the archives. If a company so chooses to image that system for
their own benefit because they transfer archives and so forth, that\'s
fine. But the important point here is that taking that snapshot on paper
is considered an acceptable practice by the agency in the means of
getting an audit of the raw data, what the original raw data is.

As CROMERRR is written right now, the concerns that we really have are
you\'re changing the definition of what original raw data is for us. We
say it\'s the paper printout. CROMERRR says it\'s the electronic record
that\'s saved now. That creates a whole different, we\'ve already gone
over all these problems that creates. But the question of a possible
alternative that can be raised is if you can take a snapshot and put it
on paper, how is it that you cannot take a snapshot and put it
electronically in something that you can maintain for a longer period of
time, instead of trying to maintain the original raw data that\'s going
to evolve and change and you\'re going to have trouble with. But you
could possibly take a snapshot electronically and keep that.

The argument that we\'ve heard from the agency over this is that you
don\'t get to keep -- you don\'t have the meta data that generated that
file, all the audit trails and so forth and the instrument parameters
and everything that\'s saved in the electronic file that\'s not on that
printout. It wouldn\'t be on that snapshot of say a TIF image of some
sort. But we\'re also submitting here that it\'s not on the raw data
printout either and that\'s considered an acceptable form of raw data.
So we want to make that point and raise caution that we\'re changing the
definitions of what original raw data is.

Tammy White: My name is Tammy White and I am from Rutgers University,
New Jersey. I\'m part of the IR-4 program, which we have a couple things
happening here. We are a United States Department of Agriculture-funded
program, which means we have limited funds in order to accomplish the
work that we do on behalf of the growers of this country. A point that
was just made was that there have been precedents for the acceptability
of this data that was generated using computer-based systems in a
printout form. Earlier it was mentioned that when putting CROMERRR
together, that Part 11 from the Federal Drug Administration side was
utilized as well as the \[inaudible\]. But I think there\'s another
precedent that is there, and please if someone can add onto it. Within
the \[Organization for Economic Cooperation and Development, Good
Laboratory Practice\] scope, the permissibility of using that printout
as the original data has been established. So I think that there\'s
precedents already established for that.

On behalf of IR-4, I can\'t reiterate enough the cost of trying to
implement the data retention systems, and to try to revamp the data
collection systems over time is an enormous expense on a program that we
currently -- we have very limited funds. When trying to accomplish a
grant-funded program and trying to be as efficient in that program and
having a requirement such as CROMERRR placed on top of us, the
efficiency that we would lose would just be enormous.

Robin Roberts: Could I see a show of hands of those in favor of
decoupling? I\'m not sure who wouldn\'t have their hands up. And the
whole notion of a work group to work on a narrow issue of doing a
time-sensitive security or fraud provision? Are there any other
comments? There\'s one over here and then after that we\'ll probably
take a break here.

Paul Toll: I\'m Paul Toll with the Bayer Corporation. Just kind of side
with what Charles said earlier and Tammy just said, I think even if we
aren\'t going to decouple the records part of it from the reporting and
signatures, I think all these companies or at least \[Federal
Insecticide, Fungicide and Rodenticide Act\] arena are pretty much
global companies. We\'ve got work that\'s going on over in Europe, even
for registrations here in the U.S. To have a different set of rules here
in the U.S. than what they have in Europe is very troublesome, and the
harmonization of those types of situations would be very beneficial. I
would suggest that you also look and see what \[Organization for
Economic Cooperation and Development\] has already in this arena.

Robin Roberts: There are a couple of options here. We could take a break
now or we could go to the next section here, which is what special
interests are raised by CROMERRR criteria for long-term archiving. I\'ve
got a feeling we\'ve kind of hit on that already.

Before we come back for that, why don\'t we break now. It\'s just been
suggested that in addition to just the issues that you\'d like to
comment on regarding electronic record-keeping, if there are other --
the other sections of the rule, A, B and D, that you\'d also like to
comment on, we\'ll have a brief period of time for that later on in the
day before we recap everything at the end of the meeting here. So keep
that in mind. So if you have something on your mind that you\'d like to
say that doesn\'t fall within the scope of this meeting as defined by
the agenda, we\'ll have an opportunity for you to say your piece. Let\'s
take a break for fifteen minutes, that means we come back at ten to
three.

\[End of Tape 2\]

\[Tape 3 of 3\]

EPA, Unidentified Male Speaker: I heard these from a couple of people
and I just want to see how other folks feel about these. We had one
suggestion and I also received a lengthy written comment about the idea
of basically substituting the e-sign criteria for record-keeping, which
I think Mr. Duvall read to you here a while ago. It basically says
accuracy and accessibility and describes a little bit, a few sentences,
about what that might be about. So I wasn\'t clear whether your
particular suggestion was just substituting those criteria for the ones
that we had. I did have a written comment that suggested doing that. I
was just wondering, from kind of asking other people in the room what
they think, whether that would be useful, appropriate, helpful, too
general, whatever.

Mark Duvall: The e-sign legislation I think is an appropriate model to
think about. I don\'t think we\'ve thought about it hard enough yet to
say this is the right answer. But it certainly is suggestive that a less
detailed, less regulatory approach might well be sufficient.

EPA, Unidentified Male Speaker: One of the reasons perhaps for doing
that, if we were to do that, is that because e-sign specifically
excludes reports specifically designed in response to a federal
requirement from those requirements, right now e-sign doesn\'t apply to
that kind of records or those kinds of record-keeping. So this would
essentially bring those requirements, which are fairly general but
important, that would bring those into the record-keeping for EPA. Any
thoughts from anyone else?

Robin Roberts: I\'d like to encourage any other comments from any of you
who are familiar with e-sign legislation and the difficulty perhaps in
extending it to EPA-required records.

Unidentified Male Speaker: Just from what I heard about e-sign as it was
being described, it sounds as if that would apply more logically if you
need to apply something on the reporting side. I think it\'s still a
separate issue whether anything at all is needed on the record-keeping
side. I\'d still draw that distinction.

Mark Greenwood: One thought, this really is in the nature of a question.
I think we all would be curious to see how other parts of the government
are responding to the \[Government Paperwork Elimination Act\]. We know
about the \[Federal Drug Administration\] requirements, I think you\'ve
heard a lot of people expressing deep concerns about how those are set
up. But after all, the \[Government Paperwork Elimination Act\] is a
government-wide requirement. I\'m curious how other agencies are trying
to deal with these kinds of issues. There may be some other models out
there that will provide some consistency that would be useful to look
at. I would just pose that, if you know, and if not that\'s a good kind
of action item to go look at.

Howard Krueger: I do support e-sign as another model, which I think is a
valued alternative. What I think we ought to consider is put that on the
table adjacent to the CROMERRR nine criteria and then let EPA in
particular identify areas in e-sign where they find that it may not
measure up to the standards or the need that they have. So e-sign may
not be a perfect answer, but I think if you were going to try to solve a
problem and you had to pick one or the other, I would certainly vote
that you pick e-sign. But we could work and make it even better, I
think. I don\'t think it\'s the answer in and of itself.

