Document ID: EPA-HQ-RCRA-2001-0032-0184
Agency: epa
Document Type: Supporting & Related Material
Title: 
Posted Date: 2013-12-13T05:00Z

RESPONSE TO COMMENTS DOCUMENT
                                       
HAZARDOUS WASTE MANAGEMENT SYSTEM: MODIFICATIONS OF THE HAZARDOUS WASTE MANIFEST SYSTEM; PROPOSED E-MANIFEST SYSTEM
                                       
                            PUBLISHED MAY 22, 2001
                                       
                                       
                                       
                                       
                               December 2, 2013
                                       
                                       
                                       
                                       
                                       
                                       
                                       
                                       
                                       +
                                       
                    ************FINAL DOCUMENT************
BACKGROUND AND PURPOSE OF DOCUMENT

Background

On May 22, 2001, EPA published a notice of proposed rulemaking to revise the hazardous waste manifest system (66 FR 28240).  The proposed revisions aimed to reduce the manifest system's paperwork burden on users, while enhancing the effectiveness of the manifest as a tool to track hazardous waste shipments.  The proposed rule would have accomplished this by adopting a standardized manifest form with fewer or no optional data fields; adopting a new approach for distributing and acquiring the form; standardizing the data elements and procedures for tracking certain types of hazardous waste shipments; and allowing the manifest to be completed, signed, transmitted, and stored electronically.  Thus, the proposed rule consisted of manifest system reforms of two distinct types: (1) revisions to the manifest form and the procedures for using the form and (2) revisions aimed at replacing the paper-based manifest system with a nearly paperless, electronic approach to tracking hazardous waste shipments (referred to as the Ae-manifest@ in this document).

EPA received 66 public comment letters in response to the May 22, 2001 proposed rule.  Commenters generally supported our goals of further standardizing the manifest form elements and reducing variability among the manifests that authorized RCRA State agencies currently distribute.  However, the commenters had differing views on many of the particulars of the proposed revisions to the manifest.  Moreover, there were a substantial number of comments that took issue with EPA's proposed approach to the e-manifest, particularly with respect to the technical rigor of the proposal, the assumptions relied upon by EPA in its projections of burden and cost reductions, the feasibility of the proposed electronic signature options, the highly detailed security requirements aimed at preventing fraud and data corruption, the reliance on regulated industry to develop private e-manifest systems, and the preamble's suggestion that State programs may not be required to adopt the e-manifest requirements within their authorized RCRA State programs.

We believed that the comments addressing the e-manifest proposal raised significant substantive issues that merited further analysis and stakeholder outreach prior to adopting a final approach.  The comments received in response to the form revisions proposal, on the other hand, raised fewer difficult issues that would deter us from going forward with a final rule.  Therefore, EPA separated the e-manifest portion from the form revisions portion of the proposal for purposes of taking final action at that time.  EPA published a final rule on the form revisions on March 4, 2005 (70 FR 10776).  EPA is now taking final action on the e-manifest portion.  

Purpose of Document

This document presents a summary of the public comments received in response to the e-manifest provisions of the proposed rule.  The public comments (e.g., suggestions, concerns, questions) are summarized according to specific issues related to the proposed rule and preamble.  

In each summary, we indicate the number of organizations whose comments are reflected in it.  We also identify the organizations.  To do so, we assigned each organization a unique commenter number.  We then prepared the summaries and inserted commenter numbers into each summary to identify the organizations whose comments are reflected in it.  The appendix to this document includes a table identifying each organization that commented on the proposed rule and its commenter number.

This document also provides the Agency's response to each comment.  The responses explain how the comments were considered in developing the final e-manifest rule.  This document does not address comments that are outside the scope of the e-manifest. 

SUMMARY OF PUBLIC COMMENTS AND AGENCY RESPONSES ON E-MANIFEST

1.0	General Comments

     1.1	General Support

Comment: We heard from 46 commenters that indicated their general support for the rule and/or efforts to automate the manifest in particular (Commenter Nos. 1, 4, 6, 8, 9, 12, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24, 26, 27, 28, 30, 31, 32, 34, 35, 36, 37, 39, 40, 42, 44, 45, 46, 47, 48, 49, 51, 52, 53, 54, 56, 57, 58, 60, 61, 62, and 63).  Thirteen of these commenters expressed their support of EPA's goals to streamline the manifest requirements and reduce burden on waste handlers (Commenter Nos. 12, 19, 21, 22, 23, 31, 42, 49, 53, 58, 60, 62, and 63).  One of the commenters had participated in the e-manifest pilot program (Commenter No. 28).  The commenter expressed support for automation, but encouraged EPA to work through any issues that were identified in the pilot before moving forward.  

Response:  EPA thanks commenters for their support of the proposed rule and efforts to automate the manifest.  EPA has modified its proposed e-manifest approach due in part to feedback from stakeholders.  In addition to stakeholder comments on the proposed rule, we received input from stakeholders at 2 national meetings (May 2004 and November 2008) held since the publication of the 2001 proposed rule, and from webinars conducted after the 2008 public meeting.  We also gained additional insights from additional e-Manifest pilot tests conducted during 2007  -  2008 with the States of Michigan, Minnesota, New Jersey, and Massachusetts.  Further, we solicited additional comment on the e-Manifest program direction and specific policy issues in Federal Register notices we published in April 2006 and February 2008.  Finally, the Hazardous Waste Electronic Manifest Establishment Act (e-Manifest Act) was enacted in October 2012. The final rule addresses key provisions of this legislation that authorizes the establishment of a national electronic manifest system by EPA, and that requires implementing regulations to authorize the use of electronic manifests and, among other things, to ensure consistent implementation in the states.  Please refer to specific EPA responses to learn more about the changes that resulted after these outreach efforts with stakeholders.  

Comment: We heard from 17 commenters suggesting that the e-manifest requirements should be simple to understand and follow and not be too prescriptive to prevent future technologies and improvements (Commenter Nos. 4, 12, 25, 28, 32, 33, 34, 43, 45, 51, 52, 53, 54, 57, 59, 60, and 61).  One of the commenters noted that technological advances will make it very difficult for EPA to select technologies and standards that may be appropriate years into the future (Commenter No. 61).  The commenter suggested that EPA establish a basic framework on how the e-manifest should work, and then implement the details in non-regulatory documents that can be quickly modified as needed.  In response to EPA's question whether Extensible Mark-up Language (XML) is sufficiently stable to support the e-manifest approach, one commenter believes XML is the technology most likely to be able to support EPA's purposes in the foreseeable future (Commenter No. 33).  Another commenter suggested that the rule should be technology neutral and allow for industry to use other technologies than specified in the rule (Commenter No. 60).   Another commenter asked that the final rule include a complete process description from initial preparation by the generator through the final storage of the manifest (e.g., a process flow chart) (Commenter No. 51).  Two commenters suggested that EPA add an option for a petitioner to demonstrate equivalency to the two proposed data formats in the rule (Commenter Nos. 57 and 61).

Response:  EPA thanks commenters for their suggestions on keeping the e-manifest approach flexible and easy to implement.  In our May 2001 proposal, we set forth a standards-based approach for reporting and recordkeeping of the e-manifest.  Users of the e-manifest would have had two options for transmitting the e-manifest, i.e., Electronic Data Interchange (EDI) and Extensible Mark-up Language (XML).  Users also would have had to comply with electronic manifest systems and security requirements, such as requirements for independent system validation, limits on system access, full interoperability among users' systems.  Signing the e-manifest would have been done using either a secure digitized signature or a digital signature based on private key/public key cryptography. 

As we discuss below in response to other comments, EPA received many comments critical of the proposed decentralized, standards-based approach.  Several commenters suggested that a preferred approach would be for EPA or another entity to develop a consistent, national solution for the e-Manifest.  We received strong additional comments supporting such a national system at a May 2004 public meeting in Washington, D.C. and in comments responding to the April 2006 Federal Register notice soliciting comment on the preferred program direction.  

Since the 2001 proposal, EPA has made significant progress toward developing its Agency-wide electronic receiving system, called the Central Data Exchange (CDX).  We have also, with our State environmental program partners, developed the National Environmental Information Exchange Network as a means to efficiently share environmental information with the States, through the nodes the States have developed on this network. The CDX has evolved from a prototype system to a fully operational electronic document receiving system and the building blocks supporting the CDX functions have changed substantially.  These changes reflect EPA's experience operating the CDX over these years, evolving trends in Internet technologies, and comments received from potential CDX users.  The CDX now supports tens of thousands of registered users providing data to dozens of environmental reporting programs across the major EPA media offices.  CDX registered users include representatives from state, tribe, and local agencies, industries, laboratories, and other federal agencies. 

In addition, EPA finalized the Cross Media Electronic Reporting Rule (CROMERR) on October 13, 2005 (70 FR 59847).  CROMERR provides a uniform, technology-neutral framework that applies to electronic reporting across all EPA programs.  For example, the new electronic reporting provisions modify current requirements in the Code of Federal Regulations to address obstacles to electronic reporting.  They require validation of electronic signatures on reports submitted to EPA through the CDX (or another designated EPA system).  They also ensure that valid electronic signatures have the same legal force as their wet-ink counterparts. 

Because of the emergence of the CDX as a viable option for the e-manifest, as well as stakeholders' requests for a more flexible, simple, and technology-neutral approach, EPA has decided to develop a national, centralized Web-based information technology system that EPA will host on the CDX or an equivalent system.  EPA's final rule authorizes the use of electronic manifests that are created and transmitted through the use of this national e-manifest system.  The final rule amends existing manifest regulations which now require manifests to be created only as paper forms, to be signed only with "by hand" signatures, and to be physically carried by waste handlers and retained at their sites as paper records.  These regulatory changes are necessary to ensure that electronic manifests are as valid as the traditional paper manifests that are signed with ink and manually processed and transmitted.  The use of EPA's national e-manifest system to obtain and process valid electronic manifests is the key component of the final rule.  The rule  codifies key requirements of the 2012 e-Manifest Act, which requires EPA to implement a centralized approach and develop a national electronic manifest system.  The final rule thus explains how electronic manifests obtained from and transmitted to the national system will be legally equivalent to paper manifests, and it clarifies the relevant policy issues (e.g., electronic signatures, CBI, paper manifest collections, program consistency) from the 2001 proposal, the subsequent 2006 and 2008 public notices, and the recent legislation.

EPA believes this approach will be much simpler and more flexible to implement than the proposed approach.  This follows because the proposed approach was a standards-based approach under which EPA attempted to define in regulations the technical standards that it believed were necessary to bring about the development of consistent, reliable, and secure systems by numerous private entities.  Under the new preferred approach, only one e-manifest system will be developed and hosted by EPA through the efforts of a contractor selected by EPA to develop the system in accordance with EPA's performance requirements.  This approach will obviate the need for EPA to promulgate the level of technical standards for the e-manifest as was done in the proposal.  Rather, the CDX or equivalent system will be designed with the appropriate level of controls and procedures to ensure that the e-manifest is completed, transmitted, and archived in fulfillment of EPA's performance objectives for system security, interoperability across systems, signature authentication, and other necessary controls.

Because the system and requirements will be implemented through EPA's own receiving system or its equivalent, the Agency will be able to integrate improvements and updates quickly when necessary (e.g., in response to technology advancements), as commenters requested.  The CDX has been designed by EPA expressly to be easy to use and place reasonable technology requirements on users   It offers user tools (e.g., prompts, error-flagging) to guide users and technical assistance via telephone and email should users have questions or problems.  In this regard, a CDX-hosted e-Manifest system will satisfy commenters' requests for an easy-to-use solution for the e-manifest.  In addition, the use of a single, national receiving system will provide stability and certainty for all users and enable a high level of interoperability among users' legacy and future system investments, as commenters have requested. 

In response to the commenters' support of XML, EPA agrees that there are benefits to XML.  The schemas and style sheets developed in XML will likely be the means by which EPA will implement the electronic exchange of e-manifest data.  These XML documents will conform to the data elements of the hazardous waste manifest (EPA Form 8700-22) and continuation sheet (EPA Form 8700-22A) that EPA announced in the March 4, 2005, Form Revisions final rule.  Please refer to Section 2.0 of this document for additional Agency responses in regard to the use of XML for the e-manifest.

Comment: We heard from 12 commenters requesting that EPA further coordinate with other RCRA paperwork requirements as needed in finalizing the e-manifest proposal, e.g., LDRs, Biennial Report, continuation page, exception reporting (Commenter Nos. 12, 16, 18, 21, 24, 35, 38, 45, 46, 50, 57, and 60).  One of these commenters also suggested that EPA extend the e-manifest to non-RCRA requirements, such as PCB continuation sheets or NESHAP notification letters (Commenter No. 16).

Response:  EPA thanks commenters for their request for coordinating the e-manifest with other paperwork requirements.  The e-manifest system that will be developed initially will provide the core services necessary to manage the basic waste shipment tracking and waste data collection functions of the manifest process, including manifest creation, completion, signing, routing and communication services (i.e., services required to create, view, update, transmit, and close manifests) and the collection, distribution, and archiving of official manifest records.  However, we are aware from discussions during both the 2004 and 2008 public meetings that state agency and industry stakeholders regard Biennial Report integration as an important system objective.   Therefore, once we have successfully automated the core manifest preparation and transmission services, we will endeavor to develop the data entry and reporting services to enable e-Manifest data to be refined and processed so that it may be used to develop waste receipt summary information for the biennial report.  The system would also be designed with scalability so that additional EPA reporting functions could possibly be added as future upgrades.  At this time, however, we are focusing the initial phase of system development on the core, domestic manifest tracking requirements.

Commenters should note that the e-manifest system will be hosted on EPA's CDX or equivalent system and will utilize the National Environmental Information Exchange Network (NEIEN) architecture for sharing environmental information with state programs.  In the coming years, EPA intends to increasingly automate its information collections through this architecture as an option to paper-based collections.  As this happens, users will have a greater opportunity to coordinate their electronic reporting activities across EPA's information collections, including the manifest.

	1.2	Delayed Implementation Period for the e-Manifest Requirements

Comment:  We heard from seven commenters who requested that EPA ensure a more coordinated phase-in period (Commenter Nos. 21, 23, 24, 27, 44, 48 and 49).  These commenters were concerned that States be given enough time to make legislative and other changes.  One commenter suggested that a meeting with all State manifesting managers and data system managers may be productive in determining the implementation timeframes (Commenter No. 48).  Another commenter urged EPA to make guidance available, and if possible, sponsor training workshops for the regulated community on the e-manifest approach (Commenter No. 23).

Response:  EPA thanks commenters for their suggestions and concerns.  EPA has been persuaded by public comments on the proposed rule, as well as by suggestions from stakeholders at EPA's public meetings, that the e-manifest should be effective, recognized as valid, and implemented consistently in all states.  The e-Manifest Act enacted in 2012 also requires this result. EPA agrees that development and use of the e-manifest would not be feasible unless it can be assured that the validity of electronic manifests is recognized consistently in all the states.  The Agency appreciates stakeholders' concerns that optional state adoption could frustrate the successful development and implementation of e-manifest systems because investments in these systems could be perceived as too risky.

Therefore, EPA's  approach in this final rule  requires that all state programs adopt and recognize the validity of electronic manifests through the provisions of 40 CFR 271.4(c), which addresses state program consistency and the hazardous waste manifest.  This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest system does not meet the requirements of Part 271.  With the adoption of the electronic manifest in the final rule, EPA will deem it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest. 

In addition, the e-manifest will be effective in all states on the same delayed implementation date that will be identified subsequently by EPA in the e-Manifest User Fee (Fee Rule) rulemaking.  The e-Manifest legislation enacted by the Congress provides that EPA shall implement and enforce the electronic manifest in all states on the program's effective date.  Federal implementation of e-Manifest would continue until such time as the states revise their authorized program with equivalent and consistent e-Manifest requirements and obtain authorization for these program revisions from EPA.   Consistent with the statute, the e-Manifest final regulation states that EPA expects all states to adopt the e-Manifest requirements, and that the electronic manifest will be effective Federally in all States on the announced implementation date.  

For several reasons, EPA does not expect the states to have great difficulty making the transition to the e-manifest.  EPA  believes that because of the final Cross-Media Electronic Reporting Rule (CROMERR) (which lays out a framework for electronic reporting and receiving systems across EPA's programs at the federal, state, and local levels) the states have already begun to consider necessary changes to their environmental programs to enable electronic reporting (e.g., statutory and budgetary changes).  In fact, EPA is aware that a number of states have implemented electronic reporting under some of their environmental programs that meet CROMERR's  requirements.

In addition, EPA will establish a delayed implementation date that assures a smooth transition to the e-manifest by both industry and regulators.  As a point of reference, we note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect Federally in all states immediately after a six-month period following HSWA rule publication.  The EPA Regions administer the HSWA rules until State RCRA programs get authorized for them.  We believe the States have worked effectively in coordinating and transitioning their responsibilities under the HSWA rules, and that a similar Federal/State implementation approach for e-Manifest will be equally effective. 

Under the RCRA authorization regulations at 40 CFR § 271.21(e)(2), authorized states are typically provided 1- 2 years after promulgation of Federal regulatory changes to adopt the corresponding revisions to their authorized programs.  Thus, these regulations govern when states would be expected to adopt their electronic manifest regulations under state law, so that authorized states may implement and enforce the electronic manifest requirements.  We know that authorized states have resource issues and budgetary constraints that may preclude them from meeting the adoption milestones in our Part 271 regulations.  As described above, regardless of states' progress in adopting program revisions, the e-manifest will go into effect under Federal law beginning on the implementation date to be announced by EPA in the Fee Rule.  States will be expected to obtain authorization by that implementation date or within a reasonable period of time thereafter.  This phased-in approach will give the states time to make necessary changes to their programs for the e-manifest.  Because of these factors, and because states have generally been strong proponents of e-Manifest, we expect a fairly smooth transition of e-manifest authority from EPA to the authorized states. 

In response to the comment that EPA should provide guidance and/or training to the regulated community, EPA agrees that users must understand the final e-manifest approach in order to enable compliance.  EPA expects that the final rule approach to be significantly easier to understand and implement than the proposed approach and that training will therefore not be complex.  The final rule approach will be implemented through EPA's CDX or equivalent system.  The CDX includes easy-to-follow instructions and other user support tools (e.g., user prompts, technical support via telephone and email).  Moreover, EPA expects to develop training modules for e-Manifest that should assist industry and state stakeholders to learn the system basics well enough to become proficient with the system.
Comment: We heard from eight commenters that EPA ensure implementation of the electronic manifest sooner than a two-year delayed compliance date (e.g., as soon as possible) (Commenter Nos. 1, 19, 22, 36, 45, 46, 49 and 60).  One commenter indicated that a delayed compliance date is not necessary, as the software is already readily available (Commenter No. 36).  The commenter believes that any further delay in the implementation of the new manifest system would be contradictory to the goals of reducing the paperwork and time burdens associated with the current manifest system.  

Two commenters (state representatives) indicated that, since the implementation of the electronic manifest would be voluntary for the States, the State implementers will dictate the speed at which the electronic manifest is enacted and hence no compliance date is necessary (Commenter Nos. 54 and 63).

