Response:  EPA thanks the commenters for their views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA's national system will largely provide the critical work flow controls and operational system checks. Comments on the proposed private system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters in response to EPA's request for comment on what the appropriate response should be when an invalid signature is detected (Commenter Nos. 33 and 34).  Both commenters believe the appropriate response should be to block further use or transmission of any manifest found to be invalid or for which the electronic signature cannot be verified.  One commenter indicated that its State program does not keypunch data from manifest forms that are not signed (Commenter No. 34).  The other commenter clarified that, although further use of such a manifest should be blocked in theory, it is likely, particularly as the system is being phased in, that unforeseen problems will occur where this approach could make things unworkable (Commenter No. 33).  For that reason, the commenter believes it might be advisable to have the system alert the recipient to the requirement to obtain a valid manifest, but not itself block the use, thus giving some flexibility while the recipient works to resolve the validity problem.

Response:  EPA thanks the commenters for their views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  Comments on the proposed system controls are now moot.  We agree that this comment raises a valid concern, and that there may be circumstances (e.g., an electronic signature collected off-line) where the data in an electronic manifest must be passed through the system before the signature can be validated.  This is one reason that we recommended in the final rule preamble (contingent on peer reviewed studies of reliability) the use of the digitized handwritten signature method, as this would allow signature data, including forensic data, to be collected and stored for later examination by document examiners in the event there should be a question about the legitimacy of the signature. This is how ink-signed signatures are authenticated, and there seems to be much merit to the digitized handwritten signatures because of the similarity with which they are executed and authenticated.  PIN/password signatures, on the other hand, would either require validation against data stored locally on portable devices in the field, or would require later validation that might give rise to signature discrepancies that would need to be reconciled after manifests are transmitted.  EPA will examine this issue further during system planning and development.

Comment: We heard from one commenter who opposed requirements for software-based work flow controls and operational system checks because such requirements would entail programming that would not be cost effective (Commenter No. 46).   The commenter noted that EPA's regulations already recognize the unique aspect of railroads and their ability to transmit documents electronically and hence should not mandate additional requirements when the system is already working well.

Response:  EPA thanks the commenter for its views on the proposed standards for software-based work flow controls and operational system checks.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e-Manifest Act in fact mandates this approach.  EPA's national system will largely provide the critical work flow controls and operational system checks that the proposed rule suggested for disparate private systems.  The Agency does not intend to apply its e-Manifest system controls to the rail system's electronic waybill system. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.7	Software-based Data Presentation Features and Signature Prompts

Comment: We heard from one commenter expressing full support for the proposed data presentation features (Commenter No. 59).  The commenter believes the manifest systems should not only be able to, but be required to, display all of the manifest data in a readable format at the time the electronic manifest is signed.  Two other commenters expressed support for EPA's proposal for a warning message for both digital and digitized signatures (Commenter Nos. 19 and 33).  One of the commenters also indicated that the signature warning should be displayed each time a signature is required (Commenter No. 33).  With regard to the secure digitized signature approach, however, the commenter wondered if this approach would be feasible and/or practical for all types of digitizer pad devices to be used.

Response:  EPA thanks the commenters for their views on the proposed standards for software-based data presentation features and signature prompts.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will incorporate similar signature warnings and prompts into the national system's work flow, and we plan to retain the requirement that electronic manifests be displayed in a readable format before signatures are applied.  However, with the widespread use of tablets and portable devices with varying display sizes, there may be some adjustments necessary to this requirement (e. g., scrolling) to accommodate variations in display size among devices.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from two commenters expressing opposition to the warning prompt for invalid signatures (Commenter Nos. 34 and 46).  One commenter indicated that the warning prompt is unnecessary because EDI is a well-established process, railroads have well-established relationships with other waste handlers, and the protocols are well-understood by all parties (Commenter No. 46).  The commenter stated that additional controls above what is already required of railroads would discourage use of electronic manifesting.  Another commenter indicated that a warning is not needed because it should be assumed that users understand the consequences and liability of signing their name (Commenter No. 34).

Response:  EPA thanks the commenters for their views on the proposed standards for software-based data presentation features and signature prompts.  However, EPA has determined not to codify the proposed system security controls as part of the final rule, and we do not intend to apply the signature warnings and prompts discussed in this rule to the rail system's electronic waybill system.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Any signature related warning prompts will be addressed during system development, and not as a requirement of this final rule.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.8	Full Interoperability of System Software

Comment: We heard from two commenters suggesting modifications to the proposed requirements for full interoperability of system software (Commenter Nos. 59 and 61).  One commenter suggested that EPA could establish a requirement that the exchange of manifest data and the interoperability of electronic manifesting systems not be compromised by any new approved software (Commenter No. 61).  The commenter believes this may limit the technological advances possible; however, it would ensure that any change approved will not have the impact of making obsolete the investments of others involved in electronic manifesting.  Another commenter indicated that EPA could require electronic systems to be evaluated for a specified period of time by all parties that will use the system to ensure there are no interoperability problems (Commenter No. 59).  The commenter added that paper manifests should also be used during the evaluation period in case there is a problem with the system.

Response:  EPA thanks the commenters for their views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule. On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  The development of a national e-Manifest system moots the issue of interoperability among private systems, although manifest users will need to develop the appropriate interfaces to share and exchange data from e-Manifest with their legacy data systems.  System interoperability concerns will be addressed during system planning and development efforts, and are not addressed in this final rule.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from four commenters expressing support for the one-time requirement for system sponsors to notify EPA that they have developed and would be using an e-manifest system (Commenter Nos. 17, 19, 30, and 59).  These commenters believe it is important to notify the regulatory agency of a sponsor's use of the e-manifest (e.g., to make the regulator aware that electronic manifests will be submitted) and would not place an undue burden on waste handlers.  One of the commenters cautioned that the notification would not be a disincentive unless it involves many requirements, and asked EPA to list what information is required in the notification (Commenter No. 30).

We heard from another commenter who did not believe the notification requirement, in and of itself, would be a disincentive to use of electronic manifesting (Commenter No. 33).  However, it would be a disincentive if it would mean that the electronic system would be subject to the validation requirements of the proposal and that possible existing manifest-exchange relationships with other states would be threatened as a result.

Response:  EPA thanks the commenters for their views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Thus, there will not be multiple private systems and no need for a notification requirement. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who expressed opposition to the proposed notification requirement (Commenter No. 23). The commenter noted that system users would have to register with EPA to get an approved identification numbering system.  The commenter believes the registration process would serve to notify regulatory agencies of the use of electronic manifest systems; and thus, the one-time notification is not needed.

Response:  EPA thanks the commenter for its views on the proposed standards for full interoperability of system software.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  As there will not be private systems developed, there will be no need for the proposed notification. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

3.9	Controls over System Documentation

Comment: We heard from three commenters expressing opposition to the proposed controls over system documentation (Commenter Nos. 26, 33, and 57).  These commenters expressed their belief that the proposed controls are too burdensome.  Two of the commenters noted that the paper-based system does not impose similarly burdensome controls (Commenter Nos. 26 and 57).  The other commenter noted that excessively burdensome controls and requirements will make it unlikely for waste handlers to develop or use the documentation (Commenter No. 33).

Response:  EPA thanks the commenters for their views on the proposed controls over system documentation.  However, EPA has determined not to codify the proposed private system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests. The 2012 e-Manifest Act in fact mandates this approach.   EPA will develop system documentation for the national e-Manifest system, but since there will not be private systems developed under the final rule, we will not require private entities to develop such documentation. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from one commenter who suggested that the rule should require that documentation be available during inspections (Commenter No. 35).  The commenter noted that documentation requirements are missing for such items as the technical standards and computer security system controls.

Response:  EPA thanks the commenter for its views on the proposed controls over system documentation.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. While EPA will develop system documentation for the e-Manifest system, we will not require private entities to develop such documentation or to make it available for inspections. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.10	Policies Holding Individuals Accountable

Comment: We heard from one commenter who expressed its opposition to the proposed requirement for written policies (Commenter No. 57).  The commenter indicated that there is no equivalent requirement for paper-based manifests.  Another commenter indicated that computer security is something of an illusion (Commenter No. 33).  The commenter indicated that forgery of most manual signatures is detectable and provable; however, forgery of a digital signature is for all practical purposes undetectable and un-provable, should someone gain access to the individual's signature object.  The commenter believes EPA's requirements could be circumvented by a sufficiently computer-literate individual intent on falsification.  The commenter suggested the best controls would be procedures that could somehow confirm the validity of the data itself, rather then relying on the validity of the digital signature.

Response:  EPA thanks the commenters for their views on the proposed standards for policies holding individuals accountable.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  The national e-Manifest system will be developed and operated in accordance with EPA's CROMERR Rule, and this rule announces the applicable policies under which EPA will hold manifest users accountable for their signatures and submissions. Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

      3.11	Other System Requirements

Comment: We heard from one commenter who asked for EPA clarification on whether electronic receipt of the manifest equates to acceptance of the waste (Commenter No. 26).

