**RESPONSE TO COMMENTS DOCUMENT**

**HAZARDOUS WASTE MANAGEMENT SYSTEM: MODIFICATIONS OF THE HAZARDOUS WASTE MANIFEST SYSTEM; PROPOSED E** 
**- MANIFEST SYSTEM**  **PUBLISHED MAY 22, 2001**

**December 2, 2013**

**+** **************FINAL DOCUMENT** ************December 2, 2013 FINAL DOCUMENT Page 1

**BACKGROUND AND PURPO SE OF DOCUMENT**  **Background** On May 22, 2001, EPA published a notice of proposed rulemaking to revise the hazardous waste manifest sy stem (66 FR 28240). The proposed revisions aimed to reduce the manifest s ys tem's p aperwork burden on users, while enhancing the effectiveness of the manifest as a tool to track hazardous waste shipments. The proposed rule would have accomplished this by adopting a standardized manifest form with fewer or no optional data fields; adopti ng a new approach for distributing and acquiring the form; standardizing the data elements and procedures for tracking certain t ypes of hazardous waste shipments; and allowing the manifest to be completed, signed, transmitted, and stored electronicall y. T hus, the proposed rule consisted of manifest sy stem reforms of two distinct t ypes: (1) revisions to the manifest form and the procedures for using the form and (2) revisions aimed at replacing the paper

- based manifest s ys tem with a nearl y paperless, electr onic approach to tracking hazardous waste shipments (referred to as the A e manifest @ in this document). EPA received 66 public comment letters in response to the May 22, 2001 proposed rule. Commenters generally

supported our goals of further standardizin g the manifest form elements and reducing variability

among the manifests that authorized RCRA State agencies currently distribute. However, the commenters had differing views on man y of the particulars of the proposed revisions to the manifest. Moreover , there were a substantial number of comments that took issue with EPA's proposed approach to the e

- manifest, particularl y with respect to the technical rigor of the proposal, the assumptions relied upon by EPA in its projections of burden and cost reducti ons, the feasibility of the proposed electronic signature options, the highl y detailed security

requirements aimed at preventing fraud and data corruption, the reliance on regulated industry

to develop private e

- manifest sy stems, and the preamble ’ s suggest ion that State programs may

not be required to adopt the e

- manifest requirements within their authorized RCRA State programs. We believed that the comments addressing the e

- manifest proposal raised significant substantive issues that merited further anal y sis and stakeholder outreach prior to adopting a final approach. The comments received in response to the form revisions proposal, on the other hand, raised fewer difficult issues that would deter us from going forward with a final rule. Therefore, EPA s eparated the e

- manifest portion from the form revisions portion of the proposal for purposes of taking final action at that time . EPA published a final rule on the form revisions on March 4, 2005 (70 FR 10776). EPA is now taking final action on the e

- man ifest portion

. **Purpose of Document** This document presents a summary of the public comments received in response to the e

manifest provisions of the proposed rule. The public comments (e.g., suggestions, concerns, questions) are summarized according to specific issues related to the proposed rule and preamble.December 2, 2013 FINAL DOCUMENT Page 2

In each summary , we indicate the number of organizations whose comments are reflected in it. We also identify

the organizations. To do so, we assigned each organization a unique commenter number. We then prepared the summaries and inserted commenter num bers into each summary

to identify the organizations whose comments are reflected in it. The appendix to this document includes a table identifying each organization that commented on the proposed rule and its commenter number. This document also provide s the Agency ’ s response to each comment. The responses explain how the comments were considered in developing the final e

- manifest rule . This document does not address comments that are outside the scope of the e

- manifest.
**SUMMARY OF PUBLIC COMMENTS AN D AGENCY RESPONSES ON E** 
**- MANIFEST** 
**1.0 General Comments** 
**1.1 General Support**  **Comment:** We heard from 46 commenters that indicated their general support for the rule and/or efforts to automate the manifest in particular (Commenter Nos. 1, 4, 6, 8, 9, 12, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24, 26, 27, 28, 30, 31, 32, 34, 35, 36, 37, 39, 40, 42, 44, 45, 46, 47, 48, 49, 51, 52, 53, 54, 56, 57, 58, 60, 61, 62, and 63). Thirteen of these commenters expressed their support of EPA's goals to streamline the manifes t requirements and reduce burden on waste handlers (Commenter Nos. 12, 19, 21, 22, 23, 31, 42, 49, 53, 58, 60, 62, and 63). One of the commenters had participated in the e

- manifest pilot program (Commenter No. 28). The commenter expressed support for aut omation, but encouraged EPA to work through any issues that were identified in the pilot before moving forward. **Response:** EPA thanks commenters for their support of the proposed rule and efforts to automate the manifest. EPA has modified its proposed e - manifest approach due in part to feedback from stakeholders. In addition to stakeholder comments on the proposed rule, we received input from stakeholders at 2 national meetings (May 2004 and November 2008) held since the publication of the 2001 propose d rule, and from webinars conducted after the 2008 public meeting. We also gained additional insights from additional e

- Manifest pilot tests conducted during 2007

– 2008 with the States of Michigan, Minnesota, New Jerse y, and Massachusetts. Further, we s olicited additional comment on the e

- Manifest program direction and specific policy issues in Federal Register notices we published in April 2006 and February 2008. Finall y, the Hazardous Waste Electronic Manifest Establishment Act (e

- Manifest Act) was en acted in October 2012. The final rule addresses key

provisions of this legislation that authorizes the establishment of a national electronic manifest s ys tem by EPA, and that requires implementing regulations to authorize the use of electronic manifests an d, among other things, to ensure consistent implementation in the states. Please refer to specific EPA responses to learn more about the changes that resulted after these outreach efforts with stakeholders.
**Comment:** We heard from 17 commenters suggesting that the e

- manifest requirements should be simple to understand and follow and not be too prescrip tive to prevent future technologies andDecember 2, 2013 FINAL DOCUMENT Page 3

improvements (Commenter Nos. 4, 12, 25, 28, 32, 33, 34, 43, 45, 51, 52, 53, 54, 57, 59, 60, and 61). One of the commenters noted that technological advances will make it very difficult for EPA to select technologies and standards that may be appropriate years into the future (Commenter No. 61). The commenter suggested that EPA establish a basic framework on how the e

- manifest should work, and then implement the details in non

- regulatory documents that can be quickly modified as needed. In response to EPA ’ s question whether Extensible Mark

- up Language (XML) is sufficientl y stable to support the e

- manifest approach, one commenter believes XML is the technology

most likely

to be able to support EPA's purposes in the fo reseeable future (Commenter No. 33). Another commenter suggested that the rule should be technology neutral and allow for industry

to use other technologies than specified in the rule (Commenter No. 60). Another commenter asked that the final rule inclu de a complete process description from initial preparation by

the generator through the final storage of the manifest (e.g., a process flow chart) (Commenter No. 51). Two commenters suggested that EPA add an option for a petitioner to demonstrate equivale ncy

to the two proposed data formats in the rule (Commenter Nos. 57 and 61). **Response:** EPA thanks commenters for their suggestions on keeping the e

- manifest approach flexible and eas y to implement. In our May 2001 proposal, we set forth a standards

- base d approach for reporting and recordkeeping of the e

- manifest. Users of the e

- manifest would have had two options for transmitting the e

- manifest, i.e., Electronic Data Interchange (EDI) and Extensible Mark

- up Language (XML). Users also would have had to comply with electronic manifest sy stems and security requirements, such as requirements for independent sy stem validation, limits on system access, full interoperability among users ’ sy stems. Signing the e

manifest would have been done using either a secure digitized signature or a digital signature based on private key

/public key

cry ptography

. As we discuss below in response to other comments, EPA received man y comments critical of the proposed decentralized, standards

- based approach. Several commenter s suggested that a preferred approach would be for EPA or another entity to develop a consistent, national solution for the e

- Manifest. We received strong additional comments supporting such a national s ys tem at a May 2004 public meeting in Washington, D. C. and in comments responding to the April 2006 Federal Register notice soliciting comment on the preferred program direction. Since the 2001 proposal, EPA has made significant progress toward developing its Agency

- wide electronic receiving s ys tem, call ed the Central Data Exchange (CDX). We have also, with our State environmental program partners, developed the National Environmental Information Exchange Network as a means to efficiently share environmental information with the States, through the nodes the States have developed on this network. The CDX has evolved from a prototy pe s ys tem to a fully

operational electronic document receiving s ys tem and the building blocks supporting the CDX functions have changed substantially . These changes reflect EPA ’ s experience operating the CDX over these ye ars, evolving trends in Internet technologies, and comments received from potential CDX users. The CDX now supports tens of thousands of registered users providing data to dozens of environmental reporting progr ams across the major EPA media offices. CDX registered users include representatives from state, tribe, and local agencies, industries, laboratories, and other federal agencies.December 2, 2013 FINAL DOCUMENT Page 4

In addition, EPA finalized the Cross Media Electronic Reporting Rule (CROME RR) on October 13, 2005 (70 FR 59847). CROMERR provides a uniform, technology

- neutral framework that applies to electronic reporting across all EPA programs. For example, the new electronic reporting provisions modify current requirements in the Code of Federal Regulations to address obstacles to electronic reporting. They require validation of electronic signatures on reports submitted to EPA through the CDX (or another designated EPA s ys tem). They also ensure that valid electronic signatures have the same legal force as their wet

- ink counterparts. Because of the emergence of the CDX as a viable option for the e

- manifest, as well as stakeholders ’ requests for a more flexible, simple, and technology

- neutral approach, EPA has decided to develop a national, centralized Web

- based information technology s ys tem that EPA will host on the CDX or an equivalent s ys tem. EPA ’s final rule authorize s the use of electronic manifests that are created and transmitted through the use of this national e

- m anifest sy stem. The final rule amend s existing manifest regulations which now require manifests to be created only as paper forms, to be signed only with “ by hand ” signatures, and to be ph ys ically carried b y waste handlers and retained at their sites as paper records. These regulatory changes are necessary

to ensure that electronic manifests are as valid as the traditional paper manifests that are signed with ink and manually

processed and transmitted. The use of EPA ’ s national e

- manifest sy stem to obta in and process valid electronic manifests is the key component of the final rule. The rule codif ies key requirements of the 2012 e

- Manifest Act , which requires EPA to implement a centralized approach and develop a national electronic manifest system. Th e final rule thus explain s how electronic manifests obtained from and transmitted to the national system will be legally equivalent to paper manifests, and it clarifies the re levant policy issues (e.g., electronic signatures, CBI, paper manifest collection s, program consistency) from the 2001 proposal, the subsequent 2006 and 2008 public notices, and the recent legislation. EPA believes this approach will be much simpler and more flexible to implement than the proposed approach. This follows because the p roposed approach was a standards

- based approach under which EPA attempted to define in regulations the technical standards that it believed were necessary to bring about the development of consistent, reliable, and secure sy stems by numerous private entiti es. Under the new preferred approach, only one e - manifest sy stem will be developed and hosted b y EPA through the efforts of a contractor selected b y EPA to develop the s ys tem in accordance with EPA ’ s performance requirements. This approach will obviate the need for EPA to promulgate the level of technical standards for the e

- manifest as was done in the proposal. Rather, the CDX or equivalent sy stem will be designed with the appropriate level of controls and procedures to ensure that the e

- manifest is completed, transmitted, and archived in fulfillment of EPA ’ s performance objectives for sy stem securit y, interoperabilit y across systems, signature authentication, and other necessary controls. Because the s ys tem and requirements will be implemented through EPA ’ s own receiving s ys tem or its equivalent, the Agency will be able to integrate improvements and updates quickly when necessary (e.g., in response to technology advancements), as commenters requested. The CDX has been designed b y EPA expressly to be ea sy to use and place reasonable technology requirements on users It offers user tools (e.g., prompts, error

- flagging) to guide users andDecember 2, 2013 FINAL DOCUMENT Page 5

technical assistance via telephone and email should users have questions or problems. In this regard, a CDX

- hosted e

- Manifest sy stem will satisfy commenters ’ requests for an eas y - to

- use solution for the e

- manifest. In addition, the use of a single, national receiving s ys tem will provide stability and certainty

for all users and enable a high level of interoperability am ong users’ legacy and future s ys tem investments, as commenters have requested. In response to the commenters’ support of XML, EPA agrees that there are benefits to XML. The schemas and st yl e sheets developed in XML will likely be the means by which EPA will implement the electronic exchange of e

- manifest data. These XML documents will conform to the data elements of the hazardous waste manifest (EPA Form 8700

- 22) and continuation sheet (EPA Form 8700

- 22A) that EPA announced in the March 4, 2005, Form Re visions final rule. Please refer to Section 2.0 of this document for additional Agency responses in regard to the use of XML for the e

- manifest.
**Comment:** We heard from 12 commenters requesting that EPA further coordinate with other RCRA pape rwork requirements as needed in finalizing the e

- manifest proposal, e.g., LDRs, Biennial Report, continuation page, exception reporting (Commenter Nos. 12, 16, 18, 21, 24, 35, 38, 45, 46, 50, 57, and 60). One of these commenters also suggested that EPA ex tend the e

manifest to non

- RCRA requirements, such as PCB continuation sheets or NESHAP notification letters (Commenter No. 16). **Response:** EPA thanks commenters for their request for coordinating the e

- manifest with other paperwork requirements. The e

- m anifest sy stem that will be developed initially will provide the core services necessary

to manage the basic waste shipment tracking and waste data collection functions of the manifest process, including manifest creation, completion, signing, routing and communication services (i.e., services required to create, view, update, transmit, and close manifests) and the collection, distribution, and archiving of official manifest records. However, we are aware from discussions during both the 2004 and 2008 publ ic meetings that state agency and industry

stakeholders regard Biennial Report integration as an important sy stem objective. Therefore, once we have successfull y automated the core manifest preparation and transmission services, we will endeavor to devel op the data entry and reporting services to enable e

- Manifest data to be refined and processed so that it may be used to develop waste receipt summary information for the biennial report. The s ys tem would also be designed with scalability so that addition al EPA reporting functions could possibly be added as future upgrades. At this time, however, we are focusing the initial phase of sy stem development on the core, domestic manifest tracking requirements. Commenters should note that the e

- manifest sy stem will be hosted on EPA ’ s CDX or equivalent sy stem and will utilize the National Environmental Information Exchange Network (NEIEN) architecture for sharing environmental information with state programs . In the coming ye ars, EPA intends to increasin gl y automate its informat ion collections through this architecture as an option to paper

- based collections. As this happens, users will have a greater opportunity to coordinate their electronic reporting activities across EPA ’ s information collections, in cluding the manifest.December 2, 2013 FINAL DOCUMENT Page 6 **1.2 Delayed**  **Im plementation**  **Period for the e**  **- Manifest Requirements**  **Comment:** We heard from seven commenters who requested that EPA ensure a more coordinated phase

- in period (Commenter Nos. 21, 23, 24, 27, 44, 48 and 49). These commenters were concerned that States be given enough time to make legislative and other changes. One commenter suggested that a meeting with all State manifesting managers and data sy stem managers may

be productive in determining the implementation timef rames (Commenter No. 48). Another commenter urged EPA to make guidance available, and if possible, sponsor training workshops for the regulated community on the e

- manifest approach (Commenter No. 23). **Response:** EPA thanks commenters for their suggestion s and concerns. EPA has been persuaded by public comments on the proposed rule, as well as by suggestions from stakeholders at EPA ’ s public meetings, that the e

- manifest should be effective, recognized as valid, and implemented consistently

in all states. The e

- Manifest Act enacted in 2012 also requires this result. EPA agrees that development and use of the e

- manifest would not be feasible unless it can be assured that the validity

of electronic manifests is recognized consistently in all the states. Th e Agency appreciates stakeholders ’ concerns that optional state adoption could frustrate the successful development and implementation of e

- manifest systems because investments in these sy stems could be perceived as too risky

. Therefore, EPA ’ s approach in this final rule require s that all state programs adopt and recognize the validity

of electronic manifests through the provisions of 40 CFR 271.4(c), which addresses state program consistency and the hazardous waste manifest. This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest sy stem does not meet the requirements of Part 271. With the adoption of the electronic manifest in the final rule, EPA will deem it a matter of R CRA program consistency that all authorized state programs must allow for the use of the national e

- manifest sy stem as a valid means of preparing and using the hazardous waste manifest. In addition, the e

- manifest will be effective in all states on the s ame delayed implementation date that will be identified subsequently by EPA in the e

- Manifest User Fee (Fee Rule) r ulemaking. The e

- Manifest legislation enacted b y the Congress provides that EPA shall implement and enforce the electronic manifest in all s tates on the program’s effective date. Federal implementation of e

- Manifest would continue until such time as the states revise their authorized program with equivalent and consistent e

- Manifest requirements and obtain authorization for these program revi sions from EPA. Consistent with the statute, the e

- Manifest final regulation states that EPA expects all states to adopt the e

- Manifest requirements, and that the electronic manifest will be effective Federall y in all St ates on the announced implementati on date. For several reasons, EPA does not expect the states to have great difficulty making the transition to the e

- manifest. EPA believes that because of the final Cross

- Media Electronic Reporting Rule (CROMERR) ( which lays out a framework for electronic reporting and receiving s ys tems across EPA ’ s programs at the federal, state, and local levels ) the states have already begun to consider necessary changes to their environmental programs to enable electronic reporting (e.g., statutory and budgetary

c hanges). In fact, EPA is aware that a number of states have implement edDecember 2, 2013 FINAL DOCUMENT Page 7

electronic reporting under some of their environmental programs that meet CROMERR ’ s requirements

. In addition, EPA will establish a delayed implementation date that assures a smooth transition to the e

- manifest by

both industry

and regulators. As a point of reference, we note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect Federall y in all states immediately after a six

- month pe riod following HSWA rule publication. The EPA Regions administer the HSWA rules until State RCRA programs get authorized for them. We believe the States have worked effectively in coordinating and transitioning their responsibilities under the HSWA rules , and that a similar Federal/State implementation approach for e

- Manifest will be equally effective. Under the RCRA authorization regulations at 40 CFR § 271. 21(e)(2), authorized states are ty picall y provided 1

- 2 years after promulgation of Federal regulatory changes to adopt the corresponding revisions to their authorized programs. Thus, these regulations govern when states would be expected to adopt their electronic manifest regulations under state law, so that authorized states may

imple ment and enforce the electronic manifest requirements. We know that authorized states have resource issues and budgetary constraints that may

preclude them from meeting the adoption milestones in our Part 271 regulations. As described above, regardless o f states’ progress in adopting program revisions, the e

- manifest will go into effect under Federal law beginning on the implementation date to be announced b y EPA in the Fee Rule . States will be expected to obtain authorization by that implementation date or within a reasonable period of time thereafter. This phased

- in approach will give the states time to make necessary changes to their programs for the e

- manifest. Bec ause of these factors, and because states have generally been strong proponents of e

- M anifest, we expect a fairl y smooth transiti on of e

- manifest authority from EPA to the authorized states

. In response to the comment that EPA should provide guidance and/or training to the regulated community , EPA agrees that users must understand the fin al e

- manifest approach in order to enable compliance. EP A expects that the final rule approach to be significantly easier to understand and implement than the proposed approach and that training will therefor e not be complex. The final rule approach will be implemented through EPA ’ s CDX or equivalent s ys tem

. The CDX includes eas y - to

- follow instructions and other user support tools (e.g., user prompts, technical support via telephone and email). Moreover, EPA expects to develop training mod ules for e

- Manifest that should assist industry and state stakeholders to learn the sy stem basics well enough to become proficient with the sy stem. **Comment:** We heard from eight commenters that EPA ensure implementation of the electronic manifest sooner than a two

- year delayed compliance date (e.g., as soon as possible) (Commenter Nos. 1, 19, 22, 36, 45, 46, 49 and 60). One commenter indicated that a delayed compliance date is not necessary , as the software is already readil y available (Commenter No. 36). The commenter believes that any further delay

in the implementation of the new manifest s ys tem would be contradictory

to the goals of reducing the paperwork and time burdens associated with the current manifest s ys tem.December 2, 2013 FINAL DOCUMENT Page 8

Two commenters (state representati ves) indicated that, since the implementation of the electronic manifest would be voluntary for the States, the State implementers will dictate the speed at which the electronic manifest is enacted and hence no compliance date is necessary (Commenter Nos. 54 and 63). **Response:** EPA thanks commenters for their suggestions about the delay ed compliance date. The e

- Manifest legislation requires EPA to announce its regulation implementing electronic manifest ing within 1 year of enactment of the statute. The e stablishment of the sy stem, however, is scheduled under the statute at a date 3 ye ar s from enactment of the statute, although the precise timing of sy stem implementation will be highl y dependent on funding for the system procurement. Thus, the uniform dat e on which access to the s ys tem will be available will not be announce d in this final rule, but will instead be announced after the s ys tem has been developed and has been determined to be ready for production use. EPA currently plans to announce the delayed implementation date in the subsequent Fee Rule, which will be issued prior to the sy stem’s implementation. However, EPA also emphasizes that e

- Manifest rule adoption w ill be mandatory

for all states. All authorized states must adopt fully consistent r egulations that recognize the validity

of the electronic manifests that will be obtained from and submitted to the national sy stem. While states will have some latitude to adopt their state law e

- Manifest re quirements within a reasonable time after issuanc e of this final rule, the states will not determine the uniform Federal compliance date. EPA will determine the consistent impl ementation and compliance date for e

- Manifest in the Fee Rule, and EPA will initially implement e

- Manifest beginning on this date and until the states are authorized.