Response:  EPA thanks commenters for their suggestions about the delayed compliance date.  The e-Manifest legislation requires EPA to announce its regulation implementing electronic manifesting within 1 year of enactment of the statute.  The establishment of the system, however, is scheduled under the statute at a date 3 years from enactment of the statute, although the precise timing of system implementation will be highly dependent on funding for the system procurement.  Thus, the uniform date on which access to the system will be available will not be announced in this final rule, but will instead be announced after the system has been developed and has been determined to be ready for production use.  EPA currently plans to announce the delayed implementation date in the subsequent Fee Rule, which will be issued prior to the system's implementation.  However, EPA also emphasizes that e-Manifest rule adoption will be mandatory for all states.  All authorized states must adopt fully consistent regulations that recognize the validity of the electronic manifests that will be obtained from and submitted to the national system. While states will have some latitude to adopt their state law e-Manifest requirements within a reasonable time after issuance of this final rule, the states will not determine the uniform Federal compliance date. EPA will determine the consistent implementation and compliance date for e-Manifest in the Fee Rule, and EPA will initially implement e-Manifest beginning on this date and until the states are authorized. 

Comment: We heard from eight commenters that EPA should establish a two-year or greater delayed compliance date for the electronic manifest (Commenter Nos. 17, 25, 29, 35, 51, 57, 59, and 61).  One commenter does not believe that in-place technology at the majority of the affected stakeholders allows implementation of an electronic manifest system within six months of promulgation of the final rule (Commenter No. 25).  Another commenter clarified that, so long as state adoption is mandatory, a two-year compliance date is appropriate for the electronic manifest (Commenter No. 51).

Response:  EPA thanks commenters for their suggestions about the delayed compliance date.  The e-Manifest legislation provides that EPA must publish its final regulation within one year of the statute's enactment, and develop the system within 3 years of that date.  (See response to previous comment).  So, while the final rule may be "legally effective" six months after promulgation of the final rule under RCRA§ 3010(b), as a practical matter, compliance with the system's requirements will not be possible until the system is developed and determined by EPA to be available for use.  The 3 year deadline in the statute for establishing the system represents an ambitious milestone that EPA will endeavor to meet, but ultimately, the date of system development and implementation will depend on sufficient funding for the system procurement.  Within the constraints of the statutory schedule and funding, EPA will make every effort to schedule the system's delayed implementation date so that stakeholders wishing to use e-Manifest will have time to transition smoothly to e-Manifest.  Clearly, there will be a delayed compliance/implementation date, which EPA will announce in the Fee Rule, shortly before the system is ready for use.  We use the term delayed "implementation date" to distinguish the delayed date for compliance and implementation (to be announced in the Fee Rule) from the "effective date," since RCRA § 3010(b) requires that RCRA regulations be legally effective within 6 months of their promulgation.

      1.3	General Questions/Concerns Associated with Automated Systems

Comment:  We heard from one commenter expressing concern that electronic systems may at times be just as unreliable as paper systems (Commenter No. 26).  The commenter stated that hardware, software, and Internet infrastructure problems may cause problems in manifest transmission or outright loss of the manifest.  The commenter asked that EPA clarify the consequences of such malfunctions for all participants in the management system.

We heard from one commenter on the susceptibility of electronic records to natural disasters (Commenter No. 24).  The commenter recommended that EPA acknowledge and anticipate that there may be system failures or natural disasters that cause delays in the submission of the manifest forms.  The commenter proposed that facilities should rely on electronic time stamps for the date of transmission of manifests, so that a problem with electronic sending does not become a compliance issue. 

We heard from two commenters on the susceptibility of electronically stored media to deterioration over time (Commenter Nos. 33 and 60).  One commenter stated that digitally signed and electronically stored media are generally protected in storage from those elements that can corrupt the data on the media (Commenter No. 60).  The commenter believes that, through the use of long-term storage of media in controlled environments, data will remain viable.  Another commenter indicated that digitally signed and electronically stored media have significant advantages to paper media, most notably in terms of how much information can be compacted into a very small physical volume and how much cheaper the storage costs become (Commenter No. 33).  The commenter added that, in terms of deterioration over time, they are in fact inferior to paper media, being far more susceptible to corruption/destruction by heat, electromagnetic fields, material degradation.  The commenter suggested several ways to address these concerns (e.g., creation of multiple copies of whatever information is being stored, and the dispersal of those copies to multiple sites).

Response:  EPA thanks the commenters for their observations about the potential risks and problems of an e-manifest that is implemented on the Internet.  EPA agrees that different problems could and likely will occur in the e-manifest, such as loss/corruption of electronic data.  EPA also agrees that problems inevitably occur in the paper-based system, such as loss or destruction of the paper manifest during shipment.  EPA does not expect any approach to eliminate these problems entirely.  Moreover, the paper manifest forms will remain available for instances in which the e-Manifest system is unavailable, and the DOT Hazmat requirement to carry one copy of the manifest on transport vehicles will provide a back-up means to track shipments even if the e-Manifest is corrupted or lost while the shipment is en route.

EPA has decided in this final rule to implement the e-Manifest through its CDX architecture or its equivalent, as described above, which is designed to minimize problems commonly encountered in e-reporting.  Over the years, EPA has gained considerable experience using the CDX in collecting, processing, and storing electronic media under other EPA collections.  We believe the CDX is well-equipped to handle manifest transactions, and EPA will ensure that additional controls are added as appropriate for the e-manifest.  The CDX, as currently designed, includes a range of controls that are intended to address the types of problems raised by commenters.  For example, the CDX utilizes methods for error-checking that flag obvious errors in documents and document transactions, including duplicate documents and unauthorized submissions.  In regard to the susceptibility of electronic media to damage and deterioration, the CDX archives to multiple formats:  hard disk, tape, and optical media.  This use of multiple formats is designed to ensure that degradation of one format would not jeopardize EPA's long-term storage capability for submitted data.  The CDX archives will be written out to an online disk system when they are first created.  They will be copied to an off-line disk system and also backed up to magnetic tape every day, with full backups to tape on a weekly basis. 

In addition, the CDX provides other protections against data corruption and loss.  For example, the CDX is designed to incorporate firewall security, in addition to the usual system security provisions to control physical access to the system and prohibit unauthorized internal access.  As transmissions flow through the CDX firewall, they are automatically virus-scanned, and the system would not attempt to process a file that contains a suspected virus.  The server will also be protected with intrusion detection software that alerts the system operators to suspected attempts to penetrate or hack the system.  The system operators will use the logging capability of the firewall and the intrusion detection system to monitor the health and status of the system and respond to unauthorized efforts to use or modify the system. 

Comment: We heard from three commenters on procedures for returning the electronic manifest to the generator (Commenter Nos. 6, 16 and 54).  They suggested that the timeframe for the TSD to return a manifest to the generator should be the same for both paper and electronic forms.  One commenter noted that TSDs in its State normally submit paper manifests within seven days and that EPA should consider establishing a seven-day timeframe for the paper and electronic manifest instead of 30 days (Commenter No. 6).  Another commenter also noted that the timeframe for returning a copy to the generator could be reduced (Commenter No. 16).  

Two commenters said the rule is not clear on how to address discrepancies on the electronic manifest, but they believe the procedures should be the same for both paper and electronic forms (Commenter Nos. 38 and 39).   

Response:  EPA thanks the commenters for their views on returning the electronic manifest to the generator.  EPA agrees with comments that the timeframe for the TSD to return the manifest to the generator should be the same for both electronic and paper manifests.  We do not believe there is a compelling reason to establish different timeframes for forms.  Regardless of whether the manifest is paper or electronic, the TSD will need time to evaluate the shipment against the manifest and, if needed, resolve discrepancies.  In addition, two timeframes would unnecessarily clutter the regulations and complicate the procedures for TSDs.  Under such a dual approach, the TSD would need to establish two sets of procedures, one for returning paper manifests and the other for electronic ones.  In developing the final rule, EPA sought to keep the regulations as simple as possible and avoid placing dual procedures on waste handlers whenever possible.  Therefore, in the final rule, the existing 30-day timeframe at 40 CFR 264.71(a)(2) and 265.71(a)(2) for delivering the manifest copy to the generator applies to both electronic and paper manifests.  However, we expect that in practice, e-Manifest will automate the return of manifests from the TSDs to the generators, and that TSDs will normally be able to return electronic manifest copies to generators much quicker than the 30-day limit in the regulations.   The e-Manifest should thus establish a higher standard of timeliness and accountability than is now possible with paper forms returned through the mail.

This same principle holds true for discrepancies.  We agree with comments that there is no compelling reason to establish different procedures for handling discrepancies or exceptions.  The final rule provides that the existing procedures for discrepancies and exceptions apply to both paper and electronic manifests.  However, as with the 30-day deadline for returning manifests to generators, we expect that in practice, e-Manifest will be extremely helpful to users in flagging possible exceptions and discrepancies for users' attention.  So, the reporting of exceptions and discrepancies electronically in the e-Manifest system should be much more timely and efficient than is possible with the mailing of paper reports and letters.

      1.4	Terms and Conditions Agreement 

Comment: We heard from one commenter in response to EPA's request for comment on whether a terms and conditions agreement should be required for e-manifesting (Commenter No. 19).  The commenter supported in principle the promulgation of a rule that sets forth the key terms and conditions for electronic manifesting, as opposed to requiring generators to enter into private agreements with transporters and TSDFs.  The commenter believes such a rule would ensure consistency among State programs, facilitate interstate commerce, and minimize the potential for incompatible waste handler automated systems.

Response:  We thank the commenter for its views on the terms and condition agreement.  We agree that it is not necessary for EPA to require waste handlers to enter into an agreement with EPA on the use of the electronic manifest.  In the proposed rule, we raised the possibility that, under certain regulatory approaches, such an agreement could be warranted.  However, we believe that the final rule approach obviates the need for such an agreement.  First, the final rule sets forth regulations to which all users of the electronic manifest must satisfy in initiating, transmitting, and retaining the forms.  In addition, users must use EPA's Electronic Hazardous Waste Manifest system and transmit the manifest through the Agency's Central Data Exchange (CDX) or equivalent system.  The CDX involves its own set of requirements and procedures with which users much comply.  Finally, 40 CFR Part 3 lays out procedures with which electronic manifest users must comply, such as identity proofing and creating valid electronic signatures.  EPA believes this regulatory framework establishes an effective approach for holding all users of the electronic manifest to the specified standards; as such, EPA believes that no additional agreement with EPA is needed.  

      1.5	Alternatives to Traditional EDI

Comment: We heard from 15 commenters suggesting alternative approaches from traditional EDI for automating the manifest system (Commenter Nos. 12, 19, 24, 25, 31, 30, 33, 34, 40, 48, 50, 51, 56, 60 and 61).  A number of commenters suggested alternative web-based approaches, including a State-hosted central web site, an EPA-hosted central web site, or other approach using a simple web form or software program (Commenter Nos. 12, 19, 24, 30, 31, 34, and 48).  One of these commenters suggested that the use of a centralized electronic manifest system based on the Internet and operated at the state level could satisfy the security and interoperability concerns that EPA identifies in the preamble and proposed regulations (Commenter No. 12).  The commenter proposes that EPA adopt the Internet and XML, or plain HTML, as the means for writing and transmission for electronic manifests.  It added that EPA should require the workflow (numbering, and routing) of electronic manifests, and the secure storage of manifest records, to be coordinated from a centralized state operated Internet accessible database.  Another commenter recommends that EPA host a national Internet site to be used by all handlers (Commenter No. 34).  Another commenter stated that an approach using email and/or a File/Transfer Protocol (FTP) would be appealing to waste handlers since they are virtually free (Commenter No. 33).  Another commenter suggested that EPA allow the use of images (e.g., images of signatures or other data elements) in the completion of manifests (Commenter No. 60).  The commenter believes that the use of images (e.g., TIF compressed images) would enable automated systems to interface with manual systems.  Another commenter said that EPA should allow any suitable process for data transfer, including those currently used in commerce (Commenter No. 51).   Another commenter asked that the EPA examine the possibility of adding the electronic manifest to the RCRAInfo databases.  The commenter believes that adding the electronic manifest to the RCRA Info would be more efficient than adding it to each individual state database (Commenter No. 40).  Another commenter expressed concern, however, that an online reporting approach would deposit its facility data into an EPA mandated central database, which would limit its opportunity to store and manipulate data for reporting purposes (Commenter No. 50).  One commenter recommended a locked Word document that cannot be changed, or an interactive PDF format (Commenter No. 56).

We heard from one commenter on the security of Internet EDI (Commenter No. 33).  The commenter believes that ensuring security of Internet EDI comparable to traditional EDI would be fairly easy; however, ensuring comparable levels of auditability is less certain.  The commenter suspects that Internet EDI could meet the overall requirements for authentication and data-integrity.

Response: EPA thanks commenters for their many ideas for alternatives to traditional EDI.  We acknowledge the many suggestions for a web-based e-manifest approach, as well as comments for a centralized (e.g., state or national) system.  We agree with comments that a centralized, web-based system could be advantageous for users.  Among other things, a web-based system will be cheaper and simpler to implement than other commercial options and is widely accessible, as many users already have Internet access and computer systems or portable devices that meet the minimum operating requirements needed to utilize EPA's CDX.  It is EPA's final rule approach that the CDX or equivalent architecture would be established as the Agency's central reporting hub for receiving, processing, and routing the in-bound electronic manifests to waste management entities and to state governments.  The CDX based system (or equivalent) will offer the necessary applications and components to supply, complete, electronically sign, transmit, and retain electronic manifests.   Users, however, will need to supply their own computer devices to access and use the national reporting system.  Finally, EPA notes that the details of system design and the development of the precise electronic formats for the manifest are beyond the scope of this final rule, and will be address in the system planning and development process.

In regard to the comments in favor of XML, EPA agrees that XML offers advantages over other formats.  Refer to Section 2.0 of this document for additional EPA responses in regard to the use of XML for the e-manifest.

      1.6	Participation in Manifest Automation

Comment: We heard from six commenters that expressed support for the proposal to make the e-manifest voluntary for waste handlers  (Commenter Nos. 4, 8, 19, 22, 24, and 38).  These commenters noted the substantial burden and time commitment needed for implementation and believe that smaller companies would have greater difficulty overcoming these challenges.  

Response:  EPA thanks the commenters for their views on voluntary participation by waste handlers. EPA agrees that the e-manifest should be optional for waste handlers.  EPA recognizes, for example, that a number of waste handlers might not have the necessary equipment (e.g., a personal computer) to participate.  In addition, other waste handlers may be content with the current paper-based system, or otherwise have made a significant investment in the paper-based system (e.g., investments in personnel training, filing systems), and opt not to participate.  Moreover, the e-Manifest legislation enacted by the Congress provides that the use of electronic manifests shall be at the election of the users.  EPA's final regulation affirms this policy and holds that the use of electronic manifests will be voluntary for manifest users.  The paper forms will remain available for those who wish to continue to complete and process the paper forms.  However, in the final rule, EPA clarifies that it is our ultimate goal to promote the use of electronic manifests to the greatest extent possible. In this regard, the Agency may consider fee incentives or other means to promote this end.

Comment: We heard from 30 commenters who opposed EPA's proposal for States to voluntarily adopt the e-manifest (Commenter Nos.1, 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 29, 31, 32, 35, 36, 43, 45, 46, 49, 51, 53, 57, 58, 59, 60, and 61).  A number of commenters pointed out that less than full State adoption would compromise any intended burden savings to waste handlers, since they would have additional administrative activities, such as maintaining both an electronic and paper system and coping with a patchwork of State programs (Commenter Nos. 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 31, 32, 36, 45, 49, 51, 53, 57, and 60).  Many of these commenters believe that, unless it is mandatory, waste handlers would not have an incentive to invest in automated technologies, since State non-participation could make electronic manifesting too burdensome (Commenter Nos. 4, 16, 17, 18, 23, 24, 25, 26, 32, 51, and 60).  Another commenter believes that universal State adoption is in keeping with the Government Paperwork Elimination Act (Commenter No. 57).  Four commenters pointed out that non-participation by States could interfere with interstate commerce (Commenter Nos. 4, 16, 22, and 36).  One of these commenters stated that RCRA section 3006 precludes the Administrator from giving authorization to a state program if such program is not consistent with the Federal or State programs applicable in other States (Commenter No. 4).  The commenter also pointed to 40 CFR 271.4, which provides that any aspect of the State program which unreasonably restricts or impedes the free movement across the State border of hazardous waste from or to other States for treatment, storage or disposal shall be deemed inconsistent.   Another commenter suggested that EPA consider a provision in the State reauthorization program for the evaluation of a State's progress in implementing electronic manifests (Commenter No. 58).

Response:  EPA appreciates the many commenters who are in favor of mandatory State adoption of the e-manifest.  EPA is persuaded by these views, as well as by suggestions from stakeholders at EPA's public meetings, that the e-manifest should be effective, recognized as valid, and implemented consistently in all states.  EPA agrees, for example, that development and use of the e-manifest is not feasible unless it can be assured that the validity of electronic manifests is recognized in all the states.  An IT vendor would not likely assume the risk of system development unless it believed that the electronic manifest would be recognized as valid in all jurisdictions.  Also, a patchwork of state programs differing on whether electronic manifests were available or recognized would unduly complicate interstate transportation and be too burdensome for waste handlers were they forced to comply with both paper and electronic requirements when they crossed state lines.  

EPA's final rule requires that all state programs adopt and recognize the validity of electronic manifests through the provisions of 40 CFR 271.4(c) that address state program consistency with the hazardous waste manifest.  This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest system does not meet the requirements of Part 271.  Moreover, the federal electronic manifest requirements supersede any less stringent or inconsistent requirements that may exist under state law.  In the final rule, EPA deems it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest.  In addition, the e-Manifest legislation and this final rulemaking provide that EPA will implement the e-Manifest in all states on the same implementation date.  EPA implementation and enforcement will continue until such time as each state revises its regulatory program and obtains authorization for the e-Manifest program revisions from EPA. 

Comment: We heard from eight commenters expressing that the e-manifest should be voluntary for the States (Commenter Nos. 27, 33, 35, 40, 44, 54, 59, and 63).  Two commenters believe that EPA should hold off on mandating it as the Agency resolves unanswered questions and allows industry and the States to progress on their own (Commenter Nos. 27 and 59).  Another commenter suggested that EPA consider providing funding to States if the e-manifest is mandated, or as another alternative, to add the electronic manifest to the RCRAInfo database (Commenter No. 40). Another commenter stated that States should not be required to automate because some States have their own laws regarding automation (Commenter No. 35).

We heard from nine commenters specifically addressing the implications to State programs under the e-manifest (Commenter Nos. 24, 25, 30, 33, 34, 44, 48, 54, and 59).  Four of the commenters indicated that the e-manifest would place a considerable burden on State programs for such activities as training, modifying existing hardware or software, or making new purchases (Commenter Nos. 30, 33, 48, 54).  One of these commenters suggested that EPA include language in the rule allowing States to have control over this burden (Commenter No. 48).  Another of these commenters asked EPA to clarify the regulatory implications of the e-manifest, given that some States might not adopt it (e.g., what are the regulatory implications if an electronic manifest is transported through a State that has not adopted the e-manifest?)  (Commenter No. 54).  The commenter stated that States do not have the personnel or resources to implement and monitor an electronic manifest system.  Another commenter noted that the rule would limit States' ability to collect additional information on the manifest; this limitation could prevent States from adopting the e-manifest (Commenter No. 34).  Another commenter indicated its support for EPA allocating funds to the States to assist them in developing their electronic manifesting systems in a timely fashion (Commenter No. 25).

