RESPONSE TO COMMENTS DOCUMENT                                         HAZARDOUS WASTE MANAGEMENT SYSTEM: MODIFICATIONS OF THE HAZARDOUS WASTE MANIFEST SYSTEM; PROPOSED E-MANIFEST SYSTEM                                                                     PUBLISHED MAY 22, 2001                                                                                December 2, 2013                                                                                +                                                             ************FINAL DOCUMENT************ BACKGROUND AND PURPOSE OF DOCUMENT

Background

On May 22, 2001, EPA published a notice of proposed rulemaking to revise the hazardous waste manifest system (66 FR 28240).  The proposed revisions aimed to reduce the manifest system's paperwork burden on users, while enhancing the effectiveness of the manifest as a tool to track hazardous waste shipments.  The proposed rule would have accomplished this by adopting a standardized manifest form with fewer or no optional data fields; adopting a new approach for distributing and acquiring the form; standardizing the data elements and procedures for tracking certain types of hazardous waste shipments; and allowing the manifest to be completed, signed, transmitted, and stored electronically.  Thus, the proposed rule consisted of manifest system reforms of two distinct types: (1) revisions to the manifest form and the procedures for using the form and (2) revisions aimed at replacing the paper-based manifest system with a nearly paperless, electronic approach to tracking hazardous waste shipments (referred to as the Ae-manifest@ in this document).

EPA received 66 public comment letters in response to the May 22, 2001 proposed rule.  Commenters generally supported our goals of further standardizing the manifest form elements and reducing variability among the manifests that authorized RCRA State agencies currently distribute.  However, the commenters had differing views on many of the particulars of the proposed revisions to the manifest.  Moreover, there were a substantial number of comments that took issue with EPA's proposed approach to the e-manifest, particularly with respect to the technical rigor of the proposal, the assumptions relied upon by EPA in its projections of burden and cost reductions, the feasibility of the proposed electronic signature options, the highly detailed security requirements aimed at preventing fraud and data corruption, the reliance on regulated industry to develop private e-manifest systems, and the preamble's suggestion that State programs may not be required to adopt the e-manifest requirements within their authorized RCRA State programs.

We believed that the comments addressing the e-manifest proposal raised significant substantive issues that merited further analysis and stakeholder outreach prior to adopting a final approach.  The comments received in response to the form revisions proposal, on the other hand, raised fewer difficult issues that would deter us from going forward with a final rule.  Therefore, EPA separated the e-manifest portion from the form revisions portion of the proposal for purposes of taking final action at that time.  EPA published a final rule on the form revisions on March 4, 2005 (70 FR 10776).  EPA is now taking final action on the e-manifest portion.

Purpose of Document

This document presents a summary of the public comments received in response to the e-manifest provisions of the proposed rule.  The public comments (e.g., suggestions, concerns, questions) are summarized according to specific issues related to the proposed rule and preamble.

In each summary, we indicate the number of organizations whose comments are reflected in it.  We also identify the organizations.  To do so, we assigned each organization a unique commenter number.  We then prepared the summaries and inserted commenter numbers into each summary to identify the organizations whose comments are reflected in it.  The appendix to this document includes a table identifying each organization that commented on the proposed rule and its commenter number.

This document also provides the Agency's response to each comment.  The responses explain how the comments were considered in developing the final e-manifest rule.  This document does not address comments that are outside the scope of the e-manifest.

SUMMARY OF PUBLIC COMMENTS AND AGENCY RESPONSES ON E-MANIFEST

1.0	General Comments

     1.1	General Support

Comment: We heard from 46 commenters that indicated their general support for the rule and/or efforts to automate the manifest in particular (Commenter Nos. 1, 4, 6, 8, 9, 12, 14, 15, 16, 17, 18, 19, 21, 22, 23, 24, 26, 27, 28, 30, 31, 32, 34, 35, 36, 37, 39, 40, 42, 44, 45, 46, 47, 48, 49, 51, 52, 53, 54, 56, 57, 58, 60, 61, 62, and 63).  Thirteen of these commenters expressed their support of EPA's goals to streamline the manifest requirements and reduce burden on waste handlers (Commenter Nos. 12, 19, 21, 22, 23, 31, 42, 49, 53, 58, 60, 62, and 63).  One of the commenters had participated in the e-manifest pilot program (Commenter No. 28).  The commenter expressed support for automation, but encouraged EPA to work through any issues that were identified in the pilot before moving forward.

Response:  EPA thanks commenters for their support of the proposed rule and efforts to automate the manifest.  EPA has modified its proposed e-manifest approach due in part to feedback from stakeholders.  In addition to stakeholder comments on the proposed rule, we received input from stakeholders at 2 national meetings (May 2004 and November 2008) held since the publication of the 2001 proposed rule, and from webinars conducted after the 2008 public meeting.  We also gained additional insights from additional e-Manifest pilot tests conducted during 2007  -  2008 with the States of Michigan, Minnesota, New Jersey, and Massachusetts.  Further, we solicited additional comment on the e-Manifest program direction and specific policy issues in Federal Register notices we published in April 2006 and February 2008.  Finally, the Hazardous Waste Electronic Manifest Establishment Act (e-Manifest Act) was enacted in October 2012. The final rule addresses key provisions of this legislation that authorizes the establishment of a national electronic manifest system by EPA, and that requires implementing regulations to authorize the use of electronic manifests and, among other things, to ensure consistent implementation in the states.  Please refer to specific EPA responses to learn more about the changes that resulted after these outreach efforts with stakeholders.

Comment: We heard from 17 commenters suggesting that the e-manifest requirements should be simple to understand and follow and not be too prescriptive to prevent future technologies and improvements (Commenter Nos. 4, 12, 25, 28, 32, 33, 34, 43, 45, 51, 52, 53, 54, 57, 59, 60, and 61).  One of the commenters noted that technological advances will make it very difficult for EPA to select technologies and standards that may be appropriate years into the future (Commenter No. 61).  The commenter suggested that EPA establish a basic framework on how the e-manifest should work, and then implement the details in non-regulatory documents that can be quickly modified as needed.  In response to EPA's question whether Extensible Mark-up Language (XML) is sufficiently stable to support the e-manifest approach, one commenter believes XML is the technology most likely to be able to support EPA's purposes in the foreseeable future (Commenter No. 33).  Another commenter suggested that the rule should be technology neutral and allow for industry to use other technologies than specified in the rule (Commenter No. 60).   Another commenter asked that the final rule include a complete process description from initial preparation by the generator through the final storage of the manifest (e.g., a process flow chart) (Commenter No. 51).  Two commenters suggested that EPA add an option for a petitioner to demonstrate equivalency to the two proposed data formats in the rule (Commenter Nos. 57 and 61).

Response:  EPA thanks commenters for their suggestions on keeping the e-manifest approach flexible and easy to implement.  In our May 2001 proposal, we set forth a standards-based approach for reporting and recordkeeping of the e-manifest.  Users of the e-manifest would have had two options for transmitting the e-manifest, i.e., Electronic Data Interchange (EDI) and Extensible Mark-up Language (XML).  Users also would have had to comply with electronic manifest systems and security requirements, such as requirements for independent system validation, limits on system access, full interoperability among users' systems.  Signing the e-manifest would have been done using either a secure digitized signature or a digital signature based on private key/public key cryptography.

As we discuss below in response to other comments, EPA received many comments critical of the proposed decentralized, standards-based approach.  Several commenters suggested that a preferred approach would be for EPA or another entity to develop a consistent, national solution for the e-Manifest.  We received strong additional comments supporting such a national system at a May 2004 public meeting in Washington, D.C. and in comments responding to the April 2006 Federal Register notice soliciting comment on the preferred program direction.

Since the 2001 proposal, EPA has made significant progress toward developing its Agency-wide electronic receiving system, called the Central Data Exchange (CDX).  We have also, with our State environmental program partners, developed the National Environmental Information Exchange Network as a means to efficiently share environmental information with the States, through the nodes the States have developed on this network. The CDX has evolved from a prototype system to a fully operational electronic document receiving system and the building blocks supporting the CDX functions have changed substantially.  These changes reflect EPA's experience operating the CDX over these years, evolving trends in Internet technologies, and comments received from potential CDX users.  The CDX now supports tens of thousands of registered users providing data to dozens of environmental reporting programs across the major EPA media offices.  CDX registered users include representatives from state, tribe, and local agencies, industries, laboratories, and other federal agencies.

In addition, EPA finalized the Cross Media Electronic Reporting Rule (CROMERR) on October 13, 2005 (70 FR 59847).  CROMERR provides a uniform, technology-neutral framework that applies to electronic reporting across all EPA programs.  For example, the new electronic reporting provisions modify current requirements in the Code of Federal Regulations to address obstacles to electronic reporting.  They require validation of electronic signatures on reports submitted to EPA through the CDX (or another designated EPA system).  They also ensure that valid electronic signatures have the same legal force as their wet-ink counterparts.

Because of the emergence of the CDX as a viable option for the e-manifest, as well as stakeholders' requests for a more flexible, simple, and technology-neutral approach, EPA has decided to develop a national, centralized Web-based information technology system that EPA will host on the CDX or an equivalent system.  EPA's final rule authorizes the use of electronic manifests that are created and transmitted through the use of this national e-manifest system.  The final rule amends existing manifest regulations which now require manifests to be created only as paper forms, to be signed only with "by hand" signatures, and to be physically carried by waste handlers and retained at their sites as paper records.  These regulatory changes are necessary to ensure that electronic manifests are as valid as the traditional paper manifests that are signed with ink and manually processed and transmitted.  The use of EPA's national e-manifest system to obtain and process valid electronic manifests is the key component of the final rule.  The rule  codifies key requirements of the 2012 e-Manifest Act, which requires EPA to implement a centralized approach and develop a national electronic manifest system.  The final rule thus explains how electronic manifests obtained from and transmitted to the national system will be legally equivalent to paper manifests, and it clarifies the relevant policy issues (e.g., electronic signatures, CBI, paper manifest collections, program consistency) from the 2001 proposal, the subsequent 2006 and 2008 public notices, and the recent legislation.

EPA believes this approach will be much simpler and more flexible to implement than the proposed approach.  This follows because the proposed approach was a standards-based approach under which EPA attempted to define in regulations the technical standards that it believed were necessary to bring about the development of consistent, reliable, and secure systems by numerous private entities.  Under the new preferred approach, only one e-manifest system will be developed and hosted by EPA through the efforts of a contractor selected by EPA to develop the system in accordance with EPA's performance requirements.  This approach will obviate the need for EPA to promulgate the level of technical standards for the e-manifest as was done in the proposal.  Rather, the CDX or equivalent system will be designed with the appropriate level of controls and procedures to ensure that the e-manifest is completed, transmitted, and archived in fulfillment of EPA's performance objectives for system security, interoperability across systems, signature authentication, and other necessary controls.