Mark Duvall: Responding to Mark Greenwood\'s inquiry about what are
other federal agencies doing under the Government Paperwork Elimination
Act, the Government\[sic\] Accounting Office in September 2001 did an
update on what other agencies are doing. It\'s interesting that with
respect to high-risk transactions, and this is mainly a reporting issue
rather than a record-keeping issue, twenty-two different agencies had
identified high-risk transactions, a total of 249 high-risk activities.
So twenty-two other agencies have gone through the kind of risk
assessment that \[Office of Management and Budget\] called for. Of those
249 high-risk activities that were identified by these twenty-two
agencies, forty-three or 17 percent of them, the agencies planned to use
the electronic transactions, electronic reporting option anyway.

So it\'s clear that outside of EPA, there is a process going on, more to
greater or lesser degrees, of considering whether fraud is a concern in
particular applications, identifying those applications where it\'s a
concern and then making a reasoned decision whether or not additional
protections are needed to prevent fraud.

I might also mention that the National Archives recently, December 10,
2001, put out a report on current record-keeping practices within the
federal government. The bottom line there was that government agencies
are not prepared themselves to keep records electronically. If I could
just read a couple of sentences. \"Technology tools for managing
electronic records do not exist in most agencies. Despite the growth of
electronic media, agency record systems are predominantly in paper
format rather than electronic. Virtually every agency visited\" -- and
there are 150 agencies covered in this report -- \"indicated that the
official policy is that their records will be maintained in paper
format. The predominant e-mail policy is to print out e-mails that are
considered records and to save the paper copies. The chief paradox of
today\'s federal records management is the disconnect between paper and
electronic record-keeping.\"

So if EPA is asking industry to keep records electronically for very
extended periods of time, it should do so with the recognition that the
federal government itself is having a very difficult time grappling with
the same problem, given all the federal government\'s resources. When we
consider that small businesses, states as well as medium and large-sized
companies are covered by EPA record-keeping requirements, it\'s worth
having considerable pause about imposing long-term archiving
requirements that the federal government itself is having difficulty
meeting.

Unidentified Male Speaker: I just want to cite the \[Securities and
Exchange Commission\] EDGAR system and the filing that\'s done, which is
a lot of security\'s required for the securities filings that are done
at the \[Securities and Exchange Commission\]. They\'re on to their
third generation of technology and in fact, the reporting that\'s done,
you can pull the software off of the web site that facilitates the
electronic filing of submissions. That is one model I think that should
be considered with respect to certain programs. The thrust of CROMERRR
on some level is to facilitate electronic reporting for many different
reasons.

I think a useful model is what the \[Securities and Exchange
Commission\] has done. In fact, the software that they\'ve developed to
address the e-sign issues and other issues, some of which get into the
audit trail capabilities but do not require record-keeping independent
of this mechanism for electronic reporting, the software they provide
from their own web site.

Unidentified Male Speaker: I do have another question but I just also
want to respond to Mark\'s comment a minute ago. We contributed to that
report, or we contributed our \[Government Paperwork Elimination Act\]
analysis along with other agencies. One of those high-risk reports was
ours, that we are collecting electronically risk management plan, as an
example of that kind of report for those of you that are familiar with
that. But that really does refer to electronic reporting, those
high-risk areas. So it doesn\'t really refer to the record-keeping part
of it.

I guess I would also say yes, another part of our office, not my group
but another part of our office of information collection is in charge of
record retention for EPA. They\'re struggling with many of these very
same issues.

I guess the thing is that I think maybe either -- what you said was that
if EPA is requiring people to keep electronic records for long periods
of time, then we need -- what we\'re really saying is you can keep paper
records if you want. It\'s just that if you\'re going to keep electronic
records, there\'s some requirements that should be associated with it.
So it\'s not that we\'re saying you have to keep electronic records but
we don\'t know how to do it. We\'re saying if you want to keep
electronic records, here\'s some requirements that should be associated
with it.

There\'s another option that was I think raised by a couple of people
earlier, was that rather than focus on something like an audit trail
requirement that maybe it would make more sense to do something like
have people document what their system is for ensuring integrity and
accuracy for their records. I thought that was kind of an interesting
idea because you could attach that to a more general kind of performance
requirement and then people just sort of -- it would allow variations
depending on people\'s different approaches or different software and
stuff.

So I thought that was kind of an interesting idea, but I also -- I had
as an old paperwork reduction person, I was also concerned about what
that might mean for companies in terms of costs and in terms of a new
sort of document that people would have to create. So I was also just
interested in getting some kind of broader thinking about that idea. I
think it was John Chellen and somebody else originally suggested that
this morning, that some kind of documentation system for how you
preserve and protect your records might be a better substitute for some
kind of thing, rather than like an audit trail requirement. Any other
thoughts about that?

Robin Roberts: So alternatives to the audit trail requirement. Who had
raised that point or who would like to speak to that point earlier?
We\'ve all noted that audit trail as stated in the rule is pretty
cumbersome and this is a way that we could suggest that they be
documented and preserved, protected.

Jim Scialabba: I recommended earlier a record-keeping management system
be substituted as a performance standard rather than prescriptive. In
fact, I believe probably every company in here already has a written
records retention policy in their company that would serve as a platform
from which a record management system document could be developed. In
fact right now I have some of our corporate attorneys who wrote the
original record retention policy looking at the implications of CROMERRR
on our internal records system. So I don\'t think it would be all that
cost-burdensome to companies. Again, I like the fact that it would allow
for the inclusion of innovation in technology, where a lot of times we
wouldn\'t even have to change our system. We would just incorporate new
technology, as long as it met the minimum criteria of the performance
standard that EPA would outline for us.

David Schwarz: Just a question. A number of people at this meeting and
actually a number of people at preceding meetings mentioned the
\[Organization for Economic Cooperation and Development\] standards.
Those standards are I think very interesting and we\'ve looked at them.
I guess I\'m curious, and this is a question you could answer now or you
could give us comments, but I think we\'d be very interested in knowing
to the extent that you think the \[Organization for Economic Cooperation
and Development\] consensus document standards represent an approach.
Can you sort of identify the universe of records that you think they are
best applied to?

Also, I did note I think when I read them that they do in fact involve
an audit trail requirement, which is something that a number of people
have found objectionable. I guess I\'d be curious to know why it is that
in the context of the \[Organization for Economic Cooperation and
Development\] standards the audit trail requirement is really not
objectionable, yet it seems to be objectionable in the context of
CROMERRR.

Jamie Conrad: Just reflecting on the sort of management systems approach
or the document your system type, I guess I can think of it at sort of
two levels. One would be, there actually would be an affirmative
requirement to maintain some sort of a records management system which
maybe would be part of your record retention policy, that would specify
the things you do. The other might be, and that would be sort of
performance oriented.

Another, maybe more streamlined approach, which I guess is the e-sign
approach, would be not to specify that requirement per se but to say
that you have to have procedures or mechanisms, systems in place to
ensure that your records are maintained accurately and with integrity
and so on. But what you specifically had to do in your specific case,
given the particular record in case, would be sort of done on a
case-by-case basis.