Response:  EPA thanks commenters for their suggestion that state adoption of the e-manifest requirements should be optional.  For several reasons, however, EPA does not agree with this view.  As discussed in the response above, EPA believes that uniform state adoption of the electronic manifest requirements is essential for the e-manifest to be successful.  Prospective users of the e-manifest will consider it too risky to undertake unless electronic manifests can be implemented and recognized as valid in all the states.  A patchwork of different state programs would complicate interstate transportation and be too burdensome for waste handlers.  As discussed above, EPA, in this final rule, deems it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest. The 2012 e-Manifest Act in fact mandates this result.

EPA disagrees that mandatory state adoption of the e-manifest will place undue burden on the states or industry.  As an initial point, EPA's national system approach will be much simpler for the states to implement and enforce than the proposed approach.  The final rule approach will be implemented through EPA's own electronic receiving system, the CDX (or equivalent) and user requirements.  In this regard, the final rule approach shifts a substantial burden for developing and implementing the e-manifest from states and industry to EPA, in comparison with the proposed rule.  For example, EPA will be responsible for ensuring that the CDX (or equivalent) is designed to provide the necessary tools, controls, and procedures for users to complete, sign, transmit, and keep records of the e-manifest in a secure environment.  EPA also will be responsible for overseeing CDX operation and maintenance, and finalizing this rule and future regulations to enable e-Manifesting, announcing user fee schedules, and providing clarification to the states on consistent program adoption.  Consistent with the e-Manifest legislation enacted by Congress, EPA will implement and enforce e-Manifest initially, and states will be allowed a reasonable time within which they will be expected to adopt their consistent and equivalent e-Manifest requirements and obtain authorization.  Thus, states will have some latitude to determine when they will assume implementation and enforcement responsibilities for electronic manifests, and EPA will implement the program in the interim. EPA encourages prompt adoption of electronic manifest regulations by the states, so that they might assume primary implementation and enforcement responsibilities by the system implementation date.  If this is not possible, however, the states will have additional time to examine and revise their existing programs to accommodate the final e-manifest regulations, and EPA implementation will continue in the interim. 

Beyond this, EPA notes the final CROMERR, published in October of 2005, set forth a framework for electronic reporting that EPA, states, and local governments must follow under EPA's programs.  The rule resolves a number of technical and policy questions related to e-reporting.  It also establishes the procedures and criteria for states to receive EPA authorization for their e-reporting initiatives.  As such, EPA expects that states have already begun to consider changes to their programs to enable electronic reporting in response to CROMERR and that they are therefore well-positioned to adopt the e-manifest.  

We also note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect in all states immediately after a six-month period following rule publication.  The EPA Regions administer HSWA rules until State RCRA programs get authorized for them.  We believe the States have worked effectively in coordinating and assuming their responsibilities under these HSWA rules.  We are therefore confident that under the similar Federal/State implementation scheme included in the statute for e-Manifest, the states will be similarly effective in transitioning to the final rule's e-manifest requirements.

Comment: We heard from two commenters supporting EPA's position that the States should not be allowed to modify the electronic manifest form or procedures (Commenter Nos. 49 and 61).  One of the commenters recommended that proposed 40 CFR 271.10(f) be strengthened as follows:  "...No other electronic manifest format or information, other than that required by federal law, may be required by the State as a means to identify electronically the generator, transporter, destination facility, quantity, composition, discrepancies, origin, routing, destination of, or other information about a hazardous waste shipment during its transportation from the point of generation to the point of storage, treatment, or disposal" (Commenter No. 49).  The other commenter agreed that State variations in the electronic manifest form or procedures could hinder interstate commerce (Commenter No. 61).

Response:  EPA thanks the commenters for their views.  EPA agrees that participants in the e-manifest should not be burdened by additional or inconsistent State requirements for completion, transmission and recordkeeping of the electronic manifest.  To address this, the final rule, at section 271.10(f)(1), states that with respect to manifests, "no other manifest form, electronic manifest format, shipping paper, or information other than that required by federal requirements, may be required by the state to travel with the shipment, or to be transmitted electronically, as a means to track the transportation and delivery of hazardous waste shipments."  This consistency requirement extends as well to the electronic signatures that may be executed in connection with electronic manifests.    
Section 271.3(b)(4) of the final rule further states that any requirement applicable to the content and use of electronic manifests, including electronic signature requirements, and imposed under the authority of the 2012 e-Manifest Act, "shall supersede any less stringent or inconsistent provision of a state program."  EPA believes that these final rule requirements should be effective in preventing the states from placing additional requirements on e-manifest participants beyond what is required by the federal program.  In addition to this, as described earlier in this document, EPA will be responsible for designing, developing, and operating the national e-manifest system.  As such, EPA will have sole control over the content and appearance of the e-manifest that will be available on the national system, the information collected on it, and the procedures for its use.  We also note that EPA and our state partners have already had more than 5 years of experience with implementing the standardized hazardous waste manifest format that was announced in the March 2005 Manifest Revisions Rule.  Implementation of the new manifest form has proceeded smoothly for several years, and the States have accepted the uniformity of the manifest data elements.  We do not anticipate a different experience with a standardized electronic manifest format.

Comment: We heard from five commenters asking for clarification on, or changes to, the proposed procedures for transporters that do not automate (Commenter Nos. 4, 12, 17, 54, and 59).   One of the commenters asked for additional guidance on how waste handlers could continue to use electronic manifesting in cases where the transporter does not participate (e.g., how should the electronic manifest record that the transporter's signature is provided on the hard copy manifest?) (Commenter No. 17).  The commenter also asks for clarification whether waste handlers must retain the hard copy signature for compliance purposes.  Two commenters noted that the following sentence should be corrected:  "In such a case, the transporter could provide the generator with a hand-signed copy of manifest" (Commenter Nos. 54 and 59).   They indicated that it should read as follows:  "In such a case, the generator could provide the transporter with a hand-signed copy of the manifest."  Another commenter believes that proposed 40 CFR 264.71(a)(4)(i) should be revised by adding the clause "which bears the manifest tracking number" after the words  "or other shipping paper under 49 CFR part 172, subpart C" (Commenter No. 4).  Another commenter noted that proposed 40 CFR 264.71(a)(4) and 265.71(a)(3)(v) seem to indicate that only the electronic copy of the manifest is required to be retained by the TSDF for three years, even though the signature of the transporter was manual and would not be recorded electronically (Commenter No. 12).  The commenter asked for clarification on whether the TSDF has a requirement to retain a paper copy of the transporter's signature when the transporter has not electronically signed the manifest.

Response:  EPA thanks commenters for their suggestions on the procedures for transporters that do not automate.  We also appreciate commenters' suggestions for improving the preamble text.  After consideration of all the comments, and considering the complexity entailed by the proposed approach, EPA has made certain revisions for the final rule.  For the final rule, all waste handlers shown on the manifest must be able to participate electronically, if they wish to complete and use the electronic manifest to track their waste shipment.  Thus, the involvement of a non-participating transporter in a waste shipment would present a bar to using the electronic manifest.  If any party to the manifest is not able or willing to prepare and transmit manifest information electronically, then the manifests for their hazardous waste transactions must be executed with the standard paper forms.  However, generators may participate in e-Manifest using the portable computer or device provided by the transporter servicing a generator's waste.  Indeed, we expect that many electronic manifest transactions will be executed in this manner.

The proposed rule would have required copies of printed manifests to have been provided for non-participating transporters, and would have required attestations of receipt and other handwritten notations to have been entered to describe the circumstances of the other parties' electronic signatures.  Each non-participating transporter would have been required to retain a marked up hard copy in its files, and an additional hard copy with all the attestation and signature information would have been provided to the designated facility for forwarding to the e-Manifest system operator.  EPA concluded that the burden of complying with these additional paperwork requirements would override any benefits from recording a part of the transaction electronically.  Therefore, we are omitting the proposed special e-Manifest tracking requirements for non-participating transporters. While this result may preclude some transactions from being executed electronically, we believe that the burden and complexity associated with the procedures discussed in the proposed rule for involving non-participating transporters in e-Manifest were too great to retain in the final rule.

Comment: We heard from 13 commenters regarding the requirement for automated transporters to carry a paper shipping paper in transport (Commenter Nos. 15, 17, 21, 22, 26, 33, 34, 35, 37, 48, 49, 52, and 54).   One of the commenters expressed concern that the paper copy of the manifest might be confused with the electronic copy for purposes of RCRA recordkeeping purposes (Commenter No. 17).  The commenter asked EPA to provide additional guidance on how a waste handler can use both a paper and electronic copy for various DOT and RCRA compliance purposes.   Another commenter asked for EPA to state more clearly that a shipping paper would be required in lieu of a paper manifest when electronic manifests are being used (Commenter No. 33).  Four commenters asked EPA and/or DOT to eliminate the option to satisfy the DOT shipping paper requirement with any shipping document besides a hardcopy manifest (Commenter Nos. 15, 35, 49, and 54).  Two of them point out that the manifest contains additional information designed to protect the environment (Commenter Nos. 35 and 54).  One commenter indicated that its State program was designing an e-manifest system that would require submittal of a paper copy of the manifest to the State because it would include handwritten notes and signatures that were applied to the paper copy during transport (Commenter No. 48).  The commenter expressed concern that EPA's approach would not provide for collection of this paper copy and, hence, States would not receive the actual signatures or additional notes that might not have been included in the electronic copy.  Three other commenters expressed concern that the preparation of an electronic manifest and hardcopy shipping paper would jeopardize the goals of the proposal (e.g., burden reduction, streamlining the manifesting process) (Commenter Nos. 26, 34 and 37).   A number of commenters urged EPA to continue coordinating the e-manifest approach with DOT on relevant issues (Commenter Nos. 15, 17, 21, 22, 49 and 52).

Response:  EPA thanks commenters on the requirement for transporters to carry a paper manifest. While it is the intent of EPA's final e-Manifest rule to eliminate as far as possible the reliance on the preparation and retention of paper records in connection with tracking hazardous waste shipments, it is not possible at this time to eliminate all paper documents that are required in the course of transporting hazardous wastes.  As we explained in the May 22, 2001 proposed rule (see 66 FR 28268), it will still be necessary to carry a printed copy of the manifest on the transport vehicle during the transportation of hazardous wastes that are subject to the hazardous materials regulations, since DOT requires that a hard copy of a shipping paper be carried on transport vehicles for shipments of hazardous materials, unless otherwise excepted.  For shipments that involve state-regulated wastes subject to a manifest requirement rather than RCRA-regulated hazardous wastes, EPA is clarifying further that consistency in the use of the manifest under RCRA also requires that a print-out of the manifest must be carried on the transport vehicle during the transportation of these state-regulated waste shipments.  The adoption of the electronic manifest option in the final rule does not alter or eliminate the existing DOT hazardous materials requirements and RCRA consistency provisions respecting shipping papers and the manifest.  

EPA has consulted extensively with DOT on this requirement, and we are aware that the Department is planning during 2013 a pilot program (HM Access) to explore the use of electronic shipping papers for hazard communications among its stakeholders.  It is thus possible that DOT will revise the Hazmat regulations (HMR) in the not too distant future to support an entirely paperless shipping document.  Therefore, to accommodate better these possible changes to the HMR, the final rule addresses this issue by clarifying that the paper copy of the electronic manifest must be carried on the transport vehicle: "to the extent the Hazardous Materials regulation on shipping papers requires shippers of hazardous materials to supply a paper document for compliance with 49 CFR § 177.817." See 40 CFR § 262.24(d) and § 263.20(a)(4)(iii).  At such time as DOT permits an electronic shipping paper to meet its HMR requirement, our regulations will likewise authorize a fully paperless manifest without further amendment.

While the requirement to continue to supply a printed copy of the manifest for the transport vehicles may appear to frustrate somewhat the attainment of a totally paperless manifest system, we have strived in the rule to minimize as far as possible the requirements to carry and maintain paper documents.   Despite the continuing need to supply this printed copy of the manifest, we believe that there will still be substantial reductions in paperwork burdens and forms/data processing costs for manifest users and regulatory agencies as a result of this final action.  Moreover, the supplying of one paper copy on the transport vehicle provides a convenient back-up copy of the manifest data in the event the e-Manifest system becomes unavailable during transport or the electronic format becomes lost or corrupted.  Finally, the implementation of the electronic signature approach for the initial e-Manifest system may be aided by the provision of one paper copy that could be simultaneously signed in ink while digitized handwritten (electronic) signatures are also collected.  That issue is discussed below in another comment response.

Comment: We heard from two commenters expressing concern about the signature provisions for transporters that do not automate (Commenter Nos. 34 and 35).  One commenter expressed concern that the transporter's signature would not be on the electronic manifest (Commenter No. 35).  The commenter said states require the transporter's signature to be on each manifest copy it receives.  Another commenter expressed concern that a one-time manual signature could be used to represent several waste shipments (Commenter No. 34).

Response:  EPA thanks commenters for expressing their concerns about the signature provisions for non-participating transporters.  However, in the final rule, EPA requires all waste handlers named on the manifest to be willing and able to execute the manifest electronically. Therefore, the concerns raised in these comments about non-participating transporters and their signatures not being recorded electronically are now moot.  

In regard to a transporter's signature, EPA shares the commenter's concern that a digitized handwritten signature could be copied onto multiple manifests.  For this reason, the final rule requires the digitized signature to be implemented to capture only dynamic signatures and to prevent the replay of signature copies.  Based on the methods used by document examiners to analyze such electronic signatures, a replay or exact copy of a previous signature would be easily detected on examination and thus identified as a forgery.  Refer to 40 CFR 262.25(b)(1)(ii) of the final rule.

Comment: We heard from four commenters expressing concern about the proposed procedures for generators that do not automate (Commenter Nos. 34, 35, 54, and 59).  Three commenters were concerned that the rule does not specify the transporter's timeframe for providing a generator with a signed paper copy in instances when the generator signs an electronic manifest using a portable device provided by the transporter (Commenter Nos. 35, 54, and 59).  These commenters believe the transporter should provide a copy to the generator at the time of shipment/signature.  It should not be allowed to transmit a signed copy after it has left the generator's site.  One of the commenters also suggested that EPA should clarify that the TSDF must provide the generator with a signed paper copy of the manifest if the generator is not equipped to receive an electronic acknowledgment of receipt, comparable to the procedures for paper copies (Commenter No. 59).  Another commenter expressed concern that the rule allows for too many electronic transaction scenarios, which could cause compliance difficulties (Commenter No. 34).  In particular, the commenter disagrees that small waste handlers should have access to the e-manifest if they cannot afford it.  Rather, the commenter believes the proposal should be specifically designed for handlers involved with large numbers of shipments.  The commenter also noted that the rule would allow an automated generator to hold a non-automated transporter's signature on file, whereas an automated transporter would be required to acquire a signature from a non-automated generator; the commenter asked for clarification on why these procedures are different.  Another commenter asked EPA to clearly describe what would be required of generators, transporters, TSDFs, and States when one or more of them cannot automate (Commenter No. 54).

Response:  EPA thanks commenters for their views on the need for generators to have immediate access to their electronic manifests.  EPA agrees with their concerns.  As described in greater detail elsewhere in this document, EPA plans to host the e-Manifest system on the Agency's Central Data Exchange/Exchange Network architecture (or equivalent) which EPA established to support the electronic reporting of the various environmental reports and documents that are required for compliance with EPA's environmental programs codified in Volume 40 of the Code of Federal Regulations.  The CDX is an electronic gateway to which all electronic users of the manifest will have access.  In regard to comments that the automated generators should have access to manifests that they sign in a transporter's portable device, EPA is clarifying that all electronic manifests will reside in the CDX and be available to all waste handlers involved in its shipment in real time or near real time.  There may be a brief period of time during which the manifest transaction data may be stored on the handheld device used to collect manifest data and signatures in the field, and then uploaded later to the network and e-Manifest system.  Each generator and other waste handler would have an account on the e-Manifest system, and the system would provide the generator's electronic copy to the generator's account at the time of delivery to the transporter, or very soon thereafter.  Thus, we do not agree with the comment indicating that a generator must be provided with a paper copy at the time the hazardous waste is delivered to the transporter.  Of course, if a generator indicates a preference for a paper copy, and the transporter is willing to provide such a copy as an accommodation for the generator, then the provision of the paper copy is permissible, but not required. 

EPA also is clarifying that a generator would not have a transporter's signature "on file."  All automated users, including transporters, would have two options for signing an electronic manifest: a digitized handwritten signature or a witnessed PIN/password.  The transporter would be required to witness the generator signature and obtain proof of identity from the generator in order to use a PIN or password signature, or, waste handlers could sign with a high quality digitized signature product as discussed in the preamble of the final rule.  EPA is confident that its regulations impose effective control over the authenticity of transporters' signatures.  

EPA shares the commenter's concern about multiple user scenarios under the e-Manifest.  We agree that too many user scenarios could make the system unnecessarily complicated.  At the same time, EPA heard from many stakeholders that the system should be flexible enough to accommodate the typical arrangements that exist among generators, transporters, and designated facilities in the manifesting cycle, which can vary.  We believe we have struck an appropriate balance in the final rule.  The rule clarifies that the manifest can be executed electronically only if all waste handlers can participate in the e-Manifest in accordance with the provisions of the final rule. However, we also address the common scenario under which a generator would not have its own computer equipment available, but would participate in e-Manifest by using portable devices supplied by the transporter or designated facility.  These are the basic user scenarios contemplated by the final rule.  

In regard to the commenter's concern that small businesses would be required to automate, the final rule provides that use of the e-Manifest is voluntary.  In addition, the rule allows generators to execute their electronic manifests using the initial transporter's portable devices.  Small transporters may continue to use the paper manifest for their hazardous waste shipments, should these transporters conclude that the use of electronic manifests is not cost-effective for them.  In this respect, EPA believes that sufficient flexibility exists to enable small generators and transporters to automate if they so desire or to keep manifesting their shipments with the traditional paper forms method.

Comment: We heard from four commenters on alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 16, 26, 51, 57, and 59).  One of the commenters noted that companies would prefer to have the authority to use imaging technology to store copies of manifests so they can reduce their warehousing costs (Commenter No. 59).    Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51).  The commenter suggested that waste handlers could place their electronic manifests onto the centralized repository for access by stakeholders.  Another commenter asked EPA to enable the use of Access as a back-end database that will be supported by the Internet Forms and Action Works Metro (Commenter No. 26).

Response:  EPA thanks the commenters for their suggestions on manifest storage.  EPA believes it is important for all electronic manifests to be completed, transmitted, and retained within the national e-Manifest system. Therefore, the final rule provides that any requirement in the regulations for a generator to keep or retain a copy of each manifest is satisfied when the generator retains a copy of an electronic manifest in its e-Manifest account for the same retention period as required for paper manifest records, provided that specified provisions are met.  Among other things, the rule provides that electronic manifest copies are retained by a generator when the generator can store, access, and retrieve all of the generator's electronic manifest records from an account or record collection established for the generator on the EPA Electronic Hazardous Waste Manifest System. In addition, all paper and electronic manifests will be collected, held in a central repository and made available to stakeholders (e.g., regulators), as specified.  EPA notes that the use of particular imaging technologies or database applications is beyond the scope of this final rule, and will be addressed in the system planning and procurement.

2.0	Standard Electronic Formats

      2.1	Proposed EDI Format

Comment: We heard from four commenters who supported the use of Transaction Sets 856 and 861 (Commenter Nos. 17, 19, 33, and 51).  One of these commenters, however, encouraged EPA to explore more ways to collect the information on one transaction set (Commenter No. 19).  Another commenter suggested that the sets should be tagged with unique labels so the data can be matched (Commenter No. 51).  The commenter asked EPA to define the data tags as well as the electronic data transfer standards; this will allow for the development of software that will be compatible and have longterm viability.  The commenter also suggested that EPA allow vendors to bundle their other service features such as profiling.  Another commenter noted that having two transaction sets should not be complicated for waste handlers (Commenter No. 33).   