Because the system and requirements will be implemented through EPA's own receiving system or its equivalent, the Agency will be able to integrate improvements and updates quickly when necessary (e.g., in response to technology advancements), as commenters requested.  The CDX has been designed by EPA expressly to be easy to use and place reasonable technology requirements on users   It offers user tools (e.g., prompts, error-flagging) to guide users and technical assistance via telephone and email should users have questions or problems.  In this regard, a CDX-hosted e-Manifest system will satisfy commenters' requests for an easy-to-use solution for the e-manifest.  In addition, the use of a single, national receiving system will provide stability and certainty for all users and enable a high level of interoperability among users' legacy and future system investments, as commenters have requested.

In response to the commenters' support of XML, EPA agrees that there are benefits to XML.  The schemas and style sheets developed in XML will likely be the means by which EPA will implement the electronic exchange of e-manifest data.  These XML documents will conform to the data elements of the hazardous waste manifest (EPA Form 8700-22) and continuation sheet (EPA Form 8700-22A) that EPA announced in the March 4, 2005, Form Revisions final rule.  Please refer to Section 2.0 of this document for additional Agency responses in regard to the use of XML for the e-manifest.

Comment: We heard from 12 commenters requesting that EPA further coordinate with other RCRA paperwork requirements as needed in finalizing the e-manifest proposal, e.g., LDRs, Biennial Report, continuation page, exception reporting (Commenter Nos. 12, 16, 18, 21, 24, 35, 38, 45, 46, 50, 57, and 60).  One of these commenters also suggested that EPA extend the e-manifest to non-RCRA requirements, such as PCB continuation sheets or NESHAP notification letters (Commenter No. 16).

Response:  EPA thanks commenters for their request for coordinating the e-manifest with other paperwork requirements.  The e-manifest system that will be developed initially will provide the core services necessary to manage the basic waste shipment tracking and waste data collection functions of the manifest process, including manifest creation, completion, signing, routing and communication services (i.e., services required to create, view, update, transmit, and close manifests) and the collection, distribution, and archiving of official manifest records.  However, we are aware from discussions during both the 2004 and 2008 public meetings that state agency and industry stakeholders regard Biennial Report integration as an important system objective.   Therefore, once we have successfully automated the core manifest preparation and transmission services, we will endeavor to develop the data entry and reporting services to enable e-Manifest data to be refined and processed so that it may be used to develop waste receipt summary information for the biennial report.  The system would also be designed with scalability so that additional EPA reporting functions could possibly be added as future upgrades.  At this time, however, we are focusing the initial phase of system development on the core, domestic manifest tracking requirements.

Commenters should note that the e-manifest system will be hosted on EPA's CDX or equivalent system and will utilize the National Environmental Information Exchange Network (NEIEN) architecture for sharing environmental information with state programs.  In the coming years, EPA intends to increasingly automate its information collections through this architecture as an option to paper-based collections.  As this happens, users will have a greater opportunity to coordinate their electronic reporting activities across EPA's information collections, including the manifest.

	1.2	Delayed Implementation Period for the e-Manifest Requirements

Comment:  We heard from seven commenters who requested that EPA ensure a more coordinated phase-in period (Commenter Nos. 21, 23, 24, 27, 44, 48 and 49).  These commenters were concerned that States be given enough time to make legislative and other changes.  One commenter suggested that a meeting with all State manifesting managers and data system managers may be productive in determining the implementation timeframes (Commenter No. 48).  Another commenter urged EPA to make guidance available, and if possible, sponsor training workshops for the regulated community on the e-manifest approach (Commenter No. 23).

Response:  EPA thanks commenters for their suggestions and concerns.  EPA has been persuaded by public comments on the proposed rule, as well as by suggestions from stakeholders at EPA's public meetings, that the e-manifest should be effective, recognized as valid, and implemented consistently in all states.  The e-Manifest Act enacted in 2012 also requires this result. EPA agrees that development and use of the e-manifest would not be feasible unless it can be assured that the validity of electronic manifests is recognized consistently in all the states.  The Agency appreciates stakeholders' concerns that optional state adoption could frustrate the successful development and implementation of e-manifest systems because investments in these systems could be perceived as too risky.

Therefore, EPA's  approach in this final rule  requires that all state programs adopt and recognize the validity of electronic manifests through the provisions of 40 CFR 271.4(c), which addresses state program consistency and the hazardous waste manifest.  This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest system does not meet the requirements of Part 271.  With the adoption of the electronic manifest in the final rule, EPA will deem it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest.

In addition, the e-manifest will be effective in all states on the same delayed implementation date that will be identified subsequently by EPA in the e-Manifest User Fee (Fee Rule) rulemaking.  The e-Manifest legislation enacted by the Congress provides that EPA shall implement and enforce the electronic manifest in all states on the program's effective date.  Federal implementation of e-Manifest would continue until such time as the states revise their authorized program with equivalent and consistent e-Manifest requirements and obtain authorization for these program revisions from EPA.   Consistent with the statute, the e-Manifest final regulation states that EPA expects all states to adopt the e-Manifest requirements, and that the electronic manifest will be effective Federally in all States on the announced implementation date.

For several reasons, EPA does not expect the states to have great difficulty making the transition to the e-manifest.  EPA  believes that because of the final Cross-Media Electronic Reporting Rule (CROMERR) (which lays out a framework for electronic reporting and receiving systems across EPA's programs at the federal, state, and local levels) the states have already begun to consider necessary changes to their environmental programs to enable electronic reporting (e.g., statutory and budgetary changes).  In fact, EPA is aware that a number of states have implemented electronic reporting under some of their environmental programs that meet CROMERR's  requirements.

In addition, EPA will establish a delayed implementation date that assures a smooth transition to the e-manifest by both industry and regulators.  As a point of reference, we note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect Federally in all states immediately after a six-month period following HSWA rule publication.  The EPA Regions administer the HSWA rules until State RCRA programs get authorized for them.  We believe the States have worked effectively in coordinating and transitioning their responsibilities under the HSWA rules, and that a similar Federal/State implementation approach for e-Manifest will be equally effective.

Under the RCRA authorization regulations at 40 CFR § 271.21(e)(2), authorized states are typically provided 1- 2 years after promulgation of Federal regulatory changes to adopt the corresponding revisions to their authorized programs.  Thus, these regulations govern when states would be expected to adopt their electronic manifest regulations under state law, so that authorized states may implement and enforce the electronic manifest requirements.  We know that authorized states have resource issues and budgetary constraints that may preclude them from meeting the adoption milestones in our Part 271 regulations.  As described above, regardless of states' progress in adopting program revisions, the e-manifest will go into effect under Federal law beginning on the implementation date to be announced by EPA in the Fee Rule.  States will be expected to obtain authorization by that implementation date or within a reasonable period of time thereafter.  This phased-in approach will give the states time to make necessary changes to their programs for the e-manifest.  Because of these factors, and because states have generally been strong proponents of e-Manifest, we expect a fairly smooth transition of e-manifest authority from EPA to the authorized states.

In response to the comment that EPA should provide guidance and/or training to the regulated community, EPA agrees that users must understand the final e-manifest approach in order to enable compliance.  EPA expects that the final rule approach to be significantly easier to understand and implement than the proposed approach and that training will therefore not be complex.  The final rule approach will be implemented through EPA's CDX or equivalent system.  The CDX includes easy-to-follow instructions and other user support tools (e.g., user prompts, technical support via telephone and email).  Moreover, EPA expects to develop training modules for e-Manifest that should assist industry and state stakeholders to learn the system basics well enough to become proficient with the system. Comment: We heard from eight commenters that EPA ensure implementation of the electronic manifest sooner than a two-year delayed compliance date (e.g., as soon as possible) (Commenter Nos. 1, 19, 22, 36, 45, 46, 49 and 60).  One commenter indicated that a delayed compliance date is not necessary, as the software is already readily available (Commenter No. 36).  The commenter believes that any further delay in the implementation of the new manifest system would be contradictory to the goals of reducing the paperwork and time burdens associated with the current manifest system.

Two commenters (state representatives) indicated that, since the implementation of the electronic manifest would be voluntary for the States, the State implementers will dictate the speed at which the electronic manifest is enacted and hence no compliance date is necessary (Commenter Nos. 54 and 63).

Response:  EPA thanks commenters for their suggestions about the delayed compliance date.  The e-Manifest legislation requires EPA to announce its regulation implementing electronic manifesting within 1 year of enactment of the statute.  The establishment of the system, however, is scheduled under the statute at a date 3 years from enactment of the statute, although the precise timing of system implementation will be highly dependent on funding for the system procurement.  Thus, the uniform date on which access to the system will be available will not be announced in this final rule, but will instead be announced after the system has been developed and has been determined to be ready for production use.  EPA currently plans to announce the delayed implementation date in the subsequent Fee Rule, which will be issued prior to the system's implementation.  However, EPA also emphasizes that e-Manifest rule adoption will be mandatory for all states.  All authorized states must adopt fully consistent regulations that recognize the validity of the electronic manifests that will be obtained from and submitted to the national system. While states will have some latitude to adopt their state law e-Manifest requirements within a reasonable time after issuance of this final rule, the states will not determine the uniform Federal compliance date. EPA will determine the consistent implementation and compliance date for e-Manifest in the Fee Rule, and EPA will initially implement e-Manifest beginning on this date and until the states are authorized.

Comment: We heard from eight commenters that EPA should establish a two-year or greater delayed compliance date for the electronic manifest (Commenter Nos. 17, 25, 29, 35, 51, 57, 59, and 61).  One commenter does not believe that in-place technology at the majority of the affected stakeholders allows implementation of an electronic manifest system within six months of promulgation of the final rule (Commenter No. 25).  Another commenter clarified that, so long as state adoption is mandatory, a two-year compliance date is appropriate for the electronic manifest (Commenter No. 51).

Response:  EPA thanks commenters for their suggestions about the delayed compliance date.  The e-Manifest legislation provides that EPA must publish its final regulation within one year of the statute's enactment, and develop the system within 3 years of that date.  (See response to previous comment).  So, while the final rule may be "legally effective" six months after promulgation of the final rule under RCRA§ 3010(b), as a practical matter, compliance with the system's requirements will not be possible until the system is developed and determined by EPA to be available for use.  The 3 year deadline in the statute for establishing the system represents an ambitious milestone that EPA will endeavor to meet, but ultimately, the date of system development and implementation will depend on sufficient funding for the system procurement.  Within the constraints of the statutory schedule and funding, EPA will make every effort to schedule the system's delayed implementation date so that stakeholders wishing to use e-Manifest will have time to transition smoothly to e-Manifest.  Clearly, there will be a delayed compliance/implementation date, which EPA will announce in the Fee Rule, shortly before the system is ready for use.  We use the term delayed "implementation date" to distinguish the delayed date for compliance and implementation (to be announced in the Fee Rule) from the "effective date," since RCRA § 3010(b) requires that RCRA regulations be legally effective within 6 months of their promulgation.