Response:  EPA thanks the commenter for its views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.   Comments on the proposed system controls are now moot.  However, EPA notes that even with the paper manifest system, the mere receipt of delivery of waste materials is distinguished from acceptance of the waste.  The substitution of an electronic manifest does not alter this result.  Acceptance or rejection of waste may occur after a TSDF has signed a manifest to indicate receipt of deliveries.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: We heard from eight commenters expressing opposition to the requirement for retransmission of the electronic manifest if an acknowledgment of receipt is not received within 12 hours (Commenter Nos. 16, 18, 25, 30, 46, 54, 57, and 59).  These commenters believe 12 hours is not enough time for facilities to verify receipt or to resend the manifest, given evenings, holidays, weekends, and potential system failures.  Two of these commenters suggested that EPA amend the timeframe to 12 working hours (Commenter Nos. 54 and 59).  One of the commenters suggested at least five business days (Commenter No. 25), and another suggested at least 24 hours (Commenter No. 30).

In addition, two commenters expressed concern that, given the requirements for a 12-hour re-transmittal of the electronic manifest, there may be situations where the hazardous waste haulers will arrive at the TSDF in advance of the electronic manifest (Commenter Nos. 16 and 18).  One of the commenters suggested that EPA explain what actions should be taken under these types of logistical problems (Commenter No. 18).

Response:  EPA thanks the commenters for their views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  Comments on the proposed system controls are now moot.  Any requirements for acknowledgement of receipts of electronic manifests will be addressed as a system development issue, and not addressed in this final rule.  Please refer to the EPA response in Section 3.1 of this document for further information.

Comment: Three commenters requested alternate methods of electronic storage than those proposed in the rule (Commenter Nos. 51, 57, and 59).  One of the commenters noted that companies would prefer to have the authority to use imaging technology to store copies of manifests so they can reduce their warehousing costs (Commenter No. 59).  Another commenter suggested a national repository (server) for electronic storage (Commenter No. 51).  The commenter suggested that waste handlers could place their electronic manifests onto the centralized repository for access by stakeholders. Another commenter urged EPA to continue considering other electronic forms of recordkeeping under the RCRA program (Commenter No. 57).

Response:  EPA thanks the commenters for their views on the proposed system requirements.  However, EPA has determined not to codify the proposed system security controls as part of the final rule.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach.  EPA will establish user accounts on e-Manifest for each waste handler that wishes to use the electronic manifest.  Electronic copies of completed manifests will be stored electronically to the accounts of each user and will there be available for retrieval and inspection. With respect to paper manifests that continue in use after e-Manifest is implemented, the system will only collect the final paper copy (or an image file and data file) from designated facilities.  The waste handler copies of paper manifests must still be maintained on site by waste handlers in accordance with existing recordkeeping requirements, although EPA has allowed image copy storage under certain conditions.  Comments on the proposed system controls are now moot.  Please refer to the EPA response in Section 3.1 of this document for further information.

4.0	EPA's Proposed Electronic Signature Standard

      4.1	General Comments

Comment: We heard from five commenters in support of one or both of the proposed electronic signature methods (Commenter Nos. 17, 25, 33, 60, and 61).  One of these commenters believes that it is likely that if both systems are allowed, a TSD facility in the chain on a manifest will be using a different system than that used by the generator (Commenter No. 61).  The commenter believes this would require each generator/operator to have technology that supports both the digital signature and secure digitized signature methods.  This could significantly increase the cost and complications to those using electronic manifests.  The commenter believes that, if both systems are authorized, EPA must require that the systems be compatible with each other.  The commenter suggested that EPA weigh the additional complications and costs that will exist if both systems are approved versus the advantages and disadvantages of a federally selected single system that EPA designates.  The commenter suggested that EPA look to the Treasury Department and the Department of Housing and Urban Development, which are addressing the same security issues as part of their transition to electronic transfers of tax forms and home-closing documentation.

We heard from one commenter who expressed opposition to both signature methods because they introduced an entirely new system that would not be cost-effective (Commenter No. 46).

Response:  EPA thanks the commenters for their suggestions on the electronic signature method.  EPA has considered all of the comments received on this issue and agrees with comments expressing concern about the digital signature.  For example, we received a number of comments from regulated industry suggesting that the digital signature method with its public key infrastructure was too expensive and complex to be deployed in the electronic manifest context.  However, we also received a fair number of comments from industry representatives who suggested that a digitized signature method could be implemented and used successfully for the electronic manifest.  These commenters offered that digitized signatures provide a practical and cost-effective alternative to digital signatures, and that they have been used commercially and successfully for years.  Several proponents of the digitized method added that the digitized method is preferred, because it will allow the capture of a real time signature through a process that best mimics the current process for signing paper manifests.  We received several industry comments that echoed the view expressed in State agency comments that the electronic manifest context did not warrant elaborate electronic signature security, with one such commenter suggesting that any security burden imposed beyond that associated with the digitized signature method would act as a deterrent to users using the electronic system.  Finally, we received a comment from an industry trade association suggesting that EPA must clarify in the final rule that one consistent signature method will be implemented in all states for electronic manifests, since manifests are interstate transactions that require consistency in implementation across all the states.

EPA notes that in the final regulation it is not codifying or requiring the use of a specific electronic signature technology.  The final rule is instead technology neutral, and requires at 40 CFR § 262.25(a), that signature methods for e-Manifest shall:    1. Be a legally valid and enforceable signature under applicable EPA and other Federal requirements pertaining to electronic signatures, and    2. Be a method that is designed and implemented in a manner that EPA considers to be as cost-effective and practical as possible for users of the manifest.

While the regulation is technology neutral, EPA makes recommendations in the preamble for the first generation system, based on the comments received during our comment period and further analysis.  EPA agrees with the commenters who suggested that an electronic signature method based either on a PIN/password approach or on a digitized signature approach provides a preferred balance of identification strength, practicality, and cost.   EPA's own analyses support these views.  For example, EPA conducted an economic analysis of the proposed authentication and signature technologies in May 2007.  The economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized signature method.  On the other hand, the May 2007 analysis disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely be three to four times the projected costs of implementing either the PIN/password method or digitized signature method.

Therefore, EPA is recommending both the PIN/password method and the digitized handwritten signature method in the final rule preamble, as the Agency believes that each of these methods can be adapted to the electronic manifest business process for two distinct communities of electronic manifest users with minimal cost burden.  These recommendations are not binding, however, and the system developers and users are free to consider other signature methods that meet the rule's selection criteria.   We believe that the digitized signature method may be attractive to hazardous waste transporters and hazardous waste management firms who wish to implement the electronic manifest across their enterprise by bringing mobile computer equipment to the sites of their generator customers, and tracking waste pick-ups, transportation with company vehicles, and delivery of waste shipments to the company's permitted facilities.  For those who would engage in electronic manifesting independently of the enterprise level implementation, the PIN/password signature method would be available as a means to electronically sign electronic manifests.  While we appreciate the concern expressed by commenters that there should be only one signature method specified for consistency, we believe that there are advantages at this time to specifying alternative methods that have been evaluated for practicality, signature strength, and and CROMERR compliance.  At such time as the system is in fact developed, the system could incorporate either or both of these methods, or another method that is CROMERR compliant and practical.  As explained above, we believe there are distinct communities of users who will use the digitized signature method and the PIN/password signature method.  Therefore, we believe there will be relatively few instances when one manifest will use both signature methods, and if such instances arise, the system will be able to process either signature as a valid signature.  However, we will reevaluate this question as we work with the successful IT vendor to implement a system and to implement the electronic signature solution(s).  Should we find as we approach implementation that there are greater efficiencies and advantages with the selection of one consistent signature method for all users, we can alter our current plans and develop the initial system around the one most advantageous signature method.

The final rule preamble also clarifies the identity proofing that will be required of signatories using each of these electronic signature methods.  Identity proofing is the vetting process by which an identity credential (e.g., driver's license, passport, financial account) is verified, so that one can be confident that another person who claims a particular identity is the person they claim to be.  Under EPA's Cross-Media Electronic Reporting Rule (CROMERR), the Agency generally requires electronic signatories of environmental reports to undergo a one-time identity proofing exercise before the signatory may sign and submit electronic reports to EPA.  Identity proofing aids in establishing that an asserted identity can with legal certainty be uniquely linked with the electronic signature device used by the signatory to execute their electronic signature.  While hazardous waste manifests are not included in the CROMERR priority reports list, we are to a great extent adapting the identity proofing requirements for CROMERR priority reports in this final rule for electronic manifests that would be signed with electronic signatures.

However, with respect to digitized handwritten signatures, the final rule preamble explains that no distinct identity proofing is required per CROMERR, since these signatures that will be validated on the basis of biometric or forensic properties unique to the signer, as is the case with ink-signed handwritten signatures.  Thus, it is no more necessary for a signer to establish their "ownership" of their unique, digitized handwritten signature than it is necessary to establish their ownership of their ink signatures.  Moreover, in the case of the witnessed signature approach discussed below to implementing PIN/password signatures, those who sign e-Manifests with a PIN or password in the presence of a signature witness will be proofed by the witness at the time they execute their signature.  Thus, those employing this signature method will simultaneously satisfy their signature and identity proofing requirements when they present their credential to the witness.

Comment: We heard from two commenters who expressed uncertainty about whether electronic signatures would hold up in court (Commenter Nos. 13 and 33).