**Comment:** We heard from eight commenters that EPA should establish a two

- year or greater delayed compliance date for the electronic manifest (Commenter Nos. 17, 25, 29, 35, 51, 57, 59, and 61). One commenter does not believe that in

- place technology at the majority

of the affected stakeholders allows implementation of an electronic manifest system within six months of promulgation of the final rule (Commenter No. 25). Another commenter clarified that, so long as s tate adoption is mandatory , a two

- ye ar compliance date is appropriate for the electronic manifest (Commenter No. 51). **Response:** EPA thanks commenters for their suggestions about the delay ed compliance date. The e

- Manifest legislation provides that EPA must publish its final regulation within one y ear of the statute’s enactment, and develop the s ys tem within 3 years of that date. (See response to previous comment). So, while the final rule may be “legall y effective ” six months after promulgation of the final rule under RCRA§ 3010(b) , as a practical matter, compliance with the sy stem’s requirements will not be possible until the sy stem is developed and determined by EPA to be available for use. The 3 year deadline in the statute for establishing the sy st em represents an ambitious milestone that EPA will endeavor to meet, but ultimately , the date of s ys tem development and implementation will depend on sufficient funding for the sy stem procurement. Within the constraints of the statutory schedule and fundi ng , EPA will make every effort t o schedule the s ys tem ’s delayed implementation date so that stakeholders wishing to use e

- Manifest will have time to transition smoothly to e

- Manifest. Clearly , there will be a delayed compliance/ implementation date, which EPA will announce in the Fee Rule, shortly before theDecember 2, 2013 FINAL DOCUMENT Page 9

sy stem is ready

for use. We use the term delayed “implementation date” to distinguish the delayed date for compliance and implementation (to be announced in the Fee Rule) from the “effective date,” sin ce RCRA § 3010(b) requires that RCRA regulations be legally effective within 6 months of their promulgation.

**1.3 General Questions/Concerns Associated with Automated Systems**  **Comment:** We heard from one commenter expressing concern that elec tronic sy stems may at times be just as unreliable as paper s ys tems (Commenter No. 26). The commenter stated that hardware, software, and Internet infrastructure problems may cause problems in manifest transmission or outright loss of the manifest. The co mmenter asked that EPA clarify the consequences of such malfunctions for all participants in the management sy stem. We heard from one commenter on the susceptibility of electronic records to natural disasters (Commenter No. 24). The commenter recommended that EPA acknowledge and anticipate that there may be s ys tem failures or natural disasters that cause delay s in the submission of the manifest forms. The commenter proposed that facilities should rely on electronic time stamps for the date of transmissio n of manifests, so that a problem with electronic sending does not become a compliance issue. We heard from two commenters on the susceptibility of electronicall y stored media to deterioration over time (Commenter Nos. 33 and 60). One commenter stated that digitall y signed and electronicall y stored media are generally protected in storage from those elements that can corrupt the data on the media (Commenter No. 60). The commenter believes that, through the use of long

- term storage of media in controlled environments, data will remain viable. Another commenter indicated that digitally signed and electronically stored media have significant advantages to paper media, most notably in terms of how much information can be compacted into a very

small phy sical volume and how much cheaper the storage costs become (Commenter No. 33). The commenter added that, in terms of deterioration over time, they are in fact inferior to paper media, being far more susceptible to corruption/destruction by heat, electromagneti c fields, material degradation. The commenter suggested several way s to address these concerns (e.g., creation of multiple copies of whatever information is being stored, and the dispersal of those copies to multiple sites). **Response:** EPA thanks the commenters for their observations about the potential risks and problems of an e

- manifest that is implemented on the Internet. EPA agrees that different problems could and likely will occur in the e

- manifest, such as loss/corruption of elec tronic data. EPA also agrees that problems inevitably occur in the paper

- based s ys tem, such as loss or destruction of the paper manifest during shipment. EPA does not expect any approach to eliminate these problems entirely . Moreover, the paper manifest forms will remain available for instances in which the e

- Manifest sy stem is unavailable, and the DOT Hazmat requirement to carry one cop y of the manifest on transport vehicles will provide a back

- up means to track shipments even if the e

- Manifest is corru pted or lost while the shipment is en route.December 2, 2013 FINAL DOCUMENT Page 10

EPA has decided in this final rule to implement the e

- Manifest through its CDX architecture or its equivalent, as described above, which is designed to minimize problems commonly encountered in e

- r eporting. Over the y ears, EPA has gained considerable experience using the CDX in collecting, processing, and storing electronic media under other EPA collections. We believe the CDX is well

- equipped to handle manifest transactions, and EPA will ensure that additional controls are added as appropriate for the e

- manifest. The CDX, as currentl y designed, includes a range of controls that are intended to address the ty pes of problems raised by commenters. For example, the CDX utilizes methods for error

- che cking that flag obvious errors in documents and document transactions, including duplicate documents and unauthorized submissions. In regard to the susceptibility

of electronic media to damage and deterioration, the CDX archives to multiple formats: hard disk, tape, and optical media. This use of multiple formats is designed to ensure that degradation of one format would not jeopardize EPA's long

- term storage capability for submitted data. The CDX archives will be written out to an online disk system wh en they are first created. They

will be copied to an off

- line disk sy stem and also backed up to magnetic tape every day , with full backups to tape on a weekl y basis. In addition, the CDX provides other protections against data corruption and loss. For example, the CDX is designed to incorporate firewall security , in addition to the usual sy stem securit y provisions to control physical access to the s ys tem and prohibit unauthorized internal access. As transmissions flow through the CDX firewall, they are automatically virus

- scanned, and the sy stem would not attempt to process a file that contains a suspected virus. The server will also be protected with intrusion detection software that alerts the s ys tem operators to suspected attempts to penetrate or ha ck the sy stem. The s ys tem operators will use the logging capability of the firewall and the intrusion detection sy stem to monitor the health and status of the sy stem and respond to unauthorized efforts to use or modify the sy stem. **Comment:** We heard from three commenters on procedures for returning the electronic manifest to the generator (Commenter Nos. 6, 16 and 54). They suggested that the timeframe for the TSD to return a manifest to the generator should be the same for both paper and electronic form s. One commenter noted that TSDs in its State normally submit paper manifests within seven day s and that EPA should consider establishing a seven

- day timeframe for the paper and electronic manifest instead of 30 days (Commenter No. 6). Another commenter also noted that the timeframe for returning a copy to the generator could be reduced (Commenter No. 16). Two commenters said the rule is not clear on how to address discrepancies on the electronic manifest, but they

believe the procedures should be the same for both paper and electronic forms (Commenter Nos. 38 and 39). **Response:** EPA thanks the commenters for their views on returning the electronic manifest to the generator. EPA agrees with comments that the timeframe for the TSD to return the mani fest to the generator should be the same for both electronic and paper manifests. We do not believe there is a compelling reason to establish different timeframes for forms. Regardless of whether the manifest is paper or electronic, the TSD will need tim e to evaluate the shipment against the manifest and, if needed, resolve discrepancies. In addition, two timeframes would unnecessarily clutter the regulations and complicate the procedures for TSDs. Under such a dual approach, theDecember 2, 2013 FINAL DOCUMENT Page 11

TSD would need to estab lish two sets of procedures, one for returning paper manifests and the other for electronic ones. In developing the final rule, EPA sought to keep the regulations as simple as possible and avoid placing dual procedures on waste handlers whenever possible. Therefore, in the final rule, the existing 30

- day timeframe at 40 CFR 264.71(a)(2) and 265.71(a)(2) for delivering the manifest cop y to the generator applies to both electronic and paper manifests. However, we expect that in practice, e - Manifest will automate the return of manifests from the TSDs to the generators, and that TSDs will normally be able to return electronic manifest copies to generators much quicker than the 30

- day limit in the regulations. The e

Manifest should thus establish a higher st andard of timeliness and accountability than is now possible with paper forms returned through the mail. This same principle holds true for discrepancies. We agree with comments that there is no compelling reason to establish different procedures for handling discrepancies or exceptions. The final rule provides that the existing procedures for discrepancies and exceptions apply to both paper and electronic manifests. However, as with the 30

- day deadline for returning manifests to generators, we expect that in practice, e - Manifest will be extremely helpful to users in flagging possible exceptions and discrep ancies for users’ attention. So, the reporting of exceptions and discrepancies electronical ly in the e

- Manifest s ys tem should be much more timely and efficient than is possible with the mailing of paper reports and letters.
**1.4 Terms and Conditions Agree**  **ment Comment:**  We heard from one commenter in response to EPA's request for comment on whether a terms and conditions agreement should be required for e

- manifesting (Commenter No. 19). The commenter supported in principle the promulgation of a rule that sets forth the key terms and conditions for electronic manifesting, as opposed to requiring generators to enter into private agreements with transporters and TSDFs. The commenter believes such a rule would ensure consistency

among State programs, facilitate interstate commerce, and minimize the potential for incompatible waste handler automated s ys tems. **Response:** We thank the commenter for its views on the terms and condition agreement. We agree that it is not necessary for EPA to require waste handlers to enter into an agreement with EPA on the use of the electronic manifest. In the proposed rule, we raised the possibility that, under certain regulatory

approaches, such an agreement could be warranted. However, we believe that the final rule approach obviates the need for such an agreement. First, the final rule sets forth regulations to which all users of the electronic manifest must satisfy in initiating, transmitting, and retaining the forms. In addition, users must use EPA’s Electronic Hazardous Waste Manifest sy stem and transmit the manifest through the Agency ’s Central Data Exchange (CDX) or equivalent sy stem. The CDX involves its own set of requirements and procedures with which users much comply. Finally , 40 C FR Part 3 lay s out procedures wi th which electronic manifest users must comply , such as identity proofing and creating valid electronic signatures

. EPA believes this regulatory framework establishes an effective approach for holding all users of the electronic manifest to the specified standards; as such, EPA believes that no additional agreement with EPA is needed.December 2, 2013 FINAL DOCUMENT Page 12

**1.5 Alternatives to Traditional EDI**  **Comment:** We heard from 15 commenters suggesting alternative approaches from traditional EDI for automating the manifest s ys tem (Commenter Nos. 12, 19, 24, 25, 31, 30, 33, 34, 40, 48, 50, 51, 56, 60 and 61). A number of commenters suggested alternative web

- based approaches, including a State

- hosted central web site, an EPA

- hosted central web site, or other approach using a s imple web form or software program (Commenter Nos. 12, 19, 24, 30, 31, 34, and 48). One of these commenters suggested that the use of a centralized electronic manifest sy stem based on the Internet and operated at the state level could satisfy the securit y and interoperability concerns that EPA identifies in the preamble and proposed regulations (Commenter No. 12). The commenter proposes that EPA adopt the Internet and XML, or plain HTML , as the means for writing and transmission for electronic manifests. It added that EPA should require the workflow (numbering, and routing) of electronic manifests, and the secure storage of manifest records, to be coordinated from a centralized state operated Internet accessible database. Another commenter recommends that EPA host a national Internet site to be used by all handlers (Commenter No. 34). Another commenter stated that an approach using email and/or a File/Transfer Protocol (FTP) would be appealing to waste handlers since they are virtually

free (Commenter No . 33). Another commenter suggested that EPA allow the use of images (e.g., images of signatures or other data elements) in the completion of manifests (Commenter No. 60). The commenter believes that the use of images (e.g., TIF compressed images) would enable automated s ys tems to interface with manual s ystems. Another commenter said that EPA should allow an y suitable process for data transfer, including those currentl y used in commerce (Commenter No. 51). Another commenter asked that the EPA examine th e possibility of adding the electronic manifest to the RCRAInfo databases. The commenter believes that adding the electronic manifest to the RCRA Info would be more efficient than adding it to each individual state database (Commenter No. 40). Another co mmenter expressed concern, however, that an online reporting approach would deposit its facility

data into an EPA mandated central database, which would limit its opportunity

to store and manipulate data for reporting purposes (Commenter No. 50). One comm enter recommended a locked Word document that cannot be changed, or an interactive PDF format (Commenter No. 56). We heard from one commenter on the security of Internet EDI (Commenter No. 33). The commenter believes that ensuring security of Internet ED I comparable to traditional EDI would be fairl y eas y; however, ensuring comparable levels of auditability is less certain. The commenter suspects that Internet EDI could meet the overall requirements for authentication and data

- integrit y. **Re sponse:**  EPA thanks commenters for their many ideas for alternatives to traditional EDI. We acknowledge the man y s uggestions for a web

- based e

- manifest approach, as well as comments for a centralized (e.g., state or national) s ys tem. We agree with comment s that a centralized, web

based s ys tem could be advantageous for users. Among other things, a web

- based s ys tem will be cheaper and simpler to implement than other commercial options and is widely accessible, as many users already

have Internet access and computer sy stems or portable devices that meet the minimum operating requirements needed to utilize EPA ’ s CDX. It is EPA ’ s final rule approach that the CDX or eq

uivalent architecture would be established as the Agency ’ s central reportingDecember 2, 2013 FINAL DOCUMENT Page 13

hub for receiving , processing, and routing the in

- bound electronic manifests to waste management entities and to state governments. The CDX based sy stem (or equivalent) will offer the necessary applications and components to supply , complete, electronically sign, transmit , and retain electronic manifests. Users, however, will need to supply their own computer devices to access and use the national reporting s ys tem. Finall y, EPA notes that the details of sy stem design and the development of the precise electronic formats for the manifest are beyond the scope of this final rule, and will be address in the sy stem planning and development process. In regard to the comments in favor of XML, EPA agrees that XML offers advantages over other formats. Refer to Section 2.0 of th is document for additional EPA responses in regard to the use of XML for the e

- manifest.
**1.6 Participation in Manifest Automation**  **Comment:** We heard from six commenters that expressed support for the proposal to make the e

manifest voluntary

for waste han dlers (Commenter Nos. 4, 8, 19, 22, 24, and 38). These commenters noted the substantial burden and time commitment needed for implementation and believe that smaller companies would have greater difficulty overcoming these challenges. **Response:** EPA thanks the commenters for their views on voluntary participation by

waste handlers. EPA agrees that the e

- manifest should be optional for waste handlers. EPA recognizes, for example, that a number of waste handlers might not have the necessary equipm ent (e.g., a personal computer) to participate. In addition, other waste handlers may be content with the current paper

- based s ys tem, or otherwise have made a significant investment in the paper

- based sy stem (e.g., investments in personnel training, filin g s ys tems), and opt not to participate. Moreover, the e

- Manifest legislation enacted by the Congress provides that the use of electronic manifests shall be at the election of the users. EPA’s final regulation affirms this policy and holds that the use of electronic manifests will be voluntary for manifest users. The paper forms will remain available for those who wish to continue to complete and process the paper forms. However, in the final rule, EPA clarifies that it is our ultimate goal to promote th e use of electronic manifests to the greatest extent possible. In this regard, the Agency may consider fee incentives or other means to promote this end.
**Comment:** We heard from 30 commenters who opposed EPA's proposal for States to voluntarily adopt the e

- manifest (Commenter Nos.1, 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 29, 31, 32, 35, 36, 43, 45, 46, 49, 51, 53, 57, 58, 59, 60, and 61). A number of commenters pointed out that less than full State adoption would compromise any intended burden savings to waste handlers, since they would have additional administrative activities, such as maintaining both an electronic and paper s ys tem and coping with a pat chwork of State programs (Commenter Nos. 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 31, 32, 36, 45, 49, 51, 53, 57, and 60). Many of these commenters believe that, unless it is mandatory , waste handlers would not have an incentive to invest in auto mated technologies, since State non

- participation could make electronic manifesting too burdensome (Commenter Nos. 4, 16, 17, 18, 23, 24, 25, 26, 32, 51, and 60). Another commenter believes that universal State adoption is in keeping with the Government P aperwork Elimination Act (Commenter No. 57). Four commenters pointed out that non

- participation b yDecember 2, 2013 FINAL DOCUMENT Page 14

States could interfere with interstate commerce (Commenter Nos. 4, 16, 22, and 36). One of these commenters stated that RCRA section 3006 precludes the Adm inistrator from giving authorization to a state program if such program is not consistent with the Federal or State programs applicable in other States (Commenter No. 4). The commenter also pointed to 40 CFR 271.4, which provides that an y aspect of the St ate program which unreasonably restricts or impedes the free movement across the State border of hazardous waste from or to other States for treatment, storage or disposal shall be deemed inconsistent. Another commenter suggested that EPA consider a prov ision in the State reauthorization program for the evaluation of a State's progress in implementing electronic manifests (Commenter No. 58). **Response:** EPA appreciates the many commenters who are in favor of mandatory State adoption of the e

- manifest. EP A is persuaded b y these views, as well as b y suggestions from stakeholders at EPA ’ s public meetings, that the e

- manifest should be effective, recognized as valid, and implemented consistently in all states. EPA agrees, for example, that development and us e of the e - manifest is not feasible unless it can be assured that the validity of electronic manifests is recognized in all the states. An IT vendor would not likely assume the risk of sy stem development unless it believed that the electronic manifest wou ld be recognized as valid in all jurisdictions. Also, a patchwork of state programs differing on whether electronic manifests were available or recognized would unduly complicate interstate transportation and be too burdensome for waste handlers were they forced to compl y with both paper and electronic requirements when they crossed state lines.
EPA ’ s final rule require s that all state programs adopt and recognize the validity of electronic manifests through the provisions of 40 CFR 271.4(c) that addres s state program consistency with the hazardous waste manifest. This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest s ys tem does not meet the requirements of Part 271. Moreover, the fe deral electronic manifest requirements supersede any less stringent or inconsistent requirements that may exist under state law. In the final rule, EPA deem s it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e

- manifest sy stem as a valid means of preparing and using the hazardous waste manifest. In addition, the e

- Manifest legisl ation and this final rulemaking provide that EPA will implement the e

- Manifest in a ll states on the same implementat ion date. EPA implementation and enforcement will continue until such time as each state revises its regulatory program and obtains authorization for the e

- Manifest program revisions from EPA.
**Comment:** We heard from eight commenters expressing that the e - manifest should be voluntary for the States (Commenter Nos. 27, 33, 35, 40, 44, 54, 59, and 63). Two commenters believe that EPA should hold off on mandating it as the Agency resolves unanswered questions and allows industry and the States to progress o n their own (Commenter Nos. 27 and 59). Another commenter suggested that EPA consider providing funding to States if the e

- manifest is mandated, or as another alternative, to add the electronic manifest to the RCRAInfo database (Commenter No. 40). Another commenter stated that States should not be required to automate because some States have their own laws regarding automation (Commenter No. 35).December 2, 2013 FINAL DOCUMENT Page 15

We heard from nine commenters specificall y addressing the implications to State programs under the e

- manifest (Commenter Nos. 24, 25, 30, 33, 34, 44, 48, 54, and 59). Four of the commenters indicated that the e

- manifest would place a considerable burden on State programs for such activities as training, modifying existing hardware or software, or making new purchases (Commenter Nos. 30, 33, 48, 54). One of these commenters suggested that EPA include language in the rule allowing States to have control over this burden (Commenter No. 48). Another of these commenters asked EPA to clarify the regulato ry

implications of the e

- manifest, given that some States might not adopt it (e.g., what are the regulatory implications if an electronic manifest is transported through a State that has not adopted the e

- manifest?) (Commenter No. 54). The commenter stat ed that States do not have the personnel or resources to implement and monitor an electronic manifest s ys tem. Another commenter noted that the rule would limit States ’ ability to collect additional information on the manifest; this limitation could prevent States from adopting the e

- manifest (Commenter No. 34). Another commenter indicated its support for EPA allocating funds to the States to assist them in developing their electronic manifesting sy stems in a timely fashion (Commenter No. 25). **Response:** EPA thanks commenters for their suggestion that state adoption of the e

- manifest requirements should be optional. For several reasons, however, EPA does not agree with this view. As discussed in the response above, EPA believes that uniform state adoptio n of the electronic manifest requirements is essential for the e

- manifest to be successful. Prospective u sers of the e

- manifest will consider it too risky to undertake unless electronic manifests can be implemented and recognized as valid in all the state s. A patchwork of different state programs would complicate interstate transportation and be too burdensome for waste handlers. As discussed above, EPA , in this final rule, deem s it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e

- manifest sy stem as a valid means of preparing and using the hazardous waste manifest. The 2012 e

- Manifest Act in fact mandates this result. EPA disagrees that mandatory state adoption of the e

- manifest will place undue burden on the states or industry . As an initial point, EPA ’ s national system approach will be much simpler for the states to implement and enforce than the p roposed approach. The final rule approach will be implemented through EPA ’ s own electronic r eceiving s ys tem, the CDX (or equivalent) and user requirements . In this regard, the final rule approach shifts a substantial burden for developing and implementing the e

- manifest from states and industry to EPA, in comparison with the proposed rule. For example, EPA will be responsible for ensuring that the CDX (or equivalent) is designed to provide the necessary

tools, controls, and procedures for users to complete, sign, transmit, and keep records of the e

- manifest in a secure environment. EPA also wil l be responsible for overseeing CDX operation and maintenance, and finalizing this rule and future regulations to enable e

- Manifesting, announcing user fee schedules, and providing clarification to th e states on consistent program adoption . Consistent with the e

- Manifest legislation enacted b y Congress, EPA will implement and enforce e

- Manifest initially , and states will be allowed a reasonable time within which they

will be expected to adopt their consistent and equivalent e

- Manifest requirements and obta in authorization. Thus, states will have some latitude to determine when they will assume implementation and enforcement responsibilities for electronic manifests, and EPA will implement the program in the interim. EPA encourages prompt adoption of electr onicDecember 2, 2013 FINAL DOCUMENT Page 16

manifest regulations b y the states, so that they might assume primary

implementation and enforcement responsibilities by the s ys tem implementation date. If this is not possible , however, the states will have additional time to examine and revise their existing programs to accommodate th e final e