      1.3	General Questions/Concerns Associated with Automated Systems

Comment:  We heard from one commenter expressing concern that electronic systems may at times be just as unreliable as paper systems (Commenter No. 26).  The commenter stated that hardware, software, and Internet infrastructure problems may cause problems in manifest transmission or outright loss of the manifest.  The commenter asked that EPA clarify the consequences of such malfunctions for all participants in the management system.

We heard from one commenter on the susceptibility of electronic records to natural disasters (Commenter No. 24).  The commenter recommended that EPA acknowledge and anticipate that there may be system failures or natural disasters that cause delays in the submission of the manifest forms.  The commenter proposed that facilities should rely on electronic time stamps for the date of transmission of manifests, so that a problem with electronic sending does not become a compliance issue.

We heard from two commenters on the susceptibility of electronically stored media to deterioration over time (Commenter Nos. 33 and 60).  One commenter stated that digitally signed and electronically stored media are generally protected in storage from those elements that can corrupt the data on the media (Commenter No. 60).  The commenter believes that, through the use of long-term storage of media in controlled environments, data will remain viable.  Another commenter indicated that digitally signed and electronically stored media have significant advantages to paper media, most notably in terms of how much information can be compacted into a very small physical volume and how much cheaper the storage costs become (Commenter No. 33).  The commenter added that, in terms of deterioration over time, they are in fact inferior to paper media, being far more susceptible to corruption/destruction by heat, electromagnetic fields, material degradation.  The commenter suggested several ways to address these concerns (e.g., creation of multiple copies of whatever information is being stored, and the dispersal of those copies to multiple sites).

Response:  EPA thanks the commenters for their observations about the potential risks and problems of an e-manifest that is implemented on the Internet.  EPA agrees that different problems could and likely will occur in the e-manifest, such as loss/corruption of electronic data.  EPA also agrees that problems inevitably occur in the paper-based system, such as loss or destruction of the paper manifest during shipment.  EPA does not expect any approach to eliminate these problems entirely.  Moreover, the paper manifest forms will remain available for instances in which the e-Manifest system is unavailable, and the DOT Hazmat requirement to carry one copy of the manifest on transport vehicles will provide a back-up means to track shipments even if the e-Manifest is corrupted or lost while the shipment is en route.

EPA has decided in this final rule to implement the e-Manifest through its CDX architecture or its equivalent, as described above, which is designed to minimize problems commonly encountered in e-reporting.  Over the years, EPA has gained considerable experience using the CDX in collecting, processing, and storing electronic media under other EPA collections.  We believe the CDX is well-equipped to handle manifest transactions, and EPA will ensure that additional controls are added as appropriate for the e-manifest.  The CDX, as currently designed, includes a range of controls that are intended to address the types of problems raised by commenters.  For example, the CDX utilizes methods for error-checking that flag obvious errors in documents and document transactions, including duplicate documents and unauthorized submissions.  In regard to the susceptibility of electronic media to damage and deterioration, the CDX archives to multiple formats:  hard disk, tape, and optical media.  This use of multiple formats is designed to ensure that degradation of one format would not jeopardize EPA's long-term storage capability for submitted data.  The CDX archives will be written out to an online disk system when they are first created.  They will be copied to an off-line disk system and also backed up to magnetic tape every day, with full backups to tape on a weekly basis.

In addition, the CDX provides other protections against data corruption and loss.  For example, the CDX is designed to incorporate firewall security, in addition to the usual system security provisions to control physical access to the system and prohibit unauthorized internal access.  As transmissions flow through the CDX firewall, they are automatically virus-scanned, and the system would not attempt to process a file that contains a suspected virus.  The server will also be protected with intrusion detection software that alerts the system operators to suspected attempts to penetrate or hack the system.  The system operators will use the logging capability of the firewall and the intrusion detection system to monitor the health and status of the system and respond to unauthorized efforts to use or modify the system.

Comment: We heard from three commenters on procedures for returning the electronic manifest to the generator (Commenter Nos. 6, 16 and 54).  They suggested that the timeframe for the TSD to return a manifest to the generator should be the same for both paper and electronic forms.  One commenter noted that TSDs in its State normally submit paper manifests within seven days and that EPA should consider establishing a seven-day timeframe for the paper and electronic manifest instead of 30 days (Commenter No. 6).  Another commenter also noted that the timeframe for returning a copy to the generator could be reduced (Commenter No. 16).

Two commenters said the rule is not clear on how to address discrepancies on the electronic manifest, but they believe the procedures should be the same for both paper and electronic forms (Commenter Nos. 38 and 39).

Response:  EPA thanks the commenters for their views on returning the electronic manifest to the generator.  EPA agrees with comments that the timeframe for the TSD to return the manifest to the generator should be the same for both electronic and paper manifests.  We do not believe there is a compelling reason to establish different timeframes for forms.  Regardless of whether the manifest is paper or electronic, the TSD will need time to evaluate the shipment against the manifest and, if needed, resolve discrepancies.  In addition, two timeframes would unnecessarily clutter the regulations and complicate the procedures for TSDs.  Under such a dual approach, the TSD would need to establish two sets of procedures, one for returning paper manifests and the other for electronic ones.  In developing the final rule, EPA sought to keep the regulations as simple as possible and avoid placing dual procedures on waste handlers whenever possible.  Therefore, in the final rule, the existing 30-day timeframe at 40 CFR 264.71(a)(2) and 265.71(a)(2) for delivering the manifest copy to the generator applies to both electronic and paper manifests.  However, we expect that in practice, e-Manifest will automate the return of manifests from the TSDs to the generators, and that TSDs will normally be able to return electronic manifest copies to generators much quicker than the 30-day limit in the regulations.   The e-Manifest should thus establish a higher standard of timeliness and accountability than is now possible with paper forms returned through the mail.

This same principle holds true for discrepancies.  We agree with comments that there is no compelling reason to establish different procedures for handling discrepancies or exceptions.  The final rule provides that the existing procedures for discrepancies and exceptions apply to both paper and electronic manifests.  However, as with the 30-day deadline for returning manifests to generators, we expect that in practice, e-Manifest will be extremely helpful to users in flagging possible exceptions and discrepancies for users' attention.  So, the reporting of exceptions and discrepancies electronically in the e-Manifest system should be much more timely and efficient than is possible with the mailing of paper reports and letters.

      1.4	Terms and Conditions Agreement

Comment: We heard from one commenter in response to EPA's request for comment on whether a terms and conditions agreement should be required for e-manifesting (Commenter No. 19).  The commenter supported in principle the promulgation of a rule that sets forth the key terms and conditions for electronic manifesting, as opposed to requiring generators to enter into private agreements with transporters and TSDFs.  The commenter believes such a rule would ensure consistency among State programs, facilitate interstate commerce, and minimize the potential for incompatible waste handler automated systems.

Response:  We thank the commenter for its views on the terms and condition agreement.  We agree that it is not necessary for EPA to require waste handlers to enter into an agreement with EPA on the use of the electronic manifest.  In the proposed rule, we raised the possibility that, under certain regulatory approaches, such an agreement could be warranted.  However, we believe that the final rule approach obviates the need for such an agreement.  First, the final rule sets forth regulations to which all users of the electronic manifest must satisfy in initiating, transmitting, and retaining the forms.  In addition, users must use EPA's Electronic Hazardous Waste Manifest system and transmit the manifest through the Agency's Central Data Exchange (CDX) or equivalent system.  The CDX involves its own set of requirements and procedures with which users much comply.  Finally, 40 CFR Part 3 lays out procedures with which electronic manifest users must comply, such as identity proofing and creating valid electronic signatures.  EPA believes this regulatory framework establishes an effective approach for holding all users of the electronic manifest to the specified standards; as such, EPA believes that no additional agreement with EPA is needed.

      1.5	Alternatives to Traditional EDI

Comment: We heard from 15 commenters suggesting alternative approaches from traditional EDI for automating the manifest system (Commenter Nos. 12, 19, 24, 25, 31, 30, 33, 34, 40, 48, 50, 51, 56, 60 and 61).  A number of commenters suggested alternative web-based approaches, including a State-hosted central web site, an EPA-hosted central web site, or other approach using a simple web form or software program (Commenter Nos. 12, 19, 24, 30, 31, 34, and 48).  One of these commenters suggested that the use of a centralized electronic manifest system based on the Internet and operated at the state level could satisfy the security and interoperability concerns that EPA identifies in the preamble and proposed regulations (Commenter No. 12).  The commenter proposes that EPA adopt the Internet and XML, or plain HTML, as the means for writing and transmission for electronic manifests.  It added that EPA should require the workflow (numbering, and routing) of electronic manifests, and the secure storage of manifest records, to be coordinated from a centralized state operated Internet accessible database.  Another commenter recommends that EPA host a national Internet site to be used by all handlers (Commenter No. 34).  Another commenter stated that an approach using email and/or a File/Transfer Protocol (FTP) would be appealing to waste handlers since they are virtually free (Commenter No. 33).  Another commenter suggested that EPA allow the use of images (e.g., images of signatures or other data elements) in the completion of manifests (Commenter No. 60).  The commenter believes that the use of images (e.g., TIF compressed images) would enable automated systems to interface with manual systems.  Another commenter said that EPA should allow any suitable process for data transfer, including those currently used in commerce (Commenter No. 51).   Another commenter asked that the EPA examine the possibility of adding the electronic manifest to the RCRAInfo databases.  The commenter believes that adding the electronic manifest to the RCRA Info would be more efficient than adding it to each individual state database (Commenter No. 40).  Another commenter expressed concern, however, that an online reporting approach would deposit its facility data into an EPA mandated central database, which would limit its opportunity to store and manipulate data for reporting purposes (Commenter No. 50).  One commenter recommended a locked Word document that cannot be changed, or an interactive PDF format (Commenter No. 56).

We heard from one commenter on the security of Internet EDI (Commenter No. 33).  The commenter believes that ensuring security of Internet EDI comparable to traditional EDI would be fairly easy; however, ensuring comparable levels of auditability is less certain.  The commenter suspects that Internet EDI could meet the overall requirements for authentication and data-integrity.