We heard from one commenter who recommended that a digitized signature be required rather than another type of electronic signature (Commenter No. 51).  The commenter stated that the digitized signature system has been used successfully commercially (credit card purchases) and provides an actual, real time signature, not a facsimile.

Response:  EPA thanks commenters for their views on electronic signatures.  We share the concern that electronic signatures must be enforceable in court cases.  Subsequent to the publication of the 2001 proposed rule, the Agency published in October 2005 its CROMERR Rule that establishes the legal and policy framework for all electronic reporting to the Agency.  See 70 FR 59848 (October 13, 2005).  CROMERR includes definitions at 40 C.F.R. §3.3 for "valid electronic signature" and "electronic signature device" for the very purpose of ensuring the validity and enforceability of the electronic signatures that are executed for electronic documents that are submitted to EPA.  For the e-Manifest final rule, the regulation specific to electronic signatures has been revised so that it is technology neutral and avoids codifying specific signature technologies that may become obsolete over time.  Instead, the final regulation requires that electronic signature methods or technologies used with e-Manifest shall:  (1) be consistent with EPA's CROMERR requirements in 40 C.F.R. Part 3 for valid electronic signatures; and (2) be generally acceptable to the manifest user community so that the methods encourage broad participation in the e-Manifest.

Our final rule preamble explains in more detail two electronic signature methods that were discussed in the proposed rule, and that we believe can be adapted to satisfy CROMERR requirements and be implemented in a manner that will be acceptable to the user community.  We discuss these two methods in some detail in the proposed rule, because they were carefully vetted in advance for CROMERR compliance and for practicality in their implementation.  Thus, we believe these two methods may be useful for the first generation of e-Manifest:  (1) a high quality handwritten digitized signature method;  and (2) a PIN/password electronic signature strengthened with a 2[nd] authentication factor that is unique to the manifest business process.  We have included special authentication provisions in the final rule preamble discussion of these methods to address CROMERR compliance and to strengthen these signature methods so that they will provide sufficient assurances of identity should authentication issues arise in enforcement actions.   We believe these provisions, described further below, strengthen the signature approaches and provide sufficient assurances of identity in case of enforcement actions.

Recommended digitized handwritten signature method.  The Agency is recommending a digitized handwritten signature method as one of the two methods of electronic signature that were vetted by the Agency for inclusion in the first generation e-Manifest.  As we discussed in the May, 2001 proposed rule, the digitized signature must be captured as a dynamic signature (not a replay of a copy), and the signature must be bound to the manifest document content by a hash function to prevent unauthorized alterations to signed content.  Like handwritten signatures executed with ink on paper, digitized signatures may be recognized for the characteristic or personal shape and form of the letters, loops, and other forensic signature attributes that are recorded by hardware and software during the handwritten signature act.  Thus, a digitized signature has some biometric-like properties which may provide a high level of assurance that the signature is unique to the signatory and that it may be authenticated by trained document examiners.

Indeed, for the final rule, we are clarifying that before digitized handwritten signatures may be accepted as fully CROMERR compliant so that they can stand alone as "valid electronic signatures" for e-Manifest, there must be peer reviewed studies completed to establish that the digitized signature hardware and software are forensically reliable.  This foundation of reliability is required in court cases before a document examiner could testify as an expert witness in a disputed case that a given digitized signature is or is not authentic.  EPA may be able to complete these reliability studies prior to the implementation of e-Manifest, but if not, we expect to implement the digitized handwritten signature method on an interim basis with digitized pads and/or pens that enable an ink signature to be captured simultaneously with the digitized signature.  We are aware of several existing products with this capability.  Thus, one paper copy would be executed with original ink signatures, while the digitized signatures would simultaneously be collected and associated with the electronic manifests that would be distributed and retained by the e-Manifest system.  At the end of the waste shipment transaction, the designated facility or other designated custodian would retain the one paper copy with all the ink signatures and retain this copy securely and make it available for inspection and enforcement purposes by state or federal inspectors.  The ink signatures on this stored copy would be authenticated by document examiners in the same manner that such ink signatures are currently authenticated in enforcement actions.  Thus, during this interim period before forensic reliability studies are completed, the paper copy of the manifest with ink signatures would be the manifest copy of record for enforcement purposes, and the digitized handwritten signatures on the electronic manifests would effectively be exempt from CROMERR.

While this interim solution might seem at odds with the goal of a fully paperless manifest, EPA emphasizes that after the implementation of e-Manifest, DOT's hazardous materials regulations will continue to require hazardous waste transporters to carry a hazardous materials shipping paper (i.e., the manifest) on transport vehicles.  So, e-Manifest users will still be required to produce one paper copy of the manifest in order to comply with these existing DOT shipping paper requirements.  Since there will need to be a paper copy of the manifest on the vehicle in any case for DOT's purposes, the use of this one paper copy to simultaneously record enforceable ink signatures under this interim solution will not result in additional paperwork being supplied.  Moreover, most of the paperwork reduction, greater efficiency, and data quality enhancement benefits of the electronic manifest will still be realized even with the execution and retention of this one paper manifest copy. We anticipate that this interim signature method would be used until such time as EPA is able to designate specific digitized signature products that have been tested and found through peer reviewed studies to meet the forensic reliability standard.

At such time EPA is able to designate those signature products that have been found by testing to be forensically reliable, so that it is possible to reliably authenticate digitized handwritten signatures with the expert testimony of document examiners, then these digitized handwritten signatures will qualify as "valid electronic signatures" that are fully compliant with CROMERR and may stand on their own for enforcement purposes without any paper copy back-up.

At such time as EPA designates certain digitized handwritten signature products as forensically reliable, this final rule will also require that the generator, transporter, and facility personnel who sign electronic manifests with these products must undergo identity proofing that complies with CROMERR identity proofing requirements in 40 CFR 3.2000(b)(5)(vii).  This means that the generator, transporter and facility personnel who will sign manifests with these products must have an identity credential such as a driver's license vetted by a disinterested third party or automated validation service, or, these signatories must submit electronic signature agreements containing ink signatures as an alternative means of identity proofing.  Since this method is anticipated to be a company-wide implementation by the transporter or waste management company sponsoring the mobile computer equipment, EPA expects that this method will be a good candidate for submission of signature agreements to the sponsoring company's local registration authority or LRA, who would certify to EPA that the agreements have been executed for all the signatories across the company and that the agreements are being stored locally with the company.

Significantly, during the interim period that digitized signature products are collecting ink signatures and digitized signatures simultaneously, CROMERR identity proofing will not be required from the generator, transporter, or facility personnel signing manifests in this fashion.  Since the one paper copy with ink signatures will serve as the copy of record for enforcement purposes, there is no issue of CROMERR compliance (including identity proofing requirements) while this interim signature method is being used.

Recommended PIN/password electronic signature method.  In addition to the digitized signature method discussed above, the final rule also recommends for the first generation e-Manifest an additional electronic signature method that involves a PIN or password signature strengthened with a unique 2nd authentication factor.  This method would be available for all electronic manifest signatories who are not signing electronic manifests with the digitized signature method discussed above.  While there are a variety of possible means to implement a 2nd authentication factor (e.g., personal questions, token, biometric attribute), for the manifest business process, EPA anticipates that during the implementation of the first generation e-Manifest, the 2[nd] authentication factor will be a witnessed signature certification.

Hazardous waste manifests are normally signed by waste handlers at the time custody of hazardous wastes is being transferred from one waste handler to another.   So, there is typically a witness present to each manifest signature.  For example, when a generator delivers its waste containers to the initial transporter, the generator executes the generator/offeror certification and the initial transporter signs to acknowledge receipt of the waste.  In other words, the generator personnel and transporter personnel mutually sign the manifest in the presence of the other.  Similarly, when a transporter delivers waste to the designated facility, the transporter obtains the signature of the facility personnel who signs for receipt of the waste shipment.  Again, the facility representative signs in the presence of the transporter's representative, and the transporter witnesses the signature of the designated facility's representative.

The witnessed signature method of executing PIN or password electronic signatures takes advantage of the fact that manifest signatures are normally witnessed by another party.  So, when the generator signs with its PIN or password to execute the generator/offeror certification, he or she will also certify at that time that he or she witnessed the mutually executed signature of the initial transporter.  The witness certification will further attest that the generator was shown a driver's license or other picture ID of the transporter, and that the picture ID shown is consistent with the identity claimed by the transporter.  To ensure that this proofing exercise is in fact completed and is not a sham certification, the witness must record the last 4 digits of the signer's driver's license number as part of the witness's certification.  Likewise, as the transporter signs to acknowledge his or her receipt of the waste from the generator, the transporter representative will also certify to having witnessed the signature of the generator, and will examine the driver's license of the generator and record the last 4 digits of that license number as part of the certification.  A similar certification would be executed by the transporter when it delivers the waste to the designated facility and witnesses the signature being executed the facility's representative.  For the final rule, EPA has determined that the PIN or password electronic signatures that are executed in this fashion, with the requisite certification of a witness attesting to the signer's signature act and proof of ID, are sufficiently strengthened by the witness certification, so that these signatures and certifications meet CROMERR's requirement for a 2[nd] authentication factor.