We heard from one commenter who asked for EPA to allow the use of EDI protocols currently used by the rail industry to transport hazardous materials (Commenter No. 46).  The commenter pointed out that the rail industry uses transaction sets in compliance with the American Institute (ANSI), Accredited Standards Committee (ASC) X12, and Transportation Data Coordinating Committee.  These transactions sets consist of 404 (TDCC Bill of Ladings), 858 (ANSI Bill of Lading), 417 (TDCC Car Movement Waybill), 418 (TDCC Interchange Consist), 997 (TDCC Acknowledgments), 824 (ANSI Acknowledgments), and 998 (TDCC Cancellation).  The commenter suggested that requiring the railroads to use new protocols could discourage them from transporting hazardous waste.

Response:  EPA thanks commenters for their support and suggestions for the EDI approach for the manifest.  For several reasons, however, EPA will likely offer XML, rather than EDI, as the means for transmitting information over the national system.  Over the past several years, CDX development has reflected a significant evolution in formatting standards to accommodate the Internet - away from EDI and toward the use of XML.  XML consists of a set of predefined tags and message structures that, like EDI, allows machine-to-machine exchange of data in a mutually agreed upon format, enabling exchange of data across different systems.  However, unlike EDI, XML is tailored to Internet-based communications and security protocols.  Additionally, an XML formatted file in combination with a style sheet can be displayed in a web browser.  Such features would allow the CDX to use the same standard formats both for exchanging data files and for designing web forms that would maintain the appearance of manifest forms.  The structure of XML also addresses some of the challenges in archiving data received, because the XML tags that accompany the data in an XML file can be used to interpret the datas' context without the aid of additional software.  This could facilitate the recovery of data from archived files, and reduces the need to maintain the versions of the software originally used to generate the files.  

At the time of the issuance of this final rule in late 2013, XML remains the preferred language for data exchange via the Internet, and thus is likely to be the data exchange language EPA will employ in the first generation e-Manifest system.  As data exchange languages and methods evolve, however, it is possible that e-Manifest might migrate to another data exchange language or method.  This is a system development and implementation issue rather than an issue to be addressed by regulation.

EPA will, however, endeavor to support exchanges of data between e-Manifest and the rail system's electronic waybill system, which relies on the EDI transaction sets described above for data exchanges within the rail system. 

Comment: We heard from one commenter who asked if the EDI database would be available to EPA on demand for inspection (Commenter No. 13).  The commenter stated that, if so, it would need a proprietary system for outside the firewall.

Response:  EPA thanks the commenter for its question.  As discussed above, EPA's currently preferred system development approach does not involve EDI.  Rather, it would involve the use of XML via EPA's central receiving system, i.e., the CDX.  In this regard, industry participants will not need to establish proprietary systems to maintain their e-manifests, since EPA and state inspectors will have direct access to them via the CDX.  The final rule only provides that the electronic format supported by the national system is the standard electronic format required for electronic manifesting, and we do not specify by regulation a particular data exchange language or format.

Comment: We heard from one commenter in response to EPA's request for comment on how signatures would be applied to manifest data inputted from a browser to a web site that translates the data into an EDI compliant format (Commenter No. 33).  The commenter stated that the signature would be digitally applied, no matter what form the original "signature" took.  The exact nature of how the user would sign the document, whether it is by digital signature or secure digitized signature, would depend on the system involved.  The commenter believes that encryption would provide a reasonable level of security and authentication.

In response to EPA's request for comment on whether it is the HTML document or the X12 document that would be signed, the commenter stated that, on a technical level, it is the HTML document that should be signed, since the signer never actually "sees" the X12 document.  The commenter added, however, that the signature would have to accompany the X12 document in some fashion.

In response to EPA's request for comment on whether the translation at the server would complicate the verifiability of any digital signatures, the commenter stated that this would be unlikely, given the current state of the technology and assuming that reasonable thought went into the type of digital signatures being used.  The commenter stated that encryption algorithms exist which allow for a great degree of error correction.  The commenter does not believe that it would be that complicated to routinely check transmissions received for translation errors.

Response:  EPA thanks the commenter for its question.  As discussed above and elsewhere in this document, EPA's preferred system approach does not involve EDI.  It would involve the use of XML through EPA's electronic receiving system, i.e., the CDX or equivalent system.  Likewise, our final rule will not initially require digital signatures as the method for signing electronic manifests, so the comment addressed to verifying digital signatures is moot.  These comments raise technical issues that are beyond the scope of this final regulation.

      2.2	Proposed Internet Forms Format

Comment: We heard from 10 commenters expressing support for the proposed use of XML in automating the manifest cycle (Commenter Nos. 12, 17, 19, 25, 30, 31, 33, 35, 48, and 51).  A number of these commenters noted that XML is more cost-effective than EDI, which could encourage its use (Commenter Nos. 31, 33, 35, 48, and 51).  One of the commenters pointed out that a web-based approach also will allow easy additions of features and upgrades (Commenter No. 31). The commenter asked EPA to clarify how EPA proposes to store web-based forms.

We heard from one commenter who said that the rail industry currently uses EDI and that, due to security reasons, the railroads would be less likely to interchange records with customers over the Internet (Commenter No. 46).  The commenter recommended limiting the proposal to EDI.

Response:  EPA thanks commenters for their support of the web forms approach for the manifest.  EPA agrees that there are a number of benefits to an approach relying on XML and web based data exchanges. As discussed above and elsewhere in this document, the CDX or equivalent national system will likely employ schemas and style sheets developed in XML for the electronic exchange of e-manifest data.  EPA will also endeavor to develop an interface that will enable e-Manifest data to be exchanged with the rail system's electronic waybill system.  However, the specification of a particular data exchange language or particular schema/electronic format for the manifest is a system development issue that is beyond the scope of this final regulation.

Comment: We heard from four commenters suggesting clarifications or modifications to the proposed Document Type Definition (DTD) (Commenter Nos. 12, 30, 32, and 33).  One commenter suggested that the final rule should include a more up-to-date XML Schema, rather than the XML DTD as proposed, due to its richer format (Commenter No. 32).  The commenter also suggested that EPA consider use of a name space to distinguish the DTD from other DTDs that may be developed in the future, as well as the addition of other data elements.  Another commenter asked whether EPA would draft a DTD to be the equivalent of the ASC X12 861 data set (Commenter No. 30).  Another commenter suggested that co-development of the XML schema between EPA and stakeholders will ensure the manifest is compliant with other XML systems in development (e.g., systems being developed by the United Nations, the Department of Defense, and other government organizations) (Commenter No. 12).  The commenter believes that use of a common XML framework will allow vendor neutral access to the information.  Another commenter suggested that, if feasible, EPA should develop a Document Type Definition to set the standard for any XML usage with respect to the manifest (Commenter No. 33).

Response:  EPA thanks the commenters for their many suggestions on the XML schema and stylesheets.   As explained in previous comment responses, EPA currently prefers an XML schema and stylesheet as the electronic format for the electronic manifest, and will likely develop the first generation system with support for such a schema and stylesheet.  

Because there will be only one national e-Manifest system established under the final rule, it is not necessary to promulgate the electronic manifest XML schema and stylesheet as a part of this rule notice.  Rather, the development of the schema and stylesheet will be included in the system design requirements for the IT contractor(s) selected to build and operate the e-Manifest system.  This final rule does not stipulate the use of a specific schema or data exchange language for e-Manifest, but only states that the electronic format supplied by the national e-Manifest system will be the exclusive electronic format recognized by EPA for exchanging manifest data.  Thus, the rule remains technology neutral with respect to the precise schema, data exchange language, or electronic format that will be used in the national system design.

Comment: We heard from one commenter who asked EPA to enable the use of Access as a back-end database that will be supported by the Internet Forms and Action Works Metro (Commenter No. 26).   

Response:  EPA thanks the commenter for its suggestion.  Obviously, it has been many years since EPA conducted the pilots that involved Internet Forms and Action Works software.  Many such applications are available as we consider the development of the national system in the coming years.  As described above, EPA will task a vendor to develop the e-Manifest system in accordance with EPA's technical requirements and stakeholder input.  EPA conducted several requirements meetings with stakeholders in February  -  March 2013, and we will continue this outreach as we continue with the system planning and development efforts.   These design issues are beyond the scope of this final regulation.

3.0	Electronic Record System Controls and Procedures

      3.1	Validation of System Performance and Training

Comment: We heard from three commenters who expressed support for the proposal to require an independent audit of the electronic manifest system (Commenter Nos. 19, 30, and 33).  One of the commenters supported an independent audit if the waste handler does not use off-the-shelf software, and suggested that EPA provide a list of approved, commercially available off-the-shelf packages that, if properly installed and used, would meet all of the validation requirements (Commenter No. 19).  Another commenter supported the written assessment, but asked if there is guidance or checklist for the certification (Commenter No. 30).  Another commenter believes the proposed approach is reasonable, provided it can be implemented in a reasonably efficient and cost-effective manner that does not impose any undue hardship on smaller handlers (Commenter No. 33).  The commenter believes the off-the-shelf alternative approach could meet with some resistance from larger companies, which would not want to buy off-the-shelf software.  They also might not want to use third-party vendors because they have in-house resources and expertise.  The commenter believes that, in the case of off-the-shelf software and systems developed independently of waste handlers, third-party validation would probably still be necessary, if only to insure that the independent developers were doing their job correctly and that the waste handler was using the products correctly.

Response:  EPA thanks the commenters for their many views on validation of system performance and training.  In the May 22, 2001 proposed rule, EPA proposed specific types of computer system security controls.  These security controls were proposed at section 262.26(c) of the proposed rule and were meant to ensure the authenticity and integrity of electronic manifest data, to avoid repudiation of manifests created on electronic systems, and to ensure the consistent and reliable processing of manifests by the various electronic systems that may have arisen under the proposed rule.  The proposed rule assumed that private entities would develop various electronic manifest systems adhering to EPA's standards, so it was necessary to require inspector access to both the manifest copies and the electronic manifest systems so that EPA could inspect the manifests and the private systems for compliance.

EPA acknowledges that these system security controls were quite detailed, and that if implemented, they would have had considerable impact on any private entities that might have developed electronic manifest systems under the proposed rule approach.  EPA believed it was necessary to specify these controls, and to validate and certify through written assessments that they had been implemented successfully, to provide some floor level of consistency and security in the design and operation of the "decentralized" electronic manifest systems anticipated by the proposed rule.  At the time the proposed rule was developed, there was much concern that the decentralized approach might foster the development of numerous proprietary systems that would be incapable of communicating with each other, and that this approach might result in inconsistent and insecure systems with questionable ability to produce reliable and enforceable data. So, the proposed security and processing controls were intended to ameliorate this concern by addressing what we felt were a necessary floor set of controls to define a minimally acceptable level of consistency, data integrity, and system security for the various private systems that might have developed under the proposed rule.

Based on stakeholder input and further consideration, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option had changed to the  establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  After consideration of public comments and the requirements of the 2012 e-Manifest Act, EPA's final rule decision is to establish such a national or centralized system.

Since EPA has decided to adopt a centralized system approach for the e-Manifest system, it is no longer necessary to promulgate regulatory security controls in order to assure a floor level of consistency and security among various private systems.  Because there will be one national e-Manifest system developed to host the transmission of electronic manifests, the system security requirements for e-Manifest will instead be planned and addressed under the security planning requirements that apply to all Federal information systems.  The Federal security planning requirements will produce a detailed set of requirements and controls appropriate to the security impacts of e-Manifest, and these requirements and controls will be implemented when the Agency awards a contract to an IT vendor to build and operate e-Manifest.  EPA believes it is far more sensible to develop the e-Manifest system security requirements and controls in this manner than to promulgate regulations that would codify the system security controls.  The Federal information system security planning requirements and process are set out in several publications of the National Institute of Standards and Technologies (NIST).  Taken together, these publications describe a well thought out and understood process for determining appropriate security controls, for monitoring the effectiveness of the controls and identifying vulnerabilities and needed corrective actions, and for periodically certifying and accrediting the security of an information system.  

Therefore, in lieu of codifying system security requirements for the electronic manifest in the final rule, EPA will instead follow the guidance presented in NIST Publications and other Federal information technology and systems security guidance.    Over the period of operation of the e-Manifest system, the requirements and controls developed pursuant to this guidance will be monitored, adjusted as necessary, and certified.  EPA believes that this approach will be a far more responsive and effective means to address the security of e-Manifest than the regulatory requirements that we proposed in May, 2001.  The criticisms and concerns that commenters identified with the proposed security standards are mooted by the approach we are following in this final rule.  The particular security requirements for e-Manifest will be addressed as part of the system planning, development, and certification processes, and are not included in the scope of this final rule.

Comment: We heard from nine commenters who expressed opposition to the requirement for a third-party assessment (Commenter Nos. 5, 12, 13, 17, 22, 26, 46, 51, and 57).  One of the commenters suggested that the entity developing the system should assume all liability for the operation of the system (Commenter No. 5).  Another commenter believes that, rather than an independent assessment, EPA should simply establish standards that require accuracy, security, and reliability (Commenter No. 17).  Three commenters expressed opposition to the requirement that the software be developed by an independent firm that is not a waste handler (Commenter Nos. 17, 22, and 26).  One commenter strongly disagrees with the suggestion that the use of a commercial electronic manifest software package should be a rule requirement (Commenter No. 57).  Several commenters believe that companies should be given the option to validate their own systems instead of a third-party assessment (Commenter No. 13, 22, and 51).  Two of these commenters do not believe that there should be any credentials for persons who conduct the self-audit (Commenter Nos. 22 and 51).  Several commenters noted that most commercial TSDFs already have controls in place for their paper-based manifesting and recordkeeping and that these controls would be used under the proposal; hence, EPA need not impose any additional controls on these facilities for electronic manifests (Commenter Nos. 12, 22, and 57).   One commenter indicated that, if the requirement for a third-party assessment remains in the rule, EPA should also require regulatory agencies to become subject to similar system assessments and management protocols with evaluation by independent third parties.  

Response:  EPA thanks the commenters for their views on the proposed validation of system performance and training.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Comments on the proposed system controls are now moot.  Please refer to the EPA response above for further information about the security requirements that will be implemented pursuant to Federal information technology standards and guidance.

Comment: We heard from ten commenters suggesting clarifications or modifications the proposed approach for an independent assessment of the electronic system or use of off-the-shelf software (Commenter Nos. 16, 29, 30, 32, 33, 34, 54, 57, 59, and 63).  A number of commenters suggested that EPA clarify the criteria or standards by which the electronic system would be assessed and/or the qualifications that the third party must satisfy (Commenter Nos. 30, 32, 33, 54, 57, 59, and 63).  One of these commenters suggested that there needs to be a standard whereby only licensed systems professionals can perform the validation assessments, and that such licensing would require some training and certification (Commenter No. 33).  One commenter suggested that the proposed electronic manifest form should be reviewed by a professional printer to ensure that design problems are eliminated, because computer designed forms often lack consistency in layout when printed (Commenter No. 16).  Another commenter suggested that, like printers of paper manifests, software developers should be required to register to develop manifest software (Commenter No. 29).  The commenter suggested that registration of software packages would ensure that they meet the standard content and data mapping required for Federal and State databases.  Another commenter suggested that, if EPA finalizes the proposed approach, it should require regulatory agencies to become subject to similar system assessments and management protocols with evaluation by independent third parties (Commenter No. 57).  Another commenter asked EPA to clarify the enforcement and liability issues associated with the proposed validation standards (Commenter No. 34).

Response:  EPA thanks the commenters for their views on the proposed validation of system performance and training.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest in fact mandates this approach.  Comments on the proposed private system security controls, including the comment about an independent assessment of private systems, are now moot.  Please refer to the EPA response above for further information.

      3.2	The Ability to Generate Accurate and Complete Records Available for Inspection

Comment: We heard from two commenters who indicated their general support for the proposed requirement for manifest systems to have the ability to generate accurate and complete records available for inspection (Commenter No. 22 and 46).   One of the commenters suggested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g., the next working day) (Commenter No. 22). The commenter believes this revision will help in those instances where a company's "knowledgeable person" is not immediately available (for whatever reason) or the computer system is temporarily offline.  

We heard from one commenter who did not express support or opposition to the proposed requirement, but suggested that EPA coordinate the requirement with DOT to ensure that the security issues can be resolved within both programs (Commenter No. 47).

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop the national system with security controls appropriate under Federal information technology standards and guidance.  Comments on the proposed system controls for private systems are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from seven commenters asking for clarification or modification of the proposed requirement for manifest systems to have the ability to generate accurate and complete records available for inspection (Commenter Nos. 13, 22, 26, 32, 46, 59, and 63).  One commenter indicated that railroads do not generally provide access to their computer systems to outside parties; however, railroads are willing to work with EPA to provide the information requested within a reasonable timeframe, but not necessarily on an immediate basis (Commenter No. 46).  The commenter also indicated that EPA should not expect to access railroad computer systems directly; rather, EPA should allow persons knowledgeable with the computer software to access and produce those records for them.  Another commenter indicated that the proposed rule mentions the need to provide an interface for a regulator to be able to access the system that supports digital manifesting (Commenter No. 32).  The commenter suggested that the rule should clarify whether this interface is a required element of a conforming system, or simply a desired functionality.  The commenter notes that, if a regulator interface is indeed required, far greater detail needs to be provided regarding how such an interface would work and what its components would need to include.   Another commenter noted that the proposed rule would require a person on site who can assist a RCRA inspector with operation of the software (Commenter No. 26).  The commenter suggests that this requirement should not be construed to require a person to be available at all times.  Another commenter recommended that both the electronic on-screen view and the paper copy of the manifest printed by inspectors should be required to match the standard paper manifest form so inspectors can view manifest information in the same "format" at every waste handler (i.e., the computer screen and any printed copies of the electronic manifest information should look just like the standard paper manifest form) (Commenter No. 59).  Another commenter indicated that some utility companies with wide service territories may choose to maintain their electronic records for each facility at a more central location as opposed to the facility itself (Commenter No. 22).  The commenter suggested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g., the next working day). One commenter noted that, if the EDI database would be available to EPA on demand for inspection, it would need a proprietary system for outside the firewall (Commenter No. 13).  Another commenter asked that the final rule provide further clarification regarding the issue of inspections of electronic records (Commenter No. 63).  The commenter believes EPA should include a requirement for waste handlers to print out a one or two line "summary report" of electronic manifest activity.  The commenter believes this should be required on a weekly basis so that if a system is down, or if the contact person is not available, the inspecting entity would still have manifest information.

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Information security controls will be developed in accordance with applicable Federal information technology standards and guidance.  Comments on the proposed system controls for private systems are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters regarding the feasibility of long-term validation of digital signatures (Commenter Nos. 33, 59, and 60).  One commenter opposed the requirement for long-term validation, since handwritten signatures on paper manifests are not subject to the same standard (Commenter No. 60).   Another commenter noted that current technology is not generally available that will permit validation at the time of transmission and maintain the validation for three years (Commenter No. 59).   For example, the commenter clarified that, if a valid certificate is later revoked, such as when an employee leaves the company, previous (valid) manifests will be invalidated as well.  Another commenter believes that longterm validation is feasible in regard to technical challenges; however, it is unclear if it is feasible in regard to administrative challenges and cost (Commenter No. 33).   The commenter does not believe there are practical ways to ensure long-term enforcement capability and liability protection for companies using manifests without imposing the burden and costs of indefinite signature validation mechanisms.  The commenter believes it is a question of how much risk EPA wants to live with and who will pay the costs of minimizing that risk.  The commenter added that, if EPA wants to minimize such risk, then some effort must be made to insure the long-term validity of digital signatures.  The commenter believes the central questions are who would implement and pay for such measures, and how many years such validation efforts should attempt to cover.  The commenter believes EPA should handle the cost, particularly since leaving it to the waste handlers themselves is an uncertain proposition.