- manifest regulations, and EPA implementation will continue in the interim.
Be yond this, EPA notes the final CROMERR, published in October of 2005, set forth a framework for electronic reporting that EPA, states, and local governments must follow under EPA's programs. The rule resolves a number of technical and policy questions related to e - reporting. Italso establishes the procedures and criteria for states to receive EPA authorization for their e

- repo rting initiatives. As such, EPA expects that states have already begun to consider changes to their programs to enable electronic reporting in response to CROMERR and that they are therefore well

- positioned to adopt the e

- manifest. We also note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect in all states immediately after a six

- month period following rule publication. The EPA Regions administer HSWA rules until State RCRA programs get authorized for them. We believe the States have worked effectively in coordinating and assuming their responsibilities under these HSWA rules. We are therefore confident that under the similar Federal/State implementation scheme included in the statute for e

- Manifest, the states will be similarly effective in transitioning to the final rule’s e

- manifest requirements.
**Comment:** We heard from two commenters supporting EPA ’ s position that the States should not be allowed to modify

the electronic manifest fo rm or procedures (Commenter Nos. 49 and 61). One of the commenters recommended that proposed 40 CFR 271.10(f) be strengthened as follows: “ ...No other electronic manifest format or information, other than that required b y federal law, may

be required by the State as a means to identify electronically

the generator, transporter, destination facility , quantit y, composition, discrepancies, origin, routing, destination of, or other information about a hazardous waste shipment during its transportation from th e point of generation to the point of storage, treatment, or disposal ” (Commenter No. 49). The other commenter agreed that State variations in the electronic manifest form or procedures could hinder interstate commerce (Commenter No. 61). **Response:** EPA thanks the commenters for their views. EPA agrees that participants in the e

manifest should not be burdened b y additional or inconsistent State requirements for completion, transmission and recordkeeping of the electronic m anifest. To address this, the final rule, at section 271.10(f)(1), states that with respect to manifests, “no other manifest form, electronic manifest format, shipping paper, or information other than that required b y federal requirements, may be required by

the state to travel with th e shipment, or to be transmitted electronically , as a means to track the transportation and delivery of hazardous waste shipments.” This consistency requirement extends as well to the electronic signatures that may be executed in connection with electroni c manifests. Section 271.3(b)(4) of the final rule further states that any requirement applicable to the content and use of electronic manifests, including electronic signature requirements, and imposed under the authority

of the 2012 e

- Manifest Act, “ shall supersede any less stringent or inconsistent provision of a state program.” EPA believes that these final rule requirements should be effectiveDecember 2, 2013 FINAL DOCUMENT Page 17

in preventing the states from placing additional requirements on e

- manifest participants beyond what is r equired b y the federal program . In addition to this, as described earlier in this document, EPA will be responsible for designing, developing, and operating the national e - manifest sy stem. As such, EPA will have sole control over the content and appearan ce of the e

- manifest that will be available on the national sy stem , the information collected on it, and the procedures for its use. We also note that EPA and our state partners have already had more than 5 years of experience with implementing the standardized hazardous waste manifest format that was announced in the March 2005 Manifest Revisions Rule. Implementation of the new manifest form has proceeded smoothly for several years, and the States have accepted the uniformity of the manifest data element s. We do not anticipate a different experience with a standardized electronic manifest format.

**Comment:** We heard from five commenters asking for clarification on, or changes to, the proposed procedures for transporters that do not automate (Commenter Nos. 4, 12, 17, 54, and 59). One of the commenters asked for additional guidance on how waste handlers could continue to use electronic manifesting in cases where the transporter does not participate (e.g., how should the electronic manifest r ecord that the transporter's signature is provided on the hard cop y manifest?) (Commenter No. 17). The commenter also asks for clarification whether waste handlers must retain the hard cop y signature for compliance purposes. Two commenters noted that the following sentence should be corrected: “ In such a case, the transporter could provide the generator with a hand

- signed copy of manifest ” (Commenter Nos. 54 and 59). They indicated that it should read as follows: “ In such a case, the generator could p rovide the transporter with a hand

- signed cop y of the manifest. ” Another commenter believes that proposed 40 CFR 264.71(a)(4)(i) should be revised b y adding the clause “ which bears the manifest tracking number ” after the words “ or other shipping paper un der 49 CFR part 172, subpart C ” (Commenter No. 4). Another commenter noted that proposed 40 CFR 264.71(a)(4) and 265.71(a)(3)(v) seem to indicate that only

the electronic copy

of the manifest is required to be retained by the TSDF for three ye ars, even th ough the signature of the transporter was manual and would not be recorded electronically

(Commenter No. 12). The commenter asked for clarification on whether the TSDF has a requirement to retain a paper cop y of the transporter's signature when the transp orter has not electronically

signed the manifest. **Response:** EPA thanks commenters for their suggestions on the procedures for transporters that do not automate. We also appreciate commenters’ suggestions for improving the preamble text. After consideration of all the comments, and considering the complexity entai led by

the proposed approach, EPA has made certain revisions for the final rule. For the final rule, all waste handlers shown on the manifest must be able to participate electronically, if they wish to complete and use the electronic manifest to track the ir waste shipment. Thus, the involvement of a non

participating transporter in a waste shipment would present a bar to using the electronic manifest. If an y party to the manifest is not able or willing to prepare and transmit manifest information electro nically , then the manifests for their hazardous waste transactions must be executed with the standard paper forms. However, generators may participate in e

- Manifest using the portable computer or device provided by the transporter servicing a generator’s waste. Indeed, we expect that many electronic manifest transactions will be executed in this manner.December 2, 2013 FINAL DOCUMENT Page 18

The proposed rule would have required copies of printed manifests to have been provided for non - participating transporters, and would have required attes tations of receipt and other handwritten notations to have been entered to describe the circumstances of the other parties’ electronic signatures. Each non

- participating transporter would have been required to retain a marked up hard cop y in its files, an d an additional hard cop y with all the attestation and signature information would have been provided to the designated facility for forwarding to the e

- Manifest sy stem operator. EPA concluded that the burden of complying with these additional paperwork r equirements would override an y benefits from recording a part of the transaction electronically. Therefore, we are omitting the proposed special e

- Manifest tracking requirements for non

participating transporters. Whil e this result may preclude some trans actions from being executed electronically , we believe that the burden and complexity associated with the procedures discussed in the proposed rule for involving non

- participating transporters in e

- Manifest were too great to retain in the final rule.
**Comm ent:**  We heard from 13 commenters regarding the requirement for automated transporters to carry a paper shipping paper in transport (Commenter Nos. 15, 17, 21, 22, 26, 33, 34, 35, 37, 48, 49, 52, and 54). One of the commenters expressed concern that the p aper cop y of the manifest might be confused with the electronic copy for purposes of RCRA recordkeeping purposes (Commenter No. 17). The commenter asked EPA to provide additional guidance on how a waste handler can use both a paper and electronic cop y for various DOT and RCRA compliance purposes. Another commenter asked for EPA to state more clearly that a shipping paper would be required in lieu of a paper manifest when electronic manifests are being used (Commenter No. 33). Four commenters asked EPA and/or DOT to eliminate the option to satisfy the DOT shipping paper requirement with an y shipping document besides a hardcop y m anifest (Commenter Nos. 15, 35, 49, and 54). Two of them point out that the manifest contains additional information designed to protect the environment (Commenter Nos. 35 and 54). One commenter indicated that its State program was designing an e

- manifest s ys tem that would require submittal of a paper cop y of the manifest to the State because it would include handwritten notes and signatures that were applied to the paper cop y during transport (Commenter No. 48). The commenter expressed concern that EPA's approach would not provide for collection of this paper cop y and, hence, States would not receive the actual signatures or addi tional notes that might not have been included in the electronic copy . Three other commenters expressed concern that the preparation of an electronic manifest and hardcop y shipping paper would jeopardize the goals of the proposal (e.g., burden reduction, streamlining the manifesting process) (Commenter Nos. 26, 34 and 37). A number of commenters urged EPA to continue coordinating the e

- manifest approach with DOT on relevant issues (Commenter Nos. 15, 17, 21, 22, 49 and 52). **Response:** EPA thanks comment ers on the requirement for transporters to carry a paper manifest. While it is the intent of EPA’s final e

- Manifest rule to eliminate as far as possible the reliance on the preparation and retention of paper records in connection with tracking hazardous wa ste shipments, it is not possible at this time to eliminate all paper documents that are required in the course of transporting hazardous wastes. As we explained in the May 22, 2001 proposed rule (see 66 FR 28268), it will still be necessary to carry a printed cop y of the manifest on the transportDecember 2, 2013 FINAL DOCUMENT Page 19

vehicle during the transportation of hazardous wastes that are subject to the hazardous materials regulations, since DOT requires that a hard cop y of a shipping paper be carried on transport vehicles for shipment s of hazardous materials, unless otherwise excepted. For shipments that involve state

- regulated wastes subject to a manifest requirement rather than RCRA

- regulated hazardous wastes, EPA is clarifying further that consistency in the use of the manifest und er RCRA also requires that a print

- out of the manifest must be carried on the transport vehicle during the transportation of these state

- regulated waste shipments. The adoption of the electronic manifest option in the final rule does not alter or eliminat e the existing DOT hazardous materials requirements and RCRA consistency provisions respecting shipping papers and the manifest. EPA has consulted extensively with DOT on this requirement, and we are aware that the Department is planning during 2013 a p ilot program (HM Access) to explore the use of electronic shipping papers for hazard communications among its stakeholders. Itis thus possible that DOT will revise the Hazmat regulations (HMR) in the not too distant future to support an entirel y paperles s shipping document. Therefore, to accommodate better these possible changes to the HMR, the final rule addresses this issue by clarifying that the paper cop y of the electronic manifest must be carried on the transport vehicle: “to the extent the Hazardous Materials regulation on shipping papers requires shippers of hazardous materials to supply a paper document for compliance with 49 CFR § 177.817.” See 40 CFR § 262.24(d) and § 263.20(a)(4)(iii). At such time as DOT permits an electronic shipping paper to meet its HMR requirement, our regulations will likewise authorize a fully paperless manifest without further amendment. While the requirement to continue to supply a printed copy

of the manifest for the transport vehicles may appear to frustrate somewhat the attainment of a totally paperless manifest s ys tem, we have strived in the rule to minimize as far a s possible the requirements to carry and maintain paper documents. Despite the continuing need to supply this printed cop y of the manifest, we believe that there will still be substantial reductions in paperwork burdens and forms/data processing costs for manifest users and regulatory agencies as a result of this final action. Moreover, the supplying of one paper copy on the transport vehicle provides a convenient back

up copy of the manifest data in the event the e

- Manifest sy stem becomes unavailable during transport or the electronic format becomes lost or corrupted. Finall y, the implementation of the electronic signature approach for the initial e

- Manifest sy stem may be aided by

the provision of one paper cop y that could be simultaneously signed in ink while digitized handwritten (electronic) signatures are also collected. That issue is discussed below in another comment response. **Comment:** We heard from two commenters expressing concern about the signature provisions for transporters that do not automate (Commenter Nos. 34 and 35). One commenter expressed concern that the transporter's signature would not be on the electronic manifest (Commenter No. 35). The commenter said states require the transporter's signature to be on each manifest copy it receives. Another commenter expressed concern that a one

- time manual signature could be used to represent several waste shipme nts (Commenter No. 34). **Response:** EPA thanks commenters for expressing their concerns about the signature provisions for non

- participating transporters. However, in the final rule, EPA require s all waste handlersDecember 2, 2013 FINAL DOCUMENT Page 20

named on the manifest to be willing and able to execute the manifest electronically . Therefore, the concerns raised in these comments about non

- participating transporters and their signatures not being recorded electronically are now moot. In regard to a transporter’s signature, EPA shares th e commenter’s concern that a digitized handwritten signature could be copied onto multiple manifests. For this reason, the final rule requires the digitized signature to be implemented to capture onl y dynamic signatures and to prevent the replay

of signature copies. Based on the methods used by document examiners to anal yz e such electronic signatures, a replay or exact copy

of a previous signature would be easil y detected on examination and thus identified as a forgery

. Refer to 40 CFR 262.25(b)(1)(ii) o f the final rule.
**Comment:** We heard from four commenters expressing concern about the proposed procedures for generators that do not automate (Commenter Nos. 34, 35, 54, and 59). Three commenters were concerned that the rule does not specify the transporter's timeframe for providing a generator with a signed paper cop y in instances when the generator signs an electronic manifest using a portable device provided by the transporter (Commenter Nos. 35, 54, and 59). These commenters believe the transporter s hould provide a copy to the generator at the time of shipment/signature. It should not be allowed to transmit a signed cop y after it has left the generator's site. One of the commenters also suggested that EPA should clarify that the TSDF must provide th e generator with a signed paper cop y of the manifest if the generator is not equipped to receive an electronic acknowledgment of receipt, comparable to the procedures for paper copies (Commenter No. 59). Another commenter expressed concern that the rule a llows for too man y el ectronic transaction scenarios, which could cause compliance difficulties (Commenter No. 34). In particular, the commenter disagrees that small waste handlers should have access to the e

- manifest if they cannot afford it. Rather, the commenter believes the proposal should be specificall y designed for handlers involved with large numbers of shipments. The commenter also noted that the rule would allow an automated generator to hold a non

- automated transporter's signature on file, wher eas an automated transporter would be required to acquire a signature from a non

- automated generator; the commenter asked for clarification on why these procedures are different. Another commenter asked EPA to clearl y describe what would be required of ge nerators, transporters, TSDFs, and States when one or more of them cannot automate (Commenter No. 54). **Response:** EPA thanks commenters for their views on the need for generators to have immediate access to their electronic manifests. EPA agrees with the ir concerns. As described in greater detail elsewhere in this document, EPA plans to host the e

- Manifest s ys tem on the Agency ’s Central Data Exchange/Exchange Network architecture (or equivalent) which EPA established to support the electronic reporting o f the various environmental reports and documents that are required for compliance with EPA’s environmental programs codified in Volume 40 of the Code of Federal Regulations. The CDX is an electronic gateway to which all electronic users of the manifest w ill have access. In regard to comments that the automated generators should have access to manifests that they sign in a transporter’s portable device, EPA is clarifying that all electronic manifests will reside in the CDX and be available to all waste handlers involved in its shipment in real time or near real time. There may be a brief period of time during which the manifest transaction data may be stored on the handheld device used to collect manifest data andDecember 2, 2013 FINAL DOCUMENT Page 21

signatures in the field, and then uploade d later to the network and e

- Manifest sy stem. Each generator and other waste handler would have an account on the e

- Manifest sy stem, and the sy stem would provide the generator’s electronic copy to the generator’s account at the time of delivery to the transporter, or very soon thereafter. Thus, we do not agree with the comment indicating that a generator must be provided with a paper cop y at the time the hazardous waste is delivered to the transporter. Of course, if a generator indicates a preference for a paper cop y, and the transporter is willing to provide such a cop y as an accommodation for the generator, then the provision of the paper copy is permissible, but not required. EPA also is clarifying that a generator would not have a transporter’s sign ature “on file.” All automated users, including transporters, would have two options for signing an electronic manifest: a digitized handwritten signature or a witnessed PI N/password. The transporter would be required to witness the generator signature a nd obtain proof of identity from the generator in order to use a PIN or password signature, or, waste handlers could sign with a high quality digitized signature product as discussed in the preamble of the final rule. EPA is confident that its regulations impose effective control over the authenticity of transporters’ signature s
. EPA shares the commenter’s concern about multiple user scenarios under the e

- Manifest. We agree that too many

user scenarios could make the sy stem unnecessarily complicated. At the same time, EPA heard from many stakeholders that the sy stem should be flexible enough to accommodate the t ypical arrangements that exist among generators, transporters, and designated facilities in the manifesting cycle, which can vary . We believe we have struck an appropriate balance in the final rule. The rule clarifies that the manifest can be executed electronically onl y if all waste handlers can participate in the e

- Manifest in accordance with the provisions of the final rule. However, we also address the common scenario under which a generator would not have its own computer equipment available, but would participate in e

- Manifest by using portable devices supplied by

the transporter or designated facility . These are the basic user scenarios contemplated by the final rule. In regard to the commenter’s concern that small businesses would be required to automate, the final rule provides that use of the e

- Manifest is voluntary . In addition, the rule allows generators to execute their electron ic manifests using the initial transporter’s portable devices. Small transporters may

continue to use the paper manifest for their hazardous waste shipments, should these transporters conclude that the use of electronic manifests is not cost

- effective for them. In this respect, EPA believes that sufficient flexibility exists to enable small generators and transporters to automate if they so desire or to keep manifesting their shipments with the traditional paper forms method.

**Comment:** We heard from four commenters on alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 16, 26, 51, 57, and 59). One of the commenters noted that companies would prefer to have the authority to use imaging technology to s tore copies of manifests so they

can reduce their warehousing costs (Commenter No. 59). Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51). TheDecember 2, 2013 FINAL DOCUMENT Page 22

commenter suggested that waste handlers could place their electronic manifests onto the centralized repository

for access by

stakeholders. Another commenter asked EPA to enable the use of Access as a back

- end database that will be supported by the Internet Forms and Action Works Metro (Commenter No. 26). **Respon se:**  EPA thanks the commenters for their su ggestions on manifest storage. EPA believes it is important for all electronic manifests to be completed, transmitted, and retained within t he national e

- Manifest sy stem. Therefore, the final rule provides that any requirement in the regulations for a generator to keep or retain a copy of each manifest is satisfied when the generator retains a cop y of an electronic manifest in its e

- Manifest account for the same retention period as required for paper manifest reco rds, provided that specified provisions are met. Among other things, the rule provides that electronic manifest copies are retained by a generator when the generator can store, access, and retrieve all of the generator’s electronic manifest records from a n account or record collection established for the generator on the EPA Electronic Hazardous Waste Manifest Sy stem. In addition, all paper and electronic manifests will be collected, held in a central repository

and made available to stakeholders (e.g., re gulators), as specified. EPA notes that the use of particular imaging technologies or database applications is beyond the scope of this final rule, and will be addressed in the sy stem planning and procurement.
**2.0 Standard Electronic Formats** 
**2.1 Propose**  **d EDI Format Comment:**  We heard from four commenters who supported the use of Transaction Sets 856 and 861 (Commenter Nos. 17, 19, 33, and 51). One of these commenters, however, encouraged EPA to explore more way s to collect the information on one transac tion set (Commenter No. 19). Another commenter suggested that the sets should be tagged with unique labels so the data can be matched (Commenter No. 51). The commenter asked EPA to define the data tags as well as the electronic data transfer standards; this will allow for the development of software that will be compatible and have longterm viability. The commenter also suggested that EPA allow vendors to bundle their other service features such as profiling. Another commenter noted that having two tran saction sets should not be complicated for waste handlers (Commenter No. 33). We heard from one commenter who asked for EPA to allow the use of EDI protocols currently used by the rail industry

to transport hazardous materials (Commenter No. 46). The commenter pointed out that the rail industry uses transaction sets in compliance with the American Institute (ANSI), Accredited Standards Committee (ASC) X12, and Transportation Data Coordinating Committee. These transactions sets consist of 404 (TDCC Bil l of Ladings), 858 (ANSI Bill of Lading), 417 (TDCC Car Movement Way bill), 418 (TDCC Interchange Consist), 997 (TDCC Acknowledgments), 824 (ANSI Acknowledgments), and 998 (TDCC Cancellation). The commenter suggested that requiring the railroads to use new protocols could discourage them from transporting hazardous waste. **Response:** EPA thanks commenters for their support and suggestions for the EDI approach for the manifest. For several reasons, however, EPA will likely offer XML , rather than EDI, as th eDecember 2, 2013 FINAL DOCUMENT Page 23

means for trans mitting information over the national sy stem . Over the past several ye ars, CDX development has reflected a significant evolution in formatting standards to accommodate the Internet

- away

from EDI and toward the use of XML . XML consists o f a set of predefined tags and message structures that, like EDI, allows machine

- to

- machine exchange of data in a mutuall y agreed upon format, enabling exchange of data across different s ys tems. However, unlike EDI, XMLis tailored to Internet

- based communications and securit y protocols. Additionally , an XML formatted file in combination with a style sheet can be displayed in a web browser. Such features would allow the CDX to use the same standard formats both for exchanging data files and for designing web forms that would maintain the appearance of manifest forms. The structure of XMLalso addresses some of the challenges in archiving data received, because the XML tags that accompan y the data in an XML file can be used to interpret the datas’ context without the aid of additional software. This could facilitate the recovery of data from archived files, and reduces the need to maintain the versions of the software originall y used to generate the files. At the time of the issuance of this final rule in late 2013, XML remains the preferred language for data exchange via the Internet, and thus is likely to be the data exchange language EPA will employ in the first generation e

- Manifest s ys tem. As data exchange languages and methods evolve, however, it is possible that e