CROMERR compliant identity proofing will be required of all signatories using the PIN or password method of signature.  CROMERR requires that a driver's license, passport, or similar identity credential for the signatory must be vetted one time by a disinterested party or validation service supplied for this purpose (see 40 CFR §3.2000(b)(5)(vii)(A)) prior to the use of the electronic signature.  Alternatively, one using a PIN or password electronic signature could also satisfy CROMERR identity proofing requirements by submitting an ink-signed signature agreement to EPA or to the company's local registration authority (LRA) in accordance with 40 CFR §3.2000(b)(5)(vii)(C).  However, because each e-Manifest PIN or password signatory using the witnessed signature method discussed above undergoes identity proofing by the witness at the time of signature, there is no need to provide additional credentials or documentation to meet CROMERR identity proofing requirements with these signatures.  The witnessed signature certification and underlying proofing of each signatory suffice to meet this CROMERR requirement.

Comment: We heard from seven commenters who asked that the signature approach be flexible (Commenter Nos. 22, 33, 51, 59, 60, 61, and 63).  Two commenters suggested that EPA should not specify the technology but allow industry to develop systems that meet desired outcomes (Commenter Nos. 51 and 60).   Another commenter asked EPA to ensure that its signature standards are flexible enough to accommodate States' initiatives on electronic reporting (Commenter No. 59).  Another commenter noted that, because of differences in cost, waste handlers within the same manifest cycle might use differing technologies (Commenter No. 61).  As such, EPA should ensure that its final rule address compatibility among signature methods.  Two commenters asked EPA to clarify standards and procedures to address situations in which the generator, transporter and/or TSDF operate different signature methods for the same shipment (Commenter Nos. 33 and 61).  One of these commenters believes that, if EPA should adopt an even broader approach than the two signature approaches in the proposed rule, the criteria for additional signature methods should be to maximize ease of use, minimize cost, and provide a reasonable level of security (Commenter No. 33).  The commenter added that, if numerous signature methods were to be authorized, EPA should establish a national verification system that anyone can access to confirm (or interpret) the manifest signatures.  The commenter also recommended that EPA ensure that multiple signatures are readable and verifiable by establishing a national verification system that anyone can access to confirm the signatures.  Another commenter cautioned EPA to avoid overly broad or narrow approaches for digital signatures, since the rule will have far-reaching implications (Commenter No. 63).

Response:  EPA thanks commenters for their request that the signature methods be flexible.  We agree that the methods should accommodate the various preferences and constraints of the users of the electronic manifest.  We agree with the comment that the regulation should not specify or codify technologies, and we have revised the final regulation so that it is in fact technology neutral.  For the final rule, therefore, the codified electronic signature requirements are that the signature methods satisfy CROMERR performance standards in 40 C.F.R. Part 3 and that the methods be generally acceptable to the user community.  While the final rule does not codify signature methods, we do recommend two methods in the preamble that we believe can be implemented in the first generation system in such a way as to meet the regulatory standards.   These recommended solutions were discussed at length in our response to the previous comment.

In short, EPA's intent is to set forth in the rule in general and flexible language what the regulatory requirements are for implementing an electronic manifest signature.  As the various authentication technologies (e.g., biometrics, tokens) improve or become less costly over time, different signature solutions may become more feasible and appropriate for the e-Manifest system.  EPA expects that the e-Manifest vendor and the Governing Body or Advisory Committee responsible for the oversight and change process for e-Manifest will settle on the specific authentication devices and approaches that will meet this rule's requirements and will be supported by the system over time.

Comment: We heard from five commenters who suggested alternative approaches for the electronic signature (Commenter Nos. 22, 30, 33, 60, and 61).  All of these commenters encouraged EPA to consider simple and least-cost signature approaches so long as they are comparable to the handwritten signature.  Three commenters suggested use of a Personal Identification Number (PIN) or comparable approach (Commenter Nos. 30, 33, and 61).  These commenters believe a PIN would provide a reasonable level of security in comparison with handwritten signatures.  One commenter suggested EPA draw from DOT's experience and streamline its proposal to allow use of a signature mark produced by any means (Commenter No. 22).  Another commenter suggested that EPA allow itself the flexibility to approve new technologies, including biometrics (Commenter No. 61).

Response:  EPA thanks the commenters for their suggestions for simple, low-cost signature methods.  We agree with their concerns and believe the signature methods in the final rule address such concerns.  EPA conducted a detailed economic analysis of the proposed authentication and signature technologies in May 2007, as we wanted to understand better how the hardware, software, and support services needed for each signature and identity proofing method would impact the implementation costs for the system and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs.  The May 2007 economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), although this cost is likely to increase when the cost of the higher quality pads and software that might satisfy requirements for forensic reliability are taken into account.  However, we are generally impressed that the digitized signature method has intuitive appeal and appears to be quite cost effective for users, despite the fact that this method entails a more significant initial investment by users in the signature pads and software necessary to generate the digitized signatures.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present implementation costs ($0.54 to $0.96 per manifest) comparable to the digitized signature method. Thus, our final rule language now reflects these commenters' concerns that the recommended signature methods provide authentication strength comparable to handwritten signatures while ensuring cost-effectiveness.   The final rule retains the flexibility requested by several commenters to consider and approve new technologies such as biometrics as they become more established, practical, and cost-effective.  We cannot accept the commenter's suggestion that a mark executed by any means be acceptable as an e-Manifest signature, since the signature method must be sufficiently strong and unique so that it will support criminal enforcement actions that require proof beyond a reasonable doubt of all elements of a case, including the identity of signers.

      4.2	Digital Signatures

Comment: We heard from four commenters who believe that manifest signatures do not require a level of security offered by the digital signature technology (Commenter Nos. 22, 33, 46 and 60).  One commenter suggested that electronic signatures should be no more stringent than handwritten signatures (Commenter No. 22).  Another commenter urged that EPA should not focus on field or file security, but on field and data authenticity (Commenter No. 60).  The commenter explained that manifest users can capture the generator's valid signature/authenticity through any type of technology; the rule should not mandate the type of technology used, but should allow any means of electronically capturing a signature.  Another commenter doubted that manifest signatures require the level of security offered by the digital signature and expressed uncertainty whether there currently is a level of falsification to warrant EPA's concern (Commenter No. 33).

Response:  EPA thanks the commenters for their views and agrees that the digital signature is not a preferred method for the electronic manifest at this time.  The final rule does not require a specific electronic signature technology, but in response to comments and further analysis, we make recommendations in the final rule preamble about methods that we believe to be CROMERR compliant and practical for users.  At this time, we are not recommending the digital signature method for the first generation system.

As discussed above, EPA has received significant input from industry that the digital signature method provides an unnecessary level of security, and its benefits cannot be justified in view of its costs.  An economic analysis performed in 2007 helped to support this conclusion.  The economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method.  PINs and passwords, when evaluated for helpdesk support costs (i.e., resetting lost passwords), identity proofing requirements, and the addition of a 2nd authentication factor to strengthen the signature, were found to present comparable implementation costs to the digitized signature method augmented with a 2nd authentication factor.  On the other hand, the May 2007 analysis disclosed that the projected cost of implementing the proposed digital signature method with a public key infrastructure or PKI would likely be three to four times the projected costs of implementing either the PIN/password method or digitized signature method.  Because of the far greater costs associated with the digital signature method, and the comments in the record that criticized the complexity and relative cost of this signature method, EPA has determined that it will not initially provide support for digital signatures and PKI in the implementation of the e-Manifest system.  We believe that the comments and the additional analysis conducted in May 2007 provide ample support for the digitized signature and PIN/password methods of signature.

Comment: We heard from one commenter who believes the proposed level of security for the digital signature is burdensome, but stated that it would be willing to participate nonetheless (Commenter No. 56).

Response:  EPA thanks the commenter for its views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision to adopt technology neutral electronic signature regulatory language, and to recommend the handwritten digitized signature method and the PIN/password method strengthened with a second authentication factor as our currently recommended alternatives to the digital signature method.

Comment: We heard from three commenters in response to EPA's question about whether it is practical to verify digital signatures on a document such as the manifest which will be signed sequentially by multiple waste handlers and whether multiple versions of each manifest document must be maintained electronically to preserve the complete history of the document (Commenter Nos. 22, 33, and 60).

One commenter noted that the final electronic manifest should not be so cumbersome to deter regulated parties from using the system (Commenter No. 22).  The commenter suggested that the software ultimately selected by EPA for the final rulemaking should be able to accommodate multiple generator or shipper signatures. This may be done through one document reflecting multiple signatures or through one file containing multiple "modified copies" of the manifest, each showing a different signature.  Another commenter stated that, once a section of data in the electronic manifest (e.g., number of containers) has been added to the file or record, it should never be removed or modified (Commenter No. 60).  The commenter stated that each system should be required to detect any unauthorized modification by validating each section of data.  Incorrectly modified files would result in rejection of the manifest with procedures consistent with a physically incorrect manifest, and procedures to re-manifest the shipment should be documented.  Another commenter stated that verification is practical when the completed manifest is received by the regulating entity; however, verification in the field is more problematic (Commenter No. 33).  The commenter believes that a transaction history should exist for all stages of the waste's transport.  Otherwise, it becomes extremely difficult to track down where a discrepancy (or a falsification) occurred.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory language and our recommendation to adopt the digitized handwritten signature method and PIN/password method strengthened with a 2[nd] authentication factor as alternatives to the digital signature method.