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify electronic signature requirements in this final regulation.  Instead, this final rule requires "valid electronic signatures" that comply with the Agency's CROMERR, and we recommend (but do not require) two signature methods that may be feasible under CROMERR.  Our current recommendations focus on PIN/password and digitized handwritten signature methods for the first generation system.  We are not currently recommending digital signatures involving public key/private key encryption methods (see discussion at § 4.2), so we consider this comment moot. 

      3.3	The Ability to Protect Records
      
      
Comment: We heard from two commenters regarding the requirement for retaining prior versions of software and hardware as necessary to access manifest records (Commenter Nos. 26 and 59).  One commenter noted that the requirement may require TSDFs to retain records for at least 30 years after facility closure and asked EPA if this was intended (Commenter No. 26).  Another commenter noted that maintaining prior versions of software and hardware for the required retention period could be extremely costly (Commenter No. 59).  The commenter noted that a State's laws may require it to retain records for much longer periods of time than the Federal program, making the requirement even more costly.  The commenter also noted that many companies update their data files for active accounts and archive inactive accounts.  The companies may rely on paper documents rather than the archived data when information is needed at a later date.  The commenter believes the proposed rule appears to prevent these practices by precluding the alteration of electronic documents once they are signed.  The commenter asked EPA to consider the longterm consequences of prohibiting any alteration of an electronic document after it is signed.

Response:  EPA thanks the commenters for their suggestions on the proposed data protection standards.  However, EPA has determined not to codify the proposed system security controls for private systems as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate security controls pursuant to applicable Federal information technology standards and guidance.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters in regard to the ability of protecting electronic files over the long term (Commenter Nos. 13 and 33).  One commenter indicated that backup storage of information is a concern since system crashes do occur (Commenter No. 13).  The commenter asked for clarification on what constitutes "standard computer security" and the destruction of information in relation to system failure.  Another commenter indicated that digitally signed and electronically stored media are inferior to paper copies in terms of being more susceptible to corruption/destruction by heat, magnetic fields, and degradation (Commenter No. 33).  The commenter added that storage standards change over time, making it more difficult to comply over the long term.  The commenter suggested three ways to address these concerns:  (1) creation of multiple copies of the stored information and dispersal of the copies to multiple sites; (2) periodic check-ups of the stored material and upgrades as needed; and (3) encoding of a piece of data within a much larger data-string with built-in error-correcting features, so that even if one part of the string becomes corrupted, it is still possible to decode the original piece of data correctly.

Response:  EPA thanks the commenters for their suggestions on the proposed data protection standards. However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. EPA will develop appropriate security controls for this system pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter on the appropriateness and feasibility of a requirement that manifest records be periodically archived on a write-once, read-many medium (Commenter No. 33).  The commenter indicated that it is feasible and advisable that manifest records be periodically archived on write-once read-many storage mediums.  The commenter noted, however, that it is important to remember that any digital storage medium is corruptible.  The commenter suggested that multiple copies be made and those copies be stored at multiple sites.

Response:  EPA thanks the commenter for its views on the proposed data protection standards.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.4	The Ability to Limit System Access and Conduct Authority Checks
      
      
Comment: We heard from one commenter stating its support specifically for authority checks and audit trails (Commenter No. 30).  We heard from another commenter who generally agreed with the proposed requirements to limit access and conduct authority checks, because the railroads already have such systems in place (Commenter No. 46).  However, the commenter opposed the criteria to maintain auditable logs of logon attempts and logon failures and rejections for a three-year period (Commenter No. 46).  The commenter indicated that, because of the huge number of transactions involving railroads, such a requirement would place a significant burden on the industry and force railroads to use a paper system.

Response:  EPA thanks the commenters for their support of the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed its opposition to the requirements to limit access and conduct authority checks (Commenter No. 57).  The commenter indicated that electronic systems should not be subject to greater controls than those for paper manifests.

Response:  EPA thanks the commenter for its views on the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters who asked EPA to clarify the technical standards associated with limiting unauthorized access to systems and data (Commenter Nos. 26, 34, and 59).  One of these commenters also asked for clarification on the compliance and enforcement issues associated with these proposed requirements (Commenter No. 34).  For example, the commenter asked what would happen if a system did not track failed log-ons but had all other assurances (e.g., would it be approvable?).  One commenter asked for clarification on the circumstances under which the alteration of a record would be allowed (Commenter No. 59).   The commenter believes that it appears that the alteration of a record would invalidate the electronic signature on the record and place the entire system at risk of repudiation.

Response:  EPA thanks the commenters for their views on the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      
      3.5	Use of Secure Audit Trails

Comment: We heard from one commenter who recommended that EPA acknowledge and anticipate that there may be system failures or natural disasters that cause delays in the submission of the manifest forms (Commenter No. 24).  The commenter therefore proposed that facilities should be able to rely on electronic time stamps for the date of transmission of manifests, so that a problem with electronic sending does not become a compliance issue. 

Response:  EPA thanks the commenters for their views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters indicating their opposition to the requirement for the use of secure audit trails (Commenter Nos. 26, 46, and 57).  One commenter indicated that creating a system to save all changes to manifest transactions would require programming changes by the railroad industry (Commenter No. 46).  For these and other reasons, the rail industry would probably choose to stay with the current paper system because the cost would outweigh the benefit.  Two commenters indicated that the electronic manifest system should not be subject to more burdensome controls than pen-and-ink completion of the paper manifest (Commenter Nos. 26 and 57).   One of the commenters stated that there is no need to identify or audit every party that has viewed a manifest, only the ones that have changed its contents (Commenter No. 57).

Response:  EPA thanks the commenters for their views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed support for the requirement to use secure audit trails (Commenter No. 30).  

Response:  EPA thanks the commenter for its views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.6	Software-based Work Flow Controls and Operational System Checks

Comment: We heard from two commenters requesting EPA clarification regarding making corrections to electronic manifest data once the manifest is signed (Commenter Nos. 57 and 59).  One commenter indicated that, because TSDFs and transporters that prepare manifests have historically made basic errors (e.g., entering the wrong Generator USEPA ID number), the commenter believes the proposed regulations need to address the correction of mistakes identified after the electronic manifest is closed (Commenter No. 59).  The other commenter noted that paper manifests are often prepared by one party and subsequently edited by downstream handlers, e.g., by transporters and TSDFs (Commenter No. 57).  The commenter is uncertain if this process would be preserved in the proposed system.  The commenter believes that the proposed security provisions essentially lock down portions of the manifest as they are signed and prohibit future modifications.

Response:  EPA thanks the commenters for their views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA's national system will largely provide the critical work flow controls and operational system checks. Comments on the proposed private system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters in response to EPA's request for comment on what the appropriate response should be when an invalid signature is detected (Commenter Nos. 33 and 34).  Both commenters believe the appropriate response should be to block further use or transmission of any manifest found to be invalid or for which the electronic signature cannot be verified.  One commenter indicated that its State program does not keypunch data from manifest forms that are not signed (Commenter No. 34).  The other commenter clarified that, although further use of such a manifest should be blocked in theory, it is likely, particularly as the system is being phased in, that unforeseen problems will occur where this approach could make things unworkable (Commenter No. 33).  For that reason, the commenter believes it might be advisable to have the system alert the recipient to the requirement to obtain a valid manifest, but not itself block the use, thus giving some flexibility while the recipient works to resolve the validity problem.

Response:  EPA thanks the commenters for their views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  Comments on the proposed system controls are now moot.  We agree that this comment raises a valid concern, and that there may be circumstances (e.g., an electronic signature collected off-line) where the data in an electronic manifest must be passed through the system before the signature can be validated.  This is one reason that we recommended in the final rule preamble (contingent on peer reviewed studies of reliability) the use of the digitized handwritten signature method, as this would allow signature data, including forensic data, to be collected and stored for later examination by document examiners in the event there should be a question about the legitimacy of the signature. This is how ink-signed signatures are authenticated, and there seems to be much merit to the digitized handwritten signatures because of the similarity with which they are executed and authenticated.  PIN/password signatures, on the other hand, would either require validation against data stored locally on portable devices in the field, or would require later validation that might give rise to signature discrepancies that would need to be reconciled after manifests are transmitted.  EPA will examine this issue further during system planning and development.

Comment: We heard from one commenter who opposed requirements for software-based work flow controls and operational system checks because such requirements would entail programming that would not be cost effective (Commenter No. 46).   The commenter noted that EPA's regulations already recognize the unique aspect of railroads and their ability to transmit documents electronically and hence should not mandate additional requirements when the system is already working well. 

Response:  EPA thanks the commenter for its views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e-Manifest Act in fact mandates this approach.  EPA's national system will largely provide the critical work flow controls and operational system checks that the proposed rule suggested for disparate private systems.  The Agency does not intend to apply its e-Manifest system controls to the rail system's electronic waybill system. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.7	Software-based Data Presentation Features and Signature Prompts

Comment: We heard from one commenter expressing full support for the proposed data presentation features (Commenter No. 59).  The commenter believes the manifest systems should not only be able to, but be required to, display all of the manifest data in a readable format at the time the electronic manifest is signed.  Two other commenters expressed support for EPA's proposal for a warning message for both digital and digitized signatures (Commenter Nos. 19 and 33).  One of the commenters also indicated that the signature warning should be displayed each time a signature is required (Commenter No. 33).  With regard to the secure digitized signature approach, however, the commenter wondered if this approach would be feasible and/or practical for all types of digitizer pad devices to be used.

Response:  EPA thanks the commenters for their views on the proposed standards for software-based data presentation features and signature prompts.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will incorporate similar signature warnings and prompts into the national system's work flow, and we plan to retain the requirement that electronic manifests be displayed in a readable format before signatures are applied.  However, with the widespread use of tablets and portable devices with varying display sizes, there may be some adjustments necessary to this requirement (e. g., scrolling) to accommodate variations in display size among devices.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters expressing opposition to the warning prompt for invalid signatures (Commenter Nos. 34 and 46).  One commenter indicated that the warning prompt is unnecessary because EDI is a well-established process, railroads have well-established relationships with other waste handlers, and the protocols are well-understood by all parties (Commenter No. 46).  The commenter stated that additional controls above what is already required of railroads would discourage use of electronic manifesting.  Another commenter indicated that a warning is not needed because it should be assumed that users understand the consequences and liability of signing their name (Commenter No. 34). 

Response:  EPA thanks the commenters for their views on the proposed standards for software-based data presentation features and signature prompts.  However, EPA has determined not to codify the proposed system security controls as part of the final rule, and we do not intend to apply the signature warnings and prompts discussed in this rule to the rail system's electronic waybill system.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Any signature related warning prompts will be addressed during system development, and not as a requirement of this final rule.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.8	Full Interoperability of System Software

Comment: We heard from two commenters suggesting modifications to the proposed requirements for full interoperability of system software (Commenter Nos. 59 and 61).  One commenter suggested that EPA could establish a requirement that the exchange of manifest data and the interoperability of electronic manifesting systems not be compromised by any new approved software (Commenter No. 61).  The commenter believes this may limit the technological advances possible; however, it would ensure that any change approved will not have the impact of making obsolete the investments of others involved in electronic manifesting.  Another commenter indicated that EPA could require electronic systems to be evaluated for a specified period of time by all parties that will use the system to ensure there are no interoperability problems (Commenter No. 59).  The commenter added that paper manifests should also be used during the evaluation period in case there is a problem with the system.

Response:  EPA thanks the commenters for their views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  The development of a national e-Manifest system moots the issue of interoperability among private systems, although manifest users will need to develop the appropriate interfaces to share and exchange data from e-Manifest with their legacy data systems.  System interoperability concerns will be addressed during system planning and development efforts, and are not addressed in this final rule.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from four commenters expressing support for the one-time requirement for system sponsors to notify EPA that they have developed and would be using an e-manifest system (Commenter Nos. 17, 19, 30, and 59).  These commenters believe it is important to notify the regulatory agency of a sponsor's use of the e-manifest (e.g., to make the regulator aware that electronic manifests will be submitted) and would not place an undue burden on waste handlers.  One of the commenters cautioned that the notification would not be a disincentive unless it involves many requirements, and asked EPA to list what information is required in the notification (Commenter No. 30).

We heard from another commenter who did not believe the notification requirement, in and of itself, would be a disincentive to use of electronic manifesting (Commenter No. 33).  However, it would be a disincentive if it would mean that the electronic system would be subject to the validation requirements of the proposal and that possible existing manifest-exchange relationships with other states would be threatened as a result.

Response:  EPA thanks the commenters for their views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Thus, there will not be multiple private systems and no need for a notification requirement. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed opposition to the proposed notification requirement (Commenter No. 23). The commenter noted that system users would have to register with EPA to get an approved identification numbering system.  The commenter believes the registration process would serve to notify regulatory agencies of the use of electronic manifest systems; and thus, the one-time notification is not needed.  

Response:  EPA thanks the commenter for its views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  As there will not be private systems developed, there will be no need for the proposed notification. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

3.9	Controls over System Documentation

Comment: We heard from three commenters expressing opposition to the proposed controls over system documentation (Commenter Nos. 26, 33, and 57).  These commenters expressed their belief that the proposed controls are too burdensome.  Two of the commenters noted that the paper-based system does not impose similarly burdensome controls (Commenter Nos. 26 and 57).  The other commenter noted that excessively burdensome controls and requirements will make it unlikely for waste handlers to develop or use the documentation (Commenter No. 33).

Response:  EPA thanks the commenters for their views on the proposed controls over system documentation.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e-Manifest Act in fact mandates this approach.   EPA will develop system documentation for the national e-Manifest system, but since there will not be private systems developed under the final rule, we will not require private entities to develop such documentation. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who suggested that the rule should require that documentation be available during inspections (Commenter No. 35).  The commenter noted that documentation requirements are missing for such items as the technical standards and computer security system controls.

Response:  EPA thanks the commenter for its views on the proposed controls over system documentation.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. While EPA will develop system documentation for the e-Manifest system, we will not require private entities to develop such documentation or to make it available for inspections. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.10	Policies Holding Individuals Accountable

Comment: We heard from one commenter who expressed its opposition to the proposed requirement for written policies (Commenter No. 57).  The commenter indicated that there is no equivalent requirement for paper-based manifests.  Another commenter indicated that computer security is something of an illusion (Commenter No. 33).  The commenter indicated that forgery of most manual signatures is detectable and provable; however, forgery of a digital signature is for all practical purposes undetectable and un-provable, should someone gain access to the individual's signature object.  The commenter believes EPA's requirements could be circumvented by a sufficiently computer-literate individual intent on falsification.  The commenter suggested the best controls would be procedures that could somehow confirm the validity of the data itself, rather then relying on the validity of the digital signature.

Response:  EPA thanks the commenters for their views on the proposed standards for policies holding individuals accountable.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  The national e-Manifest system will be developed and operated in accordance with EPA's CROMERR Rule, and this rule announces the applicable policies under which EPA will hold manifest users accountable for their signatures and submissions. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.11	Other System Requirements

Comment: We heard from one commenter who asked for EPA clarification on whether electronic receipt of the manifest equates to acceptance of the waste (Commenter No. 26).

Response:  EPA thanks the commenter for its views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.   Comments on the proposed system controls are now moot.  However, EPA notes that even with the paper manifest system, the mere receipt of delivery of waste materials is distinguished from acceptance of the waste.  The substitution of an electronic manifest does not alter this result.  Acceptance or rejection of waste may occur after a TSDF has signed a manifest to indicate receipt of deliveries.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from eight commenters expressing opposition to the requirement for retransmission of the electronic manifest if an acknowledgment of receipt is not received within 12 hours (Commenter Nos. 16, 18, 25, 30, 46, 54, 57, and 59).  These commenters believe 12 hours is not enough time for facilities to verify receipt or to resend the manifest, given evenings, holidays, weekends, and potential system failures.  Two of these commenters suggested that EPA amend the timeframe to 12 working hours (Commenter Nos. 54 and 59).  One of the commenters suggested at least five business days (Commenter No. 25), and another suggested at least 24 hours (Commenter No. 30).

In addition, two commenters expressed concern that, given the requirements for a 12-hour re-transmittal of the electronic manifest, there may be situations where the hazardous waste haulers will arrive at the TSDF in advance of the electronic manifest (Commenter Nos. 16 and 18).  One of the commenters suggested that EPA explain what actions should be taken under these types of logistical problems (Commenter No. 18).  

Response:  EPA thanks the commenters for their views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Comments on the proposed system controls are now moot.  Any requirements for acknowledgement of receipts of electronic manifests will be addressed as a system development issue, and not addressed in this final rule.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: Three commenters requested alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 51, 57, and 59).  One of the commenters noted that companies would prefer to have the authority to use imaging technology to store copies of manifests so they can reduce their warehousing costs (Commenter No. 59).  Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51).  The commenter suggested that waste handlers could place their electronic manifests onto the centralized repository for access by stakeholders. Another commenter urged EPA to continue considering other electronic forms of recordkeeping under the RCRA program (Commenter No. 57).

Response:  EPA thanks the commenters for their views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will establish user accounts on e-Manifest for each waste handler that wishes to use the electronic manifest.  Electronic copies of completed manifests will be stored electronically to the accounts of each user and will there be available for retrieval and inspection. With respect to paper manifests that continue in use after e-Manifest is implemented, the system will only collect the final paper copy (or an image file and data file) from designated facilities.  The waste handler copies of paper manifests must still be maintained on site by waste handlers in accordance with existing recordkeeping requirements, although EPA has allowed image copy storage under certain conditions.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

4.0	EPA's Proposed Electronic Signature Standard

      4.1	General Comments

Comment: We heard from five commenters in support of one or both of the proposed electronic signature methods (Commenter Nos. 17, 25, 33, 60, and 61).  One of these commenters believes that it is likely that if both systems are allowed, a TSD facility in the chain on a manifest will be using a different system than that used by the generator (Commenter No. 61).  The commenter believes this would require each generator/operator to have technology that supports both the digital signature and secure digitized signature methods.  This could significantly increase the cost and complications to those using electronic manifests.  The commenter believes that, if both systems are authorized, EPA must require that the systems be compatible with each other.  The commenter suggested that EPA weigh the additional complications and costs that will exist if both systems are approved versus the advantages and disadvantages of a federally selected single system that EPA designates.  The commenter suggested that EPA look to the Treasury Department and the Department of Housing and Urban Development, which are addressing the same security issues as part of their transition to electronic transfers of tax forms and home-closing documentation.  

We heard from one commenter who expressed opposition to both signature methods because they introduced an entirely new system that would not be cost-effective (Commenter No. 46).