If someone came to you and challenged you or there was an investigation
or enforcement case involving the legitimacy of a record, you would have
the burden to substantiate what you did in order to meet that
requirement. But it would be a case-by-case thing as opposed to saying
here\'s the specification for your records management system, show me
how you meet each of these ten elements. So I think you could do it
either way under this framework of a performance-oriented approach.

Robin Roberts: Now we\'ll go on to this question of \[Organization for
Economic Cooperation and Development\]\'s audit trail provisions not
being objectionable, but perhaps CROMERRR\'s being objectionable.

Kathy Barrowclough: I think that one of the points in response to Mr.
Retzer, I believe that the \[Organization for Economic Cooperation and
Development\] principles issue that was raised was as an alternative in
some cases to offer another option of printing out, and not to make it
so that that would be the answer. That would be my read, anyway. Also,
recognizing that that only applies to one kind or type of record or
regulated entity within the EPA community, because indeed those
\[Organization for Economic Cooperation and Development\] principles
relate to the \[Good Laboratory Practices\] community and they do not
relate to the rest of the environmental monitoring community.

Mark Duvall: As a follow-up to that, the \[Organization for Economic
Cooperation and Development\] principles that we\'re talking about are
\[Organization for Economic Cooperation and Development\] good
laboratory practice principles, which the \[European Union\] has adopted
as \[European Union\] \[Good Laboratory Practices\]. They have two
provisions of note. One is, they do have an audit trail provision; they
also allow paper copies. Today, EPA\'s \[Good Laboratory Practices\]
regulations have an audit trail requirement and allow paper copies. The
concern here is that the parallels that exist between the
European/\[Organization for Economic Cooperation and Development\]/U.S.
provisions will be disrupted by changing the U.S. requirements to
disallow paper copies. The reason that audit trails are not an
overwhelming concern under the \[Organization for Economic Cooperation
and Development\] principles is that they are a requirement in all those
jurisdictions that either endorse the \[Organization for Economic
Cooperation and Development\] or the U.S. requirements. The U.S. audit
trail requirement in the \[Good Laboratory Practices regulations\]
appears at 40 CFR, Section 160.30(e). There\'s a corresponding provision
in the \[Toxic Substance Control Act\] \[Good Laboratory Practices
regulations\].

So there is a provision now for audit trails in the \[Good Laboratory
Practices\] context. But it\'s limited to the laboratory context and
it\'s limited not only to laboratories but to laboratories conducting
studies under \[Good Laboratory Practices\]. So it\'s quite limited.

Charles Reese: I wanted to clarify a little bit more about the
\[Organization for Economic Cooperation and Development\]. Obviously
when we read the \[Organization for Economic Cooperation and
Development\]\'s, they seem to have a more practical approach. Sometimes
Europeans are always, what can you really do, versus what do you think
you should do approach. But we have to make sure we\'re also talking
apples to apples here, because I don\'t think the question was should we
not require audit trails whatsoever \[brief noise interruption\].

It\'s not a question of not having an audit trail in some cases, but
again we can point out here that this is a \[Good Laboratory Practices\]
setting, and also we\'re also talking about in the Part 160 there\'s
fifty-seven different types of records that one can have. In an audit
trail system in the \[Organization for Economic Cooperation and
Development\] system and listed in the good automated laboratory
practice systems, GALP, they involve laboratory information management
systems. Therefore data collected by the computer system that\'s
transferred through a computer network and somehow has the opportunity
to be manipulated through that computer network to where it finally
resides. The GALPs require an audit trail, so anyone doing work for the
EPA has to apply the GALPs.

I don\'t think the question here is we\'re concerned about -- because
taking away the audit trail, if you\'re in that situation where you\'re
following these specific guidelines that you have to have an audit
trail, in a \[Good Laboratory Practices\] setting I think we\'re saying
we\'re okay with that. The \[Organization for Economic Cooperation and
Development\] gives you the out here that you can have a different
medium if your system becomes obsolete. But that\'s outside of --
there\'s 95 percent of the rest of the country that\'s dealing with
environmental monitoring under Title XL that\'s not a \[Good Laboratory
Practices\] setting. I think those are other concerns when it comes to
dealing with audit trails. So from my particular aspect, there\'s not a
problem with audit trails under those specific circumstances, LIMs,
laboratory information management systems.

Unidentified Female Speaker: Just one other point on that same issue is
that that is related as Charles just mentioned to the laboratory
information management systems. What CROMERRR will do is broaden the
records that would be managed that way to include indexing systems and
SOPs and training records and all of those sorts of things that are not
the laboratory information management systems that are collecting data.

Robin Roberts: Great. Were there any other options that you wanted to
elaborate further on, Joe, that you heard about alternatives?

Joe Retzer: No.

Robin Roberts: Then we\'ll turn to the next section of the agenda.
Although these issues may seem or we have talked about them, it seems
that right now with archiving, current practice among companies is to
print the paper or to take an electronic snapshot, somehow image the
data and file that. That\'s what we seem to have heard. This section is
intended to kind of delve a little bit more deeply into your current
archiving practices. So the question I guess before us really is, is
printing the paper and archiving that and entrusting the paper to an
archivist who has a duty of care to maintain that record beyond the life
of his employment, is that the way that archiving is done? Or it\'s
snapshot imaging, the data now and then perhaps printing that paper, the
way that archiving is done now?

Charles Reese: Sorry if I seem like I\'m talking forever here today.
Yes, with the archiving issue, the paper record is, the printout to the
paper record is the current practice in the \[Good Laboratory
Practices\] setting. I just wanted to point out, also with what Kathy
\[Barrowclough\] said, that if you include e-records to be everything
and you require and we\'ve changed our definition now of what original
raw data is, you have to keep this original raw data for the life of a
registration, which can be a very long time, we\'re talking decades,
especially if companies merge, products get sold various places. The
kind of conditions that we can run into is virtually having to take that
electronic record and migrate it from a platform A to platform B to
platform C over time, if we don\'t have that \[Organization for Economic
Cooperation and Development\] out that we were given.

I want to point out, and I can probably provide for you later, at the
ACS meeting in 1999 in Chicago, there was a team of lawyers there
talking about the migration of electronic data and the problems with
that. They suggested that for every migration that you do on a data
system, that you run the risk of losing between 3-5 percent of that data
as you move from platform to platform. They said that virtually no
matter how hard you try, no matter how much effort you put into
validating and to make sure you catch every little piece as you move
from one platform to the next, you will invariably lose between 3-5
percent of that data.

If you\'ve got fifty years to go, by the time you\'ve migrated to that
fifth platform you have a possibility of losing 25 percent of the
original raw data. There\'s a significant issue there of compliance, if
something as you migrate becomes completely irretrievable. So far we
don\'t have solutions or answers to these questions yet that we can feel
comfortable with, outside of printing out.

Robin Roberts: Migration, loss of data over migration through different
generations has been something that\'s come up in our other meetings.