Comment: We heard from three commenters regarding EPA's proposed algorithms for the electronic signature (Commenter Nos. 26, 46, and 59).  Two commenters urged EPA to be flexible in authorizing algorithms because of technology advancements (Commenter Nos. 26 and 59).   One of the commenters suggested that EPA merely require the use of digital signature standards approved by the federal government or State, instead of listing specific standards (Commenter No. 59).  Another commenter expressed concern that the proposed algorithms would introduce a new system for railroads and would not be cost effective (Commenter No. 46).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comments in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory language and our recommendations for the first generation system to adopt the digitized handwritten signature method and the PIN/password method strengthened with a 2[nd] authentication factor as alternatives to the digital signature method.

Comment:  We heard from three commenters regarding EPA's proposed requirements for maintaining the confidentiality of private keys (Commenter Nos. 33, 46, and 60).  Two of the commenters opposed the requirements, believing they are too burdensome on waste handlers in comparison to the current manifest requirements and procedures (Commenter Nos. 46 and 60).  The other commenter believes the requirements for individuals and sponsoring firms to maintain the confidentiality of their private keys and accept accountability would be too burdensome on smaller waste handlers with limited staff (Commenter No. 33).  The commenter asked for EPA to find a balance between a reasonable level of security and affordable costs.  The commenter does not oppose a requirement for registrants to enter into a signature agreement that contains certifications that the private key would be protected from disclosure, unauthorized use, or delegation.  The commenter cautioned that these controls, however, would not provide any real guarantee of security.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final electronic signature regulatory selection criteria and preamble recommendations for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment: We heard from one commenter who expressed opposition to the requirement for a trusted third party, since it would not be cost-effective for the railroad industry (Commenter No. 46).

Another commenter raised concerns about the creation of a system involving a trusted third party and related procedures, since this would create a new area of compliance liability for which TSDFs have limited expertise (Commenter No. 26).  The commenter asked EPA to clarify appropriate procedures in cases where a signature cannot be verified at delivery of the waste.

We heard from three commenters who asked EPA to provide a list of standards or requirements for digital signatures and/or a list of Certificate Authorities for acceptable digital signatures (Commenter Nos. 30, 54, and 63).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on the electronic signature regulatory selection criteria, and preamble recommendations on electronic signature methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment: We heard from three commenters regarding the requirements for periodic certification of signature agreements or for proof of identity in regard to issuing a digital certification for use in the manifest program (Commenter Nos. 22, 33, and 60).  One commenter stated that no formal proof of identity should be required to receive a digital certificate, since no proof of identity is needed for the existing manifest system (Commenter No. 60).  Another commenter believes that EPA should keep the requirements as simple as possible and require little more than proof of identification (Commenter No. 22).  Another commenter supported the idea for registrants to certify annually that they have not violated their signature agreement and for signature agreements and annual certifications to be signed by hand (Commenter No. 33).  The commenter also suggested that a valid photo identification, proof of employment with the handler, and the individual's social security card should provide necessary proof of identity.  The commenter believes that applicants should be required, for the initial issuance at least, to present themselves in person.  Subsequent renewals could be less stringent and not require a personal appearance.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method.

Comment:  We heard from four commenters in regard the cost and complexity of a PKI program and the willingness of waste handlers to participate (Commenter Nos. 22, 33, 46 and 60).  These commenters believe that PKI would increase the burden and administrative activities required of waste handlers and would likely deter them from implementing the digital signature approach.  One commenter expressed concern that the proposed approach would require manifest users to ensure that employees with signature capability would be available at all times to electronically sign manifests (e.g., during all shifts, vacations, holidays) (Commenter No. 60).  Another commenter clarified that smaller waste handlers, in particular, would be deterred from participation because of the burden (Commenter No. 33).

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.  After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI.

Comment:  We heard from five commenters in regard to the three optional approaches for PKI implementation (Commenter Nos. 33, 46, 54, 61, and 63).  One commenter supported the centralized approach because of greater clarity and the elimination of confusion by having a single, known standard (Commenter No. 33).  Another commenter opposed any option for PKI, since it would introduce an entirely new system that would not be cost-effective for the rail industry (Commenter No. 46).  Two commenters suggested that EPA allow States who become authorized for the electronic manifest portion to have the ability to generate the certificates instead of EPA (Commenter Nos. 54 and 63).  Another commenter stated that, if EPA chooses to use the PKI program of the General Services Administration (GSA), the Agency should regularly evaluate private vendors as a possible option, as PKI private alternatives become more mature (Commenter No. 61).  The commenter also believes that the option chosen must be implemented consistently throughout the States so interstate commerce is not impeded.

Response:  EPA thanks the commenters for their views.  Please refer to the Agency's responses to the first comment in this section and in Section 4.1 of this document for information on EPA's final decision on electronic signature regulatory selection criteria and preamble recommendations on methods for the first generation system.   After considering the comments on this issue, we are not now recommending the adoption of the digital signature method or the inclusion of PKI.

      4.3	Secure Digitized Signature

Comment:  We heard from four commenters in response to EPA's request for comment on the proposed security standards for digitized signatures (Commenter Nos. 17, 33, 46, and 60).  Three commenters believe the security standards are too stringent and should require no more security than handwritten signatures (Commenter Nos. 17, 46, and 60).  The other commenter stated that the security standards are adequate to prevent casual abuse, although the commenter acknowledges that "adequate security" depends on how the term "adequate" is defined (Commenter No. 33).  The commenter does not believe the standards would protect against abuse from someone who is sufficiently literate in the technology.  In regard to the use of algorithms to bind signatures to record data sufficiently strong to prevent misuse, the commenter believes that a sufficiently sophisticated algorithm could encode the digital signature in such a way that it would only be valid to the document to which it was originally attached.  However, the commenter noted that this would necessitate an equally sophisticated validation process.

Response:  EPA thanks commenters for their views on the security issues related to the digitized signature method.  We agree with comments that the security standards for the digitized signature method should not be too stringent.  However, we continue to believe that minimum standards need to be in place to ensure authentication of a user's digitized signature consistent with the CROMERR.  For the final rule, we have replaced the codified standards that were proposed at §262.25(g) with a technology neutral standard that requires signature methods to be CROMERR compliant and to be generally cost-effective and practical for users.  However, in the final rule preamble we offer recommendations on how a quality digitized signature product must perform and suggest that products meeting these recommended performance standards would be CROMERR compliant and acceptable for the first generation e-Manifest system.  While the recommendations retain the proposed standard of employing a hash function to digitally bind the signature with the signed content, the other performance recommendations in the final rule are more focused on the quality of the digitized pads, pens, and software insofar as how they capture, process, and analyze signature and forensic data.  Significantly, the final rule recommended standards for quality handwritten digitized signatures give greater emphasis to the overarching performance standard for these products  -  that they reliably capture and analyze the forensic signature data so that a professional document examiner could testify as an expert witness to the authenticity of the signatures.  Thus, CROMERR compliant digitized handwritten signatures will be authenticated in a manner similar to ink signatures that are in dispute, that is, based on the testimony of professional document examiners about the unique forensic properties of the signature. The recommended standards in the final rule also explain that before these signature products may be determined to be CROMERR compliant, peer reviewed studies showing the forensic reliability of the signature products must be completed so that there is a proper evidentiary foundation (under the U.S. Supreme Court's Daubert opinion) for the expert testimony of the document examiners.

Under CROMERR, the Agency also generally requires electronic signatories of environmental reports to undergo a one-time identity proofing exercise before the signatory may sign and submit electronic reports to EPA.  Identity proofing aids in establishing that an asserted identity can with legal certainty be uniquely linked with the electronic signature device used by the signatory to execute their electronic signature.  However, as digitized handwritten signatures would be authenticated by examiners based on their unique biometric-like properties, it is not necessary for the signer to show "ownership" of their unique digitized handwritten signature any more than it is required that they show ownership of their ink-signed signatures.  Therefore, there will be no specific CROMERR identity proofing required for these signatures in e-Manifest.

Comment: We heard from one commenter in response to EPA's request for comment on whether EPA should require that digitized signatures be digitally signed (Commenter No. 33).  The commenter doubted that this approach would provide any additional security, since anyone who could falsify the digitized signature also could falsify digitally signing the digitized signature.

Response:  EPA thanks the commenter for its views on the security issues related to the digitized signature method.  We agree that EPA should not require that digitized handwritten signatures be digitally signed. Rather, the final rule sets forth alternative recommended performance standards for digitized handwritten signatures that we believe are sufficiently effective and that are focused more on accurately and securely capturing, processing, and analyzing forensic signature data so that the signatures may be reliably authenticated in the event of a dispute by expert document examiners.

Comment:  We heard from four commenters regarding the cost implications of the proposed secure digitized signature approach (Commenter Nos. 22, 33, 46 and 60).  One commenter expressed concern that, if EPA imposes a complex security system for its electronic signature process, it would not be as cost-effective as the current system (Commenter No. 22). The commenter believes that, on the other hand, if EPA keeps the electronic signature process simple, it could well be comparable to, or even more cost-effective than, the current handwritten system.  Another commenter stated that the secure digitized method provide a more practical and cost effective alternative to the digital signature/PKI approach and hand signed documents (Commenter No. 60).  Another commenter stated that, in consideration of the additional costs for hardware and software involved with the secure digitized method, the question of practicality and cost-effectiveness is directly dependent on the issue of whether the additional level of security is worth the additional cost and complexity (Commenter No. 33).