- Manifest might migrate to another data exchange language or method. This is a sy stem development and implementation issue rather than an issue to be addressed b y regulation. EPA will, however, endeavor to support exchanges of data between e - Manifest and the rail sy stem’s electronic way

bill sy stem, which relies on the EDI transaction sets described above for data exchanges within the rail s ys tem. **Comment:** We heard from one commenter who asked if the EDI database would be available to EPA on demand for inspection (Commenter No. 13). The commenter stated that, if so, it would need a proprietary

s ys tem for outside the firewall. **Response:** EPA thanks the commenter for its question. As discussed above, EPA ’ s currently preferred sy stem development approach does not involve EDI. Rather, it would involve the use of XML via EPA ’ s central receiving s ys tem, i.e., the CDX. In this regard, industry participants will not need to establish proprietary s ys tems to maintain their e - manifests, since EPA and state inspectors will have direct access to them via the CDX. The final rule only provides that the electronic format supported by the national s ys tem is the standard electronic format required for electronic manifesting, and we do not specify by regulation a particular data exchange language or format.
**Comment:** We heard from one commenter in response to EPA ’ s request for comment on how signatures would be applied to manifest data inputted from a browser to a web site that translates the data into an EDI compliant format (Commenter No. 33). The commenter stated that the signature would be digitally applied, n o matter what form the original “ signature ” took. The exact nature of how the user would sign the document, whether it is by digital signature or secure digitized signature, would depend on the s ys tem involved. The commenter believes that encry ption woul d provide a reasonable level of security and authentication.December 2, 2013 FINAL DOCUMENT Page 24

In response to EPA ’ s request for comment on whether it is the HTMLdocument or the X12 document that would be signed, the commenter stated that, on a technical level, it is the HTML document that should be signed, since the signer never actuall y “ sees ” the X12 document. The commenter added, however, that the signature would have to accompany the X12 document in some fashion. In response to EPA ’ s request for comment on whether the translation at the server would complicate the verifiability of an y digital signatures, the commenter stated that this would be unlikely , given the current state of the technology and assuming that reasonable thought went into the ty pe of digital signatures being used. The commenter stated that encry ption algorithms exist which allow for a great degree of error correction. The commenter does not believe that it would be that complicated to routinely check transmissions received for translation errors. **Response:** EPA thanks the commenter for its question. As discussed above and elsewhere in this document, EPA ’ s preferred sy stem approach does not involve EDI . It would involve the use of XMLthrough EPA ’ s electronic receiving s ys tem, i.e., the CDX or equivalent sy stem. Li kewise, our final rule will not initially require digital signatures as the method for signing electronic manifests, so the comment addressed to verifying digital signatures is moot. These comments raise technical issues that are beyond the scope of th is final regulation.
**2.2 Proposed Internet Forms Format**  **Comment:** We heard from 10 commenters expressing support for the proposed use of XML in automating the manifest cycle (Commenter Nos. 12, 17, 19, 25, 30, 31, 33, 35, 48, and 51). A number of these c ommenters noted that XML is more cost

- effective than EDI, which could encourage its use (Commenter Nos. 31, 33, 35, 48, and 51). One of the commenters pointed out that a web

- based approach also will allow eas y additions of features and upgrades (Commenter No. 31). The commenter asked EPA to clarify how EPA proposes to store web

- based forms. We heard from one commenter who said that the rail industry currentl y uses EDI and that, due to securit y reasons, the railroads would be less likely to interchange rec ords with customers over the Internet (Commenter No. 46). The commenter recommended limiting the proposal to EDI. **Response:** EPA thanks commenters for their support of the web forms approach for the manifest. EPA agrees that there are a number of benefits to an approach rel yi ng on XMLand web based data exchanges. As discussed above and elsewhere in this document, the CDX or equivalent national sy stem will likely employ schemas and style sheets developed in XMLfor the electronic exchange of e - manifest data. EPA will also endeavor to develop an interface that will enable e

Manifest data to be exchanged with the rail s ys tem’s electronic way bill system. However, the specification of a particular data exchange language or particular schema/ele ctronic format for the manifest is a sy stem development issue that is beyond the scope of this final regulation.
**Comment:** We heard from four commenters suggesting clarifications or modifications to the proposed Document Ty

pe Definition (DTD) (Commenter No s. 12, 30, 32, and 33). OneDecember 2, 2013 FINAL DOCUMENT Page 25

commenter suggested that the final rule should include a more up

- to

- date XMLSchema, rather than the XML DTD as proposed, due to its richer format (Commenter No. 32). The commenter also suggested that EPA consider use of a nam e space to distinguish the DTD from other DTDs that may be developed in the future, as well as the addition of other data elements. Another commenter asked whether EPA would draft a DTD to be the equivalent of the ASC X12 861 data set (Commenter No. 30). Another commenter suggested that co

- development of the XML schema between EPA and stakeholders will ensure the manifest is compliant with other XML sy stems in development (e.g., s ys tems being developed by the United Nations, the Department of Defense, and other government organizations) (Commenter No. 12). The commenter believes that use of a common XMLframework will allow vendor neutral access to the information. Another commenter suggested that, if feasible, EPA should develop a Document Ty pe Definiti on to set the standard for any XML usage with respect to the manifest (Commenter No. 33). **Response:** EPA thanks the commenters for their many suggestions on the XML schema and stylesheets. As explained in previous comment responses, EPA currentl y prefer s an XML schema and st yl esheet as the electronic for mat for the electronic manifest, and will likely develop the first generation sy stem with support for such a schema and stylesheet. Because there will be only one national e

- Manifest sy stem established under the final rule, it is not necessary

to promulgate the electronic manifest XMLschema and st yl esheet as a part of this rule notice. Rather, the development of the schema and stylesheet wil l be included in the sy stem design requirements for the IT co ntractor(s) selected to build and operate the e

- Manifest s ys tem. This final rule does not stipulate the use of a specific schema or data exchange language for e

Manifest, but only

states that the electronic format supplied by the national e

- Manifest s ys te m will be the exclusive electronic format recognized by EPA for exchanging manifest data. Thus, the rule remains technology neutral with respect to the precise schema, data exchange language, or electronic format that will be used in the national sy stem d esign.
**Comment:** We heard from one commenter who asked EPA to enable the use of Access as a back

- end database that will be supported by the In ternet Forms and Action Works Metro (Commenter No. 26). **Response:** EPA thanks the commenter for its suggestion

. Obviousl y, it has been man y ye ars since EPA conducted the pilots that involved Internet Forms and Action Works software. Many such applications are available as we consider the development of the national sy stem in the coming ye ars. As described above , EPA will task a vendor to develop the e

- Manifest sy stem in accordance with EPA’s technical requirements and stakeholder input . EPA conducted several requirements meetings with stakeholders in February

– March 2013, and we will continue this outreach as we continue with the sy stem planning and development efforts. These design issues are beyond the scope of this final regulation.
**3.0 Electronic Record System Controls and Procedures** 
**3.1 Validation of System Performance and Training** December 2, 2013 FINAL DOCUMENT Page 26

**Comment:** We heard from three commenters who expressed support for the proposal to require an independent audit of the electronic manifest s ystem (Commenter Nos. 19, 30, and 33). One of the commenters supported an independent audit if the waste handler does not us e off

- the

- shelf software, and suggested that EPA provide a list of approved, commerciall y available off

- the

- shelf packages that, if properly installed and used, would meet all of the validation requirements (Commenter No. 19). Another commenter supported the written assessment, but asked if there is guidance or checklist for the certification (Commenter No. 30). Another commenter believes the proposed approach is reasonable, provided it can be implemented in a reasonably efficient and cost

- effective manne r that does not impose any undue hardship on smaller handlers (Commenter No. 33). The commenter believes the off

- the

- shelf alternative approach could meet with some resistance from larger companies, which would not want to buy off

- the

- shelf software. The y also might not want to use third

- part y vendors because they have in

- house resources and expertise. The commenter believes that, in the case of off

- the

- shelf software and s ys tems developed independentl y of waste handlers, third

- party validation would pro bably still be necessary , if onl y to insure that the independent developers were doing their job correctly and that the waste handler was using the products correctl y. **Response:** EPA thanks the commenters for their many views on validation of sy stem perfo rmance and training. In the May 22, 2001 proposed rule, EPA proposed specific t yp es of computer s ys tem securit y controls. These securit y controls were proposed at section 262.26(c) of the proposed rule and were meant to ensure the authenticity and integrity

of electronic manifest data, to avoid repudiation of manifests created on electronic s ys tems, and to ensure the consistent and reliable processing of manifests b y the various electronic s ys tems that may have arisen under the proposed rule. The propose d rule assumed that private entities would develop various electronic manifest s ys tems adhering to EPA’s standards, so it was necessary to require inspector access to both the manifest copies and the electronic manifest sy stems so that EPA could inspect th e manifests and the private sy stems for compliance. EPA acknowledges that these s ys tem security controls were quite detailed, and that if implemented, they

would have had considerable impact on any private entities that might have developed electronic man ifest sy stems under the proposed rule approach. EPA believed it was necessary to specify

these controls, and to validate and certify through written assessments that they had been implemented successfully , to provide some floor level of consistency and se curity in the design and operation of the “decentralized” electronic manifest s ys tems anticipated by the proposed rule. At the time the proposed rule was developed, there was much concern that the decentralized approach might foster the development of num erous proprietary s ys tems that would be incapable of communicating with each other, and that this approach might result in inconsistent and insecure sy stems with questionable ability to produce reliable and enforceable data. So, the proposed security and p rocessing controls were intended to ameliorate this concern by addressing what we felt were a necessary floor set of controls to define a minimally acceptable level of consistency , data integrit y, and s ys tem security for the various private sy stems that mi ght have developed under the proposed rule. Based on stakeholder input and further consideration, EPA has determined not to codify the proposed s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published aDecember 2, 2013 FINAL DOCUMENT Page 27

notice of data availabi lity and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option had changed to the e stablishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fee s that would be paid b y the waste handlers who choose to use electronic manifests. After consideration of public comments and the requirements of the 2012 e

- Manifest Act, EPA’s final rule decision is to establish such a national or centralized sy stem. Si nce EPA has decided to adopt a centralized sy stem approach for the e

- Manifest sy stem, it is no longer necessary

to promulgate regulatory securit y controls in order to assure a floor level of consistency

and securit y among various private s ystems. Because there will be one national e

Manifest sy stem developed to host the transmission of electronic manifests, the sy stem securit y requirements for e

- Manifest will instead be planned and addressed under the securit y planning requirements that appl y t o all Federa l information sy stems. The Federal security planning requirements will produce a detailed set of requirements and controls appropriate to the security impacts of e

- Manifest, and these requirements and controls will be implemented when the Agency awards a contract to an I T vendor to build and operate e

- Manifest. EPA believes it is far more sensible to develop the e

- Manifest sy stem security requirements and controls in this manner than to promulgate regulations that would codify the sy stem securit y controls . The Federal information sy stem security planning requirements and process are set out in several publications of the National Institute of Standards and Technologies (NI ST). Taken together, these publications describe a well thought out and understood process for determining appropriate securit y controls, for monitoring the effectiveness of the controls and identifying vulnerabilities and needed corrective actions, and for periodically certifying and accrediting the securit y of an information sy stem. Therefore, in lieu of codifying s ys tem security requirements for the electronic manifest in the final rule, EPA will instead follow the gui dance presented in NIST Publication s and other Federal information technology

and sy stems security

guidance. Over the period of operation of the e

Manifest sy stem, the requirements and controls developed pursuant to this guidance will be monitored, adjusted as necessary , and certified. EPA believes that this approach will be a far more responsive and effective means to address the securit y of e

- Manifest than the regulatory requirements that we proposed in May , 2001. The criticisms and concerns that commenters identified with the proposed security standards are mooted by the approach we are following in this final ru le. The particular securit y requirements for e

- Manifest will be addressed as part of the sy stem planning, development, and certification processes, and are not included in the scope of this final rule.
**Comment:** We heard from nine commenters who expressed opposition to the requirement for a third

- part y assessment (Commenter Nos. 5, 12, 13, 17, 22, 26, 46, 51, and 57). One of the commenters suggested that the entity developing the sy stem should assume all liability for the operation of the s ys tem (Commente r No. 5). Another commenter believes that, rather than an independent assessment, EPA should simply establish standards that require accuracy , security , and reliability

(Commenter No. 17). Three commenters expressed opposition to the requirement that the software be developed by an independent firm that is not a waste handler (Commenter Nos. 17, 22, and 26). One commenter strongl y disagrees with the suggestion that the use of aDecember 2, 2013 FINAL DOCUMENT Page 28

commercial electronic manifest software package should be a rule requirement (Commenter No. 57). Several commenters believe that companies should be given the option to validate their own sy stems instead of a third

- part y assessment (Commenter No. 13, 22, and 51). Two of these commenters do not believe that there should be any cre dentials for persons who conduct the self

- audit (Commenter Nos. 22 and 51). Several commenters noted that most commercial TSDFs already have controls in place for their paper

- based manifesting and recordkeeping and that these controls would be used under the proposal; hence, EPA need not impose any additional controls on these facilities for electronic manifests (Commenter Nos. 12, 22, and 57). One commenter indicated that, if the requirement for a third

- part y assessment remains in the rule, EPA should a lso require regulatory

agencies to become subject to similar sy stem assessments and management protocols with evaluation by independent third parties. **Response:** EPA thanks the commenters for their views on the proposed validation of sy stem performance and training. However, EPA has determined not to codify the proposed s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 198 42), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response above for further information about the security requirements that will be implemented pursuant to Federal information technology standards and guidance.
**Comment:** We heard from ten commenters suggesting clarifications or modifications the proposed approach for an independent assessment of the electronic s ys tem or use of off

- the

- shelf software (Comment er Nos. 16, 29, 30, 32, 33, 34, 54, 57, 59, and 63). A number of commenters suggested that EPA clarify the criteria or standards by which the electronic sy stem would be assessed and/or the qualifications that the third party must satisfy

(Commenter Nos. 3 0, 32, 33, 54, 57, 59, and 63). One of these commenters suggested that there needs to be a standard whereb y onl y licensed s ystems professionals can perform the validation assessments, and that such licensing would require some training and certification ( Commenter No. 33). One commenter suggested that the proposed electronic manifest form should be reviewed b y a professional printer to ensure that design problems are eliminated, because computer designed forms often lack consistency in layout when printed (Commenter No. 16). Another commenter suggested that, like printers of paper manifests, software developers should be required to register to develop manifest software (Commenter No. 29). The commenter suggested that registration of software packages wo uld ensure that they meet the standard content and data mapping required for Federal and State databases. Another commenter suggested that, if EPA finalizes the proposed approach, it should require regulatory agencies to become subject to similar sy stem a ssessments and management protocols with evaluation by independent third parties (Commenter No. 57). Another commenter asked EPA to clarify the enforcement and liability issues associated with the proposed validation standards (Commenter No. 34). **Respons e:**  EPA thanks the commenters for their views on the proposed validation of sy stem performance and training. However, EPA has determined not to codify the proposed s ys temDecember 2, 2013 FINAL DOCUMENT Page 29

securit y controls as part of the final rule. On April 18, 2006, EPA published a not ice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest in fact mandates this approach. Comments on the proposed private s ys tem securit y controls, including the comment about an independent assess ment of private s ys tems, are now moot. Please refer to the EPA response above for further information.
**3.2 The Ability to Generate Accurate and Complete Records Available for**  **Inspection Comment:**  We heard from two commenters who indicated their general support for the proposed requirement for manifest sy stems to have the ability to generate accurate and complete records available for inspection (Commenter No. 22 and 46). One of the commenters sug gested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g., the next working day) (Commenter No. 22). The commenter believes this revision will help in those instances where a company 's "knowledgeable person" is not immediately

available (for whatever reason) or the computer s ys tem is temporaril y offline. We heard from one commenter who did not express support or opposition to the proposed requirement, but suggested that EPA coordinate the requirement with DOT to ensure that the securit y issues can be resolved within both programs (Commenter No. 47). **Response:** EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection. However, EPA has determined not to codify

the proposed sy stem security controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to si gnal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest s ys tem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. EPA will develop the national sy stem with security controls appropriate under Federal information technology standards and guidance. Comments on the proposed s ys tem controls for private s ys tems ar e now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from seven commenters asking for clarification or modification of the proposed requirement for manifest sy stems to have the ability to generate accurate and complete records available for inspection (Commenter Nos. 13, 22, 26, 32, 46, 59, and 63). One commenter indicated that railroads do not generally provide access to their computer s ys tems to outside parties; however, ra ilroads are willing to work with EPA to provide the information requested within a reasonable timeframe, but not necessarily on an immediate basis (Commenter No. 46). The commenter also indicated that EPA should not expect to access railroad computer sy st ems directly ; rather, EPA should allow persons knowledgeable with the computer software to access and produce those records for them. Another commenter indicated that the proposed ruleDecember 2, 2013 FINAL DOCUMENT Page 30

mentions the need to provide an interface for a regulator to be able t o access the sy stem that supports digital manifesting (Commenter No. 32). The commenter suggested that the rule should clarify whether this interface is a required element of a conforming s ys tem, or simply a desired functionality . The commenter notes that, if a regulator interface is indeed required, far greater detail needs to be provided regarding how such an interface would work and what its components would need to include. Another commenter noted that the proposed rule would require a person on sit e who can assist a RCRA inspector with operation of the software (Commenter No. 26). The commenter suggests that this requirement should not be construed to require a person to be available at all times. Another commenter recommended that both the electronic on

- screen view and the paper cop y of the manifest printed b y inspectors should be required to match the standard paper manifest form so inspectors can view manifest information in the same "format" at every waste handler (i.e., the computer screen and an y printed copies of the electronic manifest information should look just like the standard paper manifest form) (Commenter No. 59). Another commenter indicated that some utility companies with wide service territories may choose to maintain their electronic records for each facility at a more central location as opposed to the facility

itself (Commenter No. 22). The commenter suggested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g ., the next working day). One commenter noted that, if the EDI database would be available to EPA on demand for inspection, it would need a proprietary s ys tem for outside the firewall (Commenter No. 13). Another commenter asked that the final rule provide further clarification regarding the issue of inspections of electronic records (Commenter No. 63). The commenter believes EPA should include a requirement for waste handlers to print out a one or two line "summary report" of electronic manifest activity

. The commenter believes this should be required on a weekl y basis so that if a sy stem is down, or if the contact person is not available, the inspecting entity would still have manifest information. **Response:** EPA thanks the commenters for their suggesti ons on the proposed controls for generating accurate and complete records available for inspection. However, EPA has determined not to codify

the proposed sy stem security controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest s ys tem to be hosted by EPA and funded by

service f ees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. Information securit y controls will be developed in accordance with applicable Federal information technology stan dards and guidance. Comments on the proposed s ys tem controls for private s ys tems are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from three commenters regarding the feasibility of long

- term validation of digital signatures (Commenter Nos. 33, 59, and 60). One commenter opposed the requirement for long

- term validation, since handwritten signatures on paper manifests are not subject to the same standard (Commenter No. 60). Another commenter noted that current technology is not generall y available that will permit validation at the time of transmission and maintain the validation for three ye ars (Commenter No. 59). For example, the commenter clarified that, if a valid certificate is later revoked, such as when an employee leaves the company , previous (valid)December 2, 2013 FINAL DOCUMENT Page 31

manifests will be invalidated as well. Another commenter believes that longterm validation is feasible in regard to technical challenges; however, it is unclear if it is feasi ble in regard to administrative challenges and cost (Commenter No. 33). The commenter does not believe there are practical way s to ensure long

- term enforcement capability and liability protection for companies using manifests without imposing the burden and costs of indefinite signature validation mechanisms. The commenter believes it is a question of how much risk EPA wants to live with and who will pay the costs of minimizing that risk. The commenter added that, if EPA wants to minimize such risk, the n some effort must be made to insure the long

- term validity of digital signatures. The commenter believes the central questions are who would implement and pay for such measures, and how many years such validation efforts should attempt to cover. The commenter believes EPA should handle the cost, particularl y since leaving it to the waste handlers themselves is an uncertain proposition. **Response:** EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complet e records available for inspection. However, EPA has determined not to codify

electronic signature requirements in this final regulation. Instead, this final rule requires “valid electronic signatures” that compl y with the Agency ’s CROMERR, and we recomm end (but do not require) two signature methods that may be feasible under CROMERR. Our current recommendations focus on PI N/password and digitized handwritten signature methods for the first generation s ys tem. We are not currentl y recommending digital si gnatures involving public key

/private key

encry ption methods (see discussion at § 4.2) , so we consider this comment moot. **3.3 The Ability to Protect Records**  **Comment:** We heard from two commenters regarding the requirement for retaining prior versions of software and hardware as necessary to access manifest records (Commenter Nos. 26 and 59). One commenter noted that the requirement may require TSDFs to retain records for at least 30 ye ars after facility

closure and asked EPA if this was inte nded (Commenter No. 26). Another commenter noted that maintaining prior versions of software and hardware for the required retention period could be extremely costl y (Commenter No. 59). The commenter noted that a State's laws may

require it to retain rec ords for much longer periods of time than the Federal program, making the requirement even more costly . The commenter also noted that many companies update their data files for active accounts and archive inactive accounts. The companies may

rely on pape r documents rather than the archived data when information is needed at a later date. The commenter believes the proposed rule appears to prevent these practices b y precluding the alteration of electronic documents once they are signed. The commenter ask ed EPA to consider the longterm consequences of prohibiting an y alteration of an electronic document after it is signed. **Response:** EPA thanks the commenters for their suggestions on the proposed data protection standards. However, EPA has determined not to codify the proposed s ys tem security controls for private s ys tems as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the ru lemaking record that EPA’s preferred option is now the establishment of a national e