Unidentified Female Speaker: I\'d like to first add a couple additional
issues before I address these. Just basically the maturity of the
technology today does not allow businesses to comply with CROMERRR as it
is written. There is the possibility to be able to archive and manage in
all kinds of realms, long-term, bringing it back, all that kind of
stuff. Translation from machine language or databases or whatever to
human-readable forms or the ability or some form of archive and the
migration of this information from legacy systems to newer systems, now
introduces the concept of copies of data. They are no longer the
original raw data files, they are copies. So what are the conditions
that CROMERRR will address for that?

Another one is media degradation. Media doesn\'t live for thirty years.
You have to continually retrieve it. Now you\'re making another copy of
it, you\'re bringing it back to something, you put it on new media and
you\'re shipping it out for storage again. Again you\'re making another
copy of it. This has nothing to do with retrieving it, trying to read it
or anything, this is just maintaining it long-term.

One of the ones that was mentioned before, I\'ll just bring it up again,
is setting the retention periods for electronic records rather than
imposing existing paper requirements on the electronic records. Again,
one size does not fit all for the definition of archival. We need
definitions for archival requirements for the different types of systems
and the different electronic record-keeping systems that are out there.
This is kind of in the realm of the data collection versus data
manipulation and all the way down to, for example, a two-year study. A
two-year study could produce 500-800 megabytes, but one analytical
method development can generate 4 gigabytes of data. So there\'s
different quantities, there\'s different conditions that are needed
depending on where the data is being collected. So this might take it
down to a program office level to be able to determine that.

The last one is study reconstruction in the original environment. If a
product goes to market for thirty years, in thirty years I\'m supposed
to reconstruct my original environment to bring that data back? That\'s
almost impossible. So we see those as big issues for long-term
archiving.

One of the additional comments against an issue that you have listed is
that I just wanted to concur with what was said earlier about the loss
of data between whenever migration occurs or going from one medium to
the next. This doesn\'t have to do with losing data because of some type
of inadequate conversion, but because of the cause of technology
changing. So it\'s not that the systems weren\'t validated and the
actual data when it was migrated there was just pieces that were dropped
off the end of the earth, it\'s the fact that physically it\'s not
possible.

Paul Toll: I just wanted to reiterate something that was said earlier
and bring it into the current discussion. At least with Bayer
Corporation, we do a lot of contracting out of work. To assure that we
have the raw data, at least have the data in our house in case one of
these contract \[inaudible\] go out of business, we always ask that all
the data be sent to us instead of having it archived at the contract
facility. Like I think as Charles \[Reese\] said earlier, we may not
even have the same software or same hardware that this data was
generated on. So we get paper printouts of the raw data and we archive
those. So if we\'re going to have to try to archive completely in
electronic form, it may be impossible to do.

Bill Barta: I just wanted to share an experience with migration. I\'m
not an IT person, I\'m quality assurance, but just to give you a
qualitative description. We migrated some images, 100,000 images from a
VAX to an NT server. The problems we had was corruption of files, there
were old images. Secondly, another thing that happens is we went to a
different platform, the software we were using, which was old and no
longer supported by the vendor, developed a glitch in the search
mechanism. The vendor does not want to help us fix it because they no
longer support the product.

Another area you need to be aware of is that even though manufacturers
like Sony say that their optical disks last fifty years, that\'s a
projection they made. If you bought optical disks in 1992 and the head
that reads the disk broke, it was probably proprietary and you can\'t
find another one to read that information. So you would have a problem
moving it to somewhere else to read that information.

The issue of degradation of media and software compatibility is a very
large one. There\'s probably no way you can avoid some of these issues.
So the requirement that you maintain functionality becomes highly
problematical, because if the software changes, the vendor changes it to
improve it, and you\'ve lost something that you consider critical, there
is really nothing you can do about it. In theory, the agency will come
in and say you\'ve done something really bad and punish you for it. So
that\'s the scenario I see happening.

Tammy White: My name is Tammy White, I\'m with the IR-4 program with the
USDA-ARS \[US Department of Agriculture, Agricultural Research
Service\]. One of the problems in addition to the things that have been
reiterated here about data degradation, the media degradation and
things, in our lab in particular doing the chromatographic analyses,
just in the short period of time that I\'ve been doing this work
instruments go out of -- the vendors don\'t support them anymore and you
end up with a media that can only be run on a particular instrument. You
can\'t open the data from the chem station without having the instrument
attached to it. So you\'re talking that we\'d have to archive
chromatographic equipment as well as computer equipment and software.

Then you run into the problem of if the chromatograph doesn\'t function
because a board goes on it or something like that, the vendor isn\'t
supporting it anymore, you can\'t get the part, you can\'t turn on the
instrument. Therefore you can\'t even get to the software and get
something that\'s functional. So being able to make that paper copy
under the \[Good Laboratory Practices\] is very important to our
laboratory in particular, just for being able to archive beyond the
timeframes of an instrument surviving. Thank you.

Frank Miller: Just a couple of feedbacks on this long-term archiving,
mentioned before but just quickly go over them again. The storage media
and dealing with its obsolescence and so on is something that is
reasonably achievable. It\'s not the easiest thing to do, but you can do
it and you can do a validation and you can work that. I guess the issues
you run into are eventually getting to a point where the first recording
of data is really not available anymore and you have to live with the
subsequent generations of that.

Around the area of meta data and e-signatures and connecting that up to
the actual electronic record, that\'s really the technology and so on is
fairly new, the whole concept of meta data and so on. I don\'t think
there\'s really good evidence of tools and applications that have really
adopted that in the way that you\'re intending to move towards. It\'s
too emerging, too new technology. Certainly it\'s conceivable that we
could work in that direction, but nothing off the shelf really that\'s
at that grade of that today.

Then the other area that\'s really an issue is just the whole concept of
application obsolescence and migration, and the ability to reconstruct
the application that you originally had and be able to preserve that.
Unless we can work towards vendors that survive over the long haul and
they eventually take over the marketplace in these areas, it\'s going to
be difficult if not impossible to keep those applications and that
business logic and all the things that surround how the electronic
record was created for long retention periods.

Mark Greenwood: I want to reinforce a comment I made earlier, because I
think this archiving issue really does highlight the fact that we need
to look carefully at the underlying retention periods and record-keeping
requirements themselves. I think everybody views this as inevitability
that we\'re going to be more and more going to electronic records.

There are these archiving problems. We are often looking at reporting
and record-keeping requirements that are a quarter-century old, that
were not carefully thought of -- having been involved in some of those
myself -- at the time. It is a time to really go back and start looking
at some of those and ask the question, how long do we really need to
know this? What do we need to know about something that happened twenty
years ago? What is the value of that for us today in terms of managing
the environment? I think that\'s a fundamental issue that I know you
can\'t do as \[Office of Environmental Information\] by yourself, but
it\'s an issue that\'s inevitably going to have to be part of this
discussion.

Mary Catherine Fish: Mary Catherine Fish with MCF Consulting. I think
that this archiving criteria may also go to a point that\'s come up in
different forms, which is the difference between possibly the intent
that the record-keeping requirements would not create additional
record-keeping requirements, and the perception that it in fact creates
a whole slew of new record-keeping requirements. Which is that the
archiving criteria as it\'s written requires that the archiving records
include the context, the meta data, the audit trail. So for every --
where you previously had one requirement to preserve a required record,
you now would have many. So there\'s an exponential increase of the
requirement, because of this part of the wording of the archiving
requirement.