Response:  EPA thanks the commenters for their views on the costs of the digitized signature method.  We agree that we should attempt to minimize user costs while ensuring an effective, legally enforceable signature method, and we believe the final rule recommendations establish such a method.  As discussed elsewhere in this document, EPA conducted a detailed economic analysis of the proposed authentication and signature technologies in May 2007 to understand better how the hardware, software, and support services needed for each signature and identity proofing method would impact the implementation costs for the system and users, and how these costs might affect the per manifest user fee that would be imposed to recover the electronic signature costs.  The May 2007 economic analysis disclosed that the handwritten digitized signature method is a cost effective electronic signature method ($.13 to $.39 cost per manifest), despite the fact that this method entails a more significant initial investment by users in the signature pads and software necessary to generate the digitized signatures.  While there may be some additional cost involved with purchasing the quality digitized signature products that will prove capable of meeting the forensic reliability standard in our recommendations, we believe that these products will likely be very cost-effective relative to other methods we analyzed.  Further, the recommendations on forensic reliability and authentication by document examiners disclose that EPA intends that the signature process with digitized handwritten signatures be performed simply and very similarly to the current ink signature process.  Thus, the digitized signature process will in fact be very comparable to the current signature process with ink signatures insofar as the signature ceremony used to collect the signatures and the reliance on forensic signature evidence to authenticate them.  These signatures are particularly amenable to off-line capture, since they will not be subjected to real time validation against the network, and will be authenticated in the event of a dispute by professional document examiners, using the stored forensic signature evidence.

In addition, EPA also reminds commenters that many users of a digitized signature method will not need to purchase the signature apparatus and therefore will not incur such costs.  Specifically, EPA is aware that many of the generators who would sign their electronic manifests with the digitized signature method are small generators who might ship wastes under electronic manifests very infrequently, perhaps two or three times per year.  For these generators, purchase of the digitized signature apparatus may not make economic sense.  Rather, we envision that transporters and TSDs may purchase portable signature devices for their customers' use when they pick up a shipment for transportation.  Under this scenario, a digitized signature pad or pen would be supplied for each transport vehicle, and this device could be used repeatedly by many customers for thousands of signatures over a period of several years, before their expected failure or replacement.

Comment:  We heard from three commenters regarding the implementability and feasibility of secure digitized signatures (Commenter Nos. 22, 33 and 60). These commenters believe that it would be unlikely for waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature (Commenter Nos. 33 and 60).  In regard to advantages of digitized signatures over handwritten signatures, one of these commenters noted that the main advantage that manifest users would find attractive is that digitized signatures will allow them to file their required manifests electronically rather than manually (Commenter No. 33).  The commenter believes this will prove convenient, be significantly less expensive, and have the potential to greatly speed any processing involved.  In regard to whether the software implementing the proposed approach supports open standards, the commenter believes that some software implementing the approach supports open standards, whereas other software implementing the approach still utilizes proprietary algorithms and standards.  The commenter believes that open standards are better, particularly for anything a waste handler will be dependent on for a long period of time.

Response:  EPA thanks the commenters for their views on implementation of the digitized signature method.  We agree with the comments that the digitized signature can be an attractive option for users that are accustomed to the current handwritten signature processes.  That is a primary reason for our recommendation of this method in the final rule preamble. We thank the commenters for expressing their belief that it is unlikely for waste handlers to enter null or nonsense signatures on a digitizer pad in comparison with a handwritten signature.  EPA will consider their comments when we develop the e-Manifest system.

Comment: We heard from two commenters regarding parameters for ensuring accuracy (e.g., visual feedback, dynamic signature parameters) in the secure digitized signature (Commenter Nos. 33 and 60).  One commenter opposed visual feedback parameters because they add burden and do not enhance environmental protection (Commenter No. 60).  The other commenter believes that dynamic signature parameters could be helpful in establishing the genuineness of a signature; however, such parameters could cause confusion (e.g., if it rejects signatures that are in fact valid) and add burden on waste handlers (Commenter No. 33).

Response:  EPA thanks the commenters for their views about the parameters for the digitized signature.  The issue with visual feedback and collection of signature dynamics parameters is not the furtherance of environmental protection, but rather, supplying a signature that is capable of being reliably authenticated by document examiners so that the system will be protected from attempts at fraud or repudiation.  EPA acknowledges that a dynamic signature system that attempts to validate signatures immediately can be calibrated so that they report either too many false positives or false negatives.  However, EPA does not intend to implement the digitized handwritten signature so that signatures will be validated in this manner "on the fly."  Rather, EPA intends that the system will collect and retain the forensic signature evidence and then subject the forensic evidence to analysis by experts only in the event of a dispute involving a manifest signature.  This is the manner in which ink signatures are authenticated when a dispute arises regarding their authenticity, and EPA expects that the forensic data from digitized handwritten signatures will be analyzed and authenticated in a similar fashion with e-Manifest.  EPA will further consider these comments as we develop the e-Manifest system.

5.0	Preparer Signature Proposal

Comment: We heard from 13 commenters expressing concern or offering suggestions for the proposed procedures for preparers to sign and initiate the electronic manifest (Commenter Nos. 5, 17, 25, 30, 32, 33, 34, 35, 46, 54, 57, 59, and 60).

Two commenters expressed their concern for the high level of safeguards required for the preparer signature approach since EPA does not require any equivalent level of safeguards for handwritten signatures under the current manifest system (Commenter Nos. 46 and 57).  Another commenter expressed its belief that EPA should not establish any requirements for preparer signatures beyond what is currently required for paper manifests and expressed opposition to EPA's suggestion for hand-signed generator authorization for the preparer (Commenter No. 60).

Three commenters believe that the proposed preparer signature feature could diminish the importance of the generator certification and the generator's involvement/responsibility to ensure correct, valid information on the manifest (Commenter Nos. 5, 34, and 59).  One of these commenters expressed concern that EPA is making the electronic manifest available to small handlers (Commenter No. 34).  The commenter believes that the e-manifest should be available only to waste handlers involved in large numbers of manifests.  Another of these commenters believes the preparer signature could affect the cradle-to-grave responsibility as interpreted by the courts as well as other liability issues (Commenter No. 59).

One commenter believes the term "preparer" at proposed 40 CFR 262.24(b) should be changed to reflect the definition at proposed 40 CFR 260.10, i.e., the "preparer" is the person who conducts the administrative requirements of assembling the manifest, not the technical requirements of preparing the shipment for transportation (Commenter No. 57).  The commenter also believes the proposal prohibits a preparer from originating the manifest, even though preparers can originate a paper manifest under the current system.  The commenter urged EPA to revise the regulatory language to clarify that preparers can originate the electronic manifest

Two commenters suggested that the manifest should indicate the preparer's relationship to the generator (Commenter Nos. 54 and 59).  One of these commenters further stated that EPA should require that the preparer's signature and company, as well as the generator's signature, appear on the electronic manifest (Commenter No. 54).  The commenter also asked EPA to reiterate its existing policy allowing employees or other individuals to sign the manifest paper on behalf of the generator.

Two commenters asked EPA to clarify the liability of generators and preparers under the proposed approach (Commenter Nos. 5 and 30).

Two commenters asked EPA to clarify specifically how the generator authorizes the preparer to sign on his behalf, e.g., the specific language to be used (Commenter Nos. 30 and 59).  Two commenters expressed their belief that the authorization should be in writing (Commenter Nos. 33 and 59).  One of these commenters suggested that the authorization should be in writing, contain an acknowledgment that the generator is responsible as the generator of the waste described in the manifests completed by the preparer, and be executed prior to the preparer completing any manifests on behalf of the generator (Commenter No. 59).  The commenter believes the authorization should also clearly indicate to the generator that the same responsibilities and liabilities associated with a paper manifest are also associated with an electronic manifest, including the reconciliation of any rejections, discrepancies, or exceptions.

Another commenter asked EPA to clarify the procedures for a generator's employees to electronically sign an electronic manifest that is prepared by a vendor (e.g., discuss the ability of the employees to interface with the vendor's electronic manifest) (Commenter No. 25).

One commenter expressed support for allowing for preparer signatures, but noted that use of the secure digitized signature would minimize the need for preparers to sign on behalf of the generator (Commenter No. 17).  Another commenter also expressed support for preparer signatures, but asked EPA for more clarification on when preparer signatures would be appropriate and how they might be integrated into technology platforms (Commenter No. 32).

Two commenters expressed their belief that EPA should not limit the preparer signature approach to digital signatures (Commenter Nos. 33 and 60).  They believe the rule should be flexible enough for other approaches.

Four commenters believe the regulations should be clarified to require that the preparer must provide the signed manifest to the generator at the time of signature/shipment (Commenter Nos. 33, 35, 54, and 59).  One of these commenters indicated its belief that there is no other effective alternative to the proposed approach of leaving a manifest with the generator (Commenter No. 33).  The commenter believes the generator would insist of this.