-December 2, 2013 FINAL DOCUMENT Page 32

Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate security controls pursuant to applicable Federal information technology

standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from two commenters in regard to the ability of protecting electronic files over the long term (Commenter Nos. 13 and 33). One commenter indicated that backup storage of information is a co ncern since s ys tem crashes do occur (Commenter No. 13). The commenter asked for clarification on what constitutes "standard computer security" and the destruction of information in relation to sy stem failure. Another commenter indicated that digitally si gned and electronically

stored media are inferior to paper copies in terms of being more susceptible to corruption/destruction b y heat, magnetic fields, and degradation (Commenter No. 33). The commenter added that storage standards change over time, makin g it more difficult to comply over the long term. The commenter suggested three ways to address these concerns: (1) creation of multiple copies of the stored information and dispersal of the copies to multiple sites; (2) periodic check

- ups of the stored material and upgrades as needed; and (3) encoding of a piece of data within a much larger data

- string with built

- in error

- correcting features, so that even if one part of the string becomes corrupted, it is still possible to decode the original piece of da ta correctly

. **Response:** EPA thanks the commenters for their suggestions on the proposed data protection standards. However, EPA has determined not to codify the proposed private sy stem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted b y EPA and funded b y service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate security controls for this sy stem pursuant to applicable Fede ral information technology

standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from one commenter on the appropriateness and feasibility of a requirement that manifest records be periodicall y archived on a write

- once, read

- many medium (Commenter No. 33). The commenter indicated that it is feasible and advisable that manife st records be periodicall y archived on write

- once read

- man y storage mediums. The commenter noted, however, that it is important to remember that an y digital storage medium is corruptible. The commenter suggested that multiple copies be made and those cop ies be stored at multiple sites. **Response:** EPA thanks the commenter for its views on the proposed data protection standards. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking recordDecember 2, 2013 FINAL DOCUMENT Page 33

that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be ho sted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate s ys tem security controls pursuant to applicable F ederal information technology standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**3.4 The Ability to Limit System Access and Conduct Auth**  **ority Checks Comment:**  We heard from one commenter stating its support specifically for authority

checks and audit trails (Commenter No. 30). We heard from another commenter who generally agreed with the proposed requirements to limit access and conduct authorit y checks, because the railroads already have such systems in place (Commenter No. 46). However, the commenter opposed the criteria to maintain auditable logs of logon attempts and logon failures and rejections for a three

- ye ar period ( Commenter No. 46). The commenter indicated that, because of the huge number of transactions involving railroads, such a requirement would place a significant burden on the industry

and force railroads to use a paper sy stem. **Response:** EPA thanks the comm enters for their support of the proposed access controls and authority checks. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availabili ty

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by

service fees that woul d be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate sy stem securit y controls pursuant to applicable Federal information technology

standards and guid ance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from one commenter who expressed its opposition to the requirements to limit access and conduct authority checks (Commenter No. 57). The commenter indicated that electronic s ys tems should not be subject to greater controls than those for paper manifests. **Response:** EPA thanks the commenter for its views on the proposed access controls an d authority checks. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 1 9842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electroni c manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate sy stem securit y controls pursuant to applicable Federal information technology

standards and guidance. Comments on the proposed sy stem controls are now moot . Please refer to the EPA response in Section 3.1 of this document for further information.December 2, 2013 FINAL DOCUMENT Page 34

**Comment:** We heard from three commenters who asked EPA to clarify the technical standards associated with limiting unauthorized access to systems and data (Comment er Nos. 26, 34, and 59). One of these commenters also asked for clarification on the compliance and enforcement issues associated with these proposed requirements (Commenter No. 34). For example, the commenter asked what would happen if a s ys tem did not track failed log

- ons but had all other assurances (e.g., would it be approvable?). One commenter asked for clarification on the circumstances under which the alteration of a record would be allowed (Commenter No. 59). The commenter believes that it appe ars that the alteration of a record would invalidate the electronic signature on the record and place the entire sy stem at risk of repudiation. **Response:** EPA thanks the commenters for their views on the proposed access controls and authority checks. How ever, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate sy stem securit y controls pursuant to applicable Federal information technology

standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the E PA response in Section 3.1 of this document for further information.

**3.5 Use of Secure Audit Trails**  **Comment:** We heard from one commenter who recommended that EPA acknowledge and anticipate that there may

be sy stem failures or natural disasters that caus e delay s in the submission of the manifest forms (Commenter No. 24). The commenter therefore proposed that facilities should be able to rely on electronic time stamps for the date of transmission of manifests, so that a problem with electronic sending doe s not become a compliance issue. **Response:** EPA thanks the commenters for their views on the proposed standards for use of secure audit trails. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manif est sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop appropriate sy stem securit y controls pursu ant to applicable Federal information technology

standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.December 2, 2013 FINAL DOCUMENT Page 35

**Comment:** We heard from three commenters indicating their opposition to the requirement for the use of secure audit trails (Commenter Nos. 26, 46, and 57). One commenter indicated that creating a s ys tem to save all changes to manifest transactions would require pr ogramming changes b y the railroad industry (Commenter No. 46). For these and other reasons, the rail industry would probably

choose to stay

with the current paper s ys tem because the cost would outweigh the benefit. Two commenters indicated that the electronic manifest sy stem should not be subject to more burdensome controls than pen

- and

- ink completion of the paper manifest (Commenter Nos. 26 and 57). One of the commenters stated that there is no need to identify or audit every

part y that has viewed a manifest, only the ones that have changed its contents (Commenter No. 57). **Response:** EPA thanks the commenters for their views on the proposed standards for use of secure audit trails. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop app ropriate sy stem securit y controls pursuant to applicable Federal information technology

standards and guidance. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information

. **Comment:** We heard from one commenter who expressed support for the requirement to use secure audit trails (Commenter No. 30). **Response:** EPA thanks the commenter for its views on the proposed standards for use of secure audit trails. However, EPA ha s determined not to codify the proposed private sy stem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on th e rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted b y EPA and funded b y service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Ac t in fact mandates this approach. EPA will develop appropriate s ys tem securit y controls pursuant to applicable Federal information technology

standards and guidance. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response i n Section 3.1 of this document for further information.
**3.6 Software** 
**- based Work Flow Controls and Operational System Checks**  **Comment:** We heard from two commenters requesting EPA clarification regarding making corrections to electronic manifest data once the manifest is signed (Commenter Nos. 57 and 59). One commenter indicated that, because TSDFs and transporters that prepare manifests have historically

made basic errors (e.g., entering the wrong Generator USEPA ID number), the commenter believes the prop osed regulations need to address the correction of mistakes identified after the electronic manifest is closed (Commenter No. 59). The other commenter noted thatDecember 2, 2013 FINAL DOCUMENT Page 36

paper manifests are often prepared b y one part y and subsequently edited b y downstream handler s, e.g., b y transporters and TSDFs (Commenter No. 57). The commenter is uncertain if this process would be preserved in the proposed s ys tem. The commenter believes that the proposed security provisions essentially

lock down portions of the manifest as th ey are signed and prohibit future modifications. **Response:** EPA thanks the commenters for their views on the proposed standards for software

based work flow controls and operational s ys tem checks. However, EPA has determined not to codify the proposed private sy stem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest s ys tem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. EPA’s n ational s ys tem will largel y provide the critical work flow controls and operational s ys tem checks. Comments on the proposed private sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Co mment:**  We heard from two commenters in response to EPA's request for comment on what the appropriate response should be when an invalid signature is detected (Commenter Nos. 33 and 34). Both commenters believe the appropriate response should be to block f urther use or transmission of any

manifest found to be invalid or for which the electronic signature cannot be verified. One commenter indicated that its State program does not key punch data from manifest forms that are not signed (Commenter No. 34). The other commenter clarified that, although further use of such a manifest should be blocked in theory , it is likel y, particularl y as the s ys tem is being phased in, that unforeseen problems will occur where this approach could make things unworkable (Comment er No. 33). For that reason, the commenter believes it might be advisable to have the s ys tem alert the recipient to the requirement to obtain a valid manifest, but not itself block the use, thus giving some flexibility while the recipient works to resolve the validity problem. **Response:** EPA thanks the commenters for their views on the proposed standards for software

based work flow controls and operational s ys tem checks. However, EPA has determined not to codify the proposed s ys tem security controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. Comments on the proposed s ys tem controls are now moot. We agree that this comment raises a valid concern, and that there may

be circumstances (e.g., an electronic signature collected off

- line) where the data in an electronic manifest must be passed through the sy stem before the signature can be validated. This is one reason that we recommended in the final rule preamble (contingent on peer reviewed studies of reliability ) the use of the digitized handwritten signature method, as this would allow signature data, including forensic data, to be collected and stored for later examination by

document exami ners in the event there should be a question about the legitimacyDecember 2, 2013 FINAL DOCUMENT Page 37

of the signature. This is how ink

- signed signatures are authenticated, and there seems to be much merit to the digitized handwritten signatures because of the similarity with which they

are executed and authenticated. PIN/password signatures, on the other hand, would either require validation against data stored locall y on portable devices in the field, or would require later validation that might give rise to signature discrepancies that wo uld need to be reconciled a fter manifests are transmitted. EPA will examine this issue further during s ys tem planning and development.
**Comment:** We heard from one commenter who opposed requirements for software

- based work flow controls and op erational sy stem checks because such requirements would entail programming that would not be cost effective (Commenter No. 46). The commenter noted that EPA's regulations already recognize the unique aspect of railroads and their ability to transmit documents electronically and hence should not mandate additional requirements when the s ys tem is already working well. **Response:** EPA thanks the commenter for its views on the proposed standards for software

based work flow controls and operational s ys tem ch ecks. However, EPA has determined not to codify the proposed private sy stem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to sign al to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest s ys tem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. T he 2012 e

Manifest Act in fact mandates this approach. EPA’s national s ys tem will largel y provide the critical work flow control s and operational s ys tem checks that the proposed rule suggested for disparate private s ys tems. The Agency does not intend to apply

its e

- Manifest sy stem controls to the rail sy stem’s electronic way bill sy stem. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**3.7 Software** 
**- based Data**  **Presentation Features and Signature Prompts Comment:**  We heard from one commenter expressing full support for the proposed data presentation features (Commenter No. 59). The commenter believes the manifest sy stems should not only be able to, but be requir ed to, display all of the manifest data in a readable format at the time the electronic manifest is signed. Two other commenters expressed support for EPA's proposal for a warning message for both digital and digitized signatures (Commenter Nos. 19 and 33 ). One of the commenters also indicated that the signature warning should be display ed each time a signature is required (Commenter No. 33). With regard to the secure digitized signature approach, however, the commenter wondered if this approach would be feasible and/or practical for all ty pes of digitizer pad devices to be used. **Response:** EPA thanks the commenters for their views on the proposed standards for software

based data presentation features and signature prompts. However, EPA has determined not to codify the proposed private sy stem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is nowDecember 2, 2013 FINAL DOCUMENT Page 38

the establishment of a national e

- Manifest s ys te m to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. EPA will incorporate similar signature warnings and prompts into the national sy stem’s work flow, and we plan to retain the requirement that electronic manifests be displayed in a readable format before signatures are applied. However, with the widespread use of tablets and portable devices with varying display sizes, the re may

be some adjustments necessary to this requirement (e. g., scrolling) to accommodate variations in display size among devices. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document f or further information.
**Comment:** We heard from two commenters expressing opposition to the warning prompt for invalid signatures (Commenter Nos. 34 and 46). One commenter indicated that the warning prompt is unnecessary

because EDI is a well

- established process, railroads have well

- established relationships with other waste handlers, and the protocols are well

- understood by all parties (Commenter No. 46). The commenter stated that additional controls above what is already required of railroads would disc ourage use of electronic manifesting. Another commenter indicated that a warning is not needed because it should be assumed that users understand the consequences and liability of signing their name (Commenter No. 34). **Response:** EPA thanks the commente rs for their views on the proposed standards for software

based data presentation features and signature prompts. However, EPA has determined not to codify the proposed s ys tem security controls as part of the final rule, and we do not intend to apply the signature warnings and prompts discussed in this rule to the rail sy stem’s electronic way bill sy stem. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. Any signature related warning prompts will be addressed during sy stem development, and not as a requirement of this final rule. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response i n Section 3.1 of this document for further information.
**3.8 Full Interoperability of System Software**  **Comment:** We heard from two commenters suggesting modifications to the proposed requirements for full interoperability of s ys tem software (Co mmenter Nos. 59 and 61). One commenter suggested that EPA could establish a requirement that the exchange of manifest data and the interoperability

of electronic manifesting sy stems not be compromised by any new approved software (Commenter No. 61). The commenter believes this may limit the technological advances possible; however, it would ensure that any change approved will not have the impact of making obsolete the investments of others involved in electronic manifesting. Another commenter indicated that EPA could require electronic s ys tems to be evaluated for a specified period of time by all parties that will use the sy stem to ensure there are no interoperabilit y problems (Commenter No. 59). The commenter added that paper manifests should also be u sed during the evaluation period in case there is a problem with the sy stem.December 2, 2013 FINAL DOCUMENT Page 39

**Response:** EPA thanks the commenters for their views on the proposed standards for full interoperabilit y of s ys tem software. However, EPA has determined not to codify the propos ed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferr ed option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. The development of a national e

- Manifest s ys tem moots the issue of interoperability among private sy stems, although manifest users will need to develop the appropriate interfaces to share and exchange data from e

- Manifest with their le gac y data sy stems. Sy st em interoperability concerns will be addressed during s ystem planning and development efforts, and are not addressed in this final rule. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from four commenters expressing support for the one

- time requirement for sy stem sponsors to notify EPA that they have developed and would be using an e

- manifest sy stem (Commenter Nos. 17, 19, 30, and 59). These commenters believe it is important to notify the regu latory

agency of a sponsor's use of the e

- manifest (e.g., to make the regulator aware that electronic manifests will be submitted) and would not place an undue burden on waste handlers. One of the commenters cautioned that the notification would not be a disincentive unless it involves many

requirements, and asked EPA to list what information is required in the notification (Commenter No. 30). We heard from another commenter who did not believe the notification requirement, in and of itself, would be a di sincentive to use of electronic manifesting (Commenter No. 33). However, it would be a disincentive if it would mean that the electronic s ys tem would be subject to the validation requirements of the proposal and that possible existing manifest

- exchange re lationships with other states would be threatened as a result. **Response:** EPA thanks the commenters for their views on the proposed standards for full interoperabilit y of s ys tem software. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. Thus, there will not be multiple private s ys tems and no need for a notification requirement. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from one comme nter who expressed opposition to the proposed notification requirement (Commenter No. 23). The commenter noted that sy stem users would have to register with EPA to get an approved identification numbering s ys tem. The commenter believes theDecember 2, 2013 FINAL DOCUMENT Page 40

registration process would serve to notify regulatory

agencies of the use of electronic manifest sy stems; and thus, the one

- time notification is not needed. **Response:** EPA thanks the commenter for its views on the proposed standards for full interoperabilit y of s ys tem software. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifes ts. The 2012 e

Manifest Act in fact mandates this approach. As there will not be private systems developed, there will be no need for the proposed notification. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in S ection 3.1 of this document for further information.
**3.9 Controls over System Documentation**  **Comment:** We heard from three commenters expressing opposition to the proposed controls over sy stem documentation (Commenter Nos. 26, 33, and 57). These commenter s expressed their belief that the proposed controls are too burdensome. Two of the commenters noted that the paper - based s ys tem does not impose similarly burdensome controls (Commenter Nos. 26 and 57). The other commenter noted that excessively burdensom e controls and requirements will make it unlikely for waste handlers to develop or use the documentation (Commenter No. 33). **Response:** EPA thanks the commenters for their views on the proposed controls over sy stem documentation. However, EPA has determined not to codify the proposed private s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted b y EPA and funded b y service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will develop sy stem documentation for the national e

- Manifest sy stem, but since there will not be private s ys tems developed under the final rule, we will not require private entities to develop such documentation. Comments on the proposed sy stem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from one commenter who suggested that the rule should require that documentation be available during inspections (Commenter No. 35). The commenter noted that documentation requirements are missing for such items as the technical standards and computer securit y s ys tem controls. **Response:** EPA thanks the commenter for its views on the proposed controls over sy stem documentation. However, EPA has determined not to codify the proposed sy stem security controls as part of the fi nal rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on theDecember 2, 2013 FINAL DOCUMENT Page 41

rulemaking record that EPA’s preferred option is now the establishment of a national e

- M anifest sy stem to be hosted b y EPA and funded b y service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. While EPA will develop sy stem documentation for the e

- Manifest sy stem, we will not require private entities to develop such documentation or to make it available for inspections. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**3.10 Policies Holding Individuals Accountable**  **Comment:** We heard from one commenter who expressed its opposition to the proposed requirement for written policies (Commenter No. 57). The commenter indicated that there is no equivalent require ment for paper

- based manifests. Another commenter indicated that computer securit y is something of an illusion (Commenter No. 33). The commenter indicated that forgery of most manual signatures is detectable and provable; however, forgery of a digital si gnature is for all practical purposes undetectable and un

- provable, should someone gain access to the individual's signature object. The commenter believes EPA's requirements could be circumvented by a sufficientl y computer

- literate individual intent on f alsification. The commenter suggested the best controls would be procedures that could somehow confirm the validity of the data itself, rather then rel yi ng on the validity of the digital signature. **Response:** EPA thanks the commenters for their views on the proposed standards for policies holding individuals accountable. However, EPA has determined not to codify the proposed sy stem security

controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability

and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the w aste handlers who choose to use electronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. The national e

- Manifest sy stem will be developed and operated in accordance with EPA’s CROMERR Rule, and this rule announces the applicable poli cies under which EPA will hold manifest users accountable for their signatures and submissions. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**3.11 Other Sy**  **stem Requirements Comment:**  We heard from one commenter who asked for EPA clarification on whether electronic receipt of the manifest equates to acceptance of the waste (Commenter No. 26). **Response:** EPA thanks the commenter for its views on the proposed sy stem requirements. However, EPA has determined not to codify the proposed s ys tem securit y contr ols as part of the final rule. Comments on the proposed s ys tem controls are now moot. However, EPA notes that even with the paper manifest sy stem, the mere receipt of delivery of waste materials is distinguished from acceptance of the waste. The substitution of an electronic manifest does not alter this result. Acceptance or rejection of waste may occur after a TSDF has signed a manifestDecember 2, 2013 FINAL DOCUMENT Page 42

to indicate receip t of deliveries. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** We heard from eight commenters expressing opposition to the requirement for retransmission of the electronic manifest if an acknowledgment of receipt is not received within 12 hours (Commenter Nos. 16, 18, 25, 30, 46, 54, 57, and 59). These commenters believe 12 hours is not enough time for facilities to verify receipt or to resend the manifest, given evenings, holiday s, weekends, and potential sy stem failures. Two of these commenters suggested that EPA amend the timeframe to 12 working hours (Commenter Nos. 54 and 59). One of the commenters suggested at least five business day s (Commenter No. 25), and another suggested at least 24 hours ( Commenter No. 30). In addition, two commenters expressed concern that, given the requirements for a 12

- hour re

transmittal of the electronic manifest, there may be situations where the hazardous waste haulers will arrive at the TSDF in advance of the elec tronic manifest (Commenter Nos. 16 and 18). One of the commenters suggested that EPA explain what actions should be taken under these types of logistical problems (Commenter No. 18). **Response:** EPA thanks the commenters for their views on the proposed s ystem requirements. However, EPA has determined not to codify the proposed s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (7 4 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid by the waste handlers who choose to use ele ctronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. Comments on the proposed s ys tem controls are now moot. An y requirements for acknowledgement of receipts of electronic manifests will be addressed as a s ys tem development issue, and not addressed in this final rule. Please refer to the EPA response in Section 3.1 of this document for further information.
**Comment:** Three commenters requested alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 51, 57, and 59). One of the commenters noted that companies would prefer to have the authority to use imaging technology to store copies of manifests so they

can reduce their warehousing costs (Commenter No. 59). Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51). The commenter suggested that waste handlers could place their electronic manif ests onto the centralized repository

for access by

stakeholders. Another commenter urged EPA to continue considering other electronic forms of recordkeeping under the RCRA program (Commenter No. 57). **Response:** EPA thanks the commenters for their views on the proposed s ystem requirements. However, EPA has determined not to codify the proposed s ys tem securit y controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register ( 74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hostedDecember 2, 2013 FINAL DOCUMENT Page 43

by EPA and funded by

service fees that would be paid by the waste handlers who choose to use el ectronic manifests. The 2012 e

- Manifest Act in fact mandates this approach. EPA will establish user accounts on e

- Manifest for each waste handler that wishes to use the electronic manifest. Electronic copies of completed manifests will be stored electro nically to the accounts of each user and will there be available for retrieval and inspection. With respect to paper manifests that continue in use after e

- Manifest is implemented, the sy stem will only collect the final paper cop y (or an image file and dat a file) from designated facilities. The waste handler copies of paper manifests must still be maintained on site by waste handlers in accordance with existing recordkeeping requirements, although EPA has allowed image copy storage under certain conditions

. Comments on the proposed s ys tem controls are now moot. Please refer to the EPA response in Section 3.1 of this document for further information.
**4.0 EPA's Proposed Electronic Signature Standard** 
**4.1 General Comments**  **Comment:** We heard from five commenters in support of one or both of the proposed electronic signature methods (Commenter Nos. 17, 25, 33, 60, and 61). One of these commenters believes that it is likely

that if both sy stems are allowed, a TSD facility in the chain on a manifest will be usi ng a different sy stem than that used by the generator (Commenter No. 61). The commenter believes this would require each generator/operator to have technology that supports both the digital signature and secure digitized signature methods. This could significantly increase the cost and complications to those using electronic manifests. The commenter believes that, if both sy stems are authorized, EPA must require that the sy stems be compatible with each other. The commenter suggested that EPA weigh the a dditional complications and costs that will exist if both sy stems are approved versus the advantages and disadvantages of a federall y selected single sy stem that EPA designates. The commenter suggested that EPA look to the Treasury Department and the Department of Housing and Urban Development, which are addressing the same securit y issues as part of their transition to electronic transfers of tax forms and home