Response:  EPA thanks the commenters for their suggestions on the electronic signature method.  EPA has considered all of the comments received on this issue and agrees with comments expressing concern about the digital signature.  For example, we received a number of comments from regulated industry suggesting that the digital signature method with its public key infrastructure was too expensive and complex to be deployed in the electronic manifest context.  However, we also received a fair number of comments from industry representatives who suggested that a digitized signature method could be implemented and used successfully for the electronic manifest.  These commenters offered that digitized signatures provide a practical and cost-effective alternative to digital signatures, and that they have been used commercially and successfully for years.  Several proponents of the digitized method added that the digitized method is preferred, because it will allow the capture of a real time signature through a process that best mimics the current process for signing paper manifests.  We received several industry comments that echoed the view expressed in State agency comments that the electronic manifest context did not warrant elaborate electronic signature security, with one such commenter suggesting that any security burden imposed beyond that associated with the digitized signature method would act as a deterrent to users using the electronic system.  Finally, we received a comment from an industry trade association suggesting that EPA must clarify in the final rule that one consistent signature method will be implemented in all states for electronic manifests, since manifests are interstate transactions that require consistency in implementation across all the states.

EPA notes that in the final regulation it is not codifying or requiring the use of a specific electronic signature technology.  The final rule is instead technology neutral, and requires at 40 CFR § 262.25(a), that signature methods for e-Manifest shall:
   1. Be a legally valid and enforceable signature under applicable EPA and other Federal requirements pertaining to electronic signatures, and
   2. Be a method that is designed and implemented in a manner that EPA considers to be as cost-effective and practical as possible for users of the manifest.

While the regulation is technology neutral, EPA makes recommendations in the preamble for the first generation system, based on the comments received during our comment period and further analysis.  EPA agrees with the commenters who suggested that an electronic signature method based either on a PIN/password approach or on a digitized signature approach provides a preferred balance of identification strength, practicality, and cost.   EPA's own analyses support these views.  For example, EPA conducted an economic analysis of the proposed authentication and signature technologies in May 2007.  The economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized signature method.  On the other hand, the May 2007 analysis disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely be three to four times the projected costs of implementing either the PIN/password method or digitized signature method.  

Therefore, EPA is recommending both the PIN/password method and the digitized handwritten signature method in the final rule preamble, as the Agency believes that each of these methods can be adapted to the electronic manifest business process for two distinct communities of electronic manifest users with minimal cost burden.  These recommendations are not binding, however, and the system developers and users are free to consider other signature methods that meet the rule's selection criteria.  
We believe that the digitized signature method may be attractive to hazardous waste transporters and hazardous waste management firms who wish to implement the electronic manifest across their enterprise by bringing mobile computer equipment to the sites of their generator customers, and tracking waste pick-ups, transportation with company vehicles, and delivery of waste shipments to the company's permitted facilities.  For those who would engage in electronic manifesting independently of the enterprise level implementation, the PIN/password signature method would be available as a means to electronically sign electronic manifests.  While we appreciate the concern expressed by commenters that there should be only one signature method specified for consistency, we believe that there are advantages at this time to specifying alternative methods that have been evaluated for practicality, signature strength, and and CROMERR compliance.  At such time as the system is in fact developed, the system could incorporate either or both of these methods, or another method that is CROMERR compliant and practical.  As explained above, we believe there are distinct communities of users who will use the digitized signature method and the PIN/password signature method.  Therefore, we believe there will be relatively few instances when one manifest will use both signature methods, and if such instances arise, the system will be able to process either signature as a valid signature.  However, we will reevaluate this question as we work with the successful IT vendor to implement a system and to implement the electronic signature solution(s).  Should we find as we approach implementation that there are greater efficiencies and advantages with the selection of one consistent signature method for all users, we can alter our current plans and develop the initial system around the one most advantageous signature method.

The final rule preamble also clarifies the identity proofing that will be required of signatories using each of these electronic signature methods.  Identity proofing is the vetting process by which an identity credential (e.g., driver's license, passport, financial account) is verified, so that one can be confident that another person who claims a particular identity is the person they claim to be.  Under EPA's Cross-Media Electronic Reporting Rule (CROMERR), the Agency generally requires electronic signatories of environmental reports to undergo a one-time identity proofing exercise before the signatory may sign and submit electronic reports to EPA.  Identity proofing aids in establishing that an asserted identity can with legal certainty be uniquely linked with the electronic signature device used by the signatory to execute their electronic signature.  While hazardous waste manifests are not included in the CROMERR priority reports list, we are to a great extent adapting the identity proofing requirements for CROMERR priority reports in this final rule for electronic manifests that would be signed with electronic signatures.  

However, with respect to digitized handwritten signatures, the final rule preamble explains that no distinct identity proofing is required per CROMERR, since these signatures that will be validated on the basis of biometric or forensic properties unique to the signer, as is the case with ink-signed handwritten signatures.  Thus, it is no more necessary for a signer to establish their "ownership" of their unique, digitized handwritten signature than it is necessary to establish their ownership of their ink signatures.  Moreover, in the case of the witnessed signature approach discussed below to implementing PIN/password signatures, those who sign e-Manifests with a PIN or password in the presence of a signature witness will be proofed by the witness at the time they execute their signature.  Thus, those employing this signature method will simultaneously satisfy their signature and identity proofing requirements when they present their credential to the witness. 

Comment: We heard from two commenters who expressed uncertainty about whether electronic signatures would hold up in court (Commenter Nos. 13 and 33).  

We heard from one commenter who recommended that a digitized signature be required rather than another type of electronic signature (Commenter No. 51).  The commenter stated that the digitized signature system has been used successfully commercially (credit card purchases) and provides an actual, real time signature, not a facsimile.

Response:  EPA thanks commenters for their views on electronic signatures.  We share the concern that electronic signatures must be enforceable in court cases.  Subsequent to the publication of the 2001 proposed rule, the Agency published in October 2005 its CROMERR Rule that establishes the legal and policy framework for all electronic reporting to the Agency.  See 70 FR 59848 (October 13, 2005).  CROMERR includes definitions at 40 C.F.R. §3.3 for "valid electronic signature" and "electronic signature device" for the very purpose of ensuring the validity and enforceability of the electronic signatures that are executed for electronic documents that are submitted to EPA.  For the e-Manifest final rule, the regulation specific to electronic signatures has been revised so that it is technology neutral and avoids codifying specific signature technologies that may become obsolete over time.  Instead, the final regulation requires that electronic signature methods or technologies used with e-Manifest shall:  (1) be consistent with EPA's CROMERR requirements in 40 C.F.R. Part 3 for valid electronic signatures; and (2) be generally acceptable to the manifest user community so that the methods encourage broad participation in the e-Manifest.  

Our final rule preamble explains in more detail two electronic signature methods that were discussed in the proposed rule, and that we believe can be adapted to satisfy CROMERR requirements and be implemented in a manner that will be acceptable to the user community.  We discuss these two methods in some detail in the proposed rule, because they were carefully vetted in advance for CROMERR compliance and for practicality in their implementation.  Thus, we believe these two methods may be useful for the first generation of e-Manifest:  (1) a high quality handwritten digitized signature method;  and (2) a PIN/password electronic signature strengthened with a 2[nd] authentication factor that is unique to the manifest business process.  We have included special authentication provisions in the final rule preamble discussion of these methods to address CROMERR compliance and to strengthen these signature methods so that they will provide sufficient assurances of identity should authentication issues arise in enforcement actions.   We believe these provisions, described further below, strengthen the signature approaches and provide sufficient assurances of identity in case of enforcement actions. 

Recommended digitized handwritten signature method.  The Agency is recommending a digitized handwritten signature method as one of the two methods of electronic signature that were vetted by the Agency for inclusion in the first generation e-Manifest.  As we discussed in the May, 2001 proposed rule, the digitized signature must be captured as a dynamic signature (not a replay of a copy), and the signature must be bound to the manifest document content by a hash function to prevent unauthorized alterations to signed content.  Like handwritten signatures executed with ink on paper, digitized signatures may be recognized for the characteristic or personal shape and form of the letters, loops, and other forensic signature attributes that are recorded by hardware and software during the handwritten signature act.  Thus, a digitized signature has some biometric-like properties which may provide a high level of assurance that the signature is unique to the signatory and that it may be authenticated by trained document examiners.   

Indeed, for the final rule, we are clarifying that before digitized handwritten signatures may be accepted as fully CROMERR compliant so that they can stand alone as "valid electronic signatures" for e-Manifest, there must be peer reviewed studies completed to establish that the digitized signature hardware and software are forensically reliable.  This foundation of reliability is required in court cases before a document examiner could testify as an expert witness in a disputed case that a given digitized signature is or is not authentic.  EPA may be able to complete these reliability studies prior to the implementation of e-Manifest, but if not, we expect to implement the digitized handwritten signature method on an interim basis with digitized pads and/or pens that enable an ink signature to be captured simultaneously with the digitized signature.  We are aware of several existing products with this capability.  Thus, one paper copy would be executed with original ink signatures, while the digitized signatures would simultaneously be collected and associated with the electronic manifests that would be distributed and retained by the e-Manifest system.  At the end of the waste shipment transaction, the designated facility or other designated custodian would retain the one paper copy with all the ink signatures and retain this copy securely and make it available for inspection and enforcement purposes by state or federal inspectors.  The ink signatures on this stored copy would be authenticated by document examiners in the same manner that such ink signatures are currently authenticated in enforcement actions.  Thus, during this interim period before forensic reliability studies are completed, the paper copy of the manifest with ink signatures would be the manifest copy of record for enforcement purposes, and the digitized handwritten signatures on the electronic manifests would effectively be exempt from CROMERR.  

While this interim solution might seem at odds with the goal of a fully paperless manifest, EPA emphasizes that after the implementation of e-Manifest, DOT's hazardous materials regulations will continue to require hazardous waste transporters to carry a hazardous materials shipping paper (i.e., the manifest) on transport vehicles.  So, e-Manifest users will still be required to produce one paper copy of the manifest in order to comply with these existing DOT shipping paper requirements.  Since there will need to be a paper copy of the manifest on the vehicle in any case for DOT's purposes, the use of this one paper copy to simultaneously record enforceable ink signatures under this interim solution will not result in additional paperwork being supplied.  Moreover, most of the paperwork reduction, greater efficiency, and data quality enhancement benefits of the electronic manifest will still be realized even with the execution and retention of this one paper manifest copy. We anticipate that this interim signature method would be used until such time as EPA is able to designate specific digitized signature products that have been tested and found through peer reviewed studies to meet the forensic reliability standard.    

At such time EPA is able to designate those signature products that have been found by testing to be forensically reliable, so that it is possible to reliably authenticate digitized handwritten signatures with the expert testimony of document examiners, then these digitized handwritten signatures will qualify as "valid electronic signatures" that are fully compliant with CROMERR and may stand on their own for enforcement purposes without any paper copy back-up. 

At such time as EPA designates certain digitized handwritten signature products as forensically reliable, this final rule will also require that the generator, transporter, and facility personnel who sign electronic manifests with these products must undergo identity proofing that complies with CROMERR identity proofing requirements in 40 CFR 3.2000(b)(5)(vii).  This means that the generator, transporter and facility personnel who will sign manifests with these products must have an identity credential such as a driver's license vetted by a disinterested third party or automated validation service, or, these signatories must submit electronic signature agreements containing ink signatures as an alternative means of identity proofing.  Since this method is anticipated to be a company-wide implementation by the transporter or waste management company sponsoring the mobile computer equipment, EPA expects that this method will be a good candidate for submission of signature agreements to the sponsoring company's local registration authority or LRA, who would certify to EPA that the agreements have been executed for all the signatories across the company and that the agreements are being stored locally with the company.  

Significantly, during the interim period that digitized signature products are collecting ink signatures and digitized signatures simultaneously, CROMERR identity proofing will not be required from the generator, transporter, or facility personnel signing manifests in this fashion.  Since the one paper copy with ink signatures will serve as the copy of record for enforcement purposes, there is no issue of CROMERR compliance (including identity proofing requirements) while this interim signature method is being used.

Recommended PIN/password electronic signature method.  In addition to the digitized signature method discussed above, the final rule also recommends for the first generation e-Manifest an additional electronic signature method that involves a PIN or password signature strengthened with a unique 2nd authentication factor.  This method would be available for all electronic manifest signatories who are not signing electronic manifests with the digitized signature method discussed above.  While there are a variety of possible means to implement a 2nd authentication factor (e.g., personal questions, token, biometric attribute), for the manifest business process, EPA anticipates that during the implementation of the first generation e-Manifest, the 2[nd] authentication factor will be a witnessed signature certification.

Hazardous waste manifests are normally signed by waste handlers at the time custody of hazardous wastes is being transferred from one waste handler to another.   So, there is typically a witness present to each manifest signature.  For example, when a generator delivers its waste containers to the initial transporter, the generator executes the generator/offeror certification and the initial transporter signs to acknowledge receipt of the waste.  In other words, the generator personnel and transporter personnel mutually sign the manifest in the presence of the other.  Similarly, when a transporter delivers waste to the designated facility, the transporter obtains the signature of the facility personnel who signs for receipt of the waste shipment.  Again, the facility representative signs in the presence of the transporter's representative, and the transporter witnesses the signature of the designated facility's representative.  

The witnessed signature method of executing PIN or password electronic signatures takes advantage of the fact that manifest signatures are normally witnessed by another party.  So, when the generator signs with its PIN or password to execute the generator/offeror certification, he or she will also certify at that time that he or she witnessed the mutually executed signature of the initial transporter.  The witness certification will further attest that the generator was shown a driver's license or other picture ID of the transporter, and that the picture ID shown is consistent with the identity claimed by the transporter.  To ensure that this proofing exercise is in fact completed and is not a sham certification, the witness must record the last 4 digits of the signer's driver's license number as part of the witness's certification.  Likewise, as the transporter signs to acknowledge his or her receipt of the waste from the generator, the transporter representative will also certify to having witnessed the signature of the generator, and will examine the driver's license of the generator and record the last 4 digits of that license number as part of the certification.  A similar certification would be executed by the transporter when it delivers the waste to the designated facility and witnesses the signature being executed the facility's representative.  For the final rule, EPA has determined that the PIN or password electronic signatures that are executed in this fashion, with the requisite certification of a witness attesting to the signer's signature act and proof of ID, are sufficiently strengthened by the witness certification, so that these signatures and certifications meet CROMERR's requirement for a 2[nd] authentication factor.

CROMERR compliant identity proofing will be required of all signatories using the PIN or password method of signature.  CROMERR requires that a driver's license, passport, or similar identity credential for the signatory must be vetted one time by a disinterested party or validation service supplied for this purpose (see 40 CFR §3.2000(b)(5)(vii)(A)) prior to the use of the electronic signature.  Alternatively, one using a PIN or password electronic signature could also satisfy CROMERR identity proofing requirements by submitting an ink-signed signature agreement to EPA or to the company's local registration authority (LRA) in accordance with 40 CFR §3.2000(b)(5)(vii)(C).  However, because each e-Manifest PIN or password signatory using the witnessed signature method discussed above undergoes identity proofing by the witness at the time of signature, there is no need to provide additional credentials or documentation to meet CROMERR identity proofing requirements with these signatures.  The witnessed signature certification and underlying proofing of each signatory suffice to meet this CROMERR requirement.   

Comment: We heard from seven commenters who asked that the signature approach be flexible (Commenter Nos. 22, 33, 51, 59, 60, 61, and 63).  Two commenters suggested that EPA should not specify the technology but allow industry to develop systems that meet desired outcomes (Commenter Nos. 51 and 60).   Another commenter asked EPA to ensure that its signature standards are flexible enough to accommodate States' initiatives on electronic reporting (Commenter No. 59).  Another commenter noted that, because of differences in cost, waste handlers within the same manifest cycle might use differing technologies (Commenter No. 61).  As such, EPA should ensure that its final rule address compatibility among signature methods.  Two commenters asked EPA to clarify standards and procedures to address situations in which the generator, transporter and/or TSDF operate different signature methods for the same shipment (Commenter Nos. 33 and 61).  One of these commenters believes that, if EPA should adopt an even broader approach than the two signature approaches in the proposed rule, the criteria for additional signature methods should be to maximize ease of use, minimize cost, and provide a reasonable level of security (Commenter No. 33).  The commenter added that, if numerous signature methods were to be authorized, EPA should establish a national verification system that anyone can access to confirm (or interpret) the manifest signatures.  The commenter also recommended that EPA ensure that multiple signatures are readable and verifiable by establishing a national verification system that anyone can access to confirm the signatures.  Another commenter cautioned EPA to avoid overly broad or narrow approaches for digital signatures, since the rule will have far-reaching implications (Commenter No. 63).

Response:  EPA thanks commenters for their request that the signature methods be flexible.  We agree that the methods should accommodate the various preferences and constraints of the users of the electronic manifest.  We agree with the comment that the regulation should not specify or codify technologies, and we have revised the final regulation so that it is in fact technology neutral.  For the final rule, therefore, the codified electronic signature requirements are that the signature methods satisfy CROMERR performance standards in 40 C.F.R. Part 3 and that the methods be generally acceptable to the user community.  While the final rule does not codify signature methods, we do recommend two methods in the preamble that we believe can be implemented in the first generation system in such a way as to meet the regulatory standards.  
These recommended solutions were discussed at length in our response to the previous comment.

In short, EPA's intent is to set forth in the rule in general and flexible language what the regulatory requirements are for implementing an electronic manifest signature.  As the various authentication technologies (e.g., biometrics, tokens) improve or become less costly over time, different signature solutions may become more feasible and appropriate for the e-Manifest system.  EPA expects that the e-Manifest vendor and the Governing Body or Advisory Committee responsible for the oversight and change process for e-Manifest will settle on the specific authentication devices and approaches that will meet this rule's requirements and will be supported by the system over time.

Comment: We heard from five commenters who suggested alternative approaches for the electronic signature (Commenter Nos. 22, 30, 33, 60, and 61).  All of these commenters encouraged EPA to consider simple and least-cost signature approaches so long as they are comparable to the handwritten signature.  Three commenters suggested use of a Personal Identification Number (PIN) or comparable approach (Commenter Nos. 30, 33, and 61).  These commenters believe a PIN would provide a reasonable level of security in comparison with handwritten signatures.  One commenter suggested EPA draw from DOT's experience and streamline its proposal to allow use of a signature mark produced by any means (Commenter No. 22).  Another commenter suggested that EPA allow itself the flexibility to approve new technologies, including biometrics (Commenter No. 61).

Response:  EPA thanks the commenters for their suggestions for simple, low-cost signature methods.  We agree with their concerns and believe the signature methods in the final rule address such concerns.  EPA conducted a detailed economic analysis of the proposed authentication and signature technologies in May 2007, as we wanted to understand better how the hardware, software, and support services needed for each signature and identity proofing method would impact the implementation costs for the system and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs.  The May 2007 economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), although this cost is likely to increase when the cost of the higher quality pads and software that might satisfy requirements for forensic reliability are taken into account.  However, we are generally impressed that the digitized signature method has intuitive appeal and appears to be quite cost effective for users, despite the fact that this method entails a more significant initial investment by users in the signature pads and software necessary to generate the digitized signatures.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present implementation costs ($0.54 to $0.96 per manifest) comparable to the digitized signature method. Thus, our final rule language now reflects these commenters' concerns that the recommended signature methods provide authentication strength comparable to handwritten signatures while ensuring cost-effectiveness.   The final rule retains the flexibility requested by several commenters to consider and approve new technologies such as biometrics as they become more established, practical, and cost-effective.  We cannot accept the commenter's suggestion that a mark executed by any means be acceptable as an e-Manifest signature, since the signature method must be sufficiently strong and unique so that it will support criminal enforcement actions that require proof beyond a reasonable doubt of all elements of a case, including the identity of signers.