Another commenter expressed concern about the logistical difficulties associated with a preparer's leaving a signed paper manifest with the generator prior to shipment (Commenter No. 57).  The commenter suggested that, as an alternative, the generator be provided with a shipping paper at, or in advance of, pick-up of the waste.

Two commenters expressed their belief that the generator should receive verification of receipt or notice of rejections or discrepancies (Commenter Nos. 33 and 60).  Once of these commenters supported its view by indicating that a conflict of interest could arise if a generator allowed its preparer (e.g., TSD) to verify receipt of shipment (Commenter No. 33).  The other commenter noted that there may be instances where electronic verifications are not possible (Commenter No. 60).  In these circumstances, the commenter believes that alternative means of verification should be acceptable and may include, but are limited to, a hard copy of the manifest or a summary of the relevant manifest data.  The commenter also believes that the particular concern regarding a generator/preparers relationship when the preparer is employed by the same entity that operates the receiving facility is addressed by the formal business relationship of the two parties, e.g. indemnification or some other contractual relationship.  The commenter offered regulatory text for EPA's consideration that would apply to preparers that also act as the transporter and designated TSDF.

Response:  EPA thanks the commenters for their many views on the third-party storage of electronic manifests.   In the May 22, 2001 proposed rule, EPA proposed the provisions for manifest preparation and signature by authorized preparers at section 262.24(b).  The topic of manifest preparation and the related issue of when it is proper for a preparer of manifests to sign for the generator has been subsumed by the discussion of "offeror" responsibilities and offeror signatures in the March 4, 2005 final rule notice on Manifest Form Revisions.  Because this area is now fully addressed in the general discussion of offeror responsibilities and offeror certifications that apply to all manifests, both paper and electronic, it is not necessary to codify in the final e-Manifest rule a distinct provision limited to electronic manifesting addressing manifest preparation and preparer signatures.  The offeror responsibilities and options for signing manifests are no different for paper manifests or electronic manifests.  Therefore, EPA is not taking further action on the preparer signature proposal in the final rule.  Refer to the document, "Hazardous Waste Management System: Modifications of the Hazardous Waste Manifest System; Proposed Rule," in the Federal docket for EPA's responses to public comments on the proposed preparer signature provisions.  The document is available at www.regulations.gov under EPA docket number EPA-HQ-RCRA-2001-0032.

6.0	Proposed Conditions on Third-party Storage

Comment:  We heard from eight commenters who either stated their support for third-party storage of manifests, or expressed their lack of opposition to it (Commenter Nos. 12, 17, 22, 33, 46, 54, 59, and 60).  Two of these commenters believe the off-site storage provision would be an incentive for facilities to automate (Commenter Nos. 33 and 60).

One of the commenters noted that it is unclear as to just how off-site vendors would assume the computer and record security controls in storing manifests (Commenter No. 33).  The commenter suggested that EPA could make it a requirement that, should a third-party storer decide to leave the business, they must provide EPA with copies of all manifest records in their possession; however, the commenter noted some drawbacks with this approach.  The commenter also suggested that EPA could make it a requirement that, should a third-party storer decide to leave the business, they must give a reasonable amount of notice to their customers to allow the customers time to find an alternate storer and have their records transferred to that alternate storer.  The commenter noted, however, that this would leave EPA largely dependent on the competence and diligence of the third-party storer.

One commenter stated its belief that it should be the responsibility of the TSDF to assure that adequate data security is maintained by these third-party storage providers (Commenter No. 17).  The commenter does not believe that EPA needs to include any particular restrictions or controls on the use of these vendors.

One commenter clarified that, if railroads are allowed to use their current EDI systems to transmit and store the information, it is in favor of off-site storage (Commenter No. 46).

Two of the commenters clarified that they do not oppose off-site storage so long as the rule fully addresses the issue of inspection of manifests that are electronic (Commenter Nos. 54 and 59).  One commenter suggested that EPA should include a requirement that the manifest system have the capability and that the generator, and/or TSDF, and/or transporter print out a one (or two) line "summary report" of electronic manifest activity (Commenter No. 54).  The commenter believes this should be required on a weekly basis so that if a system is down, or if the contact person is not available, the inspecting entity would still have manifest information.  The other commenter stated that facilities should be required to recover their records or transfer them to another third-party storer if inspectors are not provided with adequate access, or if the business arrangements between the third-party storer and the generator are no longer in effect during the required retention time (Commenter No. 59).

Response:  EPA thanks the commenters for their many views on the third-party storage of electronic manifests.  In the May 22, 2001 proposed rule, EPA proposed to permit facilities to engage commercial record storage services or networks to provide for electronic storage of manifest copies.  Based on stakeholder input and further consideration, EPA has determined not to pursue its proposed decentralized e-manifest approach.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  The 2012 e-Manifest Act in fact mandates this approach. Under this approach, users of the e-Manifest may be able to maintain their official copies of the electronic manifest on secure storage sites and their accounts on the national system, rather than on third-party systems.  Because of the centralized approach, it is no longer necessary to address third-party storage in the final rule.

Comment: We heard from six commenters regarding liability and enforcement issues associated with the offsite storage of electronic manifests (Commenter Nos. 16, 18, 22, 33, 34, and 60).

Several commenters believe that EPA needs to clarify the liability and enforcement implications for facilities and their third-party storers under the proposed approach (Commenter Nos. 16, 18, and 34).  These commenters asked EPA to clarify in particular the compliance and enforcement issues  that would apply to a RCRA facility that uses a third party to store its manifests, in situations where the manifest cannot be immediately produced to inspectors (e.g., because of technical difficulties).

Another commenter expressed its belief that the issue of vendor liability and vendee protection should be left to the contract between the two parties (Commenter No. 22).  The commenter believes these issues should not be addressed through EPA's rule.

Two commenters believe that the third-party storer should not incur any liability under RCRA (Commenter Nos. 33 and 60).  One of the commenters believes the vendor would face service-provider liability rather than liability under RCRA per se (Commenter No. 33).  The other commenter does not believe there would be any distinction between hard copy manifests and the manifest data stored electronically in regard to enforcement, and as such, EPA can use its existing enforcement authority for recordkeeping of electronic forms (Commenter No. 60).  The commenter stated that the regulated entity is the owner of its electronically stored manifest data and it would be compelled to produce the data upon demand from EPA.  In this regard, the commenter believes that the third party service provider should not incur any RCRA liability from the simple storage of data.  The commenter added that the third party service provider is responsible for the administration of the storage system and that the data remains under the control and ownership of the facility through their contractual agreements.  The commenter believes that, if the data storage service should exit the business, the accounts would be transferred to an alternate third party service provider.

Response: EPA thanks the commenters for expressing their concerns on the third-party storage of electronic manifests.  Because the centralized national e-Manifest system being pursued by EPA under the e-Manifest Act and this final rule will address storage of manifests at users' accounts on the national system, it is no longer necessary to address third-party storage in the final rule.  Please refer to the Agency response above for additional information.

7.0	Regulatory Analyses Supporting the Rule                                                        Comment: We heard from 10 commenters on EPA's regulatory impact analysis of the proposed rule (Commenter Nos. 10, 21, 26, 33, 34, 44, 52, 54, 59, and 63).

One commenter expressed its disagreement with EPA that the rule is not economically significant (Commenter No. 10).  In regard to the Economics Background Document of the rule, the commenter stated that EPA has inadequately addressed the costs related to waste handlers' equipment purchases.  The commenter disagreed with a basic assumption in the analysis that waste handlers have personal computers readily available for the e-manifest.  The commenter believes that the analysis is too simplistic and that automated handlers would need to pay for computer equipment, such as computers, printers, signature devices on vehicles, as well as for employee training on the e-manifest.  The commenter expressed concern that the analysis does not account for situations in which transporter printer capabilities are needed, e.g., in editing a generator's manifest.

In addition, the commenter does not believe the study adequately addresses economic impacts on small businesses.  The commenter is concerned that the study's underlying data are based on consultations with relatively large waste handlers, which has skewed the data.  The commenter points out that the largest waste handlers likely have the greatest amounts of computer hardware and software in place, as well as greater resources for implementation.  Even though the e-manifest is optional, the commenter believes small waste handlers may be forced into adopting electronic manifesting, which could be financially crippling.

In regard to the Hazardous Waste Manifest Cost Benefit Analysis, the commenter states that EPA has not accounted for the need of transport vehicles to have computer and printer capabilities (e.g., to process the manifest for the non-automated generator).  Further, the commenter is concerned that the EPA's studies do not indicate the specific number of waste handlers that would enjoy the burden reduction under the e-manifest proposal.  The commenter believes that the per-entity burden reduction likely would not offset the incremental burden from necessary expenditures such as computer hardware, software, and training.  Given these observations, the commenter expressed doubt that waste handlers would see savings under the proposed approach.  Finally, the commenter expressed its belief that States would be the primary beneficiaries under the e-manifest approach, not the waste handlers.

Another commenter disagreed with EPA's burden estimates for the e-manifest (Commenter No. 52).  The commenter believes that the burden to waste handlers would increase under the proposed approach, since a hard copy of the shipping paper would still be required during transportation.