- closing documentation. We heard from one commenter who expressed opposition to both signatur e methods because they introduced an entirel y new system that would not be cost

- effective (Commenter No. 46). **Response:** EPA thanks the commenters for their suggestions on the electronic signature method. EPA has considered all of the comments received o n this issue and agrees with comments expressing concern about the digital signature. For example, we received a number of comments from regulated industry

suggesting that the digital signature method with its public key infrastructure was too expensive and complex to be deployed in the electronic manifest context. However, we also received a fair number of comments from industry representatives who suggested that a digitized signature method could be implemented and used successfull y for the electronic m anifest. These commenters offered that digitized signatures provide a practical and cost

- effective alternative to digital signatures, and that they have been used commerciall y and successfull y for ye ars. Several proponents of the digitized method added that the digitized method is preferred, because it will allow the capture of a real time signature through a processDecember 2, 2013 FINAL DOCUMENT Page 44

that best mimics the current process for signing paper manifests. We received several industry comments that echoed the view expressed in S tate agency comments that the electronic manifest context did not warrant elaborate electronic signature security , with one such commenter suggesting that an y security burden imposed beyond that associated with the digitized signature method would act as a deterrent to users using the electronic s ys tem. Finally , we received a comment from an industry trade association suggesting that EPA must clarify in the final rule that one consistent signature method will be implemented in all states for electronic man ifests, since manifests are interstate transactions that require consistency in implementation across all the states. EPA notes that in the final regulation it is not codifying or requiring the use of a specific electronic signature technology . The final rule is instead technology neutral, and requires at 40 CFR § 262.25(a), that signature methods for e

- Manifest shall: 1. Be a legall y valid and enforceable signature under applicable EPA and other Federal requirements pertaining to electronic signatures, and 2. Be a method that is designed and implemented in a manner that EPA considers to be as cost

- effective and practical as possible for users of the manifest. While the regulation is technology neutral, EPA makes recommendations in the preamble for the first generation sy stem, based on the comments received during our comment period and further anal ys is. EPA agrees with the commenters who suggested that an elec tronic signature method based either on a PIN/password approach or on a digitized signature approach provides a preferred balance of identification strength, practicality , and cost. EPA’s own anal ys es support these views. For example, EPA conducted an e conomic anal ys is of the proposed authentication and signature technologies in May 2007. The economic anal ys is disclosed that the handwritten digitized signature method is a cost effective electronic signature method. PINs and passwords, when evaluated fo r helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized signature method. On the other hand, the May

2007 analy sis disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely be three to four times the projected costs of implementing either the PI N/password method or digitized signature method. Therefore, EPA is recommend ing both the PIN/password method and the digitized handwritten signature method in the final rule preamble , as the Agency believes that each of these methods can be adapted to the electronic manifest business process for two distinct communities of electronic manifest users with minimal cost burden. These recommendations are not binding, however, and the s ys tem developers and users are free to consider other signature methods th at meet the rule’s selection criteria. We believe that the digitized signature method may be attractive to hazardous waste transporters and hazardous waste management firms who wish to implement the electronic manifest across their enterprise b y bringing mobile computer equipment to the sites of their generator customers, and tracking waste pick

- ups, transportation with company vehicles, and delivery

of waste shipments to the company’s permitted facilities. For those who would engage in electronicDecember 2, 2013 FINAL DOCUMENT Page 45

manife sting independently of the enterprise level implementation, the PI N/password signature method would be available as a means to electronically sign electronic manifests. While we appreciate the concern expressed b y commenters that there should be onl y one signature method specified for consistency , we believe that there are advantages at this time to specifying alternative methods that have been evaluated for practicality, signature strength, and and CROMERR compliance. At such time as the sy stem is in fac t developed, the sy stem could incorporate either or both of these methods, or another method that is CROMERR compliant and practical. As explained above, we believe there are distinct communities of users who will use the digitized signature method and th e PIN/password signature method. Therefore, we believe there will be relatively

few instances when one manifest will use both signature methods, and if such instances arise, the sy stem will be able to process either signature as a valid signature. Howeve r, we will reevaluate this question as we work with the successful IT vendor to implement a sy stem and to implement the electronic signature solution(s). Should we find as we approach implementation that there are greater efficiencies and advantages with the selection of one consistent signature method for all users, we can alter our current plans and develop the initial sy stem around the one most advantageous signature method. The final rule preambl e also clarifies the identity proofing that will be requ ired of signatories using each of these electronic signature methods. Identity proofing is the vetting process by which an identity

credential (e.g., driver’s license, passport, financial account) is verified, so that one can be confident that another per son who claims a particular identity is the person they claim to be. Under EPA’s Cross

- Media Electronic Reporting Rule (CROMERR), the Agency generally requires electronic signatories of environmental reports to undergo a one

- time identity proofing exercis e before the signatory may sign and submit electronic reports to EPA. I dentity proofing aids in establishing that an asserted identit y can with legal certainty be uniquely linked with the electronic signature device used b y the signatory to execute their electronic signature. While hazardous waste manifests are not included in the CROMERR priority reports list, we are to a great extent adapting the identity proofing requirements for CROMERR priority reports in this final rule for electronic manifests that would be signed with electronic signatures. However, with respect to digitized handwritten signatures, the final rule preamble explains that no distinct identity

proofing is required per CROMERR , since these signatures that will be validated on the basis of biometric or forensic properties unique to the signer, as is the case with ink

- signed handwritten signatures. Thus, it is no more necessary for a signer to establish their “ownership” of their unique, digi tized handwritten signature than it is necessary to establish their ownership of their ink signatures. Moreover, in the case of the witnessed signature approach discussed below to implementing PI

N/password signatures, those who sign e

- Manifests with a PIN or password in the presence of a signature witness will be proofed by the witness at the time they execute their signature. Thus, those employing this signature method will simultaneously satisfy their signature and identit y proofing requirements when th ey present their credential to the witness.
**Comment:** We heard from two commenters who expressed uncertainty about whether electronic signatures would hold up in court (Commenter Nos. 13 and 33).December 2, 2013 FINAL DOCUMENT Page 46

We heard from one commenter who recommended that a digitized signature be required rather than another t ype of electronic signature (Commenter No. 51). The commenter stated that the digitized signature sy stem has been used successfully commercially

(credit card purchases) and provides an actual, r eal time signature, not a facsimile. **Response:** EPA thanks commenters for their views on electronic signatures. We share the concern that electronic signatures must be enforceable in court cases. Subsequent to the publication of the 2001 proposed rule, the Agency published in October 2005 its CROMERR Rule that establishes the legal and policy framework for all electronic reporting to the Agency

. See 70 FR 59848 (Octob er 13, 2005). CROMERR incl udes definitions at 40 C.F.R. §3.3 for “valid electronic signature ” and “electronic signature device” for the very purpose of ensuring the validity and enforceability

of the electronic signatures that are exe cuted for electronic documents that are submitted to EPA. For the e

- Manifest final rule, the regulation spe cific to electronic signatures has been revised so that it is technology neutral and avoids codifying specific signature technologies that may

become obsolete over time. Instead, the final regulation requires that electronic signature methods or technolog ies used with e

- Manifest shall: (1) be consistent with EPA’s CROMERR requirements in 40 C.F.R. Part 3 for valid electronic signatures; and (2) be generall y acceptable to the manifest user community so that the methods encourage broad participation in the e - Manifest. Our final rule preamble explains in more detail two electronic signature methods that were discussed in the proposed rule, and that we believe can be adapted to satisfy CROMERR requirements and be implemented in a manner that will be accepta ble to the user community . We discuss these two methods in some detail in the proposed rule, because they were carefull y vetted in advance for CROMERR compliance and for practicality in their implementation. Thus, we believe these two methods may be usef ul for the first generation of e

- Manifest: (1) a high quality handwritten digitized signature method ; and (2) a PI N/password electronic signature strengthened with a 2 nd authentication factor that is unique to the manifest business process . We have included special authentication provisions in the final rule preamble discussion of these methods to address CROMERR compliance and to strengthen these s ignature methods so that they will provide sufficient assurances of identity should authentication issu es arise in enforcement actions. We believe these provisions, described further below, strengthen the signature approaches and provide sufficient assurances of identit y in case of enforcement actions. Recommended digitized handwritten signature method

. The Agency is recommending a digitized handwritten signature method as one of the two methods of electronic signature that were vetted by the Agency for inclusion in the first generation e

- Manifest . As we discussed in the May , 2001 proposed rule, the di gitized signature must be captured as a dy namic signature (not a replay of a copy), and the signature must be bound to the manifest document content by a hash function to prevent unauthorized alterations to signed content. L ike handwritten signatures exec uted with ink on paper, digitized signatures may be recognized for the characteristic or personal shape and form of the letters, loops, and other forensic signature attributes that are recorded by hardware and software during the handwritten signature act. Thus, a digitized signature has some biometric

- like properties which may

provide a high level of assurance that the signature is unique to the signatory and that it may

be authenticated b y trained document examiners.December 2, 2013 FINAL DOCUMENT Page 47

Indeed, for the final rule, we ar e clarifying that before digitized handwritten signatures may be accepted as full y CROMERR compliant so that they can stand alone as “ valid electro nic signatures ” for e

- Manifest , there must be peer reviewed studies completed to establish that the digitized signature hardware and software are forensically reliable. This foundation of reliability is required in court case s before a document examiner could testify as an expert witness in a disputed case that a given digitized signature is or is not authentic. EPA may be able to complete these reliability

studies prior to the implementation of e

- Manifest, but if not, we expect to implement the digitized handwritten signature method on an interim basis with digitized pads and/or pens that enable an ink signatur e to be captured simultaneously with the digitized signature. We are aware of several existing products with this capability . Thus, one paper copy would be executed with original ink signatures, while the digitized signatures would simultaneously

be coll ected and associated with the electronic manifests that would be distributed and retained b y the e

- Manifest sy stem. At the end of the waste shipment transaction, the designated facility

or other designated custodian would retain the one paper copy with al l the ink signatures and retain this copy securel y and make it available for inspection and enforcement purposes b y state or federal inspectors. The ink signatures on this stored copy would be authenticated b y document examiners in the same manner that su ch ink signatures are currentl y authenticated in enforcement actions . Thus, during this interim period before forensic reliability studies are completed, the paper cop y of the manifest with ink signatures would be the manifest copy of record for enforceme nt purposes, and the digitized handwritten signatures on the electronic manifests would effectively be exempt from CROMERR. While this interim solution might seem at odds with the goal of a full y paperless manifest, EPA emphasizes that after the impleme ntation of e

- Manifest, DOT’s hazardous materials regulations will continue to require hazardous waste transporters to carry a hazardous materials shipping paper (i.e., the manifest) on transport vehicles. So, e

- M anifest users will still be required to pro duce one paper copy

of the manifest in order to comply with these existing DOT shipping paper requirements . Since there will need to be a paper cop y of the manifest on the vehicle in an y case for DOT’s purposes, the use of this one paper copy to simultane ousl y re cord enforceable ink signatures under this interim solution will not result in additional paperwork being supplied. Moreover, most of the paperwork reduction, greater efficiency , and data quality enhancement benefits of the electronic manifest wil l still be realized even with the execution and retention of this one paper manifest copy

. We anticipate that this interim signature method would be used until such time as EPA is able to designate specific digitized signature products that have been tested and found through peer reviewed studies to meet the forensic reliability standard. At such time EPA is able to designate those signature products that have been found b y testing to be forensically

reliable, so that it is possible to r eliably authenticate digitized handwritten signatures with the expert testimony of document examiners, then these digitized handwritten signatures will qualify

as “valid electronic signatures” that are full y compliant with CROMERR and may stand on their own for enforcement purposes without any paper copy

back

- up. At such time as EPA designates certain digitized handwritten signature products as forensically reliable, this final rule will also require that the generator, transporter, and facility personnel whoDecember 2, 2013 FINAL DOCUMENT Page 48

sign electronic manifests with these products must undergo identity proofing that complies with CROMERR identity

proofing requirements in 40 CFR 3.2000(b)(5)(vii). This means that the generator, transporter and facility personnel who will sign manife sts with these products must have an identit y credential such as a driver’s license vetted b y a disinterested third part y or automated validation service, or, these signatories must submit electronic signature agreements containing ink signatures as an alt ernative means of identity proofing. Since this method is anticipated to be a company

- wide implementation by the transporter or waste management compan y sponsoring the mobile computer equipment, EPA expects that this method will be a good candidate for su

bmission of signature agreements to the sponsoring company ’s local registration authorit y or LRA, who would certify to EPA that the agreements have been executed for all the signatories across the compan y and that the agreements are being stored locall y wi th the compan y. Significantl y, during the interim p eriod that digitized signature products are collect ing ink signatures and digitized signatures simultaneously , CROMERR identity proofing will not be required from the generator, transporter, or facility personnel signing manifests in this fashion. Since the one paper cop y with ink signatures will serve as the cop y of record for enforcement purposes, there is no issue of CROMERR compliance (including identity proofing requirements) while this interim signature method is being used. Recommended PIN/password electronic signature method

. In addition to the digitized signature method discussed above, the final rule also recommends for the first generation e

- Manifest an additional e lectronic signature method that involves a PI N or password signature strengthened with a unique 2nd authentication factor. This method would be available for all electronic manifest signatorie s who are not signing electronic manifests with the digitized signature method discussed above. While there are a variet y of possible means to implement a 2nd authentication factor (e.g., personal questions, token, biometric attribute), for the manifest business process, EPA anticipates that during the implementation of the fi rst generation e

- Manifest, the 2 nd authentication factor will be a witnessed signature certification. Hazardous waste manifests are normall y signed b y waste handlers at the time custody of hazardous wastes is being transferred from one waste handler to another. So, the re is ty pically a witness present to each manifest signature. For example, when a generator delivers its waste containers to the initial transporter, the generator executes the generator/offeror certification and the initial transporter signs to acknowled ge receipt of the waste. In other words, the generator personnel and transporter personnel mutually sign the manifest in the presence of the other. Similarly , when a transporter delivers waste to the designated facility , the transporter obtains the signature of the facility

personnel who sign s for receipt of the waste shipment. Again, the facilit y representative signs in the presence of the transporter ’s representative, and the transporter witnesses the signature of the designated facility ’s representati ve. The witnessed signature method of executing PIN or password electronic signatures takes advantage of the fact that manifest signatures are normally witnessed b y another part y. So, when the generator signs with its PI N or password to execute the generator/ offeror certification, he or she will also certify

at that time that he or she witnessed the mutually executed signature of theDecember 2, 2013 FINAL DOCUMENT Page 49

initial transporter. The witness certification will further attest that the generator was shown a driver’s license or other pic ture ID of the transporter, and that the picture ID shown is consistent with the identity

claimed by

the transporter. To ensure that this proofing exercise is in fact completed and is not a sham certification, the witness must record the last 4 digits of the signer’s driver’s license number as part of the witness’s certification. L ikewise, as the transporter signs to acknowledge his or her receipt of the waste from the generator, the transporter representative will also certify

to having witnessed the signature of the generator, and will examine the driver’s license of the generator and record the last 4 digits of that license number as part of the certification. A similar certification would be executed b y the transporter when it delivers the waste to th e designated facility and witnesses the signature being executed the facility ’s representative. For the final rule, EPA has determined that the PI N or password electronic signatures that are executed in this fashion, with the requisite certification of a witness attesting to the signer’s signature act and proof of ID, are sufficiently strengthened b y the witness certification, so that these signatures and certifications meet CROMERR’s requirement for a 2 nd authentication factor. CROMERR compliant identity proofing will be required of all signatories using the PIN or password method of signature. CROMERR requires that a driver’s license, passport, or similar identity credential for the signatory must be vetted one time by a disinterested part y or validatio n service supplied for this purpose (see 40 CFR §3.2000(b)(5)(vii)(A)) prior to the use of the electronic signature. Alternativel y, one using a PIN or password electronic signature could also satisfy CROMERR identity

proofing requirements by submitting an ink

- signed signature agreement to EPA or to the compan y’s local registration authority (LRA) in accordance with 40 CFR §3.2000(b)(5)(vii)(C). However, because each e

- Manifest PIN or password signatory using the witnessed signature method discussed above undergoes identit y proofing b y the witness at the time of signature, there is no need to provide additional credentials or documentation to meet CROMERR identity

proofing requirements with these signatures. The witnessed signature certification and underl yi ng proofing of each signatory suffice to meet this CROMERR requirement.

**Comment:** We heard from seven commenters who asked that the signature approach be flexible (Commenter Nos. 22, 33, 51, 59, 60, 61, and 63). Two commenters suggested that EPA sho uld not specify

the technology

but allow industry

to develop sy stems that meet desired outcomes (Commenter Nos. 51 and 60). Another commenter asked EPA to ensure that its signature standards are flexible enough to accommodate States' initiatives on electronic reporting (Commenter No. 59). Another commenter noted that, because of differences in cost, waste handlers within the same manifest cycle might use differing technologies (Commenter No. 61). As such, EPA should ensure that its final rule address co mpatibility among signature methods. Two commenters asked EPA to clarify standards and procedures to address situations in which the generator, transporter and/or TSDF operate different signature methods for the same shipment (Commenter Nos. 33 and 61). One of these commenters believes that, if EPA should adopt an even broader approach than the two signature approaches in the proposed rule, the criteria for additional signature methods should be to maximize ease of use, minimize cost, and provide a reason able level of security (Commenter No. 33). The commenter added that, if numerousDecember 2, 2013 FINAL DOCUMENT Page 50

signature methods were to be authorized, EPA should establish a national verification s ys tem that anyone can access to confirm (or interpret) the manifest signatures. The co mmenter also recommended that EPA ensure that multiple signatures are readable and verifiable b y establishing a national verification system that anyone can access to confirm the signatures. Another commenter cautioned EPA to avoid overl y broad or narrow approaches for digital signatures, since the rule will have far

- reaching implications (Commenter No. 63). **Response:** EPA thanks commenters for their request that the signature methods be flexible. We agree that the methods should accommodate the various preferences and constraints of the users of the electronic manifest. We agree with the comment that the regulation should not specify or codify technologies, and we have revised the final regulation so that it is in fact technology neutral. For the final rule, therefore, the codified electronic signature requirements are that the signature methods satisfy CROMERR performance standards in 40 C.F.R. Part 3 and that the methods be generally

acceptable to the user community . While the final rule does not codify signature methods, we do recommend two methods in the preamble that we believe can be implemented in the first generation s ys tem in such a way as to meet the regulatory standards. These recommended solutions were discussed at length in our response t o the previous comment. In short, EPA’s intent is to set forth in the rule in general and flexible language what the regulatory

requirements are for implementing an electronic manifest signature. As the various authentication technologies (e.g., biometri cs, tokens) improve or become less costly over time, different signature solutions may become more feasible and appropriate for the e

- Manifest sy stem. EPA expects that the e

- Manifest vendor and the Governing Body or Advisory Committee responsible for the oversight and change process for e

- Manifest will settle on the specific authentication devices and approaches that will meet this rule’s requirements and will be supported by

the sy stem over time.
**Comment:** We heard from five commenters who suggested alter native approaches for the electronic signature (Commenter Nos. 22, 30, 33, 60, and 61). All of these commenters encouraged EPA to consider simple and least

- cost signature approaches so long as they are comparable to the handwritten signature. Three comme nters suggested use of a Personal Id entification Number (PIN) or comparable approach (Commenter Nos. 30, 33, and 61). These commenters believe a PIN would provide a reasonable level of security in comparison with handwritten signatures. One commenter sug gested EPA draw from DOT's experience and streamline its proposal to allow use of a signature mark produced b y an y m eans (Commenter No. 22). Another commenter suggested that EPA allow itself the flexibility to approve new technologies, including biometric s (Commenter No. 61). **Response:** EPA thanks the commenters for their suggestions for simple, low

- cost signature methods. We agree with their concerns and believe the signature methods in the final rule address such concerns. EPA conducted a detailed eco nomic anal ys is of the proposed authentication and signature technologies in May 2007, as we wanted to understand better how the hardware, software, and support services needed for each signature and identity proofing method would impact the implementation costs for the s ys tem and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs. The MayDecember 2, 2013 FINAL DOCUMENT Page 51

2007 economic analy sis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), although this cost is likely to increase when the cost of the higher quality pads and software that might satisfy requirements for forensic reliabilit y are taken into account. However , we are generall y i mpressed that the digitized signature method has intuitive appeal and appears to be quite cost effective for users, despite the fact that this method entails a more significant initial investment by users in the signature pads and softw are necessary to generate the digitized signatures. PI Ns and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature , were found to present implementation costs ($0.54 to $0.96 per manifest) comparable to the digit ized signature method

. Thus, our final rule language now reflects these commenters’ concerns that the recommended signature methods provide authentication str ength comparable to handwritten signatures while ensuring cost

- effectiveness. The final rule retains the flexibility requested b y several commenters to consider and approve new technologies such as biometrics as they become more established, practical, and cost

- effective. We cannot accept the commenter’s suggestion that a mark executed b y any means be acceptable as an e