Response: EPA thanks commenters for their many ideas for alternatives to traditional EDI.  We acknowledge the many suggestions for a web-based e-manifest approach, as well as comments for a centralized (e.g., state or national) system.  We agree with comments that a centralized, web-based system could be advantageous for users.  Among other things, a web-based system will be cheaper and simpler to implement than other commercial options and is widely accessible, as many users already have Internet access and computer systems or portable devices that meet the minimum operating requirements needed to utilize EPA's CDX.  It is EPA's final rule approach that the CDX or equivalent architecture would be established as the Agency's central reporting hub for receiving, processing, and routing the in-bound electronic manifests to waste management entities and to state governments.  The CDX based system (or equivalent) will offer the necessary applications and components to supply, complete, electronically sign, transmit, and retain electronic manifests.   Users, however, will need to supply their own computer devices to access and use the national reporting system.  Finally, EPA notes that the details of system design and the development of the precise electronic formats for the manifest are beyond the scope of this final rule, and will be address in the system planning and development process.

In regard to the comments in favor of XML, EPA agrees that XML offers advantages over other formats.  Refer to Section 2.0 of this document for additional EPA responses in regard to the use of XML for the e-manifest.

      1.6	Participation in Manifest Automation

Comment: We heard from six commenters that expressed support for the proposal to make the e-manifest voluntary for waste handlers  (Commenter Nos. 4, 8, 19, 22, 24, and 38).  These commenters noted the substantial burden and time commitment needed for implementation and believe that smaller companies would have greater difficulty overcoming these challenges.

Response:  EPA thanks the commenters for their views on voluntary participation by waste handlers. EPA agrees that the e-manifest should be optional for waste handlers.  EPA recognizes, for example, that a number of waste handlers might not have the necessary equipment (e.g., a personal computer) to participate.  In addition, other waste handlers may be content with the current paper-based system, or otherwise have made a significant investment in the paper-based system (e.g., investments in personnel training, filing systems), and opt not to participate.  Moreover, the e-Manifest legislation enacted by the Congress provides that the use of electronic manifests shall be at the election of the users.  EPA's final regulation affirms this policy and holds that the use of electronic manifests will be voluntary for manifest users.  The paper forms will remain available for those who wish to continue to complete and process the paper forms.  However, in the final rule, EPA clarifies that it is our ultimate goal to promote the use of electronic manifests to the greatest extent possible. In this regard, the Agency may consider fee incentives or other means to promote this end.

Comment: We heard from 30 commenters who opposed EPA's proposal for States to voluntarily adopt the e-manifest (Commenter Nos.1, 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 29, 31, 32, 35, 36, 43, 45, 46, 49, 51, 53, 57, 58, 59, 60, and 61).  A number of commenters pointed out that less than full State adoption would compromise any intended burden savings to waste handlers, since they would have additional administrative activities, such as maintaining both an electronic and paper system and coping with a patchwork of State programs (Commenter Nos. 4, 5, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 31, 32, 36, 45, 49, 51, 53, 57, and 60).  Many of these commenters believe that, unless it is mandatory, waste handlers would not have an incentive to invest in automated technologies, since State non-participation could make electronic manifesting too burdensome (Commenter Nos. 4, 16, 17, 18, 23, 24, 25, 26, 32, 51, and 60).  Another commenter believes that universal State adoption is in keeping with the Government Paperwork Elimination Act (Commenter No. 57).  Four commenters pointed out that non-participation by States could interfere with interstate commerce (Commenter Nos. 4, 16, 22, and 36).  One of these commenters stated that RCRA section 3006 precludes the Administrator from giving authorization to a state program if such program is not consistent with the Federal or State programs applicable in other States (Commenter No. 4).  The commenter also pointed to 40 CFR 271.4, which provides that any aspect of the State program which unreasonably restricts or impedes the free movement across the State border of hazardous waste from or to other States for treatment, storage or disposal shall be deemed inconsistent.   Another commenter suggested that EPA consider a provision in the State reauthorization program for the evaluation of a State's progress in implementing electronic manifests (Commenter No. 58).

Response:  EPA appreciates the many commenters who are in favor of mandatory State adoption of the e-manifest.  EPA is persuaded by these views, as well as by suggestions from stakeholders at EPA's public meetings, that the e-manifest should be effective, recognized as valid, and implemented consistently in all states.  EPA agrees, for example, that development and use of the e-manifest is not feasible unless it can be assured that the validity of electronic manifests is recognized in all the states.  An IT vendor would not likely assume the risk of system development unless it believed that the electronic manifest would be recognized as valid in all jurisdictions.  Also, a patchwork of state programs differing on whether electronic manifests were available or recognized would unduly complicate interstate transportation and be too burdensome for waste handlers were they forced to comply with both paper and electronic requirements when they crossed state lines.

EPA's final rule requires that all state programs adopt and recognize the validity of electronic manifests through the provisions of 40 CFR 271.4(c) that address state program consistency with the hazardous waste manifest.  This provision states that a state program shall be deemed inconsistent with the federal RCRA program if the state manifest system does not meet the requirements of Part 271.  Moreover, the federal electronic manifest requirements supersede any less stringent or inconsistent requirements that may exist under state law.  In the final rule, EPA deems it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest.  In addition, the e-Manifest legislation and this final rulemaking provide that EPA will implement the e-Manifest in all states on the same implementation date.  EPA implementation and enforcement will continue until such time as each state revises its regulatory program and obtains authorization for the e-Manifest program revisions from EPA.

Comment: We heard from eight commenters expressing that the e-manifest should be voluntary for the States (Commenter Nos. 27, 33, 35, 40, 44, 54, 59, and 63).  Two commenters believe that EPA should hold off on mandating it as the Agency resolves unanswered questions and allows industry and the States to progress on their own (Commenter Nos. 27 and 59).  Another commenter suggested that EPA consider providing funding to States if the e-manifest is mandated, or as another alternative, to add the electronic manifest to the RCRAInfo database (Commenter No. 40). Another commenter stated that States should not be required to automate because some States have their own laws regarding automation (Commenter No. 35).

We heard from nine commenters specifically addressing the implications to State programs under the e-manifest (Commenter Nos. 24, 25, 30, 33, 34, 44, 48, 54, and 59).  Four of the commenters indicated that the e-manifest would place a considerable burden on State programs for such activities as training, modifying existing hardware or software, or making new purchases (Commenter Nos. 30, 33, 48, 54).  One of these commenters suggested that EPA include language in the rule allowing States to have control over this burden (Commenter No. 48).  Another of these commenters asked EPA to clarify the regulatory implications of the e-manifest, given that some States might not adopt it (e.g., what are the regulatory implications if an electronic manifest is transported through a State that has not adopted the e-manifest?)  (Commenter No. 54).  The commenter stated that States do not have the personnel or resources to implement and monitor an electronic manifest system.  Another commenter noted that the rule would limit States' ability to collect additional information on the manifest; this limitation could prevent States from adopting the e-manifest (Commenter No. 34).  Another commenter indicated its support for EPA allocating funds to the States to assist them in developing their electronic manifesting systems in a timely fashion (Commenter No. 25).

Response:  EPA thanks commenters for their suggestion that state adoption of the e-manifest requirements should be optional.  For several reasons, however, EPA does not agree with this view.  As discussed in the response above, EPA believes that uniform state adoption of the electronic manifest requirements is essential for the e-manifest to be successful.  Prospective users of the e-manifest will consider it too risky to undertake unless electronic manifests can be implemented and recognized as valid in all the states.  A patchwork of different state programs would complicate interstate transportation and be too burdensome for waste handlers.  As discussed above, EPA, in this final rule, deems it a matter of RCRA program consistency that all authorized state programs must allow for the use of the national e-manifest system as a valid means of preparing and using the hazardous waste manifest. The 2012 e-Manifest Act in fact mandates this result.

EPA disagrees that mandatory state adoption of the e-manifest will place undue burden on the states or industry.  As an initial point, EPA's national system approach will be much simpler for the states to implement and enforce than the proposed approach.  The final rule approach will be implemented through EPA's own electronic receiving system, the CDX (or equivalent) and user requirements.  In this regard, the final rule approach shifts a substantial burden for developing and implementing the e-manifest from states and industry to EPA, in comparison with the proposed rule.  For example, EPA will be responsible for ensuring that the CDX (or equivalent) is designed to provide the necessary tools, controls, and procedures for users to complete, sign, transmit, and keep records of the e-manifest in a secure environment.  EPA also will be responsible for overseeing CDX operation and maintenance, and finalizing this rule and future regulations to enable e-Manifesting, announcing user fee schedules, and providing clarification to the states on consistent program adoption.  Consistent with the e-Manifest legislation enacted by Congress, EPA will implement and enforce e-Manifest initially, and states will be allowed a reasonable time within which they will be expected to adopt their consistent and equivalent e-Manifest requirements and obtain authorization.  Thus, states will have some latitude to determine when they will assume implementation and enforcement responsibilities for electronic manifests, and EPA will implement the program in the interim. EPA encourages prompt adoption of electronic manifest regulations by the states, so that they might assume primary implementation and enforcement responsibilities by the system implementation date.  If this is not possible, however, the states will have additional time to examine and revise their existing programs to accommodate the final e-manifest regulations, and EPA implementation will continue in the interim.

Beyond this, EPA notes the final CROMERR, published in October of 2005, set forth a framework for electronic reporting that EPA, states, and local governments must follow under EPA's programs.  The rule resolves a number of technical and policy questions related to e-reporting.  It also establishes the procedures and criteria for states to receive EPA authorization for their e-reporting initiatives.  As such, EPA expects that states have already begun to consider changes to their programs to enable electronic reporting in response to CROMERR and that they are therefore well-positioned to adopt the e-manifest.

We also note that final rules under the Hazardous and Solid Waste Amendments of 1984 (HSWA) normally go into effect in all states immediately after a six-month period following rule publication.  The EPA Regions administer HSWA rules until State RCRA programs get authorized for them.  We believe the States have worked effectively in coordinating and assuming their responsibilities under these HSWA rules.  We are therefore confident that under the similar Federal/State implementation scheme included in the statute for e-Manifest, the states will be similarly effective in transitioning to the final rule's e-manifest requirements.

Comment: We heard from two commenters supporting EPA's position that the States should not be allowed to modify the electronic manifest form or procedures (Commenter Nos. 49 and 61).  One of the commenters recommended that proposed 40 CFR 271.10(f) be strengthened as follows:  "...No other electronic manifest format or information, other than that required by federal law, may be required by the State as a means to identify electronically the generator, transporter, destination facility, quantity, composition, discrepancies, origin, routing, destination of, or other information about a hazardous waste shipment during its transportation from the point of generation to the point of storage, treatment, or disposal" (Commenter No. 49).  The other commenter agreed that State variations in the electronic manifest form or procedures could hinder interstate commerce (Commenter No. 61).