So that\'s one mechanism that leads to the problems that people are
encountering, as part of what makes this so big. It\'s an actual -- we
can go back to the basic argument over whether it\'s voluntary or
mandatory, I won\'t get into that. But this archiving criteria, I think
is really one of the concrete ways that makes this proposal a great
expansion of what\'s currently required. I would think that that would
have ramifications all down the line in terms of \[Information
Collection Rules\] and any other kind of analysis that EPA is going to
do about how onerous or burdensome its record-keeping requirements are.

Mike Penders: This discussion has illustrated to me just that the
record-keeping requirements are not, should not logically function as a
condition of electronic reporting per se, but pertain to the precise
programs and technologies and monitoring that are relevant to keeping
records under record retention requirements, statute by statute, program
by program.

Really I think it has brought home to me the importance of decoupling
these notions and letting record retention evolve with technologies,
program by program, that meet the fraud concerns and other concerns with
reference to the technologies, audit trails, that are particular to the
testing, monitoring, equipment and forms of auditing that may be
required under those programs, but do not relate back as a condition of
electronic reporting per se.

Jim VanHorn: One of the things I don\'t understand what information
technology means and I don\'t speak IT, but I have been through three
major mainframe computer changes in the positions I\'ve been in,
production, quality and environmental. I have been through one complete
merger of two companies and they had completely different systems that
they were dealing with and their process on it. Each of those forced
things on it required a year or a year and a half of pre-planning, then
there was the implementation of crossover on it to do. As a general rule
it was a year before they were stable. In every instance on that, we
still had things in that, with all of the planning and as much input as
was put into it, that would not transfer.

So this is just an example of some of the things that I have been seeing
that go through that point out the problems in why you\'re not going to
get 100 percent transfer when you go from one system to the other. I
just know for a fact it has happened that way.

I still have the question that I have not understood the \[inaudible\]
of it as to what the magnitude of this is going to be for Smurfit-Stone,
is just what records and data and all are we still including in this? Is
it everything in our facility that has -- I can even back up to this far
point on environmental related? Or is it really the final reports that
we submit that must be maintained in this record system? If it is, then
it creates a much less of a concern with us than if it does have to be
all the way back to the individual data that\'s collected throughout all
of the processes.

Henry Bartholomew: Just an observation on archiving in general. I work a
lot with folks in our accounting area of our companies. We\'ve run into
the same discussion, for example with \[Federal Energy Regulatory
Commission\] and the \[Securities an d Exchange Commission\], on
long-term archiving and migration and so forth. Whether people need to
keep records on paper or electronically, it comes as you\'re hearing at
a significant cost. It\'s cost of space, memory if it\'s computer. It\'s
cost of the software, it\'s cost of personnel to do that.

I think putting this as a third issue and having focus on the individual
program areas, the key question starts with what information do
companies need and does EPA need and for what amount of time. If the
\[Internal Revenue Service\] for tax purposes and bring in the money
that runs government can get along with limited timeframes like five to
seven years worth of data, maybe that\'s where we ought to be thinking.
Again, distinguish between report information that\'s provided EPA and
\[inaudible\] of reliability for that versus internal information that
may lie behind that but be necessary to company operations. What EPA
should be focusing on is the former, the reporting side, but not all the
other information that goes in the company.

So several things come out of that. Look for short timeframes, do it
program by program, look for minimal archiving and record-keeping
long-term requirements, distinguish between what you need to
substantiate on the reporting side from what companies need to do their
internal operations and stay the heck away from that. Keep it as short
as possible, recognizing cost. I think having it as a separate exercise
makes a lot of sense.

Robin Roberts: We have at least one more comment. I would just like to
say that the war stories have been great, they\'re all edifying. But I
would like to turn at some point towards a more solution-oriented
sharing of experience. Where have you made the change? We\'ll just segue
into the last part of our agenda, if we can make that transition.

Carolyn Greenwood: Most of what I was going to say was just said, except
that I just want to add that you need to remember that when people --
we\'ve had some examples of companies that have to keep a lot of data
one way or another. They\'ve decided, when they come to us they say --

\[End of Tape 3, Side A; Side B begins\]

\-- they have to manage all this stuff on their hard drive. Their system
tends to get slower, they get more frustrated with the system itself. It
makes it more tricky for the software folks to design a system that will
be more efficient, because it\'s dragging all this data along with it.
So to kind of confirm or second one of the things that was just said, I
think program by program is the way you want to do this. Some people
need to keep lots of data and some people don\'t. It would be real
unwieldy for some folks to have to keep a lot of this data, only because
you wanted to have it consistent across all the programs.

Kathy Barrowclough: I guess in response to what Mr. Roberts just asked,
get away from war stories and what would be potential solutions. What I
believe I\'m hearing is we don\'t have solutions to the archiving
issues, to the long-term archiving issues. There are issues and we
recognize that, but we don\'t see solutions. One of the potential
solutions is really to look at the archiving requirements, the record
retention requirements, and maybe reevaluate those.

Charles Reese: But I like war stories, and what better way to give you
an example. One particular example just springs to mind. It was a
brilliant idea to create a document management system so that people
could share reports throughout the company without having to physically
go find where the report was filed. So a scanning mechanism was put in
place to scan 300,000, 600,000, 1.3 million pages of documents it
suddenly turned into, as they thought this was going to be a great idea.

Halfway into doing this system, the company that we had had the
proprietary software, set up our system, was purchased by a larger
company. That company said, that\'s okay, we will continue to support
the older system. Which lasted a year, and the older system went away in
favor of the -- it was a competitor buying a competitor, now they favor
their system. It literally left our document management system in the
lurch. To purchase new system software and reconfigure, it actually took
a manual transfer along the lines. Right when we got finished with that,
another merger happened and you see where this is going.

The potential for mergers in the software industry and the drop-off of
support are another part of this angle that you worry about when you\'re
trying to migrate data and move it forward and keep it for the life of
the record retention period that you have to keep it. You may lose
support over a period of time that forces you into a different scenario,
that raises your costs and changes your platform and creates frustration
across the board. You may actually reach a point where it simply can\'t
be done anymore.

Robin Roberts: I\'d just be curious, Carol \[sic\] \[Greenwood\], not to
put you on the spot, but are there any success stories you\'ve run
across? You just mentioned that you have successfully migrated
information from databases, old ones, and they\'ve become unwieldy and
slow. But is there some really sleek operation that\'s -- finding your
financial statement as an example of why someone would hire your
corporation?

Carolyn Greenwood: We\'ve done lots of good things. I don\'t want to say
this is always -- I could come to a meeting like this and say, make it
as hard as possible, because it just means more business for us. But
obviously what we want out of this is something -- we\'ve got lots of
stuff on our plate already, so I\'m not begging for business. What we
really want out of this is a clear rule that\'s reasonable for everybody
to work with. We don\'t want frantic customers coming to us with
emergency needs anymore than they want to be a frantic customer.