- Manifest signature, since the signature method must be sufficiently strong and unique so that it will support criminal enforcement actio ns that require proof beyond a reasonable doubt of all elements of a case, including the identity of signers.
**4.2 Digital Signatures**  **Comment:** We heard from four commenters who believe that manifest signatures do not require a level of securi ty

offered by

the digital signature technology (Commenter Nos. 22, 33, 46 and 60). One commenter suggested that electronic signatures should be no more stringent than handwritten signatures (Commenter No. 22). Another commenter urged that EPA should not focus on field or file securit y, but on field and data authenticity (Commenter No. 60). The commenter explained that manifest users can capture the generator's valid signature/authenticity through any

t ype of technology ; the rule should not mandate the ty pe of technology

used, but should allow any means of electronically

capturing a signature. Another commenter doubted that manifest signatures require the level of security offered b y the digital signature and expressed uncertaint y whether there currentl y is a level of falsification to warrant EPA's concern (Commenter No. 33). **Response:** EPA thanks the commenters for their views and agrees that the digital signature is not a preferred method for the electronic manifest at this time. The final rule does no t require a specific electronic signature technology , but in response to comments and further analy sis, we make recommendations in the final rule preamble about methods that we believe to be CROMERR compliant and practical for users. At this time, we are not recommending the digital signature method for the first generation sy stem. As discussed above, EPA has received significant input from industry that the digital signature method provides an unnecessary level of securit y, and its benefits cannot be jus tified in view of its costs. An economic analy sis performed in 2007 helped to support this conclusion. The economic analy sis disclosed that the handwritten digitized signature method is a cost effective electronic signature method. PI Ns and passwords, when evaluated for helpdesk support costsDecember 2, 2013 FINAL DOCUMENT Page 52

(i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized s ignature method augmented with a 2nd authentication factor. On the other hand, the May 2007 anal ys is disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely

be three to f

our times the projected costs of implementing either the PIN/password method or digitized signature method. Because of the far greater costs associated with the digital signature method, and the comments in the record that criticized the complexity and re lative cost of this signature method, EPA has determined that it will not initially provide support for digital signatures and PKI in the implementation of the e

- Manifest sy stem. We believe that the comments and the additional anal ys is conducted in May 20 07 provide ample support for the digitized signature and PIN/password methods of signature.
**Comment:** We heard from one commenter who believes the proposed level of securit y for the digital signature is burdensome, but stated that it would be willing to participate nonetheless (Commenter No. 56). **Response:** EPA thanks the commenter for its views. Please refer to the Agency ’s r esponses to the first comment in this section and in Section 4.1 of this document for information on EPA’s final decision to adopt technology neutral electronic signature regulatory language, and to recommend the handwritten digitized signature method and the PI N/password method strengthened with a second authentication factor as our currently recommended alternatives to the digital signature method.
**Comment:** We heard from three commenters in response to EPA's question about whether it is practical to verify

digital signatures on a document such as the manifest which will be signed sequentially

by multiple waste handlers and whether multiple versions of each manifest document must be maintained electronically to preserve the complete history of the document (Commenter Nos. 22, 33, and 60). One commenter noted that the final electronic manifest should not be so cumbersome to deter regulated parties from using the s ys tem (Commenter No. 22). The commenter suggested that the software ultimatel y selected by EPA for the final rulemaking should be able to accommodate multiple generator or shipper signatures. This may be done through one document reflecting multiple signatures or through one file containing multiple "modified copies" of the manifest, each showing a different signature. Another commenter stated that, once a section of data in the electronic manifest (e.g., number of containers) has been added to the file or record, it should never be removed or modified (Commenter No. 60). The commenter stated that each s ys tem should be required to detect an y unauthorized modification by validating each section of data. In correc tly

modified files would result in rejection of the manifest with procedures consistent with a phy sically

incorrect manifest, and procedures to re

- manifest the shipment should be documented. Another commenter stated that verification is practical when the completed manifest is received b y the regulating entit y; however, verification in the field is more problematic (Commenter No. 33). The commenter believes that a transaction history should existDecember 2, 2013 FINAL DOCUMENT Page 53

for all stages of the waste's transport. Otherwise, it bec omes extremel y difficult to track down where a discrepancy

(or a falsification) occurred. **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s r esponses to the first comment in this section and in Section 4.1 of this docume nt for information on EPA’s final decision on electronic signature regulatory language and our recommendation to adopt the digitized handwritten signature method and PIN/password method strengthened with a 2 nd authentication factor as alternatives to the digital signature method.
**Comment:** We heard from three commenters regarding EPA's proposed algorithms for the electronic signature (Commenter Nos. 26, 46, and 59). Two commenters urged EPA to be flexible in authorizing algorithms because of technology advancements (Commenter Nos. 26 and 59). One of the commenters suggested that EPA merel y require the use of digital signature standards approved b y the federal government or State, instead of listing specific standards (Commenter No. 59). Ano ther commenter expressed concern that the proposed algorithms would introduce a new s ys tem for railroads and would not be cost effective (Commenter No. 46). **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s response s to the first comments in this section and in Section 4.1 of this document for information on EPA’s final decision on electronic signature regulatory language and our recommendation s for the first generation s ys tem to adopt the digitized handwritten signature m ethod and the PI N/password method strengthened with a 2 nd authentication factor as alternatives to the digital signature method.
**Comment:** We heard from three commenters regarding EPA's proposed requirements for maintaining the confidentiality of private key s (Commenter Nos. 33, 46, and 60). Two of the commenters opposed the requirements, believing they are too burdensome on waste handlers in comparison to the current manifest requirements and procedures (Commenter Nos. 46 and 60). The other commenter be lieves the requirements for individuals and sponsoring firms to maintain the confidentiality

of their private key s and accept accountability would be too burdensome on smaller waste handlers with limited staff (Commenter No. 33). The commenter asked for E PA to find a balance between a reasonable level of security and affordable costs. The commenter does not oppose a requirement for registrants to enter into a signature agreement that contains certifications that the private key would be protected from dis closure, unauthorized use, or delegation. The commenter cautioned that these controls, however, would not provide any real guarantee of securit y. **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s respon ses to the first c omment in this section and in Section 4.1 of this document for information on EPA’s final electronic signature regulatory selection criteria and preamble recommendations for the first generation s ys tem

. After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.December 2, 2013 FINAL DOCUMENT Page 54

**Comment:** We heard from one commenter who expressed opposition to the requirement for a trusted third part y, since it would not be cost

- effective for the railroad industry (Commenter No. 4 6). Another commenter raised concerns about the creation of a sy stem involving a trusted third part y and related procedures, since this would create a new area of compliance liability for which TSDFs have limited expertise (Commenter No. 26). The commenter asked EPA to clarify appropriate procedures in cases where a signature cannot be verified at delivery of the waste. We heard from three commenters who asked EPA to provide a list of standards or requirements for digital signatures and/or a list of Certificate Authorities for acceptable digital signatures (Commenter Nos. 30, 54, and 63). **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s re sponses to the first comment in this section and in Section 4.1 of this docume nt for information on EPA’s final decision on the electronic signature regulatory selection criteria, and preamble recommendations on electronic signature methods for the first generation s ystem. After considering the comments on this issue, we are not no w recommending the adoption of the digital signature method.
**Comment:** We heard from three commenters regarding the requirements for periodic certification of signature agreements or for proof of identity in regard to issuing a digital certification for us e in the manifest program (Commenter Nos. 22, 33, and 60). One commenter stated that no formal proof of identity

should be required to receive a digital certificate, since no proof of identity is needed for the existing manifest sy stem (Commenter No. 60). Another commenter believes that EPA should keep the requirements as simple as possible and require little more than proof of identification (Commenter No. 22). Another commenter supported the idea for registrants to certify annually that they have not v iolated their signature agreement and for signature agreements and annual certifications to be signed by hand (Commenter No. 33). The commenter also suggested that a valid photo identification, proof of emplo ym ent with the handler, and the individual's so cial security card should provide necessary proof of identit y. The commenter believes that applicants should be required, for the initial issuance at least, to present themselves in person. Subsequent renewals could be less stringent and not require a pe rsonal appearance. **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s re sponses to the first comment in this section and in Section 4.1 of this document for information on EPA’s fin al decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation s ys tem. After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.
**Comment:** We heard from four commenters in regard the cost and complexity of a PKI program and the willingness of waste handlers to participate (Commenter Nos. 22, 33, 46 and 60). These commenters believe that PKIwould increase the burden and administrative acti vities required of waste handlers and would likely deter them from implementing the digital signature approach. One commenter expressed concern that the proposed approach would require manifest users toDecember 2, 2013 FINAL DOCUMENT Page 55

ensure that emplo ye es with signature capability woul d be available at all times to electronicall y sign manifests (e.g., during all shifts, vacations, holiday s) (Commenter No. 60). Another commenter clarified that smaller waste handlers, in particular, would be deterred from participation because of the burden (Commenter No. 33). **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s responses to the first comment in this section and in Section 4.1 of this document for information on EPA’s final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation s ys tem. After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI

. **Comment :**  We heard from five commenters in regard to the three optional approaches for PKI implementation (Commenter Nos. 33, 46, 54, 61, and 63). One commenter supported the centralized approach because of greater clarity and the elimination of confusion by hav ing a single, known standard (Commenter No. 33). Another commenter opposed any option for PKI, since it would introduce an entirel y new s ys tem that would not be cost

- effective for the rail industry (Commenter No. 46). Two commenters suggested that EPA al low States who become authorized for the electronic manifest portion to have the ability to generate the certificates instead of EPA (Commenter Nos. 54 and 63). Another commenter stated that, if EPA chooses to use the PKI program of the General Services A dministration (GSA), the Agency should regularl y evaluate private vendors as a possible option, as PKI private alternatives become more mature (Commenter No. 61). The commenter also believes that the option chosen must be implemented consistently

througho ut the States so interstate commerce is not impeded. **Response:** EPA thanks the commenters for their views. Please refer to the Agency ’s re sponses to the first comment in this section and in Section 4.1 of this document for information on EPA’s final dec ision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation s ys tem. After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI

.

**4.3 Secure Digitized Signature**  **Comment:** We heard from four commenters in response to EPA's request for comment on the proposed security

standards for digitized signatures (Commenter Nos. 17, 33, 46, and 60). Three c ommenters believe the securit y standards are too stringent and should require no more security than handwritten signatures (Commenter Nos. 17, 46, and 60). The other commenter stated that the securit y standards are adequate to prevent casual abuse, althou gh the commenter acknowledges that "adequate security " depends on how the term "adequate" is defined (Commenter No. 33). The commenter does not believe the standards would protect against abuse from someone who is sufficiently literate in the technology

. In regard to the use of algorithms to bind signatures to record data sufficientl y strong to prevent misuse, the commenter believes that a sufficiently

sophisticated algorithm could encode the digital signature in such a way that it wouldDecember 2, 2013 FINAL DOCUMENT Page 56

only be valid to the document to which it was originally attached. 1 However, the commenter noted that this would necessitate an equally sophisticated validation process. **Response:** EPA thanks commenters for their views on the securit y issues related to the digitized sign ature method. We agree with comments that the securit y standards for the digitized signature method should not be too stringent. However, we continue to believe that minimum standards need to be in place to ensure authentication of a user’s digitized signature consistent with the CROMERR. For the final rule, we have replaced the codified standards that were proposed at §262.25(g) with a technology neutral standard that requires signature methods to be CROMERR compliant an d to be generally cost

- effective and practical for users. However, in the final rule preamble we offer recommendations on how a quality digitized signature product must perform and suggest that products meeting these recommended performance standards would be CROMERR compliant and accept able for the first generation e

- Manifest system. While the recommendations retain the proposed standard of employing a hash function to digitally bind the signature with the signed content, the other performance recommendations in the final rule are more focused on the quality of the digitized pads, pens, and software insofar as how they capture , process , and anal yz e signature and forensic data

. Significantl y, the final rule recommended standards for quality

handwritten digitized signatures give greater e mphasis to the overarching performance standard for these products

– that they reliably capture and analyze the forensic s ignature data so that a professional document examiner could testify as an expert witness to the authenticity

of the signatures. Thus , CROMERR compliant digitized handwritten signatures will be authenticated in a manner similar to ink signatures that are in dispute, that is, based on the testimony of professional docume nt examiners about the unique forensic properties of the signature. The recommended standards in the final rule also explain that before these signature products may

be determined to be CROMERR compliant, peer reviewed studies showing the forensic reliability

of the signature products must be comp l eted so that there is a p roper evidentiary

foundation (under the U.S. Supreme Court’s Daubert opinion) for the expert testimony of the document examiners. Under CROMERR, the Agency also generally requires electronic signatories of environmental reports to undergo a one

- time ide ntity proofing exercise before the signatory may sign and submit electronic reports to EPA. I dentity proofing aids in establishing that an asserted identity can with legal certainty

be uniquely

linked with the electronic signature device used by the signatory

to execute their electronic signature. However, as digitized handwritten signatures would be authenticated b y examiners based on their unique biometric

- like properties, it is not necessary for the signer to show “ownership” of their unique digitized handwritten signature an y more than it is required that they

show ownership of their ink

- signed signatures. Therefore, there will be no specific CROMERR identity proofing required for these signatures in e

- Manifest.
**Comment:** We heard from one comment er in response to EPA's request for comment on whether EPA should require that digitized signatures be digitall y signed (Commenter No. 33). The

1 It appears that Commenter 33 intended to use the term “digitized signature” instead of “digital signature” in this comment.December 2, 2013 FINAL DOCUMENT Page 57

commenter doubted that this approach would provide an y additional security, since an yone who could falsify

the digitized signature also could falsify digitally signing the digitized signature. **Response:** EPA thanks the commenter for its views on the security issues related to the digitized signature method. We agree that EPA should not require that digitized handwritten signatures be digitally signed. Rather, the final rule sets forth alternative recommended performance standards for digitized handwritten signatures that we believe are suffic ientl y effective and that are focused more on accurately

and securel y c apturing, processing, and anal yz ing forensic signature data so that the signatures may

be reliabl y authenticated in the event of a dispute by expert document examiners.
**Comment:** We heard from four commenters regarding the cost implications of the propos ed secure digitized signature approach (Commenter Nos. 22, 33, 46 and 60). One commenter expressed concern that, if EPA imposes a complex securit y s ys tem for its electronic signature process, it would not be as cost

- e ffective as the current sy stem (Commenter No. 22). The commenter believes that, on the other hand, if EPA keeps the electronic signature process simple, it could well be comparable to, or even more cost

- effective than, the current handwritten sy stem. Another commenter stated that the secure digitized method provide a more practical and cost effective alternative to the digital signature/PKI approach and hand signed documents (Commenter No. 60). Another commenter stated that, in consideration of the additional costs for hardware and software i nvolved with the secure digitized method, the question of practicality and cost

- effectiveness is directly dependent on the issue of whether the additional level of security is worth the additional cost and complexity (Commenter No. 33). **Response:** EPA thanks the commenters for their views on the costs of the digitized signature method. We agree that we should attempt to minimize user costs while ensuring an effective, legally enforceable signature method, and we believe the final rule recommendatio ns establish such a method. As discussed elsewhere in this document, EPA conducted a detailed economic anal ys is of the proposed authentication and signature technologies in May 2007 to understand better how the hardware, software, and support services nee ded for each signature and identit y proofing method would impact the implementation costs for the s ys tem and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs. The May 2007 ec onomic analy sis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), despite the fact that this method entails a more significant initial investment by users in the sign ature pads and software necessary to generate the digitized signatures. While there may be some additional cost involved with purchasing the quality digitized signature products that will prove capable of meeting the forensic reliability standard in our r ecommendations, w e believe that these pr oducts will likely be very cost

- effective relative to other methods we anal yz ed. Further, the recommendations on forensic reliability and authentication by

document examiners disclose that EPA intends that the signature process with digitized handwritten signatures be performed simply and very similarly

to the current ink signature process. Thus, the digitized signature process will in fact be very comparable to the current signature process with ink signatures inso far as the signature ceremony used to collect the signatures and the reliance on forensic signature evidence to authenticate them. These signatures are particularly amenable to off

- line capture,December 2, 2013 FINAL DOCUMENT Page 58

since they will not be subjected to real time validation against the network, and will be authenticated in the event of a dispute by professional document examiners, using the stored forensic signature evidence. In addition, EPA also reminds commenters that many users of a digitized signature method will not nee d to purchase the signature apparatus and therefore will not incur such costs. Specificall y, EPA is aware that many

of the generators who would sign their electronic manifests with the digitized signature method are small generators who might ship wastes under electronic manifests very infrequently , perhaps two or three times per year. For these generators, purchase of the digitized signature apparatus may not make economic sense. Rather, we envision that transporters and TSDs may purchase portable signature devices for their customers’ use when they pick up a shipment for transportation. Under this scenario, a digitized signature pad or pen would be supplied for each transport vehicle, and this device c ould be used repeatedly by many customers for thous ands of signatures over a period of several years, before their expected failure or replacement.

**Comment:** We heard from three commenters regarding the implementa bility and feasibility

of secure digitized signatures (Commenter Nos. 22, 33 and 60). These commenters believe that it would be unlikely

for waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature (Commenter Nos. 33 and 60). In regard to advantages of digitized signatures o ver handwritten signatures, one of these commenters noted that the main advantage that manifest users would find attractive is that digitized signatures will allow them to file their required manifests electronicall y rather than manuall y (Commenter No. 33) . The commenter believes this will prove convenient, be significantl y less expensive, and have the potential to greatly

speed any

processing involved. In regard to whether the software implementing the proposed approach supports open standards, the comme nter believes that some software implementing the approach supports open standards, whereas other software implementing the approach still utilizes proprietary algorithms and standards. The commenter believes that open standards are better, particularly f or any thing a waste handler will be dependent on for a long period of time. **Response:** EPA thanks the commenters for their views on implementation of the digitized signature method. We agree with the comments that the digitized signature can be an attrac tive option for users that are accustomed to the current handwritten signature processes
. That is a primary reason for our recommendation of this method in the final rule preamble. We thank the commenters for expressing their belief that it is unlikely fo r waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature. EPA will consider their comments when we develop the e

- Manifest sy stem. **Comment:** We heard from two commenters regarding parameters for en suring accuracy (e.g., visual feedback, dynamic signature parameters) in the secure digitized signature (Commenter Nos. 33 and 60). One commenter opposed visual feedback parameters because they add burden and do not enhance environmental protection (Comme nter No. 60). The other commenter believes that dynamic signature parameters could be helpful in establishing the genuineness of aDecember 2, 2013 FINAL DOCUMENT Page 59

signature; however, such parameters could cause confusion (e.g., if it rejects signatures that are in fact valid) and add burden on waste handlers (Commenter No. 33). **Response:** EPA thanks the commenters for their views about the parameters for the digitized signature. The issue with visual feedback and collection of signature dynamics parameters is not the furtherance of env ironmental protection, but rather, suppl yi ng a signature that is capable of being reliabl y authenticated by document examiners so that the sy stem will be protected from attempts at fraud or repudiation. EPA acknowledges that a dynamic signature s ys tem that attempt s to validate signatures immediately can be calibrated so that they report either too many false positives or false negatives. However, EPA does not intend to implement the digitized handwritten signature so that signatures will be validated in this manner “on the fly .” Rather, EPA intends that the sy stem will collect and retain the forensic signature evidence and then subject the forensic evidence to anal ys is by experts only

in the event of a dispute involving a manifest signature. This is the manner in which ink signatures are authenticated when a dispute arises regarding their authenticity , and EPA expects that the forensic data from digitized handwritten signatures will be analyzed and authenticated in a similar fashion with e

- Manifest. EPA will further consider these c omments as we develop the e

- Manifest sy stem. **5.0 Preparer Signature Proposal**  **Comment:** We heard from 13 commenters expressing concern or offering suggestions for the proposed procedures for preparers to sign and initiate the e lectronic manifest (Commenter Nos. 5, 17, 25, 30, 32, 33, 34, 35, 46, 54, 57, 59, and 60). Two commenters expressed their concern for the high level of safeguards required for the preparer signature approach since EPA does not require any equivalent lev el of safeguards for handwritten signatures under the current manifest sy stem (Commenter Nos. 46 and 57). Another commenter expressed its belief that EPA should not establish any requirements for preparer signatures beyond what is currentl y required for p aper manifests and expressed opposition to EPA's suggestion for hand

- signed generator authorization for the preparer (Commenter No. 60). Three commenters believe that the proposed preparer signature feature could diminish the importance of th e generator certification and the generator's involvement/responsibility to ensure correct, valid information on the manifest (Commenter Nos. 5, 34, and 59). One of these commenters expressed concern that EPA is making the electronic manifest available to small handlers (Commenter No. 34). The commenter believes that the e

- manifest should be available only to waste handlers involved in large numbers of manifests. Another of these commenters believes the preparer signature could affect the cradle