      4.2	Digital Signatures

Comment: We heard from four commenters who believe that manifest signatures do not require a level of security offered by the digital signature technology (Commenter Nos. 22, 33, 46 and 60).  One commenter suggested that electronic signatures should be no more stringent than handwritten signatures (Commenter No. 22).  Another commenter urged that EPA should not focus on field or file security, but on field and data authenticity (Commenter No. 60).  The commenter explained that manifest users can capture the generator's valid signature/authenticity through any type of technology; the rule should not mandate the type of technology used, but should allow any means of electronically capturing a signature.  Another commenter doubted that manifest signatures require the level of security offered by the digital signature and expressed uncertainty whether there currently is a level of falsification to warrant EPA's concern (Commenter No. 33).

Response:  EPA thanks the commenters for their views and agrees that the digital signature is not a preferred method for the electronic manifest at this time.  The final rule does not require a specific electronic signature technology, but in response to comments and further analysis, we make recommendations in the final rule preamble about methods that we believe to be CROMERR compliant and practical for users.  At this time, we are not recommending the digital signature method for the first generation system.

As discussed above, EPA has received significant input from industry that the digital signature method provides an unnecessary level of security, and its benefits cannot be justified in view of its costs.  An economic analysis performed in 2007 helped to support this conclusion.  The economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized signature method augmented with a 2nd authentication factor.  On the other hand, the May 2007 analysis disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely be three to four times the projected costs of implementing either the PIN/password method or digitized signature method.  Because of the far greater costs associated with the digital signature method, and the comments in the record that criticized the complexity and relative cost of this signature method, EPA has determined that it will not initially provide support for digital signatures and PKI in the implementation of the e-Manifest system.  We believe that the comments and the additional analysis conducted in May 2007 provide ample support for the digitized signature and PIN/password methods of signature.  

Comment: We heard from one commenter who believes the proposed level of security for the digital signature is burdensome, but stated that it would be willing to participate nonetheless (Commenter No. 56).  

Response:  EPA thanks the commenter for its views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision to adopt technology neutral electronic signature regulatory language, and to recommend the handwritten digitized signature method and the PIN/password method strengthened with a second authentication factor as our currently recommended alternatives to the digital signature method.

Comment: We heard from three commenters in response to EPA's question about whether it is practical to verify digital signatures on a document such as the manifest which will be signed sequentially by multiple waste handlers and whether multiple versions of each manifest document must be maintained electronically to preserve the complete history of the document (Commenter Nos. 22, 33, and 60).    

One commenter noted that the final electronic manifest should not be so cumbersome to deter regulated parties from using the system (Commenter No. 22).  The commenter suggested that the software ultimately selected by EPA for the final rulemaking should be able to accommodate multiple generator or shipper signatures. This may be done through one document reflecting multiple signatures or through one file containing multiple "modified copies" of the manifest, each showing a different signature.  Another commenter stated that, once a section of data in the electronic manifest (e.g., number of containers) has been added to the file or record, it should never be removed or modified (Commenter No. 60).  The commenter stated that each system should be required to detect any unauthorized modification by validating each section of data.  Incorrectly modified files would result in rejection of the manifest with procedures consistent with a physically incorrect manifest, and procedures to re-manifest the shipment should be documented.  Another commenter stated that verification is practical when the completed manifest is received by the regulating entity; however, verification in the field is more problematic (Commenter No. 33).  The commenter believes that a transaction history should exist for all stages of the waste's transport.  Otherwise, it becomes extremely difficult to track down where a discrepancy (or a falsification) occurred. 

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory language and our recommendation to adopt the digitized handwritten signature method and PIN/password method strengthened with a 2[nd] authentication factor as alternatives to the digital signature method.

Comment: We heard from three commenters regarding EPA's proposed algorithms for the electronic signature (Commenter Nos. 26, 46, and 59).  Two commenters urged EPA to be flexible in authorizing algorithms because of technology advancements (Commenter Nos. 26 and 59).   One of the commenters suggested that EPA merely require the use of digital signature standards approved by the federal government or State, instead of listing specific standards (Commenter No. 59).  Another commenter expressed concern that the proposed algorithms would introduce a new system for railroads and would not be cost effective (Commenter No. 46).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comments in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory language and our recommendations for the first generation system to adopt the digitized handwritten signature method and the PIN/password method strengthened with a 2[nd] authentication factor as alternatives to the digital signature method.

Comment:  We heard from three commenters regarding EPA's proposed requirements for maintaining the confidentiality of private keys (Commenter Nos. 33, 46, and 60).  Two of the commenters opposed the requirements, believing they are too burdensome on waste handlers in comparison to the current manifest requirements and procedures (Commenter Nos. 46 and 60).  The other commenter believes the requirements for individuals and sponsoring firms to maintain the confidentiality of their private keys and accept accountability would be too burdensome on smaller waste handlers with limited staff (Commenter No. 33).  The commenter asked for EPA to find a balance between a reasonable level of security and affordable costs.  The commenter does not oppose a requirement for registrants to enter into a signature agreement that contains certifications that the private key would be protected from disclosure, unauthorized use, or delegation.  The commenter cautioned that these controls, however, would not provide any real guarantee of security.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final electronic signature regulatory selection criteria and preamble recommendations for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment: We heard from one commenter who expressed opposition to the requirement for a trusted third party, since it would not be cost-effective for the railroad industry (Commenter No. 46).    

Another commenter raised concerns about the creation of a system involving a trusted third party and related procedures, since this would create a new area of compliance liability for which TSDFs have limited expertise (Commenter No. 26).  The commenter asked EPA to clarify appropriate procedures in cases where a signature cannot be verified at delivery of the waste.

We heard from three commenters who asked EPA to provide a list of standards or requirements for digital signatures and/or a list of Certificate Authorities for acceptable digital signatures (Commenter Nos. 30, 54, and 63).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on the electronic signature regulatory selection criteria, and preamble recommendations on electronic signature methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment: We heard from three commenters regarding the requirements for periodic certification of signature agreements or for proof of identity in regard to issuing a digital certification for use in the manifest program (Commenter Nos. 22, 33, and 60).  One commenter stated that no formal proof of identity should be required to receive a digital certificate, since no proof of identity is needed for the existing manifest system (Commenter No. 60).  Another commenter believes that EPA should keep the requirements as simple as possible and require little more than proof of identification (Commenter No. 22).  Another commenter supported the idea for registrants to certify annually that they have not violated their signature agreement and for signature agreements and annual certifications to be signed by hand (Commenter No. 33).  The commenter also suggested that a valid photo identification, proof of employment with the handler, and the individual's social security card should provide necessary proof of identity.  The commenter believes that applicants should be required, for the initial issuance at least, to present themselves in person.  Subsequent renewals could be less stringent and not require a personal appearance.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment:  We heard from four commenters in regard the cost and complexity of a PKI program and the willingness of waste handlers to participate (Commenter Nos. 22, 33, 46 and 60).  These commenters believe that PKI would increase the burden and administrative activities required of waste handlers and would likely deter them from implementing the digital signature approach.  One commenter expressed concern that the proposed approach would require manifest users to ensure that employees with signature capability would be available at all times to electronically sign manifests (e.g., during all shifts, vacations, holidays) (Commenter No. 60).  Another commenter clarified that smaller waste handlers, in particular, would be deterred from participation because of the burden (Commenter No. 33).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI.

Comment:  We heard from five commenters in regard to the three optional approaches for PKI implementation (Commenter Nos. 33, 46, 54, 61, and 63).  One commenter supported the centralized approach because of greater clarity and the elimination of confusion by having a single, known standard (Commenter No. 33).  Another commenter opposed any option for PKI, since it would introduce an entirely new system that would not be cost-effective for the rail industry (Commenter No. 46).  Two commenters suggested that EPA allow States who become authorized for the electronic manifest portion to have the ability to generate the certificates instead of EPA (Commenter Nos. 54 and 63).  Another commenter stated that, if EPA chooses to use the PKI program of the General Services Administration (GSA), the Agency should regularly evaluate private vendors as a possible option, as PKI private alternatives become more mature (Commenter No. 61).  The commenter also believes that the option chosen must be implemented consistently throughout the States so interstate commerce is not impeded. 

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.   After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI.

      4.3	Secure Digitized Signature

Comment:  We heard from four commenters in response to EPA's request for comment on the proposed security standards for digitized signatures (Commenter Nos. 17, 33, 46, and 60).  Three commenters believe the security standards are too stringent and should require no more security than handwritten signatures (Commenter Nos. 17, 46, and 60).  The other commenter stated that the security standards are adequate to prevent casual abuse, although the commenter acknowledges that "adequate security" depends on how the term "adequate" is defined (Commenter No. 33).  The commenter does not believe the standards would protect against abuse from someone who is sufficiently literate in the technology.  In regard to the use of algorithms to bind signatures to record data sufficiently strong to prevent misuse, the commenter believes that a sufficiently sophisticated algorithm could encode the digital signature in such a way that it would only be valid to the document to which it was originally attached.  However, the commenter noted that this would necessitate an equally sophisticated validation process.

Response:  EPA thanks commenters for their views on the security issues related to the digitized signature method.  We agree with comments that the security standards for the digitized signature method should not be too stringent.  However, we continue to believe that minimum standards need to be in place to ensure authentication of a user's digitized signature consistent with the CROMERR.  For the final rule, we have replaced the codified standards that were proposed at §262.25(g) with a technology neutral standard that requires signature methods to be CROMERR compliant and to be generally cost-effective and practical for users.  However, in the final rule preamble we offer recommendations on how a quality digitized signature product must perform and suggest that products meeting these recommended performance standards would be CROMERR compliant and acceptable for the first generation e-Manifest system.  While the recommendations retain the proposed standard of employing a hash function to digitally bind the signature with the signed content, the other performance recommendations in the final rule are more focused on the quality of the digitized pads, pens, and software insofar as how they capture, process, and analyze signature and forensic data.  Significantly, the final rule recommended standards for quality handwritten digitized signatures give greater emphasis to the overarching performance standard for these products  -  that they reliably capture and analyze the forensic signature data so that a professional document examiner could testify as an expert witness to the authenticity of the signatures.  Thus, CROMERR compliant digitized handwritten signatures will be authenticated in a manner similar to ink signatures that are in dispute, that is, based on the testimony of professional document examiners about the unique forensic properties of the signature. The recommended standards in the final rule also explain that before these signature products may be determined to be CROMERR compliant, peer reviewed studies showing the forensic reliability of the signature products must be completed so that there is a proper evidentiary foundation (under the U.S. Supreme Court's Daubert opinion) for the expert testimony of the document examiners.  

Under CROMERR, the Agency also generally requires electronic signatories of environmental reports to undergo a one-time identity proofing exercise before the signatory may sign and submit electronic reports to EPA.  Identity proofing aids in establishing that an asserted identity can with legal certainty be uniquely linked with the electronic signature device used by the signatory to execute their electronic signature.  However, as digitized handwritten signatures would be authenticated by examiners based on their unique biometric-like properties, it is not necessary for the signer to show "ownership" of their unique digitized handwritten signature any more than it is required that they show ownership of their ink-signed signatures.  Therefore, there will be no specific CROMERR identity proofing required for these signatures in e-Manifest.    

Comment: We heard from one commenter in response to EPA's request for comment on whether EPA should require that digitized signatures be digitally signed (Commenter No. 33).  The commenter doubted that this approach would provide any additional security, since anyone who could falsify the digitized signature also could falsify digitally signing the digitized signature.  

Response:  EPA thanks the commenter for its views on the security issues related to the digitized signature method.  We agree that EPA should not require that digitized handwritten signatures be digitally signed. Rather, the final rule sets forth alternative recommended performance standards for digitized handwritten signatures that we believe are sufficiently effective and that are focused more on accurately and securely capturing, processing, and analyzing forensic signature data so that the signatures may be reliably authenticated in the event of a dispute by expert document examiners. 

Comment:  We heard from four commenters regarding the cost implications of the proposed secure digitized signature approach (Commenter Nos. 22, 33, 46 and 60).  One commenter expressed concern that, if EPA imposes a complex security system for its electronic signature process, it would not be as cost-effective as the current system (Commenter No. 22). The commenter believes that, on the other hand, if EPA keeps the electronic signature process simple, it could well be comparable to, or even more cost-effective than, the current handwritten system.  Another commenter stated that the secure digitized method provide a more practical and cost effective alternative to the digital signature/PKI approach and hand signed documents (Commenter No. 60).  Another commenter stated that, in consideration of the additional costs for hardware and software involved with the secure digitized method, the question of practicality and cost-effectiveness is directly dependent on the issue of whether the additional level of security is worth the additional cost and complexity (Commenter No. 33).  

Response:  EPA thanks the commenters for their views on the costs of the digitized signature method.  We agree that we should attempt to minimize user costs while ensuring an effective, legally enforceable signature method, and we believe the final rule recommendations establish such a method.  As discussed elsewhere in this document, EPA conducted a detailed economic analysis of the proposed authentication and signature technologies in May 2007 to understand better how the hardware, software, and support services needed for each signature and identity proofing method would impact the implementation costs for the system and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs.  The May 2007 economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), despite the fact that this method entails a more significant initial investment by users in the signature pads and software necessary to generate the digitized signatures.  While there may be some additional cost involved with purchasing the quality digitized signature products that will prove capable of meeting the forensic reliability standard in our recommendations, we believe that these products will likely be very cost-effective relative to other methods we analyzed.  Further, the recommendations on forensic reliability and authentication by document examiners disclose that EPA intends that the signature process with digitized handwritten signatures be performed simply and very similarly to the current ink signature process.  Thus, the digitized signature process will in fact be very comparable to the current signature process with ink signatures insofar as the signature ceremony used to collect the signatures and the reliance on forensic signature evidence to authenticate them.  These signatures are particularly amenable to off-line capture, since they will not be subjected to real time validation against the network, and will be authenticated in the event of a dispute by professional document examiners, using the stored forensic signature evidence.  

In addition, EPA also reminds commenters that many users of a digitized signature method will not need to purchase the signature apparatus and therefore will not incur such costs.  Specifically, EPA is aware that many of the generators who would sign their electronic manifests with the digitized signature method are small generators who might ship wastes under electronic manifests very infrequently, perhaps two or three times per year.  For these generators, purchase of the digitized signature apparatus may not make economic sense.  Rather, we envision that transporters and TSDs may purchase portable signature devices for their customers' use when they pick up a shipment for transportation.  Under this scenario, a digitized signature pad or pen would be supplied for each transport vehicle, and this device could be used repeatedly by many customers for thousands of signatures over a period of several years, before their expected failure or replacement.  

Comment:  We heard from three commenters regarding the implementability and feasibility of secure digitized signatures (Commenter Nos. 22, 33 and 60). These commenters believe that it would be unlikely for waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature (Commenter Nos. 33 and 60).  In regard to advantages of digitized signatures over handwritten signatures, one of these commenters noted that the main advantage that manifest users would find attractive is that digitized signatures will allow them to file their required manifests electronically rather than manually (Commenter No. 33).  The commenter believes this will prove convenient, be significantly less expensive, and have the potential to greatly speed any processing involved.  In regard to whether the software implementing the proposed approach supports open standards, the commenter believes that some software implementing the approach supports open standards, whereas other software implementing the approach still utilizes proprietary algorithms and standards.  The commenter believes that open standards are better, particularly for anything a waste handler will be dependent on for a long period of time.

Response:  EPA thanks the commenters for their views on implementation of the digitized signature method.  We agree with the comments that the digitized signature can be an attractive option for users that are accustomed to the current handwritten signature processes.  That is a primary reason for our recommendation of this method in the final rule preamble. We thank the commenters for expressing their belief that it is unlikely for waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature.  EPA will consider their comments when we develop the e-Manifest system.

Comment: We heard from two commenters regarding parameters for ensuring accuracy (e.g., visual feedback, dynamic signature parameters) in the secure digitized signature (Commenter Nos. 33 and 60).  One commenter opposed visual feedback parameters because they add burden and do not enhance environmental protection (Commenter No. 60).  The other commenter believes that dynamic signature parameters could be helpful in establishing the genuineness of a signature; however, such parameters could cause confusion (e.g., if it rejects signatures that are in fact valid) and add burden on waste handlers (Commenter No. 33).

Response:  EPA thanks the commenters for their views about the parameters for the digitized signature.  The issue with visual feedback and collection of signature dynamics parameters is not the furtherance of environmental protection, but rather, supplying a signature that is capable of being reliably authenticated by document examiners so that the system will be protected from attempts at fraud or repudiation.  EPA acknowledges that a dynamic signature system that attempts to validate signatures immediately can be calibrated so that they report either too many false positives or false negatives.  However, EPA does not intend to implement the digitized handwritten signature so that signatures will be validated in this manner "on the fly."  Rather, EPA intends that the system will collect and retain the forensic signature evidence and then subject the forensic evidence to analysis by experts only in the event of a dispute involving a manifest signature.  This is the manner in which ink signatures are authenticated when a dispute arises regarding their authenticity, and EPA expects that the forensic data from digitized handwritten signatures will be analyzed and authenticated in a similar fashion with e-Manifest.  EPA will further consider these comments as we develop the e-Manifest system.

5.0	Preparer Signature Proposal

Comment: We heard from 13 commenters expressing concern or offering suggestions for the proposed procedures for preparers to sign and initiate the electronic manifest (Commenter Nos. 5, 17, 25, 30, 32, 33, 34, 35, 46, 54, 57, 59, and 60).  

Two commenters expressed their concern for the high level of safeguards required for the preparer signature approach since EPA does not require any equivalent level of safeguards for handwritten signatures under the current manifest system (Commenter Nos. 46 and 57).  Another commenter expressed its belief that EPA should not establish any requirements for preparer signatures beyond what is currently required for paper manifests and expressed opposition to EPA's suggestion for hand-signed generator authorization for the preparer (Commenter No. 60).

Three commenters believe that the proposed preparer signature feature could diminish the importance of the generator certification and the generator's involvement/responsibility to ensure correct, valid information on the manifest (Commenter Nos. 5, 34, and 59).  One of these commenters expressed concern that EPA is making the electronic manifest available to small handlers (Commenter No. 34).  The commenter believes that the e-manifest should be available only to waste handlers involved in large numbers of manifests.  Another of these commenters believes the preparer signature could affect the cradle-to-grave responsibility as interpreted by the courts as well as other liability issues (Commenter No. 59).

One commenter believes the term "preparer" at proposed 40 CFR 262.24(b) should be changed to reflect the definition at proposed 40 CFR 260.10, i.e., the "preparer" is the person who conducts the administrative requirements of assembling the manifest, not the technical requirements of preparing the shipment for transportation (Commenter No. 57).  The commenter also believes the proposal prohibits a preparer from originating the manifest, even though preparers can originate a paper manifest under the current system.  The commenter urged EPA to revise the regulatory language to clarify that preparers can originate the electronic manifest

Two commenters suggested that the manifest should indicate the preparer's relationship to the generator (Commenter Nos. 54 and 59).  One of these commenters further stated that EPA should require that the preparer's signature and company, as well as the generator's signature, appear on the electronic manifest (Commenter No. 54).  The commenter also asked EPA to reiterate its existing policy allowing employees or other individuals to sign the manifest paper on behalf of the generator. 

Two commenters asked EPA to clarify the liability of generators and preparers under the proposed approach (Commenter Nos. 5 and 30).  