Response:  EPA thanks the commenters for their views.  EPA agrees that participants in the e-manifest should not be burdened by additional or inconsistent State requirements for completion, transmission and recordkeeping of the electronic manifest.  To address this, the final rule, at section 271.10(f)(1), states that with respect to manifests, "no other manifest form, electronic manifest format, shipping paper, or information other than that required by federal requirements, may be required by the state to travel with the shipment, or to be transmitted electronically, as a means to track the transportation and delivery of hazardous waste shipments."  This consistency requirement extends as well to the electronic signatures that may be executed in connection with electronic manifests.     Section 271.3(b)(4) of the final rule further states that any requirement applicable to the content and use of electronic manifests, including electronic signature requirements, and imposed under the authority of the 2012 e-Manifest Act, "shall supersede any less stringent or inconsistent provision of a state program."  EPA believes that these final rule requirements should be effective in preventing the states from placing additional requirements on e-manifest participants beyond what is required by the federal program.  In addition to this, as described earlier in this document, EPA will be responsible for designing, developing, and operating the national e-manifest system.  As such, EPA will have sole control over the content and appearance of the e-manifest that will be available on the national system, the information collected on it, and the procedures for its use.  We also note that EPA and our state partners have already had more than 5 years of experience with implementing the standardized hazardous waste manifest format that was announced in the March 2005 Manifest Revisions Rule.  Implementation of the new manifest form has proceeded smoothly for several years, and the States have accepted the uniformity of the manifest data elements.  We do not anticipate a different experience with a standardized electronic manifest format.

Comment: We heard from five commenters asking for clarification on, or changes to, the proposed procedures for transporters that do not automate (Commenter Nos. 4, 12, 17, 54, and 59).   One of the commenters asked for additional guidance on how waste handlers could continue to use electronic manifesting in cases where the transporter does not participate (e.g., how should the electronic manifest record that the transporter's signature is provided on the hard copy manifest?) (Commenter No. 17).  The commenter also asks for clarification whether waste handlers must retain the hard copy signature for compliance purposes.  Two commenters noted that the following sentence should be corrected:  "In such a case, the transporter could provide the generator with a hand-signed copy of manifest" (Commenter Nos. 54 and 59).   They indicated that it should read as follows:  "In such a case, the generator could provide the transporter with a hand-signed copy of the manifest."  Another commenter believes that proposed 40 CFR 264.71(a)(4)(i) should be revised by adding the clause "which bears the manifest tracking number" after the words  "or other shipping paper under 49 CFR part 172, subpart C" (Commenter No. 4).  Another commenter noted that proposed 40 CFR 264.71(a)(4) and 265.71(a)(3)(v) seem to indicate that only the electronic copy of the manifest is required to be retained by the TSDF for three years, even though the signature of the transporter was manual and would not be recorded electronically (Commenter No. 12).  The commenter asked for clarification on whether the TSDF has a requirement to retain a paper copy of the transporter's signature when the transporter has not electronically signed the manifest.

Response:  EPA thanks commenters for their suggestions on the procedures for transporters that do not automate.  We also appreciate commenters' suggestions for improving the preamble text.  After consideration of all the comments, and considering the complexity entailed by the proposed approach, EPA has made certain revisions for the final rule.  For the final rule, all waste handlers shown on the manifest must be able to participate electronically, if they wish to complete and use the electronic manifest to track their waste shipment.  Thus, the involvement of a non-participating transporter in a waste shipment would present a bar to using the electronic manifest.  If any party to the manifest is not able or willing to prepare and transmit manifest information electronically, then the manifests for their hazardous waste transactions must be executed with the standard paper forms.  However, generators may participate in e-Manifest using the portable computer or device provided by the transporter servicing a generator's waste.  Indeed, we expect that many electronic manifest transactions will be executed in this manner.

The proposed rule would have required copies of printed manifests to have been provided for non-participating transporters, and would have required attestations of receipt and other handwritten notations to have been entered to describe the circumstances of the other parties' electronic signatures.  Each non-participating transporter would have been required to retain a marked up hard copy in its files, and an additional hard copy with all the attestation and signature information would have been provided to the designated facility for forwarding to the e-Manifest system operator.  EPA concluded that the burden of complying with these additional paperwork requirements would override any benefits from recording a part of the transaction electronically.  Therefore, we are omitting the proposed special e-Manifest tracking requirements for non-participating transporters. While this result may preclude some transactions from being executed electronically, we believe that the burden and complexity associated with the procedures discussed in the proposed rule for involving non-participating transporters in e-Manifest were too great to retain in the final rule.

Comment: We heard from 13 commenters regarding the requirement for automated transporters to carry a paper shipping paper in transport (Commenter Nos. 15, 17, 21, 22, 26, 33, 34, 35, 37, 48, 49, 52, and 54).   One of the commenters expressed concern that the paper copy of the manifest might be confused with the electronic copy for purposes of RCRA recordkeeping purposes (Commenter No. 17).  The commenter asked EPA to provide additional guidance on how a waste handler can use both a paper and electronic copy for various DOT and RCRA compliance purposes.   Another commenter asked for EPA to state more clearly that a shipping paper would be required in lieu of a paper manifest when electronic manifests are being used (Commenter No. 33).  Four commenters asked EPA and/or DOT to eliminate the option to satisfy the DOT shipping paper requirement with any shipping document besides a hardcopy manifest (Commenter Nos. 15, 35, 49, and 54).  Two of them point out that the manifest contains additional information designed to protect the environment (Commenter Nos. 35 and 54).  One commenter indicated that its State program was designing an e-manifest system that would require submittal of a paper copy of the manifest to the State because it would include handwritten notes and signatures that were applied to the paper copy during transport (Commenter No. 48).  The commenter expressed concern that EPA's approach would not provide for collection of this paper copy and, hence, States would not receive the actual signatures or additional notes that might not have been included in the electronic copy.  Three other commenters expressed concern that the preparation of an electronic manifest and hardcopy shipping paper would jeopardize the goals of the proposal (e.g., burden reduction, streamlining the manifesting process) (Commenter Nos. 26, 34 and 37).   A number of commenters urged EPA to continue coordinating the e-manifest approach with DOT on relevant issues (Commenter Nos. 15, 17, 21, 22, 49 and 52).

Response:  EPA thanks commenters on the requirement for transporters to carry a paper manifest. While it is the intent of EPA's final e-Manifest rule to eliminate as far as possible the reliance on the preparation and retention of paper records in connection with tracking hazardous waste shipments, it is not possible at this time to eliminate all paper documents that are required in the course of transporting hazardous wastes.  As we explained in the May 22, 2001 proposed rule (see 66 FR 28268), it will still be necessary to carry a printed copy of the manifest on the transport vehicle during the transportation of hazardous wastes that are subject to the hazardous materials regulations, since DOT requires that a hard copy of a shipping paper be carried on transport vehicles for shipments of hazardous materials, unless otherwise excepted.  For shipments that involve state-regulated wastes subject to a manifest requirement rather than RCRA-regulated hazardous wastes, EPA is clarifying further that consistency in the use of the manifest under RCRA also requires that a print-out of the manifest must be carried on the transport vehicle during the transportation of these state-regulated waste shipments.  The adoption of the electronic manifest option in the final rule does not alter or eliminate the existing DOT hazardous materials requirements and RCRA consistency provisions respecting shipping papers and the manifest.

EPA has consulted extensively with DOT on this requirement, and we are aware that the Department is planning during 2013 a pilot program (HM Access) to explore the use of electronic shipping papers for hazard communications among its stakeholders.  It is thus possible that DOT will revise the Hazmat regulations (HMR) in the not too distant future to support an entirely paperless shipping document.  Therefore, to accommodate better these possible changes to the HMR, the final rule addresses this issue by clarifying that the paper copy of the electronic manifest must be carried on the transport vehicle: "to the extent the Hazardous Materials regulation on shipping papers requires shippers of hazardous materials to supply a paper document for compliance with 49 CFR § 177.817." See 40 CFR § 262.24(d) and § 263.20(a)(4)(iii).  At such time as DOT permits an electronic shipping paper to meet its HMR requirement, our regulations will likewise authorize a fully paperless manifest without further amendment.

While the requirement to continue to supply a printed copy of the manifest for the transport vehicles may appear to frustrate somewhat the attainment of a totally paperless manifest system, we have strived in the rule to minimize as far as possible the requirements to carry and maintain paper documents.   Despite the continuing need to supply this printed copy of the manifest, we believe that there will still be substantial reductions in paperwork burdens and forms/data processing costs for manifest users and regulatory agencies as a result of this final action.  Moreover, the supplying of one paper copy on the transport vehicle provides a convenient back-up copy of the manifest data in the event the e-Manifest system becomes unavailable during transport or the electronic format becomes lost or corrupted.  Finally, the implementation of the electronic signature approach for the initial e-Manifest system may be aided by the provision of one paper copy that could be simultaneously signed in ink while digitized handwritten (electronic) signatures are also collected.  That issue is discussed below in another comment response.

Comment: We heard from two commenters expressing concern about the signature provisions for transporters that do not automate (Commenter Nos. 34 and 35).  One commenter expressed concern that the transporter's signature would not be on the electronic manifest (Commenter No. 35).  The commenter said states require the transporter's signature to be on each manifest copy it receives.  Another commenter expressed concern that a one-time manual signature could be used to represent several waste shipments (Commenter No. 34).

Response:  EPA thanks commenters for expressing their concerns about the signature provisions for non-participating transporters.  However, in the final rule, EPA requires all waste handlers named on the manifest to be willing and able to execute the manifest electronically. Therefore, the concerns raised in these comments about non-participating transporters and their signatures not being recorded electronically are now moot.

In regard to a transporter's signature, EPA shares the commenter's concern that a digitized handwritten signature could be copied onto multiple manifests.  For this reason, the final rule requires the digitized signature to be implemented to capture only dynamic signatures and to prevent the replay of signature copies.  Based on the methods used by document examiners to analyze such electronic signatures, a replay or exact copy of a previous signature would be easily detected on examination and thus identified as a forgery.  Refer to 40 CFR 262.25(b)(1)(ii) of the final rule.

Comment: We heard from four commenters expressing concern about the proposed procedures for generators that do not automate (Commenter Nos. 34, 35, 54, and 59).  Three commenters were concerned that the rule does not specify the transporter's timeframe for providing a generator with a signed paper copy in instances when the generator signs an electronic manifest using a portable device provided by the transporter (Commenter Nos. 35, 54, and 59).  These commenters believe the transporter should provide a copy to the generator at the time of shipment/signature.  It should not be allowed to transmit a signed copy after it has left the generator's site.  One of the commenters also suggested that EPA should clarify that the TSDF must provide the generator with a signed paper copy of the manifest if the generator is not equipped to receive an electronic acknowledgment of receipt, comparable to the procedures for paper copies (Commenter No. 59).  Another commenter expressed concern that the rule allows for too many electronic transaction scenarios, which could cause compliance difficulties (Commenter No. 34).  In particular, the commenter disagrees that small waste handlers should have access to the e-manifest if they cannot afford it.  Rather, the commenter believes the proposal should be specifically designed for handlers involved with large numbers of shipments.  The commenter also noted that the rule would allow an automated generator to hold a non-automated transporter's signature on file, whereas an automated transporter would be required to acquire a signature from a non-automated generator; the commenter asked for clarification on why these procedures are different.  Another commenter asked EPA to clearly describe what would be required of generators, transporters, TSDFs, and States when one or more of them cannot automate (Commenter No. 54).