- to

- grave responsibility as interpreted b y the courts as well as other liability issues (Commenter No. 59). One commenter believes the term "preparer" at proposed 40 CFR 262.24(b) should be changed to reflect the definition at proposed 40 CFR 260.10, i.e., the "preparer" is the person who conducts the administrative requirements of assembling the manifest, not the technical requirements of preparing the shipment for transportation (Commenter No. 57). The commenter also believes the proposal prohibits a preparer from originating the manifest, even though preparers can originate aDecember 2, 2013 FINAL DOCUMENT Page 60

paper manifest under the current s ys tem. The commenter urged EPA to revise the regulatory language to clarify

that preparers can originate the electronic manifest Two commenters suggested that the manifest should indicate the preparer's relationship to the generator (Commenter Nos. 54 and 59). One of these commenters further stated that EPA should require that the preparer's signature and compan y, as well as the generator's signature, app ear on the electronic manifest (Commenter No. 54). The commenter also asked EPA to reiterate its existing policy

allowing employees or other individuals to sign the manifest paper on behalf of the generator. Two commenters asked EPA to clarify the liability

of generators and preparers under the proposed approach (Commenter Nos. 5 and 30). Two commenters asked EPA to clarify specifically

how the generator authorizes the preparer to sign on his behalf, e.g., the specific language to be used (Commenter Nos. 30 and 59). Two commenters expressed their belief that the authorization should be in writing (Commenter Nos. 33 and 59). One of these commenters suggested that the authorization should be in writing, cont ain an acknowledgment that the generator is responsible as the generator of the waste described in the manifests completed by the preparer, and be executed prior to the preparer completing an y m anifests on behalf of the generator (Commenter No. 59). The c ommenter believes the authorization should also clearl y indicate to the generator that the same responsibilities and liabilities associated with a paper manifest are also associated with an electronic manifest, including the reconciliation of any rejection s, discrepancies, or exceptions. Another commenter asked EPA to clarify the procedures for a generator's employees to electronically

sign an electronic manifest that is prepared by a vendor (e.g., discuss the ability of the employees to interface with the vendor's electronic manifest) (Commenter No. 25). One commenter expressed support for allowing for preparer signatures, but noted that use of the secure digitized signature would minimize the need for preparers to sign on behalf of the generator (Comment er No. 17). Another commenter also expressed support for preparer signatures, but asked EPA for more clarification on when preparer signatures would be appropriate and how they might be integrated into technology platforms (Commenter No. 32). Two commenters expressed their belief that EPA should not limit the preparer signature approach to digital signatures (Commenter Nos. 33 and 60). They believe the rule should be flexible enough for other approaches. Four commenters believe the regulat ions should be clarified to require that the preparer must provide the signed manifest to the generator at the time of signature/shipment (Commenter Nos. 33, 35, 54, and 59). One of these commenters indicated its belief that there is no other effective al ternative to the proposed approach of leaving a manifest with the generator (Commenter No. 33). The commenter believes the generator would insist of this.December 2, 2013 FINAL DOCUMENT Page 61

Another commenter expressed concern about the logistical difficulties associated with a preparer' s leaving a signed paper manifest with the generator prior to shipment (Commenter No. 57). The commenter suggested that, as an alternative, the generator be provided with a shipping paper at, or in advance of, pick

- up of the waste. Two commenters express ed their belief that the generator should receive verification of receipt or notice of rejections or discrepancies (Commenter Nos. 33 and 60). Once of these commenters supported its view by

indicating that a conflict of interest could arise if a generator allowed its preparer (e.g., TSD) to verify receipt of shipment (Commenter No. 33). The other commenter noted that there may

be instances where electronic verifications are not possible (Commenter No. 60). In these circumstances, the commenter believes that alternative means of verification should be acceptable and may

include, but are limited to, a hard copy of the manifest or a summary of the relevant manifest data. The commenter also believes that the particular concern regarding a generator/preparers relationship when the preparer is employed b y the same entity that operates the receiving facility

is addressed by

the formal business relationship of the two parties, e.g. indemnification or some other contractual relationship. The commenter offered regulatory text for EPA's consideration that would apply to preparers that also act as the transporter and designated TSDF. **Response:** EPA thanks the commenters for their many views on the third

- party

storage of electronic manifests. In the May 22, 2001 pr oposed rule, EPA proposed the provisions for manifest preparation and signature b y authorized preparers at section 262.24(b). The topic of manifest preparation and the related issue of when it is proper for a preparer of manifests to sign for the generato r has been subsumed by the discussion of “offeror” responsibilities and offeror signatures in the March 4, 2005 final rule notice on Manifest Form Revisions. Because this area is now fully

addressed in the general discussion of offeror responsibilities an d offeror certifications that apply

to all manifests, both paper and electronic, it is not necessary to codify in the final e

- Manifest rule a distinct provision limited to electronic manifesting addressing manifest preparation and preparer signatures. The offeror responsibilities and options for signing manifests are no different for paper manifests or electronic manifests. Therefore, EPA is not taking further action on the preparer signature proposal in the final rule. Refer to the document, “Hazardous Waste Management S ys tem: Modifications of the Hazardous Waste Manifest Sy stem; Proposed Rule,” in the Federal docket for EPA’s responses to public comments on the proposed preparer signature provisions. The document is available at www.regulations.gov under EPA docket number EPA

- HQ

- RCRA

- 2001

- 0032.
**6.0 Proposed Conditions on Third** 
**- party Storage**  **Comment:** We heard from eight commenters who either stated their support for third

- party storage of manifests, or expres sed their lack of opposition to it (Commenter Nos. 12, 17, 22, 33, 46, 54, 59, and 60). Two of these commenters believe the off

- site storage provision would be an incentive for facilities to automate (Commenter Nos. 33 and 60). One of the commenters noted that it is unclear as to just how off

- site vendors would assume the computer and record security controls in storing manifests (Commenter No. 33). The commenterDecember 2, 2013 FINAL DOCUMENT Page 62

suggested that EPA could make it a requirement that, should a third

- part y st orer decide to leave the business, they

must provide EPA with copies of all manifest records in their possession; however, the commenter noted some drawbacks with this approach. The commenter also suggested that EPA could make it a requirement that, shoul d a third

- part y storer decide to leave the business, they

must give a reasonable amount of notice to their customers to allow the customers time to find an alternate storer and have their records transferred to that alternate storer. The commenter noted, however, that this would leave EPA largel y dependent on the competence and diligence of the third

- part y storer. One commenter stated its belief that it should be the responsibility of the TSDF to assure that adequate data security

is maintained by

these third

- part y storage providers (Commenter No. 17). The commenter does not believe that EPA needs to include an y particular restrictions or controls on the use of these vendors. One commenter clarified that, if railroads are allowed to use their current EDI sy stems to transmit and store the information, it is in favor of off

- site storage (Commenter No. 46). Two of the commenters clarified that they do not oppose off

- site storage so long as the rule full y addresses the issue of inspection of manifests that are electronic (Commenter Nos. 54 and 59). One commenter suggested that EPA should include a requirement that the manifest sy stem have the capability

and that the generator, and/or TSDF, and/or transporter print out a one (or two) line "summary

report" o f electronic manifest activit y (Commenter No. 54). The commenter believes this should be required on a weekl y basis so that if a s ys tem is down, or if the contact person is not available, the inspecting entit y would still have manifest information. The o ther commenter stated that facilities should be required to recover their records or transfer them to another third

- part y storer if inspectors are not provided with adequate access, or if the business arrangements between the third

- part y storer and the gen erator are no longer in effect during the required retention time (Commenter No. 59). **Response:** EPA thanks the commenters for their many views on the third

- party

storage of electronic manifests. In the May 22, 2001 proposed rule, EPA proposed to permit facilities to engage commercial record storage services or networks to provide for electronic storage of manifest copies. Based on stakeholder input and further consideration, EPA has determined not to pursue its proposed decentralized e

- manifest approach . On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the establishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. The 2012 e

Manifest Act in fact mandates this approach. Under this approach, users of the e

- Manifest may be able to maintain their official copies of the electronic manifest on secure storage sites and their accounts on the national sy stem, rather than on third

- part y s ys tems. Because of the centralized approach, it is no longer necessary to address third

- part y storage in the final rule.
**Comment:** We heard from six commenters regarding liability and enforcement issues associated with the offsite storage of electronic manifests (Commenter Nos. 16, 18, 22, 33, 34, and 60).December 2, 2013 FINAL DOCUMENT Page 63

Several commenters believe that EPA needs to clarify the liability and enforcement implications for facilities and their third

- part y storers under the proposed approach (Commenter Nos. 16, 18, and 34). These commenters asked EPA to clarify in particular the compliance and enforcement issues that would app ly

to a RCRA facility

that uses a third part y to store its manifests, in situations where the manifest cannot be immediately produced to inspectors (e.g., because of technical difficulties). Another commenter expressed its belief that the issue of vendo r liability and vendee protection should be left to the contract between the two parties (Commenter No. 22). The commenter believes these issues should not be addressed through EPA's rule. Two commenters believe that the third

- part y storer should not incur an y liability under RCRA (Commenter Nos. 33 and 60). One of the commenters believes the vendor would face service

- provider liability

rather than liability

under RCRA per se (Commenter No. 33). The other commenter does not believe there would be an y distinction between hard copy manifests and the manifest data stored electronically in regard to enforcement, and as such, EPA can use its existing enforcement authorit y for recordkeeping of electronic forms (Commenter No. 60). The commenter stated that the regulated entity is the owner of its electronicall y stored manifest data and it would be compelled to produce the data upon demand from EPA. In this regard, the commenter believes that the third party service provider should not incur any RCRA liability from the simple storage of data. The commenter added that the third party service provider is responsible for the administration of the storage s ystem and that the data remains under the control and ownership of the facility through their c ontractual agreements. The commenter believes that, if the data storage service should exit the business, the accounts would be transferred to an alternate third part y service provider. **Response:** EPA thanks the commenters for expressing their concerns on the third

- part y storage of el ectronic manifests. Because the centralized national e

- Manifest sy s tem being pursued by EPA under the e

- Manifest Act and this final rule will address storage of manifests at users’ accounts on the national sy stem, it is no lo nger necessary to address third

- part y storage in the final rule. Please refer to the Agency response above for additional information.
**7.0 Regulatory Analyses Supporting the Rule**  **Comment:** We heard from 10 commenters on EPA's regulatory impact analy sis o f the proposed rule (Commenter Nos. 10, 21, 26, 33, 34, 44, 52, 54, 59, and 63). One commenter expressed its disagreement with EPA that the rule is not economically significant (Commenter No. 10). In regard to the Economics Background Document of the r ule, the commenter stated that EPA has inadequatel y addressed the costs related to waste handlers' equipment purchases. The commenter disagreed with a basic assumption in the anal ys is that waste handlers have personal computers readily available for the e

- manifest. The commenter believes that the analy sis is too simplistic and that automated handlers would need to pay for computer equipment, such as computers, printers, signature devices on vehicles, as well as forDecember 2, 2013 FINAL DOCUMENT Page 64

employee training on the e

- manifest. Th e commenter expressed concern that the anal ys is does not account for situations in which transporter printer capabilities are needed, e.g., in editing a generator's manifest. In addition, the commenter does not believe the study adequatel y addresses econo mic impacts on small businesses. The commenter is concerned that the study 's underl yi ng data are based on consultations with relatively large waste handlers, which has skewed the data. The commenter points out that the largest waste handlers likely have the greatest amounts of computer hardware and software in place, as well as greater resources for implementation. Even though the e

manifest is optional, the commenter believes small waste handlers may be forced into adopting electronic manifesting, which could be financially crippling. In regard to the Hazardous Waste Manifest Cost Benefit Anal ys is, the commenter states that EPA has not accounted for the need of transport vehicles to have computer and printer capabilities (e.g., to process the manifest for the non

- automated generator). Further, the commenter is concerned that the EPA's studies do not indicate the specific number of waste handlers that would enjoy the burden reduction under the e

- manifest proposal. The commenter believes th at the per - entit y burden reduction likely would not offset the incremental burden from necessary expenditures such as computer hardware, software, and training. Given these observations, the commenter expressed doubt that waste handlers would see savings under the proposed approach. Finally , the commenter expressed its belief that States would be the primary beneficiaries under the e

- manifest approach, not the waste handlers. Another commenter disagreed with EPA's burden estimates for the e

- manifest (Commenter No. 52). The commenter believes that the burden to waste handlers would increase under the proposed approach, since a hard cop y of the shipping paper would still be required during transportation. Another commenter agreed with EPA that automatin g the manifest s ys tem has potential to result in an overall net savings at some future time after the new s ys tem reaches steady state operation (Commenter No. 23). However, in the interim, the commenter foresees potentially high front

- end costs for indivi dual waste handlers to purchase and deploy new hardware and software to implement the sy stem. The commenter also believes individual waste handlers would incur up - front and continuing costs for maintenance, backup sy stems, specialized training, and securi ty

. Another commenter suggested that EPA's anal ys es should account for other regulatory paperwork that might accompan y a shipment, increasing costs (e.g., LDR paperwork, DOT shipping paper) (Commenter No. 21). Another commenter noted that the rule would require waste handlers to maintain an electronic activity log audit trail to track access to the electronic records (Commenter No. 26). The commenter believes this would potentially be labor

- intensive and should be accounted for in EPA's cost studies. Th e commenter also cautioned EPA that a paper

- based sy stem might be less burdensome for some TSDFs that an automated s ystem. In addition, the commenter pointed out that much of a TSDF's business is made up of one

- time generators that will not likely haveDecember 2, 2013 FINAL DOCUMENT Page 65

automated capabilities. Therefore, EPA should not assume that all of a TSDF's forms will be automated, or that the entire manifest cycle will be automated. A number of commenters believe EPA has underestimated States' capital start

- up costs un der the e - manifest (Commenter Nos. 33, 34, 44, 54, 59, and 63). Two of these commenters stated that EPA's cost estimates are missing the amount of time and resources needed to maintain the knowledge to keep the electronic s ys tem up

- to

- date, which may requ ire at least one full

- time equivalent at a very

high pay grade (Commenter Nos. 54 and 63). Another commenter stated that EPA's cost estimate of $100,000 for State start

- up costs is too low, taking into account signature authority certificates and key s and the States' need to accommodate both EDI and XML formats (Commenter No. 59). Another commenter believes that there would be no cost savings b y implementing the proposed electronic submission sy stem for ye ars to come (Commenter No. 34). The commenter poi nted out that, initially , States would have to design and implement the electronic data submission sy stem at the same time as handling the existing hard copy s ys tem. One commenter stated that EPA should consider the full cost of implementation of the e

- manifest component, given possible effects of the rule on waste handler and States' behavior (Commenter No. 25). The commenter wondered if manifest preparers or third

- part y storers would begin to charge their waste handler customers to recoup the cost of th e electronic s ys tems. The commenter also wondered about the effects on waste handlers' costs if some States do not adopt electronic reporting and a patchwork of State programs arises, making the e

- manifest complex. **Response:** EPA thanks commenters for their many suggestions for improvements to the Agency ’s economic analy sis. In the May 22, 2001 proposed rule, EPA proposed a decentralized approach for electronic manifesting that was based on technical standards and controls for initiating, transmitting, and retaining the electronic manifest. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA’s preferred option is now the es tablishment of a national e

- Manifest sy stem to be hosted by EPA and funded by

service fees that would be paid b y the waste handlers who choose to use electronic manifests. In this regard, many of the assumptions and estimates in the Agency ’s economic anal ys is on the proposed rule are not relevant to the Agency ’s current approach. Nonetheless, commenters have raised good suggestions for further EPA research and anal ys is. EPA will continue to examine issues raised by commenters, such as costs to States, co sts for hardware, costs for carrying a paper manifest during transportation, and costs to small entities. EPA has determined that the costs, benefits, and other impacts of e

- Manifest will not occur until the sy stem is implemented. This final rule codifies key requirements of the E

- Manifest Act and authorizes the use of electronic manifests on the national sy stem, but none of the costs or benefits will be realized until the national sy stem is developed and implemented. Therefore, EPA has decided to defer the development of a detailed Regulatory Impact Analy sis until we promulgate the Fee Rule. At that time, we will have more complete and detailed information on the sy stem to be procured and its costs, as well as the user fee charges that will be as sessed to pay for and sustain the sy stem. Thus, EPA will address commenters’ input as appropriate when we prepare the econo mic anal ys is for the Fee Rule.December 2, 2013 FINAL DOCUMENT Page 66

**Comment:** We heard from two commenters on EPA ’ s anal ys is of small business impacts under the Regulato ry

Flexibility

Act (Commenter Nos. 10 and 44). One commenter expressed concern that EPA concluded that the rule would have no significant adverse impact on a substantial number of small entities (Commenter No. 10). The commenter believes EPA's anal ys is i s incomplete, since it does not fully examine impacts to small waste handlers, such as small transporter companies. The commenter notes that most hazardous waste transportation companies are small businesses; however, EPA's studies do not adequatel y anal y ze the potential economic impact on transporter companies and TSDFs that are small businesses. In addition, the commenter notes that small transportation and TSDF companies must compete with the larger companies, who have more resources to obtain e

- manife st capabilities and to undercut prices of smaller competitors. The commenter suggests that these larger companies will use the e

- manifest as a value added service to drive small er firms out of business. The commenter also noted that large generators woul d likely expect their commercial transporters and TSDFs to automate. This could force small businesses to automate or lose customers. Finally, each automated transportation vehicle would need computer capabilities, and employees would need to be trained on the e

- manifest. The commenter expressed concern that these issues are not addressed in the EPA's small business studies. The other commenter expressed general concern that EPA's anal ys is underestimates the costs to smaller generators (Commenter No. 44 ). **Response:** EPA thanks commenters for their views on impacts to small businesses under the propo sed rule. As described above, EPA’s proposed rule was based on a decentralized approach for electronic manifesting. Since then, EPA indicated i n April 2006 that its preferred option had changed to the establishment of a national e

- Manifest sy stem to be hosted by EPA , and has decided on this approach in this final rule . As discussed in the previous comment response, EPA has decided to conduct its detailed evaluation of the economic impacts of the e

- Manifest when it promulgates the Fee Rule prior to the s ys tem’s implementation. Nonetheless, commenters have raised good suggestions for further EPA research and anal ys is. At this time, EPA notes that the paper manifest form will still be available for use, so any small business that does not want to utilize the electronic manifest can still access the paper forms to comply with manifest requirements. While EPA concedes that the earl y adoption of e

- Man ifest by larger transporters and TSDFs could place competitive pressure on some smaller entities, we do not believe that there will be a significant economic impact on a substantial number of small entities. In addition, the earl y adopters will be the one s that encounter the earl y bugs and complicatio ns of e

- Manifest implementation, and perhaps a greater share of the costs. Once the initial period of s ys tem implementation is completed b y early adopters, there may be “turn

- key” solutions available from thi rd party

vendors that will make the costs of entry to e

- Manifest less substantial than perceived now by the commenters. Even the smaller transporters and TSDFs, who are after all in the business of hazardous waste transportation and management, should realize sufficient efficiencies from the electronic manifest to eventually warrant their investment and participation in the electronic s ys tem.December 2, 2013 FINAL DOCUMENT Page 67

**APPENDIX: TABLE OF ORGANIZATIONS COMMENTING ON PROPOSED RULE AND COMMENTER NUMBERS** December 2, 2013 FINAL DOCUMENT Page 68

**Table of Organi zations Commenting on Proposed Rule and Commenter Numbers**  **Commenter Number**  **Name of Organization Commenting on the Proposed Rule** 1 No Affiliation 2 Association of State and Territorial Solid Waste Management Officials 3 University

of Missouri

- Colombia Environmental Health and Safety 4 International Metals Reclamation Company , Incorporated 5 No Affiliation 6 Pennsylvania Department of Environmental Protection 7 Battery

Council International 8 The Graphic Arts Coalition 9 Hazardous Materials Advisory Council 10 Chemical Anal yt ics, Incorporated 11 Phelps Dodge Corporation 12 Department of Defense 13 Department of the Nav y, Puget Sound Naval Shipyard 14 International Precious Metals Institute 15 American Trucking Associations 16 American Petroleum Institute 17 Ony

x Environmental Services 18 Equiva 19 Specialty

Steel Industry

of North America and the Steel Manufacturers Association 20 Solutia 21 Dupont 22 Utility

Solid Waste Activities Group 23 Department of Energy 24 Sy

nthetic Organic Chemical Manufacturers Association, Incorporated 25 Eastman Chemical Company 26 Waste Management 27 State of Maine Department of Environmental Protection 28 Merck Manufacturing Division 29 BRG Environmental 30 Texas Natural Resource Conservation Commission 31 Purdue Universit y 32 Analine Technologies 33 Massachusetts Department of Environmental Protection 34 New York Department of Environmental Conservation 35 State of Michigan Department of Environmental Quality 36 National Paint and Coatings Association 37 William K. TaggartDecember 2, 2013 FINAL DOCUMENT Page 69

**Commenter Number**  **Name of Organization Commenting on the Proposed Rule** 38 Coalition for Responsible Waste Incineration 39 Sy stech Environmental Corporation 40 New Hampshire Department of Environmental Services 41 Cement Kiln Recycling Coalition 42 Paul, Hastings, Janofsky & Walker LLP 43 American Chemistry Council 44 Northeast Waste Management Official's Association 45 Dow Chemical Compan y 46 Association of American Railroads 47 Dominion 48 California Environmental Protection Agency 49 Institute of Makers of Explosives 50 Marisol, Incorporated 51 PPG Industries 52 General Motors Corporation 53 Cement Kiln Recycling Coalition 54 In formation Management Task Force of the Association of State and Territorial

Solid Waste Management Officials 55 Giant Cement Holding, Incorporated 56 American Airlines Incorporated 57 Heritage Environmental Services 58 U.S. L iquids Incorporated 59 Illinois Environmental Protection Agency 60 Safety

Kleen 61 Environmental Technology Council 62 National Automobile Dealers Association 63 Arkansas Department of Environmental Quality 64 Phelps Dodge Corporation 65 Environmental Technology Council 66 U.S. Army

Corps of Engineers