Another commenter agreed with EPA that automating the manifest system has potential to result in an overall net savings at some future time after the new system reaches steady state operation (Commenter No. 23).  However, in the interim, the commenter foresees potentially high front-end costs for individual waste handlers to purchase and deploy new hardware and software to implement the system.  The commenter also believes individual waste handlers would incur up-front and continuing costs for maintenance, backup systems, specialized training, and security.

Another commenter suggested that EPA's analyses should account for other regulatory paperwork that might accompany a shipment, increasing costs (e.g., LDR paperwork, DOT shipping paper) (Commenter No. 21).

Another commenter noted that the rule would require waste handlers to maintain an electronic activity log audit trail to track access to the electronic records (Commenter No. 26).  The commenter believes this would potentially be labor-intensive and should be accounted for in EPA's cost studies.  The commenter also cautioned EPA that a paper-based system might be less burdensome for some TSDFs that an automated system.  In addition, the commenter pointed out that much of a TSDF's business is made up of one-time generators that will not likely have automated capabilities.  Therefore, EPA should not assume that all of a TSDF's forms will be automated, or that the entire manifest cycle will be automated.

A number of commenters believe EPA has underestimated States' capital start-up costs under the e-manifest (Commenter Nos. 33, 34, 44, 54, 59, and 63).  Two of these commenters stated that EPA's cost estimates are missing the amount of time and resources needed to maintain the knowledge to keep the electronic system up-to-date, which may require at least one full-time equivalent at a very high pay grade (Commenter Nos. 54 and 63).  Another commenter stated that EPA's cost estimate of $100,000 for State start-up costs is too low, taking into account signature authority certificates and keys and the States' need to accommodate both EDI and XML formats (Commenter No. 59).  Another commenter believes that there would be no cost savings by implementing the proposed electronic submission system for years to come (Commenter No. 34).  The commenter pointed out that, initially, States would have to design and implement the electronic data submission system at the same time as handling the existing hard copy system.

One commenter stated that EPA should consider the full cost of implementation of the e-manifest component, given possible effects of the rule on waste handler and States' behavior (Commenter No. 25).  The commenter wondered if manifest preparers or third-party storers would begin to charge their waste handler customers to recoup the cost of the electronic systems.   The commenter also wondered about the effects on waste handlers' costs if some States do not adopt electronic reporting and a patchwork of State programs arises, making the e-manifest complex.

Response:  EPA thanks commenters for their many suggestions for improvements to the Agency's economic analysis.  In the May 22, 2001 proposed rule, EPA proposed a decentralized approach for electronic manifesting that was based on technical standards and controls for initiating, transmitting, and retaining the electronic manifest.  On April 18, 2006, EPA published a notice of data availability and request for comment in the Federal Register (74 FR 19842), to signal to the public on the rulemaking record that EPA's preferred option is now the establishment of a national e-Manifest system to be hosted by EPA and funded by service fees that would be paid by the waste handlers who choose to use electronic manifests.  In this regard, many of the assumptions and estimates in the Agency's economic analysis on the proposed rule are not relevant to the Agency's current approach.  Nonetheless, commenters have raised good suggestions for further EPA research and analysis.  EPA will continue to examine issues raised by commenters, such as costs to States, costs for hardware, costs for carrying a paper manifest during transportation, and costs to small entities.

EPA has determined that the costs, benefits, and other impacts of e-Manifest will not occur until the system is implemented.  This final rule codifies key requirements of the E-Manifest Act and authorizes the use of electronic manifests on the national system, but none of the costs or benefits will be realized until the national system is developed and implemented.  Therefore, EPA has decided to defer the development of a detailed Regulatory Impact Analysis until we promulgate the Fee Rule.  At that time, we will have more complete and detailed information on the system to be procured and its costs, as well as the user fee charges that will be assessed to pay for and sustain the system.  Thus, EPA will address commenters' input as appropriate when we prepare the economic analysis for the Fee Rule.

Comment: We heard from two commenters on EPA's analysis of small business impacts under the Regulatory Flexibility Act (Commenter Nos. 10 and 44).  One commenter expressed concern that EPA concluded that the rule would have no significant adverse impact on a substantial number of small entities (Commenter No. 10).  The commenter believes EPA's analysis is incomplete, since it does not fully examine impacts to small waste handlers, such as small transporter companies.  The commenter notes that most hazardous waste transportation companies are small businesses; however, EPA's studies do not adequately analyze the potential economic impact on transporter companies and TSDFs that are small businesses.  In addition, the commenter notes that small transportation and TSDF companies must compete with the larger companies, who have more resources to obtain e-manifest capabilities and to undercut prices of smaller competitors.  The commenter suggests that these larger companies will use the e-manifest as a value added service to drive smaller firms out of business.  The commenter also noted that large generators would likely expect their commercial transporters and TSDFs to automate.  This could force small businesses to automate or lose customers.  Finally, each automated transportation vehicle would need computer capabilities, and employees would need to be trained on the e-manifest.  The commenter expressed concern that these issues are not addressed in the EPA's small business studies.  The other commenter expressed general concern that EPA's analysis underestimates the costs to smaller generators (Commenter No. 44).

Response:  EPA thanks commenters for their views on impacts to small businesses under the proposed rule.  As described above, EPA's proposed rule was based on a decentralized approach for electronic manifesting.  Since then, EPA indicated in April 2006 that its preferred option had changed to the establishment of a national e-Manifest system to be hosted by EPA, and has decided on this approach in this final rule.  As discussed in the previous comment response, EPA has decided to conduct its detailed evaluation of the economic impacts of the e-Manifest when it promulgates the Fee Rule prior to the system's implementation. Nonetheless, commenters have raised good suggestions for further EPA research and analysis.  At this time, EPA notes that the paper manifest form will still be available for use, so any small business that does not want to utilize the electronic manifest can still access the paper forms to comply with manifest requirements.  While EPA concedes that the early adoption of e-Manifest by larger transporters and TSDFs could place competitive pressure on some smaller entities, we do not believe that there will be a significant economic impact on a substantial number of small entities.  In addition, the early adopters will be the ones that encounter the early bugs and complications of e-Manifest implementation, and perhaps a greater share of the costs.  Once the initial period of system implementation is completed by early adopters, there may be "turn-key" solutions available from third party vendors that will make the costs of entry to e-Manifest less substantial than perceived now by the commenters.  Even the smaller transporters and TSDFs, who are after all in the business of hazardous waste transportation and management, should realize sufficient efficiencies from the electronic manifest to eventually warrant their investment and participation in the electronic system.   APPENDIX:  TABLE OF ORGANIZATIONS COMMENTING ON PROPOSED RULE AND COMMENTER NUMBERS

   Table of Organizations Commenting on Proposed Rule and Commenter Numbers Commenter Number               Name of Organization Commenting on the Proposed Rule 1 No Affiliation 2 Association of State and Territorial Solid Waste Management Officials 3 University of Missouri - Colombia Environmental Health and Safety 4 International Metals Reclamation Company, Incorporated 5 No Affiliation 6 Pennsylvania Department of Environmental Protection 7 Battery Council International 8 The Graphic Arts Coalition 9 Hazardous Materials Advisory Council 10 Chemical Analytics, Incorporated 11 Phelps Dodge Corporation 12 Department of Defense 13 Department of the Navy, Puget Sound Naval Shipyard 14 International Precious Metals Institute 15 American Trucking Associations 16 American Petroleum Institute 17 Onyx Environmental Services 18 Equiva 19 Specialty Steel Industry of North America and the Steel Manufacturers Association 20 Solutia 21 Dupont 22 Utility Solid Waste Activities Group 23 Department of Energy 24 Synthetic Organic Chemical Manufacturers Association, Incorporated 25 Eastman Chemical Company 26 Waste Management 27 State of Maine Department of Environmental Protection 28 Merck Manufacturing Division 29 BRG Environmental 30 Texas Natural Resource Conservation Commission 31 Purdue University 32 Analine Technologies 33 Massachusetts Department of Environmental Protection 34 New York Department of Environmental Conservation 35 State of Michigan Department of Environmental Quality 36 National Paint and Coatings Association 37 William K. Taggart 38 Coalition for Responsible Waste Incineration 39 Systech Environmental Corporation 40 New Hampshire Department of Environmental Services 41 Cement Kiln Recycling Coalition 42 Paul, Hastings, Janofsky & Walker LLP 43 American Chemistry Council 44 Northeast Waste Management Official's Association 45 Dow Chemical Company 46 Association of American Railroads 47 Dominion 48 California Environmental Protection Agency 49 Institute of Makers of Explosives 50 Marisol, Incorporated 51 PPG Industries 52 General Motors Corporation 53 Cement Kiln Recycling Coalition 54 Information Management Task Force of the Association of State and Territorial Solid Waste Management Officials 55 Giant Cement Holding, Incorporated 56 American Airlines Incorporated 57 Heritage Environmental Services 58 U.S. Liquids Incorporated 59 Illinois Environmental Protection Agency 60 Safety Kleen 61 Environmental Technology Council 62 National Automobile Dealers Association 63 Arkansas Department of Environmental Quality 64 Phelps Dodge Corporation 65 Environmental Technology Council 66 U.S. Army Corps of Engineers