Response:  EPA thanks commenters for their views on the need for generators to have immediate access to their electronic manifests.  EPA agrees with their concerns.  As described in greater detail elsewhere in this document, EPA plans to host the e-Manifest system on the Agency's Central Data Exchange/Exchange Network architecture (or equivalent) which EPA established to support the electronic reporting of the various environmental reports and documents that are required for compliance with EPA's environmental programs codified in Volume 40 of the Code of Federal Regulations.  The CDX is an electronic gateway to which all electronic users of the manifest will have access.  In regard to comments that the automated generators should have access to manifests that they sign in a transporter's portable device, EPA is clarifying that all electronic manifests will reside in the CDX and be available to all waste handlers involved in its shipment in real time or near real time.  There may be a brief period of time during which the manifest transaction data may be stored on the handheld device used to collect manifest data and signatures in the field, and then uploaded later to the network and e-Manifest system.  Each generator and other waste handler would have an account on the e-Manifest system, and the system would provide the generator's electronic copy to the generator's account at the time of delivery to the transporter, or very soon thereafter.  Thus, we do not agree with the comment indicating that a generator must be provided with a paper copy at the time the hazardous waste is delivered to the transporter.  Of course, if a generator indicates a preference for a paper copy, and the transporter is willing to provide such a copy as an accommodation for the generator, then the provision of the paper copy is permissible, but not required.

EPA also is clarifying that a generator would not have a transporter's signature "on file."  All automated users, including transporters, would have two options for signing an electronic manifest: a digitized handwritten signature or a witnessed PIN/password.  The transporter would be required to witness the generator signature and obtain proof of identity from the generator in order to use a PIN or password signature, or, waste handlers could sign with a high quality digitized signature product as discussed in the preamble of the final rule.  EPA is confident that its regulations impose effective control over the authenticity of transporters' signatures.

EPA shares the commenter's concern about multiple user scenarios under the e-Manifest.  We agree that too many user scenarios could make the system unnecessarily complicated.  At the same time, EPA heard from many stakeholders that the system should be flexible enough to accommodate the typical arrangements that exist among generators, transporters, and designated facilities in the manifesting cycle, which can vary.  We believe we have struck an appropriate balance in the final rule.  The rule clarifies that the manifest can be executed electronically only if all waste handlers can participate in the e-Manifest in accordance with the provisions of the final rule. However, we also address the common scenario under which a generator would not have its own computer equipment available, but would participate in e-Manifest by using portable devices supplied by the transporter or designated facility.  These are the basic user scenarios contemplated by the final rule.

In regard to the commenter's concern that small businesses would be required to automate, the final rule provides that use of the e-Manifest is voluntary.  In addition, the rule allows generators to execute their electronic manifests using the initial transporter's portable devices.  Small transporters may continue to use the paper manifest for their hazardous waste shipments, should these transporters conclude that the use of electronic manifests is not cost-effective for them.  In this respect, EPA believes that sufficient flexibility exists to enable small generators and transporters to automate if they so desire or to keep manifesting their shipments with the traditional paper forms method.

Comment: We heard from four commenters on alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 16, 26, 51, 57, and 59).  One of the commenters noted that companies would prefer to have the authority to use imaging technology to store copies of manifests so they can reduce their warehousing costs (Commenter No. 59).    Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51).  The commenter suggested that waste handlers could place their electronic manifests onto the centralized repository for access by stakeholders.  Another commenter asked EPA to enable the use of Access as a back-end database that will be supported by the Internet Forms and Action Works Metro (Commenter No. 26).

Response:  EPA thanks the commenters for their suggestions on manifest storage.  EPA believes it is important for all electronic manifests to be completed, transmitted, and retained within the national e-Manifest system. Therefore, the final rule provides that any requirement in the regulations for a generator to keep or retain a copy of each manifest is satisfied when the generator retains a copy of an electronic manifest in its e-Manifest account for the same retention period as required for paper manifest records, provided that specified provisions are met.  Among other things, the rule provides that electronic manifest copies are retained by a generator when the generator can store, access, and retrieve all of the generator's electronic manifest records from an account or record collection established for the generator on the EPA Electronic Hazardous Waste Manifest System. In addition, all paper and electronic manifests will be collected, held in a central repository and made available to stakeholders (e.g., regulators), as specified.  EPA notes that the use of particular imaging technologies or database applications is beyond the scope of this final rule, and will be addressed in the system planning and procurement.

2.0	Standard Electronic Formats

      2.1	Proposed EDI Format

Comment: We heard from four commenters who supported the use of Transaction Sets 856 and 861 (Commenter Nos. 17, 19, 33, and 51).  One of these commenters, however, encouraged EPA to explore more ways to collect the information on one transaction set (Commenter No. 19).  Another commenter suggested that the sets should be tagged with unique labels so the data can be matched (Commenter No. 51).  The commenter asked EPA to define the data tags as well as the electronic data transfer standards; this will allow for the development of software that will be compatible and have longterm viability.  The commenter also suggested that EPA allow vendors to bundle their other service features such as profiling.  Another commenter noted that having two transaction sets should not be complicated for waste handlers (Commenter No. 33).

We heard from one commenter who asked for EPA to allow the use of EDI protocols currently used by the rail industry to transport hazardous materials (Commenter No. 46).  The commenter pointed out that the rail industry uses transaction sets in compliance with the American Institute (ANSI), Accredited Standards Committee (ASC) X12, and Transportation Data Coordinating Committee.  These transactions sets consist of 404 (TDCC Bill of Ladings), 858 (ANSI Bill of Lading), 417 (TDCC Car Movement Waybill), 418 (TDCC Interchange Consist), 997 (TDCC Acknowledgments), 824 (ANSI Acknowledgments), and 998 (TDCC Cancellation).  The commenter suggested that requiring the railroads to use new protocols could discourage them from transporting hazardous waste.

Response:  EPA thanks commenters for their support and suggestions for the EDI approach for the manifest.  For several reasons, however, EPA will likely offer XML, rather than EDI, as the means for transmitting information over the national system.  Over the past several years, CDX development has reflected a significant evolution in formatting standards to accommodate the Internet - away from EDI and toward the use of XML.  XML consists of a set of predefined tags and message structures that, like EDI, allows machine-to-machine exchange of data in a mutually agreed upon format, enabling exchange of data across different systems.  However, unlike EDI, XML is tailored to Internet-based communications and security protocols.  Additionally, an XML formatted file in combination with a style sheet can be displayed in a web browser.  Such features would allow the CDX to use the same standard formats both for exchanging data files and for designing web forms that would maintain the appearance of manifest forms.  The structure of XML also addresses some of the challenges in archiving data received, because the XML tags that accompany the data in an XML file can be used to interpret the datas' context without the aid of additional software.  This could facilitate the recovery of data from archived files, and reduces the need to maintain the versions of the software originally used to generate the files.

At the time of the issuance of this final rule in late 2013, XML remains the preferred language for data exchange via the Internet, and thus is likely to be the data exchange language EPA will employ in the first generation e-Manifest system.  As data exchange languages and methods evolve, however, it is possible that e-Manifest might migrate to another data exchange language or method.  This is a system development and implementation issue rather than an issue to be addressed by regulation.

EPA will, however, endeavor to support exchanges of data between e-Manifest and the rail system's electronic waybill system, which relies on the EDI transaction sets described above for data exchanges within the rail system.

Comment: We heard from one commenter who asked if the EDI database would be available to EPA on demand for inspection (Commenter No. 13).  The commenter stated that, if so, it would need a proprietary system for outside the firewall.

Response:  EPA thanks the commenter for its question.  As discussed above, EPA's currently preferred system development approach does not involve EDI.  Rather, it would involve the use of XML via EPA's central receiving system, i.e., the CDX.  In this regard, industry participants will not need to establish proprietary systems to maintain their e-manifests, since EPA and state inspectors will have direct access to them via the CDX.  The final rule only provides that the electronic format supported by the national system is the standard electronic format required for electronic manifesting, and we do not specify by regulation a particular data exchange language or format.

Comment: We heard from one commenter in response to EPA's request for comment on how signatures would be applied to manifest data inputted from a browser to a web site that translates the data into an EDI compliant format (Commenter No. 33).  The commenter stated that the signature would be digitally applied, no matter what form the original "signature" took.  The exact nature of how the user would sign the document, whether it is by digital signature or secure digitized signature, would depend on the system involved.  The commenter believes that encryption would provide a reasonable level of security and authentication.

In response to EPA's request for comment on whether it is the HTML document or the X12 document that would be signed, the commenter stated that, on a technical level, it is the HTML document that should be signed, since the signer never actually "sees" the X12 document.  The commenter added, however, that the signature would have to accompany the X12 document in some fashion.

In response to EPA's request for comment on whether the translation at the server would complicate the verifiability of any digital signatures, the commenter stated that this would be unlikely, given the current state of the technology and assuming that reasonable thought went into the type of digital signatures being used.  The commenter stated that encryption algorithms exist which allow for a great degree of error correction.  The commenter does not believe that it would be that complicated to routinely check transmissions received for translation errors.

Response:  EPA thanks the commenter for its question.  As discussed above and elsewhere in this document, EPA's preferred system approach does not involve EDI.  It would involve the use of XML through EPA's electronic receiving system, i.e., the CDX or equivalent system.  Likewise, our final rule will not initially require digital signatures as the method for signing electronic manifests, so the comment addressed to verifying digital signatures is moot.  These comments raise technical issues that are beyond the scope of this final regulation.

      2.2	Proposed Internet Forms Format

Comment: We heard from 10 commenters expressing support for the proposed use of XML in automating the manifest cycle (Commenter Nos. 12, 17, 19, 25, 30, 31, 33, 35, 48, and 51).  A number of these commenters noted that XML is more cost-effective than EDI, which could encourage its use (Commenter Nos. 31, 33, 35, 48, and 51).  One of the commenters pointed out that a web-based approach also will allow easy additions of features and upgrades (Commenter No. 31). The commenter asked EPA to clarify how EPA proposes to store web-based forms.

We heard from one commenter who said that the rail industry currently uses EDI and that, due to security reasons, the railroads would be less likely to interchange records with customers over the Internet (Commenter No. 46).  The commenter recommended limiting the proposal to EDI.