We have lots of success stories. We\'re confident we can do whatever
comes out because we know there\'s enough checks on the system that you
guys won\'t go too crazy with what you\'ve proposed. But I think the
bottom line of it all is yes, the things you\'re talking about even now
could be done. But do you really want to do that to these folks? We can
do that kind of stuff, we can technologically speaking do what you\'re
talking about, all the different things you\'ve talked about doing. But
it means a big burden on a lot of folks in this room.

Frankly, we don\'t even have the manpower to do some of what it sounds
like you\'re talking about. If all our customers came to us and said,
all the utilities and state agencies and local agencies came to us and
said, make us CROMERRR-compliant, in its worst scenario of what I\'ve
heard today, we would just scream and throw up our hands and go, slow
down, wait, how long have we got to do this. It would be a lot of work,
so I know it would be a lot of cost for them.

That\'s not to say we can\'t. We have done a lot of successful
migrations. We\'ve updated a lot of Part 75 systems, acid rain systems,
where the way we migrated the data was through EPA\'s format. If it was
another vendor and maybe they went out of business or whatever, we would
take EPA\'s format as the common ground and bring that up into our
system. There\'s ways that you can do this stuff, but I don\'t know that
that\'s the question here. Maybe I\'m misunderstanding your question.

Robin Roberts: So the glass is definitely half-empty? No success stories
at all, no hope on new technology delivering us from this paper
conundrum.

Frank Miller: A comment on the new products or emerging technologies.
Some thoughts around the idea of where we might be able to get some
opportunity. I think the current environment for environmental health
and safety information systems and so on is somewhat fragmented and
there\'s really no Goliath in the marketplace. Probably the same appears
for the services that one might buy around information services, again,
specialties and niche-driven, maybe no large vendor that can own it all.

There appears to be some good movement in the enterprise business
systems area where potentially that may be able to help with these kinds
of requirements. Software vendors, there\'s a couple, reasonable amount
of fairly big software vendors that operate in this area. Many of them
appear to be implementing or have already implemented environmental
health and safety modules that integrate across the enterprise and take
advantage of information.

Almost all of them are working in the area of e-business type
technologies to make sure that their systems can play in that area and
can offer some technologies to help meet some of these requirements.
Many of them either strive for, have methods for factory-floor
integration or other kinds of lower-level instrumentation or systems
integration.

Ideally for us as the regulated would be to try to get to more of a
single system approach, to come into compliance with these kinds of
requirements. To have sort of a one data source approach to this. It
would be better for us to really work with a software vendor to come
into compliance with this, like our Year 2000 compliance, coming and
making sure we were prepared for that. For example, when the euro
currency was brought upon us we counted on our software vendors to help
us get there and really didn\'t have to do too much with internal
software to have to come into compliance.

That\'s sort of what we would keep our eye on if this rule passed and we
had to come into compliance with these kinds of requirements, to see if
we could move in that direction. However, I don\'t think anybody has a
lock on this, from what I can tell.

Mark Duvall: The \[Federal Drug Administration\] has a web site relating
to Part 11. In that web site are presentations to \[Federal Drug
Administration\] by a variety of vendors. These vendors promise much.
They have lots of products for sale. They are all addressing the Part 11
requirements, which as we know are very similar to the CROMERRR
record-keeping requirements. These solutions by and large are untested,
unproven. They would need to be validated. They would need to be
validated not only as a piece of software available for sale, but more
significantly perhaps they would need to be validated within each
user\'s computing environment. For adaptability, compatibility with
existing systems; for integration with other kinds of systems, so that
information can flow freely throughout the enterprise.

The first thing to be said is, are there emerging technologies? Yes, and
there are a variety of companies that would be glad to sell them to us.
But one, they are unproven; two, they\'re very expensive. When you
consider the wide variety of electronic records being kept that would
come under CROMERRR, any one solution will be inadequate to address the
totality of the problem.

For example, there is a vendor who has made a presentation to \[Federal
Drug Administration\] claiming that they can attach an audit trail to
Microsoft Excel. Maybe they can. Up until just a few weeks ago, their
product was listed as being under development. They claim it\'s ready or
almost ready. Maybe. Maybe it is, and at some point it will be,
presumably. But a solution that works for Microsoft Excel doesn\'t do a
darn thing for software other than Excel. When Excel files are
integrated with other information, electronic information, the fact that
the Excel piece has an audit trail on it doesn\'t do a thing for all the
other pieces of the complete package of information that doesn\'t, for
the rest of it doesn\'t have an audit trail.

So system-wide solutions are what\'s needed. These are tremendously
expensive. Dow has been looking at these system-wide approaches to
things, has been pricing them. We consider that it would cost easily
between \$50-100 million for Dow to buy a system-wide approach, assuming
it would work. Those costs include not only the costs of the vendor, but
significantly greater costs within Dow for the cost of validating and
integrating them into the Dow system. Training the people in how to use
them. In addition, storing the information.

If you\'re talking about audit trails, you\'re talking about storing
meta data, potentially for many years. The whole idea of memory is you
store as little as possible as efficiently as possible. If we have to
store electronic records longer than we would normally choose to do so,
and we have to store meta data along with the original information, then
our storage requirements increase by a large degree.

So I think the bottom line is, if we can put a man on the moon, if we
can solve the Y2K problem, then yes, we can figure out as a society a
technical solution to archiving electronic data. The question is, is it
appropriate in the context of a record-keeping statute, a record-keeping
regulation, promulgated under an amendment to the Paperwork Reduction
Act, to impose on private industry the immense technical problems and
costs associated with implementing emerging, possible, untested
solutions. My response is no, that\'s not an appropriate allocation of
responsibility.

We see the federal government itself tackling this problem. The National
Archives is very concerned about government agencies archiving
electronic records for extended periods under governmental archiving
requirements. The government agencies have not yet figured out a
satisfactory solution. They have much better resources, the United
States government has better resources than any single company does. Yet
each company would individually be responsible for finding an acceptable
solution.

The magnitude of the technical and financial challenge for industry is
immense. Is the problem technically capable of being solved? Of course.
But should it be solved by industry in the context of a Paperwork
Reduction Act regulation? No. That\'s the wrong place for this problem
to be resolved. Possibly in the future, as new technologies have been
developed and established and proven and found to be efficient and
effective, then it might well be a good idea to revisit the question of
whether long-term archival electronically is an appropriate requirement
to impose on industry. But not until then.

Howard Krueger: I\'d just like to confirm from a cost-impact standpoint
that I did a rough assessment for Procter & Gamble. Again, we\'re a
worldwide company, we have over 100,000 employees with about half and
half international and U.S. We have thirty-seven plants in twenty-four
states. Just using the EPA numbers of \$40,000 per site per system to
acquire a compliance system, and then \$17,000 per facility per year to
keep things going, and that was just manufacturing facilities. Then
added to that all the records and compliance documents that we keep for
\[Federal Insecticide, Fungicide and Rodenticide Act\] and \[Toxic
Substance Control Act\] products that we make, my estimate -- and I did
a fairly careful analysis and I had a number of people contributing to
this. My assessment came out between \$80-100 million for our company.