Two commenters asked EPA to clarify specifically how the generator authorizes the preparer to sign on his behalf, e.g., the specific language to be used (Commenter Nos. 30 and 59).  Two commenters expressed their belief that the authorization should be in writing (Commenter Nos. 33 and 59).  One of these commenters suggested that the authorization should be in writing, contain an acknowledgment that the generator is responsible as the generator of the waste described in the manifests completed by the preparer, and be executed prior to the preparer completing any manifests on behalf of the generator (Commenter No. 59).  The commenter believes the authorization should also clearly indicate to the generator that the same responsibilities and liabilities associated with a paper manifest are also associated with an electronic manifest, including the reconciliation of any rejections, discrepancies, or exceptions.

Another commenter asked EPA to clarify the procedures for a generator's employees to electronically sign an electronic manifest that is prepared by a vendor (e.g., discuss the ability of the employees to interface with the vendor's electronic manifest) (Commenter No. 25).

One commenter expressed support for allowing for preparer signatures, but noted that use of the secure digitized signature would minimize the need for preparers to sign on behalf of the generator (Commenter No. 17).  Another commenter also expressed support for preparer signatures, but asked EPA for more clarification on when preparer signatures would be appropriate and how they might be integrated into technology platforms (Commenter No. 32).

Two commenters expressed their belief that EPA should not limit the preparer signature approach to digital signatures (Commenter Nos. 33 and 60).  They believe the rule should be flexible enough for other approaches. 

Four commenters believe the regulations should be clarified to require that the preparer must provide the signed manifest to the generator at the time of signature/shipment (Commenter Nos. 33, 35, 54, and 59).  One of these commenters indicated its belief that there is no other effective alternative to the proposed approach of leaving a manifest with the generator (Commenter No. 33).  The commenter believes the generator would insist of this.  

Another commenter expressed concern about the logistical difficulties associated with a preparer's leaving a signed paper manifest with the generator prior to shipment (Commenter No. 57).  The commenter suggested that, as an alternative, the generator be provided with a shipping paper at, or in advance of, pick-up of the waste.

Two commenters expressed their belief that the generator should receive verification of receipt or notice of rejections or discrepancies (Commenter Nos. 33 and 60).  Once of these commenters supported its view by indicating that a conflict of interest could arise if a generator allowed its preparer (e.g., TSD) to verify receipt of shipment (Commenter No. 33).  The other commenter noted that there may be instances where electronic verifications are not possible (Commenter No. 60).  In these circumstances, the commenter believes that alternative means of verification should be acceptable and may include, but are limited to, a hard copy of the manifest or a summary of the relevant manifest data.  The commenter also believes that the particular concern regarding a generator/preparers relationship when the preparer is employed by the same entity that operates the receiving facility is addressed by the formal business relationship of the two parties, e.g. indemnification or some other contractual relationship.  The commenter offered regulatory text for EPA's consideration that would apply to preparers that also act as the transporter and designated TSDF.

Response:  EPA thanks the commenters for their many views on the third-party storage of electronic manifests.   In the May 22, 2001 proposed rule, EPA proposed the provisions for manifest preparation and signature by authorized preparers at section 262.24(b).  The topic of manifest preparation and the related issue of when it is proper for a preparer of manifests to sign for the generator has been subsumed by the discussion of "offeror" responsibilities and offeror signatures in the March 4, 2005 final rule notice on Manifest Form Revisions.  Because this area is now fully addressed in the general discussion of offeror responsibilities and offeror certifications that apply to all manifests, both paper and electronic, it is not necessary to codify in the final e-Manifest rule a distinct provision limited to electronic manifesting addressing manifest preparation and preparer signatures.  The offeror responsibilities and options for signing manifests are no different for paper manifests or electronic manifests.  Therefore, EPA is not taking further action on the preparer signature proposal in the final rule.  Refer to the document, "Hazardous Waste Management System: Modifications of the Hazardous Waste Manifest System; Proposed Rule," in the Federal docket for EPA's responses to public comments on the proposed preparer signature provisions.  The document is available at www.regulations.gov under EPA docket number EPA-HQ-RCRA-2001-0032.

6.0	Proposed Conditions on Third-party Storage

Comment:  We heard from eight commenters who either stated their support for third-party storage of manifests, or expressed their lack of opposition to it (Commenter Nos. 12, 17, 22, 33, 46, 54, 59, and 60).  Two of these commenters believe the off-site storage provision would be an incentive for facilities to automate (Commenter Nos. 33 and 60).   

One of the commenters noted that it is unclear as to just how off-site vendors would assume the computer and record security controls in storing manifests (Commenter No. 33).  The commenter suggested that EPA could make it a requirement that, should a third-party storer decide to leave the business, they must provide EPA with copies of all manifest records in their possession; however, the commenter noted some drawbacks with this approach.  The commenter also suggested that EPA could make it a requirement that, should a third-party storer decide to leave the business, they must give a reasonable amount of notice to their customers to allow the customers time to find an alternate storer and have their records transferred to that alternate storer.  The commenter noted, however, that this would leave EPA largely dependent on the competence and diligence of the third-party storer.

One commenter stated its belief that it should be the responsibility of the TSDF to assure that adequate data security is maintained by these third-party storage providers (Commenter No. 17).  The commenter does not believe that EPA needs to include any particular restrictions or controls on the use of these vendors.

One commenter clarified that, if railroads are allowed to use their current EDI systems to transmit and store the information, it is in favor of off-site storage (Commenter No. 46).  

Two of the commenters clarified that they do not oppose off-site storage so long as the rule fully addresses the issue of inspection of manifests that are electronic (Commenter Nos. 54 and 59).  One commenter suggested that EPA should include a requirement that the manifest system have the capability and that the generator, and/or TSDF, and/or transporter print out a one (or two) line "summary report" of electronic manifest activity (Commenter No. 54).  The commenter believes this should be required on a weekly basis so that if a system is down, or if the contact person is not available, the inspecting entity would still have manifest information.  The other commenter stated that facilities should be required to recover their records or transfer them to another third-party storer if inspectors are not provided with adequate access, or if the business arrangements between the third-party storer and the generator are no longer in effect during the required retention time (Commenter No. 59).

Response:  EPA thanks the commenters for their many views on the third-party storage of electronic manifests.  In the May 22, 2001 proposed rule, EPA proposed to permit facilities to engage commercial record storage services or networks to provide for electronic storage of manifest copies.  Based on stakeholder input and further consideration, EPA has determined not to pursue its proposed decentralized e-manifest approach.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. Under this approach, users of the e-Manifest may be able to maintain their official copies of the electronic manifest on secure storage sites and their accounts on the national system, rather than on third-party systems.  Because of the centralized approach, it is no longer necessary to address third-party storage in the final rule.

Comment: We heard from six commenters regarding liability and enforcement issues associated with the offsite storage of electronic manifests (Commenter Nos. 16, 18, 22, 33, 34, and 60). 

Several commenters believe that EPA needs to clarify the liability and enforcement implications for facilities and their third-party storers under the proposed approach (Commenter Nos. 16, 18, and 34).  These commenters asked EPA to clarify in particular the compliance and enforcement issues  that would apply to a RCRA facility that uses a third party to store its manifests, in situations where the manifest cannot be immediately produced to inspectors (e.g., because of technical difficulties).  

Another commenter expressed its belief that the issue of vendor liability and vendee protection should be left to the contract between the two parties (Commenter No. 22).  The commenter believes these issues should not be addressed through EPA's rule.  

Two commenters believe that the third-party storer should not incur any liability under RCRA (Commenter Nos. 33 and 60).  One of the commenters believes the vendor would face service-provider liability rather than liability under RCRA per se (Commenter No. 33).  The other commenter does not believe there would be any distinction between hard copy manifests and the manifest data stored electronically in regard to enforcement, and as such, EPA can use its existing enforcement authority for recordkeeping of electronic forms (Commenter No. 60).  The commenter stated that the regulated entity is the owner of its electronically stored manifest data and it would be compelled to produce the data upon demand from EPA.  In this regard, the commenter believes that the third party service provider should not incur any RCRA liability from the simple storage of data.  The commenter added that the third party service provider is responsible for the administration of the storage system and that the data remains under the control and ownership of the facility through their contractual agreements.  The commenter believes that, if the data storage service should exit the business, the accounts would be transferred to an alternate third party service provider.

Response: EPA thanks the commenters for expressing their concerns on the third-party storage of electronic manifests.  Because the centralized national e-Manifest system being pursued by EPA under the e-Manifest Act and this final rule will address storage of manifests at users' accounts on the national system, it is no longer necessary to address third-party storage in the final rule.  Please refer to the Agency response above for additional information.

7.0	Regulatory Analyses Supporting the Rule
                                                      
Comment: We heard from 10 commenters on EPA's regulatory impact analysis of the proposed rule (Commenter Nos. 10, 21, 26, 33, 34, 44, 52, 54, 59, and 63).  

One commenter expressed its disagreement with EPA that the rule is not economically significant (Commenter No. 10).  In regard to the Economics Background Document of the rule, the commenter stated that EPA has inadequately addressed the costs related to waste handlers' equipment purchases.  The commenter disagreed with a basic assumption in the analysis that waste handlers have personal computers readily available for the e-manifest.  The commenter believes that the analysis is too simplistic and that automated handlers would need to pay for computer equipment, such as computers, printers, signature devices on vehicles, as well as for employee training on the e-manifest.  The commenter expressed concern that the analysis does not account for situations in which transporter printer capabilities are needed, e.g., in editing a generator's manifest.

In addition, the commenter does not believe the study adequately addresses economic impacts on small businesses.  The commenter is concerned that the study's underlying data are based on consultations with relatively large waste handlers, which has skewed the data.  The commenter points out that the largest waste handlers likely have the greatest amounts of computer hardware and software in place, as well as greater resources for implementation.  Even though the e-manifest is optional, the commenter believes small waste handlers may be forced into adopting electronic manifesting, which could be financially crippling. 

In regard to the Hazardous Waste Manifest Cost Benefit Analysis, the commenter states that EPA has not accounted for the need of transport vehicles to have computer and printer capabilities (e.g., to process the manifest for the non-automated generator).  Further, the commenter is concerned that the EPA's studies do not indicate the specific number of waste handlers that would enjoy the burden reduction under the e-manifest proposal.  The commenter believes that the per-entity burden reduction likely would not offset the incremental burden from necessary expenditures such as computer hardware, software, and training.  Given these observations, the commenter expressed doubt that waste handlers would see savings under the proposed approach.  Finally, the commenter expressed its belief that States would be the primary beneficiaries under the e-manifest approach, not the waste handlers.

Another commenter disagreed with EPA's burden estimates for the e-manifest (Commenter No. 52).  The commenter believes that the burden to waste handlers would increase under the proposed approach, since a hard copy of the shipping paper would still be required during transportation.  

Another commenter agreed with EPA that automating the manifest system has potential to result in an overall net savings at some future time after the new system reaches steady state operation (Commenter No. 23).  However, in the interim, the commenter foresees potentially high front-end costs for individual waste handlers to purchase and deploy new hardware and software to implement the system.  The commenter also believes individual waste handlers would incur up-front and continuing costs for maintenance, backup systems, specialized training, and security.

Another commenter suggested that EPA's analyses should account for other regulatory paperwork that might accompany a shipment, increasing costs (e.g., LDR paperwork, DOT shipping paper) (Commenter No. 21).

Another commenter noted that the rule would require waste handlers to maintain an electronic activity log audit trail to track access to the electronic records (Commenter No. 26).  The commenter believes this would potentially be labor-intensive and should be accounted for in EPA's cost studies.  The commenter also cautioned EPA that a paper-based system might be less burdensome for some TSDFs that an automated system.  In addition, the commenter pointed out that much of a TSDF's business is made up of one-time generators that will not likely have automated capabilities.  Therefore, EPA should not assume that all of a TSDF's forms will be automated, or that the entire manifest cycle will be automated.

A number of commenters believe EPA has underestimated States' capital start-up costs under the e-manifest (Commenter Nos. 33, 34, 44, 54, 59, and 63).  Two of these commenters stated that EPA's cost estimates are missing the amount of time and resources needed to maintain the knowledge to keep the electronic system up-to-date, which may require at least one full-time equivalent at a very high pay grade (Commenter Nos. 54 and 63).  Another commenter stated that EPA's cost estimate of $100,000 for State start-up costs is too low, taking into account signature authority certificates and keys and the States' need to accommodate both EDI and XML formats (Commenter No. 59).  Another commenter believes that there would be no cost savings by implementing the proposed electronic submission system for years to come (Commenter No. 34).  The commenter pointed out that, initially, States would have to design and implement the electronic data submission system at the same time as handling the existing hard copy system.

One commenter stated that EPA should consider the full cost of implementation of the e-manifest component, given possible effects of the rule on waste handler and States' behavior (Commenter No. 25).  The commenter wondered if manifest preparers or third-party storers would begin to charge their waste handler customers to recoup the cost of the electronic systems.   The commenter also wondered about the effects on waste handlers' costs if some States do not adopt electronic reporting and a patchwork of State programs arises, making the e-manifest complex.

Response:  EPA thanks commenters for their many suggestions for improvements to the Agency's economic analysis.  In the May 22, 2001 proposed rule, EPA proposed a decentralized approach for electronic manifesting that was based on technical standards and controls for initiating, transmitting, and retaining the electronic manifest.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  In this regard, many of the assumptions and estimates in the Agency's economic analysis on the proposed rule are not relevant to the Agency's current approach.  Nonetheless, commenters have raised good suggestions for further EPA research and analysis.  EPA will continue to examine issues raised by commenters, such as costs to States, costs for hardware, costs for carrying a paper manifest during transportation, and costs to small entities.  

EPA has determined that the costs, benefits, and other impacts of e-Manifest will not occur until the system is implemented.  This final rule codifies key requirements of the E-Manifest Act and authorizes the use of electronic manifests on the national system, but none of the costs or benefits will be realized until the national system is developed and implemented.  Therefore, EPA has decided to defer the development of a detailed Regulatory Impact Analysis until we promulgate the Fee Rule.  At that time, we will have more complete and detailed information on the system to be procured and its costs, as well as the user fee charges that will be assessed to pay for and sustain the system.  Thus, EPA will address commenters' input as appropriate when we prepare the economic analysis for the Fee Rule.

Comment: We heard from two commenters on EPA's analysis of small business impacts under the Regulatory Flexibility Act (Commenter Nos. 10 and 44).  One commenter expressed concern that EPA concluded that the rule would have no significant adverse impact on a substantial number of small entities (Commenter No. 10).  The commenter believes EPA's analysis is incomplete, since it does not fully examine impacts to small waste handlers, such as small transporter companies.  The commenter notes that most hazardous waste transportation companies are small businesses; however, EPA's studies do not adequately analyze the potential economic impact on transporter companies and TSDFs that are small businesses.  In addition, the commenter notes that small transportation and TSDF companies must compete with the larger companies, who have more resources to obtain e-manifest capabilities and to undercut prices of smaller competitors.  The commenter suggests that these larger companies will use the e-manifest as a value added service to drive smaller firms out of business.  The commenter also noted that large generators would likely expect their commercial transporters and TSDFs to automate.  This could force small businesses to automate or lose customers.  Finally, each automated transportation vehicle would need computer capabilities, and employees would need to be trained on the e-manifest.  The commenter expressed concern that these issues are not addressed in the EPA's small business studies.  The other commenter expressed general concern that EPA's analysis underestimates the costs to smaller generators (Commenter No. 44).

Response:  EPA thanks commenters for their views on impacts to small businesses under the proposed rule.  As described above, EPA's proposed rule was based on a decentralized approach for electronic manifesting.  Since then, EPA indicated in April 2006 that its preferred option had changed to the establishment of a national e-Manifest system to be hosted by EPA, and has decided on this approach in this final rule.  As discussed in the previous comment response, EPA has decided to conduct its detailed evaluation of the economic impacts of the e-Manifest when it promulgates the Fee Rule prior to the system's implementation. Nonetheless, commenters have raised good suggestions for further EPA research and analysis.  At this time, EPA notes that the paper manifest form will still be available for use, so any small business that does not want to utilize the electronic manifest can still access the paper forms to comply with manifest requirements.  While EPA concedes that the early adoption of e-Manifest by larger transporters and TSDFs could place competitive pressure on some smaller entities, we do not believe that there will be a significant economic impact on a substantial number of small entities.  In addition, the early adopters will be the ones that encounter the early bugs and complications of e-Manifest implementation, and perhaps a greater share of the costs.  Once the initial period of system implementation is completed by early adopters, there may be "turn-key" solutions available from third party vendors that will make the costs of entry to e-Manifest less substantial than perceived now by the commenters.  Even the smaller transporters and TSDFs, who are after all in the business of hazardous waste transportation and management, should realize sufficient efficiencies from the electronic manifest to eventually warrant their investment and participation in the electronic system.  
APPENDIX:  TABLE OF ORGANIZATIONS COMMENTING ON PROPOSED RULE AND COMMENTER NUMBERS
                                       

   Table of Organizations Commenting on Proposed Rule and Commenter Numbers
Commenter Number
              Name of Organization Commenting on the Proposed Rule
1
No Affiliation
2
Association of State and Territorial Solid Waste Management Officials
3
University of Missouri - Colombia Environmental Health and Safety
4
International Metals Reclamation Company, Incorporated
5
No Affiliation
6
Pennsylvania Department of Environmental Protection
7
Battery Council International
8
The Graphic Arts Coalition
9
Hazardous Materials Advisory Council
10
Chemical Analytics, Incorporated
11
Phelps Dodge Corporation
12
Department of Defense
13
Department of the Navy, Puget Sound Naval Shipyard
14
International Precious Metals Institute
15
American Trucking Associations
16
American Petroleum Institute
17
Onyx Environmental Services
18
Equiva
19
Specialty Steel Industry of North America and the Steel Manufacturers Association
20
Solutia
21
Dupont
22
Utility Solid Waste Activities Group
23
Department of Energy
24
Synthetic Organic Chemical Manufacturers Association, Incorporated
25
Eastman Chemical Company
26
Waste Management
27
State of Maine Department of Environmental Protection
28
Merck Manufacturing Division
29
BRG Environmental
30
Texas Natural Resource Conservation Commission
31
Purdue University
32
Analine Technologies
33
Massachusetts Department of Environmental Protection
34
New York Department of Environmental Conservation
35
State of Michigan Department of Environmental Quality
36
National Paint and Coatings Association
37
William K. Taggart
38
Coalition for Responsible Waste Incineration
39
Systech Environmental Corporation
40
New Hampshire Department of Environmental Services
41
Cement Kiln Recycling Coalition
42
Paul, Hastings, Janofsky & Walker LLP
43
American Chemistry Council
44
Northeast Waste Management Official's Association
45
Dow Chemical Company
46
Association of American Railroads
47
Dominion
48
California Environmental Protection Agency
49
Institute of Makers of Explosives
50
Marisol, Incorporated
51
PPG Industries
52
General Motors Corporation
53
Cement Kiln Recycling Coalition
54
Information Management Task Force of the Association of State and Territorial Solid Waste Management Officials
55
Giant Cement Holding, Incorporated
56
American Airlines Incorporated
57
Heritage Environmental Services
58
U.S. Liquids Incorporated
59
Illinois Environmental Protection Agency
60
Safety Kleen
61
Environmental Technology Council
62
National Automobile Dealers Association
63
Arkansas Department of Environmental Quality
64
Phelps Dodge Corporation
65
Environmental Technology Council
66
U.S. Army Corps of Engineers