Response:  EPA thanks commenters for their support of the web forms approach for the manifest.  EPA agrees that there are a number of benefits to an approach relying on XML and web based data exchanges. As discussed above and elsewhere in this document, the CDX or equivalent national system will likely employ schemas and style sheets developed in XML for the electronic exchange of e-manifest data.  EPA will also endeavor to develop an interface that will enable e-Manifest data to be exchanged with the rail system's electronic waybill system.  However, the specification of a particular data exchange language or particular schema/electronic format for the manifest is a system development issue that is beyond the scope of this final regulation.

Comment: We heard from four commenters suggesting clarifications or modifications to the proposed Document Type Definition (DTD) (Commenter Nos. 12, 30, 32, and 33).  One commenter suggested that the final rule should include a more up-to-date XML Schema, rather than the XML DTD as proposed, due to its richer format (Commenter No. 32).  The commenter also suggested that EPA consider use of a name space to distinguish the DTD from other DTDs that may be developed in the future, as well as the addition of other data elements.  Another commenter asked whether EPA would draft a DTD to be the equivalent of the ASC X12 861 data set (Commenter No. 30).  Another commenter suggested that co-development of the XML schema between EPA and stakeholders will ensure the manifest is compliant with other XML systems in development (e.g., systems being developed by the United Nations, the Department of Defense, and other government organizations) (Commenter No. 12).  The commenter believes that use of a common XML framework will allow vendor neutral access to the information.  Another commenter suggested that, if feasible, EPA should develop a Document Type Definition to set the standard for any XML usage with respect to the manifest (Commenter No. 33).

Response:  EPA thanks the commenters for their many suggestions on the XML schema and stylesheets.   As explained in previous comment responses, EPA currently prefers an XML schema and stylesheet as the electronic format for the electronic manifest, and will likely develop the first generation system with support for such a schema and stylesheet.

Because there will be only one national e-Manifest system established under the final rule, it is not necessary to promulgate the electronic manifest XML schema and stylesheet as a part of this rule notice.  Rather, the development of the schema and stylesheet will be included in the system design requirements for the IT contractor(s) selected to build and operate the e-Manifest system.  This final rule does not stipulate the use of a specific schema or data exchange language for e-Manifest, but only states that the electronic format supplied by the national e-Manifest system will be the exclusive electronic format recognized by EPA for exchanging manifest data.  Thus, the rule remains technology neutral with respect to the precise schema, data exchange language, or electronic format that will be used in the national system design.

Comment: We heard from one commenter who asked EPA to enable the use of Access as a back-end database that will be supported by the Internet Forms and Action Works Metro (Commenter No. 26).

Response:  EPA thanks the commenter for its suggestion.  Obviously, it has been many years since EPA conducted the pilots that involved Internet Forms and Action Works software.  Many such applications are available as we consider the development of the national system in the coming years.  As described above, EPA will task a vendor to develop the e-Manifest system in accordance with EPA's technical requirements and stakeholder input.  EPA conducted several requirements meetings with stakeholders in February  -  March 2013, and we will continue this outreach as we continue with the system planning and development efforts.   These design issues are beyond the scope of this final regulation.

3.0	Electronic Record System Controls and Procedures

      3.1	Validation of System Performance and Training

Comment: We heard from three commenters who expressed support for the proposal to require an independent audit of the electronic manifest system (Commenter Nos. 19, 30, and 33).  One of the commenters supported an independent audit if the waste handler does not use off-the-shelf software, and suggested that EPA provide a list of approved, commercially available off-the-shelf packages that, if properly installed and used, would meet all of the validation requirements (Commenter No. 19).  Another commenter supported the written assessment, but asked if there is guidance or checklist for the certification (Commenter No. 30).  Another commenter believes the proposed approach is reasonable, provided it can be implemented in a reasonably efficient and cost-effective manner that does not impose any undue hardship on smaller handlers (Commenter No. 33).  The commenter believes the off-the-shelf alternative approach could meet with some resistance from larger companies, which would not want to buy off-the-shelf software.  They also might not want to use third-party vendors because they have in-house resources and expertise.  The commenter believes that, in the case of off-the-shelf software and systems developed independently of waste handlers, third-party validation would probably still be necessary, if only to insure that the independent developers were doing their job correctly and that the waste handler was using the products correctly.

Response:  EPA thanks the commenters for their many views on validation of system performance and training.  In the May 22, 2001 proposed rule, EPA proposed specific types of computer system security controls.  These security controls were proposed at section 262.26(c) of the proposed rule and were meant to ensure the authenticity and integrity of electronic manifest data, to avoid repudiation of manifests created on electronic systems, and to ensure the consistent and reliable processing of manifests by the various electronic systems that may have arisen under the proposed rule.  The proposed rule assumed that private entities would develop various electronic manifest systems adhering to EPA's standards, so it was necessary to require inspector access to both the manifest copies and the electronic manifest systems so that EPA could inspect the manifests and the private systems for compliance.

EPA acknowledges that these system security controls were quite detailed, and that if implemented, they would have had considerable impact on any private entities that might have developed electronic manifest systems under the proposed rule approach.  EPA believed it was necessary to specify these controls, and to validate and certify through written assessments that they had been implemented successfully, to provide some floor level of consistency and security in the design and operation of the "decentralized" electronic manifest systems anticipated by the proposed rule.  At the time the proposed rule was developed, there was much concern that the decentralized approach might foster the development of numerous proprietary systems that would be incapable of communicating with each other, and that this approach might result in inconsistent and insecure systems with questionable ability to produce reliable and enforceable data. So, the proposed security and processing controls were intended to ameliorate this concern by addressing what we felt were a necessary floor set of controls to define a minimally acceptable level of consistency, data integrity, and system security for the various private systems that might have developed under the proposed rule.

Based on stakeholder input and further consideration, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option had changed to the  establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  After consideration of public comments and the requirements of the 2012 e-Manifest Act, EPA's final rule decision is to establish such a national or centralized system.

Since EPA has decided to adopt a centralized system approach for the e-Manifest system, it is no longer necessary to promulgate regulatory security controls in order to assure a floor level of consistency and security among various private systems.  Because there will be one national e-Manifest system developed to host the transmission of electronic manifests, the system security requirements for e-Manifest will instead be planned and addressed under the security planning requirements that apply to all Federal information systems.  The Federal security planning requirements will produce a detailed set of requirements and controls appropriate to the security impacts of e-Manifest, and these requirements and controls will be implemented when the Agency awards a contract to an IT vendor to build and operate e-Manifest.  EPA believes it is far more sensible to develop the e-Manifest system security requirements and controls in this manner than to promulgate regulations that would codify the system security controls.  The Federal information system security planning requirements and process are set out in several publications of the National Institute of Standards and Technologies (NIST).  Taken together, these publications describe a well thought out and understood process for determining appropriate security controls, for monitoring the effectiveness of the controls and identifying vulnerabilities and needed corrective actions, and for periodically certifying and accrediting the security of an information system.

Therefore, in lieu of codifying system security requirements for the electronic manifest in the final rule, EPA will instead follow the guidance presented in NIST Publications and other Federal information technology and systems security guidance.    Over the period of operation of the e-Manifest system, the requirements and controls developed pursuant to this guidance will be monitored, adjusted as necessary, and certified.  EPA believes that this approach will be a far more responsive and effective means to address the security of e-Manifest than the regulatory requirements that we proposed in May, 2001.  The criticisms and concerns that commenters identified with the proposed security standards are mooted by the approach we are following in this final rule.  The particular security requirements for e-Manifest will be addressed as part of the system planning, development, and certification processes, and are not included in the scope of this final rule.

Comment: We heard from nine commenters who expressed opposition to the requirement for a third-party assessment (Commenter Nos. 5, 12, 13, 17, 22, 26, 46, 51, and 57).  One of the commenters suggested that the entity developing the system should assume all liability for the operation of the system (Commenter No. 5).  Another commenter believes that, rather than an independent assessment, EPA should simply establish standards that require accuracy, security, and reliability (Commenter No. 17).  Three commenters expressed opposition to the requirement that the software be developed by an independent firm that is not a waste handler (Commenter Nos. 17, 22, and 26).  One commenter strongly disagrees with the suggestion that the use of a commercial electronic manifest software package should be a rule requirement (Commenter No. 57).  Several commenters believe that companies should be given the option to validate their own systems instead of a third-party assessment (Commenter No. 13, 22, and 51).  Two of these commenters do not believe that there should be any credentials for persons who conduct the self-audit (Commenter Nos. 22 and 51).  Several commenters noted that most commercial TSDFs already have controls in place for their paper-based manifesting and recordkeeping and that these controls would be used under the proposal; hence, EPA need not impose any additional controls on these facilities for electronic manifests (Commenter Nos. 12, 22, and 57).   One commenter indicated that, if the requirement for a third-party assessment remains in the rule, EPA should also require regulatory agencies to become subject to similar system assessments and management protocols with evaluation by independent third parties.

Response:  EPA thanks the commenters for their views on the proposed validation of system performance and training.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Comments on the proposed system controls are now moot.  Please refer to the EPA response above for further information about the security requirements that will be implemented pursuant to Federal information technology standards and guidance.

Comment: We heard from ten commenters suggesting clarifications or modifications the proposed approach for an independent assessment of the electronic system or use of off-the-shelf software (Commenter Nos. 16, 29, 30, 32, 33, 34, 54, 57, 59, and 63).  A number of commenters suggested that EPA clarify the criteria or standards by which the electronic system would be assessed and/or the qualifications that the third party must satisfy (Commenter Nos. 30, 32, 33, 54, 57, 59, and 63).  One of these commenters suggested that there needs to be a standard whereby only licensed systems professionals can perform the validation assessments, and that such licensing would require some training and certification (Commenter No. 33).  One commenter suggested that the proposed electronic manifest form should be reviewed by a professional printer to ensure that design problems are eliminated, because computer designed forms often lack consistency in layout when printed (Commenter No. 16).  Another commenter suggested that, like printers of paper manifests, software developers should be required to register to develop manifest software (Commenter No. 29).  The commenter suggested that registration of software packages would ensure that they meet the standard content and data mapping required for Federal and State databases.  Another commenter suggested that, if EPA finalizes the proposed approach, it should require regulatory agencies to become subject to similar system assessments and management protocols with evaluation by independent third parties (Commenter No. 57).  Another commenter asked EPA to clarify the enforcement and liability issues associated with the proposed validation standards (Commenter No. 34).

Response:  EPA thanks the commenters for their views on the proposed validation of system performance and training.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest in fact mandates this approach.  Comments on the proposed private system security controls, including the comment about an independent assessment of private systems, are now moot.  Please refer to the EPA response above for further information.

      3.2	The Ability to Generate Accurate and Complete Records Available for Inspection

Comment: We heard from two commenters who indicated their general support for the proposed requirement for manifest systems to have the ability to generate accurate and complete records available for inspection (Commenter No. 22 and 46).   One of the commenters suggested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g., the next working day) (Commenter No. 22). The commenter believes this revision will help in those instances where a company's "knowledgeable person" is not immediately available (for whatever reason) or the computer system is temporarily offline.