Just setting that aside, the bigger challenge is that those are real
live dollars you\'ve got to come up with and there is no one budget that
can accommodate that kind of an impact in even a three to five year
period. It\'s kind of overwhelming in today\'s environment. So given the
current requirements, that\'s for a large multinational company, that\'s
what you\'re talking, which is validated by the comments that Mark made.
I hadn\'t known what his assessment was nor did he know what mine was
before we were here today.

Robin Rorick: Robin Rorick with \[the American Petroleum Institute\]
API. It\'s not just the system cost but it\'s also sort of having to
take inventory of the current systems, both assessing each application
and identifying the gaps between the functionality and each of the new
requirements. Sort of closing these gaps with custom system code, either
new software and/or add-ons to the existing software. Updating each of
the integration routines for applications integrated into other
information. Redeveloping the reports and the records in accordance with
changes made to the underlying applications. Updating the system
documentation and user manuals. Then conducting all the end-user
training. So it\'s not just the system costs for the archiving and
everything else, it\'s all the other associated steps and the costs
associated with that.

API hired a contractor to take a look and do a technical analysis of
this, and came out with a study that we will append to our written
comments when they\'re submitted. But the average cost per facility came
out to be about \$2 million. That was for a facility with just five
computer system applications that would have to be updated. In the end,
when they looked at the overall cost impact on the oil and gas industry,
they compared it to what had to be done for Y2K compliance. The estimate
of that was \$2 billion for the oil and gas industry.

Robin Roberts: Great. I would just recap some of the bigger issues I\'ve
heard here. It would seem to be there are a lot of concerns about the
audit trail and the gap between the current technology and what CROMERRR
is asking us to do. The issues raised by archiving, which are many but
which seem to be characterized mostly by rapid obsolescence of the
technology, the cost of it, the efficiency of it if it were to be
installed.

Some concern about the scope of the rule and the definition of terms
like electronic records and what exactly do we mean by electronic
record-keeping systems, and whether the time periods for which records
should be kept, although they may have been fine in the paper world, do
those apply in an electronic world where the media inherently degrades
over time. That goes to questions of migration and loss of data
integrity over different generations, how do you migrate legacy systems.

There also seems to be some concerns about anti-fraud, that if we should
have a workgroup to go of industry and EPA to look at these programs
that are at highest risk for anti-fraud. Maybe go after those first,
especially since that particular aspect of the rule wouldn\'t be
time-sensitive as would be compliance with the \[Government Paperwork
Elimination Act\] purpose sections of it.

As for alternatives, there seems to some concern about risk analysis of
the records, that we do a risk analysis to find out where an appropriate
solution may lie, the notions that the signature legislation with a few
adaptations could apply also to EPA-required recommendations. Then
again, there seems to be strong support for this notion of a workgroup
with EPA to come up with this record-keeping issue if it\'s decoupled
from the electronic reporting and gone at in a more deliberative and
risk analysis type of environment, where the enforcement or the data
security is commensurate with the risk of the program.

I would like to turn to the panelists and if possible have them recap
just the major things that they heard or respond to specific questions
that you heard or comments that were heard.

Joe Retzer: I think you did a good job of listing a lot of the things we
heard today, so I don\'t need to repeat those. I guess I just want to
thank you for coming and providing us these comments. I want to let you
know that I think they\'ve been very thoughtful. We haven\'t had a lot
of \[inaudible\] maybe inwardly you\'ve been shaking your fists, but
outwardly you didn\'t. At least the tone I think was one where we could
really hear what you were saying today and pay attention to it.

Our comment period continues until February 27, so please get your
written comments in as well. We also have another public meeting in two
weeks in Dallas. Obviously we\'re going to give very serious
consideration to decoupling the record-keeping part from the other, or
looking at possibly some other simpler or more straightforward kind of
criteria, as well as looking at modification of the ones that we have
here. So we\'ve got a lot of options in front of us, a lot of good
ideas.

I think we heard a new idea that I heard today was trying to do
something in terms of looking at the broader record-keeping requirements
themselves. That\'s really not a function of our office and information
office, as opposed to the programs who set up those individual
record-keeping and reporting requirements for their programs. But it may
well make sense to try and take a look at these broader record-keeping
requirements in terms of things like the longevity of a record-keeping
requirement that might have been set some time ago. For example, before
people were keeping records primarily in electronic form. So that may be
something we would want to take a look at as well.

Charles Reese: My only comment was, we\'ve talked about these workgroups
here. What are your plans as far as doing some actual field research to
-- because you\'ve asked questions about what types of electronic files
and what types of records that we here use. It seems to me that there\'s
probably some recognition to the fact that you didn\'t know of some of
the ways that we conducted our business. What would be your approach to
actually going out in the field and observing what actually is taking
place on a ground level, to see how people really are using these
records and to verify the things that you\'ve heard here today? What
approaches you may take prior to the end of the comment period or after
that comment period.

Joe Retzer: I guess there\'s two things. One is we do have some
contractor work going on to do some research into some of these areas.
That report will be available as part of the record, part of the docket
on the rule. The other thing is I guess you could invite us. If there\'s
something locally, some idea you have about us coming to see how you
keep records in your company, please invite us. We have limited amount
of time during the rest of the comment period, but if you\'ve got an
idea invite us and if we can arrange something we\'ll do it.

EPA, Unidentified Male Speaker: Let me add a couple thoughts to that. We
have also been meeting with small groups of industry people. We have
plans in fact to hold at least one more meeting. As Joe was saying, time
is relatively short between now and the end of February, but we are
trying to have smaller group discussions to the extent that we can, to
help us sort of make a decision about what the next step should be. If
we do decide to decouple the two parts of the rule, then I think we need
to step back and do sort of a longer thinking about our process.

Something that you might want to be aware of, the agency has from time
to time used what\'s sometimes referred to as negotiated rule-making
under the Federal Advisory Committee Act. If we actually constructed a
process where we worked with some of you, your colleagues, as a
workgroup to continue the rule-making, we\'d have to be constituted
under \[Federal Advisory Committee Act\]. There are certain requirements
and limitations. So that will -- if we think about that, we\'ll have to
think about whether or not we could cope with \[Federal Advisory
Committee Act\] requirements. So that\'s just a constraint.

If that responds to your question, I did want to also add something
about electronic reporting, which sort of came up a little bit from time
to time. We did of course talk about electronic reporting at the two
public meetings that we had in late October and early November. It\'s
just because of time and resource constraints, it\'s unlikely that
we\'ll be able to schedule another public meeting to talk specifically
about -- it\'s \[inaudible\] we\'ll be able to schedule another public
meeting before the end of the comment period, period. At some point
there\'s so much we can do.

However, I guess I would suggest a couple things and I really urge those
of you who have electronic reporting issues to follow up with us one way
or another. Certainly, the most avenue right now I think for your
expression of comments and concerns is to put them into your written
comments that you file, as part of the comment period. As with all the
issues that you raised today, electronic record-keeping \[inaudible\]
electronic reporting. If you have issues, please do put them in writing
and get them to us by February 27.