We heard from one commenter who did not express support or opposition to the proposed requirement, but suggested that EPA coordinate the requirement with DOT to ensure that the security issues can be resolved within both programs (Commenter No. 47).

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop the national system with security controls appropriate under Federal information technology standards and guidance.  Comments on the proposed system controls for private systems are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from seven commenters asking for clarification or modification of the proposed requirement for manifest systems to have the ability to generate accurate and complete records available for inspection (Commenter Nos. 13, 22, 26, 32, 46, 59, and 63).  One commenter indicated that railroads do not generally provide access to their computer systems to outside parties; however, railroads are willing to work with EPA to provide the information requested within a reasonable timeframe, but not necessarily on an immediate basis (Commenter No. 46).  The commenter also indicated that EPA should not expect to access railroad computer systems directly; rather, EPA should allow persons knowledgeable with the computer software to access and produce those records for them.  Another commenter indicated that the proposed rule mentions the need to provide an interface for a regulator to be able to access the system that supports digital manifesting (Commenter No. 32).  The commenter suggested that the rule should clarify whether this interface is a required element of a conforming system, or simply a desired functionality.  The commenter notes that, if a regulator interface is indeed required, far greater detail needs to be provided regarding how such an interface would work and what its components would need to include.   Another commenter noted that the proposed rule would require a person on site who can assist a RCRA inspector with operation of the software (Commenter No. 26).  The commenter suggests that this requirement should not be construed to require a person to be available at all times.  Another commenter recommended that both the electronic on-screen view and the paper copy of the manifest printed by inspectors should be required to match the standard paper manifest form so inspectors can view manifest information in the same "format" at every waste handler (i.e., the computer screen and any printed copies of the electronic manifest information should look just like the standard paper manifest form) (Commenter No. 59).  Another commenter indicated that some utility companies with wide service territories may choose to maintain their electronic records for each facility at a more central location as opposed to the facility itself (Commenter No. 22).  The commenter suggested that EPA should consider requiring that all records be made available within a certain timeframe of their request (e.g., the next working day). One commenter noted that, if the EDI database would be available to EPA on demand for inspection, it would need a proprietary system for outside the firewall (Commenter No. 13).  Another commenter asked that the final rule provide further clarification regarding the issue of inspections of electronic records (Commenter No. 63).  The commenter believes EPA should include a requirement for waste handlers to print out a one or two line "summary report" of electronic manifest activity.  The commenter believes this should be required on a weekly basis so that if a system is down, or if the contact person is not available, the inspecting entity would still have manifest information.

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Information security controls will be developed in accordance with applicable Federal information technology standards and guidance.  Comments on the proposed system controls for private systems are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters regarding the feasibility of long-term validation of digital signatures (Commenter Nos. 33, 59, and 60).  One commenter opposed the requirement for long-term validation, since handwritten signatures on paper manifests are not subject to the same standard (Commenter No. 60).   Another commenter noted that current technology is not generally available that will permit validation at the time of transmission and maintain the validation for three years (Commenter No. 59).   For example, the commenter clarified that, if a valid certificate is later revoked, such as when an employee leaves the company, previous (valid) manifests will be invalidated as well.  Another commenter believes that longterm validation is feasible in regard to technical challenges; however, it is unclear if it is feasible in regard to administrative challenges and cost (Commenter No. 33).   The commenter does not believe there are practical ways to ensure long-term enforcement capability and liability protection for companies using manifests without imposing the burden and costs of indefinite signature validation mechanisms.  The commenter believes it is a question of how much risk EPA wants to live with and who will pay the costs of minimizing that risk.  The commenter added that, if EPA wants to minimize such risk, then some effort must be made to insure the long-term validity of digital signatures.  The commenter believes the central questions are who would implement and pay for such measures, and how many years such validation efforts should attempt to cover.  The commenter believes EPA should handle the cost, particularly since leaving it to the waste handlers themselves is an uncertain proposition.

Response:  EPA thanks the commenters for their suggestions on the proposed controls for generating accurate and complete records available for inspection.  However, EPA has determined not to codify electronic signature requirements in this final regulation.  Instead, this final rule requires "valid electronic signatures" that comply with the Agency's CROMERR, and we recommend (but do not require) two signature methods that may be feasible under CROMERR.  Our current recommendations focus on PIN/password and digitized handwritten signature methods for the first generation system.  We are not currently recommending digital signatures involving public key/private key encryption methods (see discussion at § 4.2), so we consider this comment moot.

      3.3	The Ability to Protect Records               Comment: We heard from two commenters regarding the requirement for retaining prior versions of software and hardware as necessary to access manifest records (Commenter Nos. 26 and 59).  One commenter noted that the requirement may require TSDFs to retain records for at least 30 years after facility closure and asked EPA if this was intended (Commenter No. 26).  Another commenter noted that maintaining prior versions of software and hardware for the required retention period could be extremely costly (Commenter No. 59).  The commenter noted that a State's laws may require it to retain records for much longer periods of time than the Federal program, making the requirement even more costly.  The commenter also noted that many companies update their data files for active accounts and archive inactive accounts.  The companies may rely on paper documents rather than the archived data when information is needed at a later date.  The commenter believes the proposed rule appears to prevent these practices by precluding the alteration of electronic documents once they are signed.  The commenter asked EPA to consider the longterm consequences of prohibiting any alteration of an electronic document after it is signed.

Response:  EPA thanks the commenters for their suggestions on the proposed data protection standards.  However, EPA has determined not to codify the proposed system security controls for private systems as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate security controls pursuant to applicable Federal information technology standards and guidance.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters in regard to the ability of protecting electronic files over the long term (Commenter Nos. 13 and 33).  One commenter indicated that backup storage of information is a concern since system crashes do occur (Commenter No. 13).  The commenter asked for clarification on what constitutes "standard computer security" and the destruction of information in relation to system failure.  Another commenter indicated that digitally signed and electronically stored media are inferior to paper copies in terms of being more susceptible to corruption/destruction by heat, magnetic fields, and degradation (Commenter No. 33).  The commenter added that storage standards change over time, making it more difficult to comply over the long term.  The commenter suggested three ways to address these concerns:  (1) creation of multiple copies of the stored information and dispersal of the copies to multiple sites; (2) periodic check-ups of the stored material and upgrades as needed; and (3) encoding of a piece of data within a much larger data-string with built-in error-correcting features, so that even if one part of the string becomes corrupted, it is still possible to decode the original piece of data correctly.

Response:  EPA thanks the commenters for their suggestions on the proposed data protection standards. However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. EPA will develop appropriate security controls for this system pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter on the appropriateness and feasibility of a requirement that manifest records be periodically archived on a write-once, read-many medium (Commenter No. 33).  The commenter indicated that it is feasible and advisable that manifest records be periodically archived on write-once read-many storage mediums.  The commenter noted, however, that it is important to remember that any digital storage medium is corruptible.  The commenter suggested that multiple copies be made and those copies be stored at multiple sites.

Response:  EPA thanks the commenter for its views on the proposed data protection standards.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.4	The Ability to Limit System Access and Conduct Authority Checks               Comment: We heard from one commenter stating its support specifically for authority checks and audit trails (Commenter No. 30).  We heard from another commenter who generally agreed with the proposed requirements to limit access and conduct authority checks, because the railroads already have such systems in place (Commenter No. 46).  However, the commenter opposed the criteria to maintain auditable logs of logon attempts and logon failures and rejections for a three-year period (Commenter No. 46).  The commenter indicated that, because of the huge number of transactions involving railroads, such a requirement would place a significant burden on the industry and force railroads to use a paper system.

Response:  EPA thanks the commenters for their support of the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed its opposition to the requirements to limit access and conduct authority checks (Commenter No. 57).  The commenter indicated that electronic systems should not be subject to greater controls than those for paper manifests.

Response:  EPA thanks the commenter for its views on the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters who asked EPA to clarify the technical standards associated with limiting unauthorized access to systems and data (Commenter Nos. 26, 34, and 59).  One of these commenters also asked for clarification on the compliance and enforcement issues associated with these proposed requirements (Commenter No. 34).  For example, the commenter asked what would happen if a system did not track failed log-ons but had all other assurances (e.g., would it be approvable?).  One commenter asked for clarification on the circumstances under which the alteration of a record would be allowed (Commenter No. 59).   The commenter believes that it appears that the alteration of a record would invalidate the electronic signature on the record and place the entire system at risk of repudiation.

Response:  EPA thanks the commenters for their views on the proposed access controls and authority checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

             3.5	Use of Secure Audit Trails

Comment: We heard from one commenter who recommended that EPA acknowledge and anticipate that there may be system failures or natural disasters that cause delays in the submission of the manifest forms (Commenter No. 24).  The commenter therefore proposed that facilities should be able to rely on electronic time stamps for the date of transmission of manifests, so that a problem with electronic sending does not become a compliance issue.

Response:  EPA thanks the commenters for their views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from three commenters indicating their opposition to the requirement for the use of secure audit trails (Commenter Nos. 26, 46, and 57).  One commenter indicated that creating a system to save all changes to manifest transactions would require programming changes by the railroad industry (Commenter No. 46).  For these and other reasons, the rail industry would probably choose to stay with the current paper system because the cost would outweigh the benefit.  Two commenters indicated that the electronic manifest system should not be subject to more burdensome controls than pen-and-ink completion of the paper manifest (Commenter Nos. 26 and 57).   One of the commenters stated that there is no need to identify or audit every party that has viewed a manifest, only the ones that have changed its contents (Commenter No. 57).

Response:  EPA thanks the commenters for their views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed support for the requirement to use secure audit trails (Commenter No. 30).

Response:  EPA thanks the commenter for its views on the proposed standards for use of secure audit trails.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. EPA will develop appropriate system security controls pursuant to applicable Federal information technology standards and guidance. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.6	Software-based Work Flow Controls and Operational System Checks

Comment: We heard from two commenters requesting EPA clarification regarding making corrections to electronic manifest data once the manifest is signed (Commenter Nos. 57 and 59).  One commenter indicated that, because TSDFs and transporters that prepare manifests have historically made basic errors (e.g., entering the wrong Generator USEPA ID number), the commenter believes the proposed regulations need to address the correction of mistakes identified after the electronic manifest is closed (Commenter No. 59).  The other commenter noted that paper manifests are often prepared by one party and subsequently edited by downstream handlers, e.g., by transporters and TSDFs (Commenter No. 57).  The commenter is uncertain if this process would be preserved in the proposed system.  The commenter believes that the proposed security provisions essentially lock down portions of the manifest as they are signed and prohibit future modifications.