I guess the second thing is that, again, within the constraints of time,
I am certainly prepared to try to meet with at least one or two small
groups of people if they want to constitute themselves, to talk about
issues on the electronic reporting side. That\'s certainly something
that we could consider.

We may also be able to have some sort of ongoing discussions beyond the
closed public comment period, although I\'ll have to check with the
lawyers and make sure that we don\'t violate anything under the
administrative procedures act. But there probably are ways to continue
the dialogue at some point or another. We do want to do that because we
do want to make electronic reporting, we do want to try to push that
part of the rule forward even if we do end up decoupling the
record-keeping side of it.

I guess the only other thing is I don\'t have my slides here for the
electronic reporting part, but as you think about what\'s in the
proposal and that notice of proposed rule-making, I guess I would urge
you to try and bear in mind that there\'s sort of three distinct areas
in a way that deal with electronic reporting. As you comment, try to
make clear to us which area you\'re really concerned with. There is the
provisions, I think they\'re Subpart B, that deal with electronic, which
are the regulatory requirements, proposed regulatory requirements, that
deal with electronic reporting directly to EPA. They\'re fairly short
and straightforward. That\'s Subpart B.

Subpart D, I think I have that right, in terms of what\'s in the
proposed rule-making provisions, is the much more robust treatment of
requirements on electronic report receiving system. These are
requirements that are primarily imposed, to the extent they are imposed,
on states and local governments who want to implement electronic
reporting. They do have some implications, obviously because some of you
read between the lines and see that, they have some implications for
what your electronic reporting experience will be like, reporting
systems that meet those criteria, particularly the criteria that address
the signature method, the requirement for some sort of registration
process and the signature certification scenario. You can kind of look
through those criteria. Although they don\'t directly apply to companies
reporting, they will have an impact.

Where you will see the greatest example of that impact, where I suspect
probably there will be substantial comments, is in the preamble
discussion of the way that EPA has been proposing to implement
electronic reporting through the central exchange system. That lays out
the conceptual design of that system as we were thinking about it about
a year and a half ago. Mostly that\'s still true, but we\'re still
thinking about it.

One of the things that will influence our thinking, of course, are the
comments that we get on what\'s in the preamble. Bear in mind that the
way that that system is laid out in the preamble is one but only one of
many possible ways, we think, of satisfying the criteria for systems in
Subpart D.

It may very well be that the comments, which we will be very interested
to see on the system concept may or may not have much effect on the
criteria themselves. They may or may not. But the criteria are actually,
if you look at them, considerably more flexible than a reading of the
central data exchange concept, because that\'s going to be a concrete
thing whereas the criteria are meant to be somewhat neutral.

So I guess I would encourage you to kind of keep that distinction in
mind as you express your concerns, because I think that will help us
understand how best to interpret what your concerns are.

Robin Roberts: Are there any concerns about electronic reporting that
maybe quickly someone wants to mention?

Unidentified Female Speaker: I have sort of an unrelated question, I\'m
thinking now as a wrapping up. At the beginning of the day, it was
mentioned that all of the remarks made here today would be made
available. I wonder if those will be in sort of transcript or summary
form, when they might be made available and will be provided with a list
and affiliation of the attendees here today.

Robin Roberts: The transcript will be available, it\'s usually a
two-week turnaround time on that. Also a list of those that attended, I
can have that available soon. Releasing it to you is an EPA call. The
formal way that we proceed is that I present the transcripts and the
attendance list to EPA, they take a look at it and pass it on.

Evi Huffer: We plan to make that information available to the public in
the docket. We\'ll put in the summary of the meeting as well as the
actual transcript, as well as the participants. You\'ll be able to find
that in the docket in about three or four weeks.

Unidentified Speaker: \[inaudible\]

Unidentified Male Speaker: It\'s electronic.

Evi Huffer: It\'s electronic and you can find it actually on our web
site at epa.gov/cdx.

Robin Roberts: If you have the sheet that has the FRN notice on it, the
web address of the docket is on it.

Unidentified Male Speaker: I was looking for the docket, I found the
electronic docket for the number of comments that have been submitted by
SQA and Dow and Mobil, but I have not seen the transcript from either
one of the October or November meetings. Are they out there? I haven\'t
found them.

Evi Huffer: They evidently haven\'t been put on our web site yet. They
should be and hopefully they will be up next week.

Unidentified Male Speaker: We\'ll check.

Unidentified Male Speaker: That\'s one part of the reason for the
question is, from the earlier meetings we haven\'t seen them yet.

Unidentified Female Speaker: Just one comment on the record on the
reporting requirements. Would you please, in whatever comes out finally,
make it more clear what people who currently report to EPA need to do,
or if this applies how it applies, and what they need to do. As a
vendor, you know, we\'re just trying to gear up. It was not clear this
go-around what all these things meant and what we should start doing, if
anything.

Unidentified Male Speaker: \[inaudible\] particular programs that
you\'re aware of that --

Evi Huffer: The ones we deal with most would be the acid rain, Part 75,
and NOX budget. Also Part 60, CEM systems, some of whom report to states
and most report of course just federally. Then ambient air quality
requirements, we do a lot of that, ozone mapping kind of stuff. Any of
those I\'d be most interested in, mostly it\'s all air that we deal
with.

Robin Roberts: Last thoughts, parting thoughts? One in the back here.

Unidentified Male Speaker: Just again, from work I\'ve been doing with
FERC, Federal Energy Regulatory Commission, over the past two years or
so, they\'ve been really moving aggressively toward electronic
reporting, both of standardized forms that utilities have to submit but
also pleadings in individual cases. They do a lot of judicial
determination-type work. They\'re moving very quickly in trying to
accommodate that.

The message we\'ve given them, they\'ve heard it and it\'s worked quite
well, is for reporting allow companies to keep information they have to
submit to EPA or states and so forth and the states pass along to EPA,
in whatever form they typically keep their internal information. Whether
it\'s Word, WordPerfect, Adobe, a variety of formats, and allow that to
be sent over and keep it as simple as possible.

FERC\'s got it now so you can do pleadings through their web site and
you can use any of those various \[Microsoft\] Word formats. They
capture it, they turn it into an Adobe document which preserves the
pagination and so forth so it becomes a fixed document for the public
record. You don\'t have to go through a lot of elaborate signature
tracking and so forth. If you want to submit something, you have to have
registered in the sense of signing on through the web site as who am I,
where am I and contact information. I\'m able to submit stuff for my
boss, general counsel of our association, and he\'s also registered in
there. And that\'s sort of the end of it, it\'s a five-minute process
once you\'ve done that initial background work and it\'s very easy.

So that would be my observation. Electronic reporting can have lots of
benefits, both in terms of us as reporting entities, the states and
maybe more directly dealing with EPA, but also for EPA in terms of
managing this data. So just simple, simple, simple and let people use
their existing software systems, is my suggestion.

Robin Roberts: Thank you. Any statements from the panelists and then I
think we\'ll just wrap it up. Are there any outstanding questions? I
guess I\'d like to thank you all for coming. This is a road show, we\'ll
be appearing in Dallas January 31 as well.

\[End of transcript\]